Threat briefs

The Cost Calculator Builder PRO plugin for WordPress, versions up to and including 4.0.3, is vulnerable to unauthenticated Remote Code Execution (RCE) via CVE-2026-14900 due to insufficient sanitization of the `orderDetails[*].originalValue` field, allowing arbitrary code injection into a `PHP eval()` call that can be exploited by unauthenticated attackers.

XunRuiCMS versions up to 4.7.4 are vulnerable to code injection via the _get_tpl_content function in the Email Template Rendering component.

A use-after-free vulnerability exists in the P2P Session Teardown component of VStarcam O-KAM SuperIPCam 1.3.3.32.

LobeChat versions 1.84.26 through 2.1.48 contain a path traversal vulnerability in writeTempFile that allows authenticated users to achieve remote code execution by overwriting application startup scripts.

Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.

The VOLTA-AUTODOXER (VOLTA) Windows infostealer automates the triage of stolen credentials and sensitive data by sending serialized evidence bundles to LLMs via the OpenRouter API to rank victim monetization potential.

A stack-based buffer overflow vulnerability has been identified in the Linksys E8450 (firmware 1.2.00.360516) within the hidden_timezone argument of /www/cgi-bin/portal.cgi.

A remote OS command injection vulnerability exists in the WAVLINK WN536AX6-A router, version V260507_2.0.0.

Multiple vulnerabilities were discovered in the C-Kermit communication software during a code audit, including a remote code execution vector exploitable by a malicious peer and an authentication bypass with TLS certificate spoofing.

Termix-SSH Termix versions up to 2.9.2 are vulnerable to remote path traversal via the destPath argument in the /plugin-api/file-manager/transferToHost endpoint.

A vulnerability in the OpenVPN CLI Handler component of the WAVLINK WN553X1-B (firmware V260403_2.0.0) allows remote OS command injection via the 'file_id' argument.

An authenticated OS command injection vulnerability in the TP-Link Archer AX17 router allows administrative LAN users to achieve root command execution via malicious OpenVPN client profile descriptions.

A vulnerability in the Local Firmware Upgrade Interface of specific Ruijie switches allows for remote buffer overflow.

The Whitearmor ransomware group exfiltrated a large-scale employee database, login logs, and operational rosters from a GoDaddy AmplifAI instance, exposing Okta SSO and Office 365 federation details.

A security flaw in the Ser2net component of Oray Pugongying X5 Pro 7.6.1 allows for remote CRLF injection via manipulation of the regmsg argument.

A TOCTOU vulnerability in PhpSpreadsheet allows attackers to bypass XML security filters via double-encoded numeric entities, enabling XXE and Denial of Service attacks.

Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.

Liquid Web / StellarWP BookIt contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability.

Prefab UI versions 0.14.0 through 0.20.2 contain a sandbox escape vulnerability where caller-supplied Python code executed in a Deno subprocess can access unrestricted filesystem and network permissions via the exposed Deno API.

The Google::Auth Perl module is vulnerable to server-side request forgery (SSRF) via unvalidated AWS credential URLs (CVE-2026-74759) and an OAuth authorization bypass (CVE-2026-74760) due to missing state validation in the gcloud-auth login callback.

A public exploit PoC has been published for CVE-2022-36532, an authenticated remote code execution vulnerability in Bolt CMS versions 5.1.12 and earlier. The vulnerability involves improper file extension enforcement and parameter confusion during file rename operations.

The Nickboss WordPress File Upload plugin (up to version 5.2.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

A vulnerability in the Wavlink WN701AE (260105) ioos Web Backend allows remote OS command injection via the vlan_name argument in the del_vlan_group function.

Chatwoot before version 4.16.0 contains an authentication bypass vulnerability in its direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks, leading to data manipulation.

A path traversal vulnerability in the Beta9 gateway fails to validate volume ownership and paths, allowing tenants to access arbitrary worker files and other tenants data.

The Beta9 worker contains a path traversal vulnerability in the sandbox file API that allows authenticated tenants to read, write, and delete arbitrary files on the host worker filesystem.

Beta9 worker pods execute tenant image definition shell commands with inadequate isolation, allowing access to the worker's filesystem and privileged resources.

CVE-2026-8452 is a critical pre-authentication heap overflow in the Citrix NetScaler AAA service, reachable when SAML is configured, allowing for remote code execution via publicly available exploit code.

A critical remote code execution vulnerability, CVE-2026-33017, exists in Langflow AI pipelines prior to version 1.9.0 that allows an unauthenticated remote attacker to execute code with full server process privileges, impacting availability, integrity, and confidentiality.

An authentication bypass vulnerability (CVE-2026-112816) in the Canonical LXD HTTPS interface allows attackers to impersonate trusted clients via crafted TLS certificate chains, granting unauthorized control over clusters, containers, and host systems.