Threat briefs

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() due to improper handling of session keys prefixed with "!".

NT OneAPP fails to validate server certificates and hostnames, allowing network-adjacent attackers to conduct man-in-the-middle attacks.

A public exploit exists for a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows remote code execution via Internet Explorer 11.

An integer overflow vulnerability in GitLab CE/EE allows unauthenticated attackers to execute arbitrary code via specially crafted regular expressions.

Frappe Framework versions prior to 16.33.0 contain a blind SQL injection vulnerability in the get_events method, allowing authenticated attackers to extract sensitive database content.

Vyper versions 0.4.0b1 through 0.5.0b1 miscompile unfoldable constants and omitted default arguments from imported modules, potentially allowing attacker-influenced input to corrupt validation or accounting logic.

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role.

The Grav Login plugin contains a missing authorization flaw in the login.invite task, allowing unauthenticated attackers to register arbitrary email addresses as super users by manipulating page frontmatter.

Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary operating-system command execution.

Researchers identified that Java’s certificate blocklist (blocked.certs) can be bypassed for compromised certificates by re-encoding them to produce different SHA-256 fingerprints while maintaining signature validity.

A security flaw in TOTOLINK EX200 firmware 5.2.3c.7200 allows for remote stack-based buffer overflow via the Comment argument in the setStaticDhcpConfig function.

Rex versions through 1.16.1 for Perl accept unknown SSH host keys during remote rsync transfers due to a hardcoded StrictHostKeyChecking=no configuration.

The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.

The Robots-Validate Perl module (versions 0.4.3 through 0.4.9) fails to clear User-Agent matcher state between requests, causing legitimate clients to be incorrectly classified as imposter robots.

An authentication bypass vulnerability in JetBrains YouTrack Helpdesk allows unauthenticated attackers to hijack any user account, including administrators, by spoofing emails to trigger an insecure account merging process.

The Amazon SageMaker Python SDK fails to verify S3 bucket ownership in the default_bucket() function, allowing attackers to pre-create predictable buckets for IAM credential theft or remote code execution.

Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.

The regcomp function in musl libc is affected by multiple integer overflow issues which can lead to incorrectly-sized allocations and out-of-bounds heap writes.

Django REST framework versions prior to 3.18.2 are susceptible to a Denial of Service attack where specially crafted Accept headers cause CPU-intensive parsing and thread exhaustion.

Django REST framework versions 3.12.0 through 3.18.1 contain a logic flaw where TokenProxy.delete() uses an incorrect primary key, causing credential revocation attempts to fail silently.

A vulnerability in file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) allows for unrestricted file upload via the FileController.php store function.

A buffer overflow vulnerability exists in the Tenda BE3L Pro (version 16.03.60.62) within the formWifiBasicSet function of the /goform/WifiBasicSet file. The flaw is triggered via the security_5g argument and can be initiated remotely.

Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.

MongoDB Compass is vulnerable to arbitrary code execution when processing specially crafted BSON values from a stored view aggregation pipeline during an editing operation.

CVE-2026-114267 affects SourceCodester Food Order Management System 1.0, where an unknown function in the Admin Endpoint component exhibits missing authorization.

LocalAI versions 4.6.0 through 4.11.0 are vulnerable to server-side request forgery (SSRF) allowing attackers to exfiltrate internal metadata via malicious configuration URLs.

A vulnerability in ProjectWorlds Advanced Library Management System 1.0 allows remote SQL injection via the roll_number argument in individual_report_search.php.

The multicluster-global-hub-operator-bundle is configured with overly broad RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts.

A missing authentication vulnerability in the MomoTommy file-management-system Files API allows remote attackers to manipulate request arguments to gain unauthorized access to file operations.