Threat briefs

ThemeHunk Customizer versions from n/a through 2.8.7 are affected by a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Bold Grid weForms plugin is affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability.

WP Mailster versions through 1.9.1.0 contain an unrestricted file upload vulnerability that allows remote attackers to upload web shells and achieve remote code execution.

Traefik versions 3.x.x before 3.7.16 and versions prior to 2.11.60 are vulnerable to security policy bypasses and unauthorized access to sensitive data.

An uncontrolled recursion vulnerability (CVE-2026-112368) in the MongoDB PHP driver allows an unauthenticated attacker to trigger stack exhaustion and process termination by providing malicious BSON documents.

Multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-113399 through CVE-2026-113869, may lead to arbitrary code execution, data confidentiality compromise, or denial of service.

ApostropheCMS is vulnerable to an unauthenticated denial-of-service condition due to the order of operations in the import-export middleware, allowing attackers to consume server-side resources.

Authenticated users with the 'Scoped HA Settings Sync' permission can exploit CVE-2026-113779 in pfSense-pkg-RESTAPI versions prior to 2.9.0 to modify API configuration secrets and achieve full administrative privilege escalation.

A threat actor using the handle BUGSTER utilized the Hermes Agent framework and DeepSeek V4 to facilitate credential theft, database exfiltration, VoIP fraud planning, and Wi-Fi password cracking.

Oracle has disclosed multiple vulnerabilities affecting various Oracle Systems, which could allow a remote, anonymous, or authenticated attacker to compromise the confidentiality, integrity, and availability of the affected systems.

Multiple vulnerabilities in Oracle TimesTen In-Memory Database allow a remote, authenticated attacker to compromise the confidentiality, integrity, and availability of the system.

Attackers can abuse the Kubernetes TokenRequest API to mint service account tokens without filesystem access, facilitating privilege escalation and movement to cloud resources via IAM Roles for Service Accounts (IRSA).

Kubernetes pods attached to the host network can access services running on the host's localhost, potentially allowing network traffic snooping or the bypassing of network policies.

Detection logic for identifying AWS EKS pod deployments that request high-risk Linux capabilities capable of facilitating container escapes and host-level privilege escalation.

Systemd override configuration files can be leveraged by malicious actors to achieve persistence or escalate privileges by executing malicious commands during system startup or via systemd timers.

This detection identifies potential reconnaissance activity in Azure Kubernetes Service (AKS) by flagging identities that enumerate three or more distinct Kubernetes API resource types within a short timeframe.

Attackers who compromise accounts and register unauthorized MFA devices often delete the resulting notification emails to evade detection, a technique monitored via Microsoft 365 Exchange audit logs.

A SQL injection vulnerability exists in the Insurance-Management-System project due to manipulation of the Plan_no/Name argument in /Admin/View/editPlan.php.

The Live Summary for Gravity Forms plugin for WordPress is affected by a Reflected Cross-site Scripting (XSS) vulnerability.

GS Plugins GS Pins for Pinterest contains a Deserialization of Untrusted Data vulnerability that allows Object Injection.

The WordPress Team Members - GS Plugins plugin is affected by a Deserialization of Untrusted Data vulnerability, allowing Object Injection.

NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC implementation, allowing a remote attacker to cause a service crash via QUIC path migration.

The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

An unintended proxy mode classification in Apache Camel via prefix matching allows unauthenticated request forgery, potentially exposing internal services to unauthorized access.

A denial of service vulnerability, CVE-2026-23869, exists in React Server Components due to excessive CPU usage triggered by specially crafted HTTP requests to Server Function endpoints, potentially leading to service disruption.

A deserialization of untrusted data vulnerability (CVE-2026-107436) in the WP Chill Strong Testimonials plugin allows remote attackers to perform object injection, potentially leading to remote code execution.

This detection identifies the creation or modification of Kubernetes Roles and ClusterRoles that include high-risk permissions, such as wildcard access or RBAC escalation verbs (bind, escalate, impersonate), which may facilitate privilege escalation or unauthorized access.

A stored cross-site scripting (XSS) vulnerability exists in the Kevin Stover Ninja Forms plugin due to improper neutralization of input during web page generation.

Detection of potential credential enumeration in AWS EKS via monitoring of control-plane audit logs for sensitive namespace or cluster-wide secret listing operations.