Threat briefs

An authorization bypass vulnerability in yudao-cloud through 2026.09 allows authenticated users to circumvent row-level data scope restrictions by injecting a header, leading to unauthorized access to cross-departmental and cross-user records.

A critical vulnerability (CVE-2026-30612) in the abandoned Time4Popcorn application allows remote attackers to hijack the unauthenticated background updater to execute arbitrary code with SYSTEM or root privileges.

Progress Telerik Report Server is vulnerable to a pre-authentication remote code execution chain involving authentication bypass (CVE-2024-1800) and insecure deserialization (CVE-2024-4358) via the report management API.

Tribulant Software Newsletters newsletters-lite contains an 'Improper Neutralization of Special Elements used in an SQL Command' (SQL Injection) vulnerability.

A Deserialization of Untrusted Data vulnerability exists in Tribulant Software Newsletters (newsletters-lite) from version n/a through 4.18.1, allowing Object Injection.

An unauthenticated blind SQL injection vulnerability (CVE-2026-112866) exists in the Product Filter by WBW WordPress plugin, allowing attackers to access database information via the plugin frontend.

Cervantes version v1.3-beta contains a broken access control vulnerability in the JiraController component allowing unauthorized manipulation of Jira tickets across projects.

QuarkA QA Analytics versions 5.3.0.1 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows attackers to inject and execute malicious scripts in the context of other users browsers.

VOD Infomaniak contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Pixelite Events Manager plugin contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, allowing Reflected XSS.

The Noah Hearle We’re Open! opening-hours plugin contains an Improper Neutralization of Input During Web Page Generation vulnerability, resulting in Reflected Cross-site Scripting.

Arraytics WP Event Solution is affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability.

CVE-2024-23334 is a path traversal vulnerability in aiohttp versions prior to 3.9.2 that allows attackers to access arbitrary files via malicious file uploads.

Collabora Online - Built-in CODE Server, when used within the NextCloud platform, contains an OS command injection vulnerability that allows for remote code execution when the CODE server is not running.

The User Profile Builder plugin for WordPress is vulnerable to privilege escalation because it fails to authorize the role assignment attribute in the Gutenberg Register block, allowing authenticated users to register accounts with higher-privileged roles.

The Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 2.2.1.

An unauthenticated denial of service vulnerability in the Cookies and Content Security Policy WordPress plugin allows remote attackers to exhaust database resources via unlimited write requests to an unprotected AJAX endpoint.

Apache Unomi versions prior to 1.5.2 are vulnerable to remote code execution (RCE) via crafted MVEL or OGNL expressions injected into the /context.json endpoint.

The Ally Web Accessibility plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection in the get_global_remediations() method.

Kaspersky's Q1 2026 report highlights trends in malware targeting Windows, macOS, and IoT devices, including the exploitation of CVE-2026-20131 in Cisco Secure FMC firewalls and the rise of new ransomware variants and mining activities.

A publicly available proof-of-concept for CVE-2024-38077 targets the Windows Remote Desktop Licensing (RDL) service over RPC port 135 to identify vulnerable Windows Server systems.

Visitor Management System 1.0 is vulnerable to a critical attack chain where SQL injection in 'pass.php' leads to plaintext credential theft and subsequent unrestricted file upload in 'admin_user_0.php' for remote code execution.

VvvebJs versions 2.0.5 and earlier are vulnerable to stored cross-site scripting due to improper sanitization of uploaded SVG files containing embedded JavaScript.

An authenticated time-based blind SQL injection vulnerability in ZoneMinder versions up to 1.37.64 allows attackers to exfiltrate sensitive database information via the removetag action.

An authenticated SQL injection vulnerability in OpenSIS Community Edition 8.0-9.1 allows attackers to execute arbitrary SQL commands via unsanitized X-Forwarded-For headers.

A code injection vulnerability exists in Happy DOM's ECMAScriptModuleCompiler, allowing remote code execution (RCE) by injecting arbitrary JavaScript expressions into `export { }` declarations, enabling command execution if JavaScript evaluation is enabled.

Node.js is vulnerable to NUL byte truncation in dns.resolve* functions, allowing attackers to bypass allowlist filters and perform SSRF by injecting a NUL character into hostname strings.

Appsmith versions 1.95 and earlier are vulnerable to a stored XSS in the Table Widget component, allowing an authenticated attacker to perform administrative account takeover via session-based privilege escalation.

CVE-2025-52691 is a critical arbitrary file upload vulnerability in SmarterMail (Build 9406 and earlier) that enables unauthenticated remote code execution, with multiple proof-of-concept exploits publicly available.

Ticket-Booking-App 1.0 is vulnerable to a time-based blind SQL injection in the email parameter of the authenticate.php script, allowing remote attackers to infer database content via time-delay payloads.