Threat briefs

CVE-2026-4802 is a command injection vulnerability in Cockpit's system logs UI that allows a remote attacker to execute arbitrary commands on the host by exploiting unsanitized user-controlled parameters in crafted links.

The WP User Frontend Pro WordPress plugin is vulnerable to arbitrary file upload via the upload_files function, allowing authenticated attackers to achieve remote code execution.

An unauthenticated blind command injection vulnerability in the DroboAccess v2.1 enable_user function allows remote attackers to execute arbitrary shell commands via the username parameter.

CVE-2026-102785 is a critical unauthenticated remote code execution vulnerability in YOOtheme Pro (versions <= 5.0.52) that allows attackers to write and execute polyglot files via manipulated image processing operations.

An authentication bypass vulnerability in the Craft Commerce Mollie integration allows unauthenticated attackers to mark arbitrary transactions as paid by manipulating webhook parameters.

Craft CMS contains a CRLF injection vulnerability that allows authenticated users to overwrite the CRAFT_SECURITY_KEY in the .env file, facilitating arbitrary code execution via forged signed login redirects.

CVE-2025-21479 is a high-severity local privilege escalation vulnerability in the Qualcomm Adreno GPU driver allowing for kernel-level arbitrary physical memory writes, with functional exploits now targeting Android devices including the iQOO Neo9.

A critical authentication bypass vulnerability exists in the Laravel token guard driver due to improper handling of JSON array input, allowing unauthorized access when using MySQL/MariaDB.

The Twisted framework contains a memory exhaustion vulnerability in its IRC protocol implementation that allows unauthenticated remote attackers to crash the server process by sending unbounded data streams without line feeds.

A race condition in the Zephyr RTOS scheduler wait queue management allows unprivileged user-mode threads to trigger out-of-bounds memory access or use-after-free in supervisor context by exploiting improper locking in SMP configurations.

A vulnerability in the WireGuard implementation (subsys/net/lib/wireguard/wg.c) allows an off-path attacker to redirect peer traffic by sending an unauthenticated UDP datagram.

Ahsay AhsayCBS up to version 10.3.2 is vulnerable to unauthenticated remote OS command injection via the /rps/api/json/UpdateReceivers.do endpoint, enabling full system compromise.

A vulnerability in the obsidian-tc server allows malicious or non-compliant clients to execute destructive tool calls by echoing validly bound request states even after a human-in-the-loop confirmation is declined.

A parser differential in the SiYuan kernel WebSocket implementation allows unauthenticated attackers to bypass authentication by using duplicated query parameters, granting unauthorized access to the live event stream.

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

The Twisted XML element stream library is vulnerable to memory exhaustion, allowing unauthenticated remote attackers to trigger a denial of service by sending unbounded, unclosed XML element trees.

A malicious version of the LiteLLM Python package (v1.107.0) was distributed via PyPI and Docker, containing credential theft functionality and dormant command-and-control capabilities.

Detection of Hypervisor-protected Code Integrity (HVCI) being disabled by modifying specific Windows registry keys, potentially allowing the execution of malicious kernel-mode code.

ConnMan versions up to and including 2.0 contain a stack-based buffer overflow in the DHCPv6 client, allowing an on-link attacker to cause a root-privileged service crash.

Amazon Web Services Multi Model Server 1.1.11 and earlier is vulnerable to a relative path traversal attack during model archive extraction, which may allow remote actors to execute arbitrary code via a crafted model archive.

Kruize Autotune contains an authentication bypass in its REST API that exposes sensitive monitoring datasource credentials in cleartext via improperly serialized JSON responses.

A public proof-of-concept for CVE-2025-9074 demonstrates that the Docker Engine API exposure on Docker Desktop for Windows allows container escape and unauthorized host file system access.

Netdata’s ndsudo helper utility is vulnerable to local privilege escalation due to insecure PATH-based command resolution, allowing low-privileged users to execute arbitrary code as root.

An object injection vulnerability in the Wikibase action=parse API enables attackers with low-privilege access to achieve remote code execution via serialized PHP entities.

A public proof-of-concept exploit is available for CVE-2026-106173, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM.

HPE has addressed multiple vulnerabilities affecting various versions of its Networking Wireless Operating Systems (AOS-10 and AOS-8) that require firmware updates.

An authentication bypass vulnerability in Mitel MiCollab versions 9.8.1.201 and earlier enables unauthenticated attackers to perform arbitrary file reads via a path traversal flaw.

OPNMGR versions prior to 3.10.0 are vulnerable to an unauthenticated path traversal attack in the snyk_scan_progress.php file, allowing remote attackers to read sensitive .json files on the server.

An authentication bypass vulnerability in the GEOritm REST API allows unauthenticated remote attackers to enumerate fleet assets and retrieve sensitive personal data via the /restapi/objects/obj-groups endpoint.

A critical path traversal vulnerability in the npm package image-downloader allows attackers to perform arbitrary file writes by providing a specially crafted percent-encoded URL.