Threat briefs

A missing authorization vulnerability in the BlueSpiceUserManager extension allows authenticated users to block or unblock arbitrary accounts, enabling administrative account lockout or unauthorized access restoration.

Participants Database (xnau webdesign) versions from n/a through 2.7.8.5 are affected by a Blind SQL Injection vulnerability.

GamiPress versions n/a through 8.0.7 contain an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability, specifically allowing Blind SQL Injection.

The Amauri.IO WPMobile.App WordPress plugin contains a missing authorization vulnerability that allows for the exploitation of incorrectly configured access control security levels.

UAC-0099 gained initial access to a Ukrainian organization via spearphishing to deploy the MythicRatatoskr backdoor, which uses the Yggdrasil mesh network for C2, before handing off access to Sandworm for destructive data-wiping.

WizLearn Technologies' Learning Management System (LMS) is vulnerable to an authentication bypass via specially crafted POST requests, allowing unauthenticated attackers to gain administrative access.

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.

The U.S. FBI and CrowdStrike disrupted domestic laptop farms operated by the DPRK-nexus actor FAMOUS CHOLLIMA to conduct employment fraud and gain persistent access to victim organizations.

CrowdStrike identified four threat actors leveraging AI agent frameworks, such as Claude Code, to automate and execute multi-stage cyber campaigns including reconnaissance, exploitation, and data exfiltration.

Threat actors are exploiting a compromised service principal credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 Microsoft 365 tenants and potentially escalate privileges.

libexpat through 2.9.0 is vulnerable to a denial of service attack because the billion laughs protection in accountingDiffTolerated() detects entity amplification too late.

Operation FlashHole is a cyber-espionage campaign attributed to the Lazarus Group.

The Music Store WordPress plugin version 1.4.7 and earlier contains a directory traversal vulnerability in the f parameter, allowing unauthenticated attackers with a valid purchase_id to read arbitrary files from the server.

The Anti-Spam by CleanTalk plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session via the 'user_email' parameter.

The toml package is vulnerable to prototype pollution, allowing unauthorized injection of properties into Object.prototype via maliciously crafted TOML documents.

A vulnerability in PHP allows a remote, unauthenticated attacker to disclose sensitive information, though specific version details and CVE identifiers remain undisclosed by the vendor.

Observed network traffic patterns indicative of a Coruna-like exploit kit targeting iOS devices via web-based delivery mechanisms.

A heap buffer overflow in GStreamer's libgstvideo via untrusted unixfd deserialization allows remote attackers to trigger out-of-bounds memory access, potentially leading to code execution.

CVE-2024-0235 is an unauthenticated information disclosure vulnerability in the Myeventon Eventon plugin that allows remote attackers to enumerate user email addresses via the 'eventon_get_virtual_users' AJAX action.

An unauthenticated attacker can crash Node.js applications using multer versions 2.0.0 through 2.4.0 by sending crafted multipart requests that trigger uncaught exceptions in the busboy parser after request teardown.

An information disclosure vulnerability in plone.app.content allows unauthenticated attackers to enumerate site users and groups when the Plone REST API is enabled.

The Hugging Face 'datasets' library is vulnerable to arbitrary code execution (CVE-2026-57845) due to insecure deserialization of untrusted data via the pandas builder.

Coraza WAF versions prior to 3.8.1 contain a filename parsing vulnerability that allows attackers to bypass file-based security rules using specifically crafted multipart upload parameters.

Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes.

A vulnerability in CFITSIO up to version 4.7.0 allows for arbitrary code execution through an out-of-bounds write in the ffgcls2 function when processing maliciously crafted FITS files.

Motor.NET versions before 0.19.0 contain an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that can cause a permanent crash-loop.

Motor.NET versions before 0.19.0 contain a denial of service vulnerability where crafted cloudEvents headers trigger a fatal exception in ExtractCloudEvent, causing a permanent crash-loop upon message redelivery.

Mistune versions 3.0.0 through 3.2.x are vulnerable to a denial-of-service attack where crafted Markdown inputs with nested square brackets cause excessive CPU consumption during parsing.

Bytebase versions prior to 1.0.1 are vulnerable to an authentication bypass in the GitLab login flow, allowing unauthenticated attackers to impersonate any user, including administrative accounts.