Threat briefs

The JetBackup WordPress plugin before 3.1.24.10 is vulnerable to an arbitrary file write attack via malicious symbolic links in backup archives, allowing authenticated administrators to achieve remote code execution.

A project restriction bypass in Incus 7.3.0 through 7.4.x allows restricted users to inject malicious arguments into the mkfs command, leading to privilege escalation on the host.

Mistune versions prior to 3.3.0 are susceptible to an algorithmic complexity vulnerability in the inline link parser, allowing unauthenticated attackers to cause CPU exhaustion via crafted markdown payloads.

Mistune versions 3.0.0 through 3.2.x are vulnerable to an algorithmic complexity issue in the parse_link_text function, allowing unauthenticated attackers to trigger CPU exhaustion via crafted Markdown containing unbalanced brackets.

PyJWT fails to validate empty HMAC keys when resolving from JWK or JWKS, allowing unauthenticated attackers to forge JWTs with arbitrary claims when the identity provider is misconfigured.

The GitHub Action bundled with Black fails to validate the required-version parameter from pyproject.toml when use_pyproject is enabled, allowing for the execution of untrusted code in the GitHub Actions runner environment.

Jupyter nbconvert versions up to 7.17.1 are vulnerable to an arbitrary file write attack via path traversal in malicious notebook cell metadata, allowing execution of arbitrary file writes when exporting to specific formats.

The Storybook development server exposes authentication tokens via WebSocket, allowing attackers on the same local network to inject malicious code into story files and execute arbitrary commands through vulnerable addons.

GitPython versions prior to 3.2.1 are vulnerable to a path traversal flaw in the create_submodule() function, which allows an attacker-influenced submodule path to lead to the execution of a planted post-checkout hook.

A middleware bypass vulnerability in the @sentry/nextjs SDK allows unauthenticated access to routes if the configured tunnel path overlaps with application routes in Webpack-based builds.

Atlassian has released security updates addressing multiple vulnerabilities across its Data Center and Server product portfolio, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, and Jira Service Management.

Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability where authenticated users with the schedule_search capability can bypass SPL command safeguards during scheduled searches, potentially leading to unauthorized data access, modification, or service disruption.

AIDE versions 0.16 through 0.19.4 fail to process filenames containing invalid UTF-8 sequences, allowing local attackers to hide malicious files from integrity monitoring.

The oslo.utils library contains an information exposure vulnerability in its LUKS inspector that can result in sensitive cryptographic key material being written to system logs when processing LUKSv1 disk images.

Multiple vulnerabilities in JupyterHub allow a remote, authenticated attacker to achieve privilege escalation, bypass security measures, manipulate data, and trigger a denial-of-service.

Splunk SOAR versions prior to 8.7.0 are vulnerable to an authentication bypass where a user with restricted permissions can use the REST API to infer administrative tokens via crafted query filters.

A vulnerability in OpenSearch allows a remote, authenticated attacker to trigger a Denial of Service condition on the affected instance.

Multiple vulnerabilities in Cisco IOS XE, Secure Firewall Threat Defense (SFTD), and Snort allow attackers to execute arbitrary code, bypass security controls, or cause a denial-of-service condition.

Cisco has patched 34 vulnerabilities, including critical-severity remote code execution and authentication bypass flaws, affecting Expressway Series, Unified Communications products, and Snort 3.

MikroTik RouterOS versions 7.24.5 and earlier contain a session token replay vulnerability in the WebFig interface that allows unauthenticated attackers to hijack administrative sessions.

Multiple vulnerabilities in Apache Traffic Server allow a remote, unauthenticated attacker to execute arbitrary code, bypass security controls, perform data manipulation, or trigger a denial-of-service condition.

Multiple vulnerabilities in HAProxy have been identified that can be exploited to cause a Denial of Service.

The PHP Group has disclosed multiple vulnerabilities that allow a remote, anonymous attacker to cause a denial-of-service condition, bypass security controls, or achieve other unknown impacts.

Microsoft addressed 1,413 vulnerabilities including 75 critical flaws and an exploited zero-day (CVE-2026-96951) bypass in Windows Shell that circumvents Mark of the Web protections.

The Drupal Webform module is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows for Code Injection.

OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.

The retired Apache Abdera library is vulnerable to XML external entity (XXE) injection, enabling unauthenticated remote attackers to access sensitive files or perform server-side requests via malicious XML input.

Lotus versions through 0.10.2 contain an SQL injection vulnerability that allows authenticated organization users to inject SQL via billable metric property_name or categorical filter values.

CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.

JSON-SCADA before 0.65-alpha contains an SQL injection vulnerability in the opcApi() function within src/server_realtime_auth/index.js.