Threat briefs

Netmaker versions up to 1.7.0 contain an authorization bypass vulnerability allowing authenticated external clients to modify or exfiltrate configuration data from arbitrary networks via the updateExtClient handler.

mem0 versions 0.1.117 before 1.0.8 contain an SQL injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to execute injected SQL on the configured Databricks SQL warehouse by influencing stored memory content.

EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.

Goose terminal integration transmits unredacted shell command history, including API tokens and passwords, to external LLM providers, leading to potential credential exposure.

Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 are vulnerable to unauthenticated SQL injection, allowing attackers to exfiltrate database information via the /api/doc/out/more/list and /api/ec/dev/table/counts endpoints.

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability in the fileId parameter, allowing unauthenticated remote file retrieval.

Kavita versions 0.5.2 through 0.5.4.0 contain a path traversal vulnerability in the /api/image/cover-upload endpoint, allowing unauthenticated attackers to read arbitrary files.

PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.

The NotificationX plugin for WordPress (versions 2.0.0 through 2.3.11) contains an unauthenticated SQL injection vulnerability in the REST API that allows remote attackers to perform database queries.

WooThemes Diarise versions through 1.5.9 are vulnerable to an arbitrary file read exploit in download.php, allowing unauthenticated attackers to retrieve sensitive system files via a crafted calendar parameter.

SeaCMS versions through 8.7 are vulnerable to unauthenticated remote SQL injection via the rlist[] parameter, enabling database information exfiltration through error-based exploitation.

Intermesh Group-Office versions 3.3.0 through 3.5.4 contain an unauthenticated path traversal vulnerability in compress.php, allowing remote attackers to read arbitrary files via directory traversal sequences.

The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.

The Javo Spot WordPress theme before version 3.0.0 is vulnerable to unauthenticated path traversal via the jvfrm_spot_get_json AJAX action, allowing attackers to read sensitive files like wp-config.php.

YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.

A critical vulnerability in the Java Secure Socket Extension (JSSE) component allows unauthenticated remote attackers to access, modify, create, or delete sensitive data within affected Oracle Java SE and GraalVM environments.

An integer-overflow vulnerability in RedisBloom CMSketch RDB deserialization allows an authenticated attacker to trigger out-of-bounds memory access, resulting in potential remote code execution or denial of service.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in the ShowMsg() function, allowing unauthenticated attackers to execute arbitrary system commands via a crafted HTTP Referer header.

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

A critical vulnerability in the RingRTC library used by Signal allows a remote peer to block call termination by flooding the Finite State Machine (FSM) event queue, enabling unauthorized extension of audio and video capture.

Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

CVE-2026-48849 is a stored XSS, HTML, and CSS injection vulnerability in Roundcube Webmail that enables malicious payload execution upon session restoration.

A vulnerability in quic-go, an implementation of the QUIC protocol in Go, allows a remote attacker to cause a denial-of-service (DoS) condition by sending specially crafted QPACK-encoded HEADERS frames with large trailer field sections, leading to excessive memory allocation in affected HTTP/3 client and server implementations prior to version 0.59.1.

An unauthenticated file upload vulnerability, CVE-2026-55450, in Langflow versions prior to 1.9.1 allows remote attackers to upload arbitrary amounts of data to the server via the `/api/v1/upload/{flow_id}` endpoint, leading to disk space exhaustion and Denial-of-Service, additionally leaking the absolute file path in the server's response.

Exploitation of CVE-2024-29824, a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), allows remote code execution via a crafted HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint.

CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.

A local privilege escalation vulnerability in the Amazon WorkSpaces Skylight Workspace Config Service allows low-privileged users to achieve arbitrary file writes as SYSTEM via a TOCTOU race condition during log rotation.

An unauthenticated remote code execution vulnerability (CVE-2026-53921) in the OpenWrt DHCPv6 server component odhcpd allows attackers to execute code with root privileges via crafted DHCPv6 requests.

Casbin Casdoor versions prior to 3.54.1 are vulnerable to an authenticated path traversal vulnerability that allows attackers with administrative access to write arbitrary files to the server, leading to RCE or DoS.