Threat briefs

A SQL injection vulnerability exists in the Login function of admin_class.php in oretnom23 file-management-system-php, caused by the manipulation of the username or password arguments.

Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.

Open eClass version 3.15 is susceptible to remote code execution, as detailed by a public exploit proof-of-concept published to Exploit-DB.

NTPsec ntpd versions 1.1.4 through 1.2.5 are vulnerable to a remote denial-of-service attack due to an out-of-bounds read flaw triggered by malformed NTS extension fields.

Apache bRPC versions prior to 1.18.0 are vulnerable to stack exhaustion and process crashes when processing maliciously crafted, deeply nested mcpack data requests.

Cisco has released software hardening updates to address multiple vulnerabilities discovered during an internal security review of several Unified Communications products.

Cisco has released a software hardening update to address eight vulnerabilities (CVE-2026-76490 through CVE-2026-76497) identified during an internal security review of the Expressway Core and Edge series.

Cisco released security hardening updates for the Snort 3 engine to address multiple internally discovered vulnerabilities, including out-of-bounds write issues categorized as CWE-787.

Apache IoTDB versions 2.0.0 through 2.0.10 contain a privilege escalation vulnerability where the Legacy Pipe receiver protocol uses a hardcoded root identity to perform unauthorized data operations.

OpenChoreo API server allows authenticated users with workflow update permissions to hijack ownership of cross-project WorkflowRuns, leading to unauthorized access to logs, build credentials, and workflow modification.

A stored cross-site scripting (XSS) vulnerability in the Brainstorm Force SureCart plugin (versions 4.9.5 and earlier) due to improper neutralization of input during web page generation.

WPdreams Ajax Search Lite (up to version 4.14.6) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command.

The Geo Mashup software by Dylan Kuhn is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation.

VideoWhisper Paid Videochat Turnkey Site (from n/a through 7.5.14) is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation.

ThemeHunk Customizer versions from n/a through 2.8.7 are affected by a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Bold Grid weForms plugin is affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability.

WP Mailster versions through 1.9.1.0 contain an unrestricted file upload vulnerability that allows remote attackers to upload web shells and achieve remote code execution.

Traefik versions 3.x.x before 3.7.16 and versions prior to 2.11.60 are vulnerable to security policy bypasses and unauthorized access to sensitive data.

An uncontrolled recursion vulnerability (CVE-2026-112368) in the MongoDB PHP driver allows an unauthenticated attacker to trigger stack exhaustion and process termination by providing malicious BSON documents.

Multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-113399 through CVE-2026-113869, may lead to arbitrary code execution, data confidentiality compromise, or denial of service.

ApostropheCMS is vulnerable to an unauthenticated denial-of-service condition due to the order of operations in the import-export middleware, allowing attackers to consume server-side resources.

Authenticated users with the 'Scoped HA Settings Sync' permission can exploit CVE-2026-113779 in pfSense-pkg-RESTAPI versions prior to 2.9.0 to modify API configuration secrets and achieve full administrative privilege escalation.

A threat actor using the handle BUGSTER utilized the Hermes Agent framework and DeepSeek V4 to facilitate credential theft, database exfiltration, VoIP fraud planning, and Wi-Fi password cracking.

Oracle has disclosed multiple vulnerabilities affecting various Oracle Systems, which could allow a remote, anonymous, or authenticated attacker to compromise the confidentiality, integrity, and availability of the affected systems.

Multiple vulnerabilities in Oracle TimesTen In-Memory Database allow a remote, authenticated attacker to compromise the confidentiality, integrity, and availability of the system.

Attackers can abuse the Kubernetes TokenRequest API to mint service account tokens without filesystem access, facilitating privilege escalation and movement to cloud resources via IAM Roles for Service Accounts (IRSA).

Kubernetes pods attached to the host network can access services running on the host's localhost, potentially allowing network traffic snooping or the bypassing of network policies.

Detection logic for identifying AWS EKS pod deployments that request high-risk Linux capabilities capable of facilitating container escapes and host-level privilege escalation.

Systemd override configuration files can be leveraged by malicious actors to achieve persistence or escalate privileges by executing malicious commands during system startup or via systemd timers.

This detection identifies potential reconnaissance activity in Azure Kubernetes Service (AKS) by flagging identities that enumerate three or more distinct Kubernetes API resource types within a short timeframe.