Briefs

The Anthropic Claude Code CLI and Claude Agent SDK are vulnerable to OS command injection via crafted file paths, allowing arbitrary command execution.

A denial-of-service vulnerability, CVE-2025-57834, exists in Samsung Exynos processors and modems due to improper input validation, potentially leading to device malfunction or service disruption.

A use-after-free vulnerability exists in the Wi-Fi driver of Samsung Mobile and Wearable Processors Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000 due to improper synchronization on a global variable, allowing attackers to trigger a race condition and potentially execute arbitrary code.

A remote OS command injection vulnerability (CVE-2026-5677) exists in the CsteSystem function of the /cgi-bin/cstecgi.cgi file in Totolink A7100RU firmware version 7.4cu.2313_b20191024 due to improper handling of the resetFlags argument.

A remote, unauthenticated attacker can bypass authentication on Totolink A8000R routers running firmware version 5.9c.681_B20180413 by manipulating the `langType` argument in the `setLanguageCfg` function of the `/cgi-bin/cstecgi.cgi` file.

Brave CMS versions prior to 2.0.6 contain an unrestricted file upload vulnerability within the CKEditor upload functionality in the ckupload method, allowing authenticated users to upload executable PHP scripts and achieve Remote Code Execution.

text-generation-webui versions prior to 4.1.1 are vulnerable to path traversal, allowing a high-privileged user to overwrite Python files and achieve arbitrary code execution by triggering the 'download-model.py' file through the application's 'Model' menu.

A CRLF header injection vulnerability in Plunk versions prior to 0.8.0 allows authenticated API users to inject arbitrary email headers, enabling silent email forwarding, reply redirection, or sender spoofing.

The Drift Protocol suffered a $280 million crypto theft orchestrated by North Korean hackers who spent six months building an in-person operational presence within the Drift ecosystem, engaging with contributors at crypto conferences and via Telegram.

A SQL injection vulnerability in code-projects Online FIR System 1.0 allows remote attackers to execute arbitrary SQL commands by manipulating the email or password parameters in the /Login/checklogin.php file.

A critical vulnerability in Vim versions prior to 9.2.0276 allows arbitrary OS command execution via a crafted file that bypasses the modeline sandbox due to missing security checks, potentially leading to code execution.

CVE-2026-34402 is a time-based blind SQL injection vulnerability in ChurchCRM versions prior to 7.1.0. Authenticated users with Edit Records or Manage Groups permissions can exploit the PropertyAssign.php endpoint to exfiltrate or modify database content, including user credentials, PII, and configuration secrets.

CVE-2026-21382 is a memory corruption vulnerability related to handling power management requests with improperly sized input/output buffers, potentially leading to code execution.

A memory corruption vulnerability (CVE-2026-21378) exists in a camera sensor driver due to improper validation of output buffer size during IOCTL processing, potentially leading to arbitrary code execution.

A use-after-free vulnerability, identified as CVE-2026-21380, exists due to memory corruption when using deprecated DMABUF IOCTL calls for video memory management, potentially leading to arbitrary code execution.

A memory corruption vulnerability exists in Qualcomm camera sensor drivers due to insufficient output buffer size validation during IOCTL processing, potentially leading to arbitrary code execution.

CVE-2026-21375 is a memory corruption vulnerability in Qualcomm chipsets due to insufficient output buffer size validation during IOCTL processing, potentially leading to arbitrary code execution.

CVE-2026-21374 describes a memory corruption vulnerability due to insufficient buffer size validation when processing auxiliary sensor input/output control commands, potentially allowing a local attacker to execute arbitrary code with elevated privileges.

A memory corruption vulnerability (CVE-2026-21372) exists when processing IOCTL requests with invalid buffer sizes leading to a heap-based buffer overflow, reported by Qualcomm with a CVSS v3.1 score of 7.8.

CVE-2026-21371 is a memory corruption vulnerability due to insufficient size validation when retrieving an output buffer, potentially leading to information disclosure or arbitrary code execution on affected Qualcomm devices.

CVE-2026-21367 describes a transient denial-of-service vulnerability in Qualcomm products that occurs when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans, potentially leading to service disruption.

CVE-2025-47392 describes a memory corruption vulnerability that occurs when decoding corrupted satellite data files with invalid signature offsets, reported by Qualcomm, Inc.

CVE-2025-47389 describes a memory corruption vulnerability stemming from a buffer copy operation failure due to an integer overflow during the attestation report generation process, potentially leading to arbitrary code execution.

A memory corruption vulnerability (CVE-2025-47390) exists while preprocessing IOCTL requests in the JPEG driver, potentially leading to local privilege escalation or denial of service.

CVE-2025-47391 is a memory corruption vulnerability due to a stack-based buffer overflow (CWE-121) while processing a frame request, as detailed in the Qualcomm security bulletin for April 2026, potentially leading to arbitrary code execution.

Twitch Studio version 0.114.8 and prior contains a privilege escalation vulnerability (CVE-2024-14032) that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service, enabling them to overwrite system files and achieve full system compromise.

Detects the execution of headless browsers from suspicious parent processes with arguments indicative of scripted retrieval, bypassing application control policies and restrictions on direct download tools.

A remote command injection vulnerability exists in OFFIS DCMTK version 3.7.0 and earlier due to insufficient input sanitization in the `storescp` application, potentially allowing unauthenticated attackers to execute arbitrary OS commands.

The Media Library Assistant WordPress plugin through version 3.34 is vulnerable to SQL injection, allowing attackers to manipulate database queries.

A vulnerability in the distribution toolkit prior to 3.1.0 allows a malicious upstream registry or man-in-the-middle attacker to redirect authentication requests, potentially exposing upstream credentials.