Threat briefs

Multiple Fidelis products are vulnerable to local privilege escalation due to insecure file permissions on binaries and scripts owned by the fidelis user, allowing for unauthorized root access via sudo.

Apache Ranger versions 2.8.0 and earlier are vulnerable to OS command injection via the UnixUserGroupBuilder component when processing crafted usernames containing shell metacharacters.

A reflected cross-site scripting (XSS) vulnerability in the Zenario CMS Organizer spare alias feature allows authenticated users to execute arbitrary JavaScript within the administrative interface.

Elementor Pro versions 4.2.1 and below contain a critical file upload vulnerability (CVE-2026-32475) that allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

A critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-48519) exists in Langflow versions up to and including 1.9.1, allowing attackers to execute arbitrary Python code by sending a crafted JSON payload to the `/api/v1/build_public_tmp` API endpoint of a publicly shared flow.

Concrete CMS versions 9.5.0 and earlier contain an IDOR vulnerability in the message_detail endpoint that allows unauthenticated attackers to retrieve private conversation messages and file attachment URLs by manipulating the messageId parameter.

A SQL injection vulnerability, identified as CVE-2026-22599, affects Strapi's Content-Type Builder, where an authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute, potentially leading to arbitrary file read, denial of service, or remote code execution on the database server.

A missing authorization vulnerability in the Websiteinwp Blogpoet WordPress theme (versions < 1.0.4) allows unauthenticated users to access restricted functionality, including unauthorized plugin installation and activation.

An incomplete URL sanitization routine in the Instatic isSafeUrl() function allows stored Cross-Site Scripting (XSS) via leading C0 control characters, enabling low-privileged users to achieve administrative account compromise.

An improper authentication vulnerability in the SMS Code Verification component of ruoyi-vue-pro allows remote attackers to bypass authentication mechanisms by manipulating the mobile or code arguments in AuthController.java.

A SQL injection vulnerability exists in the Restaurant_IMS application, where manipulation of the login_id or epsw arguments in the lsmodal.php file leads to SQL injection.

A public exploit exists for CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril and Xreader document viewers that enables remote code execution via malicious EPUB files.

Warp terminal emulator is vulnerable to a DCS lifecycle hook spoofing issue. The application fails to verify the authenticity of state-mutating lifecycle hooks transmitted via the PTY stream, allowing an attacker to spoof Current Working Directory (CWD) and SSH session transport metadata if a user views attacker-controlled terminal output.

Araxis Merge for Windows stores server credentials using DPAPI with NULL entropy, allowing an attacker with local user access to decrypt and extract stored credentials from the registry.

The GEO my WP WordPress plugin (versions <= 4.5.0.1) is vulnerable to unauthenticated local file inclusion (LFI) and arbitrary PHP code execution via the 'form[info_window_template][content_path]' parameter. A public exploit PoC has been published.

A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.

OpenJPEG versions 2.4.0 through 2.5.4 and current git master are vulnerable to a heap buffer overflow in the opj_dwt_encode_and_deinterleave_v function, which can be triggered during reversible 5/3 forward DWT encoding to cause a denial of service.

CVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.

The virtualenv activation script for zsh is vulnerable to command injection via the environment prompt when PROMPT_SUBST is enabled, allowing arbitrary code execution upon prompt rendering.

CVE-2023-32571 is a critical remote code execution vulnerability in System.Linq.Dynamic.Core affecting versions 1.0.7.10 through 1.2.25, triggered by the parsing of untrusted input in LINQ query methods.

Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.

Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.

Postiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.

A vulnerability in Faveo Helpdesk 2.0.3 allows for remote manipulation of password recovery functions.

A missing authorization vulnerability exists in the Knit Pay UPI QR Code Payment Gateway for WooCommerce plugin, affecting versions from n/a through 1.6.3. The vulnerability allows for the exploitation of incorrectly configured access control security levels.

The Relevanssi WordPress plugin is vulnerable to object injection due to deserialization of untrusted data.

An origin validation error in the msal-node library allows an attacker to intercept sensitive parameters during the authorization code flow, potentially leading to unauthorized information disclosure.

The aBlocks WordPress plugin fails to validate user input within the /ablocks/v1/form-builder/registration REST endpoint, allowing authenticated users with Contributor access to escalate privileges to Editor.

An integer overflow in the open62541 library allows a malicious OPC UA server to trigger heap corruption in clients, potentially leading to remote code execution.

Paytium versions from n/a through 5.0.5 contain a Deserialization of Untrusted Data vulnerability that allows for Object Injection.