Threat briefs

An unauthenticated command injection vulnerability in the sub_416874 function of H3C Magic NX15 (100R017) allows remote attackers to execute arbitrary system commands via /usr/bin/usrlist.

A critical HTTP request smuggling vulnerability (CVE-2026-66752) exists in tiny-http versions up to and including 0.12.0, allowing remote attackers to desynchronize request framing by sending a Transfer-Encoding header with arbitrary values, causing the library to incorrectly apply chunk-decoding and ignore Content-Length, which enables request smuggling attacks and can lead to denial of service by tying up connections and consuming worker threads.

An incorrect permission assignment vulnerability in the Dell Application Store allows a local low-privileged attacker to disclose sensitive information.

SENAYAN Library Management System (SLiMS) Bulian 9.8.0 contains an unauthenticated SQL injection vulnerability in the dl_detail.php script that allows for unauthorized database access.

The orbitale imagemagick-php library up to version 3.3.5 is vulnerable to remote OS command injection via the Command::font function in src/Command.php, allowing unauthenticated attackers to execute arbitrary commands.

Grav versions 2.0.15 through 2.2.1 contain an allowlist bypass vulnerability allowing authenticated page editors to execute arbitrary public static methods, leading to unauthorized file system operations.

Craft CMS versions 5.0.0 through 5.10.9 contain an authorization bypass vulnerability allowing attackers with site-scoped tokens to manipulate content across unauthorized sites via GraphQL mutations.

The Grav API plugin for Grav CMS contains multiple vulnerabilities allowing unauthenticated resource exhaustion and authorized users to bypass page-level access controls.

Siemens Software Center versions prior to 4.0.9.8 are vulnerable to a DLL sideloading attack identified as CVE-2026-110936, which is currently being exploited in the wild to achieve arbitrary code execution.

CVE-2022-34961 is a stored cross-site scripting vulnerability in Open Source Social Network version 6.3 that allows authenticated attackers to execute malicious scripts via the location input field in the Users Timeline module.

A vulnerability, CVE-2026-9147, in the uproot library allows arbitrary Python code execution when processing crafted ROOT files due to improper handling of streamer metadata fields during dynamic code generation, impacting applications that open or process untrusted ROOT files.

IBM MQ contains a stack-based buffer overflow vulnerability during TLS handshake certificate processing that allows a remote, unauthenticated attacker to execute arbitrary code.

The attested-tls-poc library fails to bind attestation evidence to TLS connections, enabling attackers to relay valid evidence to impersonate workloads and intercept sensitive data.

CVE-2026-33234 is an SSRF vulnerability in the AutoGPT Platform that allows authenticated users to bypass IP blocklists via the SendEmailBlock component to conduct internal network reconnaissance and banner grabbing.

IBM Concert versions 1.0 through 3.0.0 utilize weak cryptographic algorithms, creating a vulnerability that may allow an attacker to decrypt sensitive information.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability allowing authenticated attackers to inject and execute malicious JavaScript.

Apache Answer versions 2.0.2 and earlier contain an authentication bypass vulnerability in the reaction API that allows unauthorized users to access restricted metadata and manipulate content reactions.

An unauthenticated remote SQL injection vulnerability in the xp_cmdshell function of the /ws.asmx endpoint in Wubang Five-in-One Safety Production Management Information System allows for arbitrary command execution.

Cognition versions prior to 0.13.0 are vulnerable to unauthenticated remote code execution due to insecure API authentication defaults and the use of a local execution sandbox.

Multiple vulnerabilities identified in Stormshield Network Security firmware may allow remote attackers to bypass security policies, manipulate data integrity, or conduct cross-site scripting (XSS) attacks.

LoopX serve-status (v0.0.1 to v0.4.4) uses a permissive wildcard CORS policy on unauthenticated local HTTP endpoints, allowing any website to exfiltrate private control-plane state and markdown documentation from local developer environments.

The Perl module Cpanel::JSON::XS contains multiple security vulnerabilities in versions prior to 4.80, including information disclosure, denial-of-service, and type confusion.

This brief describes a detection methodology for identifying repetitive Ollama warning-level network errors, such as DNS lookup failures and connection timeouts, which may signal infrastructure instability or unauthorized reconnaissance.

CVE-2026-85251 allows for unauthorized credential exposure when the camel-http component follows HTTP redirects to attacker-controlled hosts.

CVE-2024-42849 is a remote denial-of-service vulnerability in Silverpeas 6.4.2 and lower, where an attacker can exhaust server resources by submitting an excessively large password string during a password change request.

CVE-2024-6333 enables authenticated remote code execution on Xerox WorkCentre printers by injecting malicious shell commands into the network troubleshooting log configuration.

A public exploit (EDB-52610) has been published for OpenEMR versions prior to 7.0.4, detailing an authenticated arbitrary file read vulnerability (CVE-2026-24849) in the Fax/SMS module's `EtherFaxActions::disposeDoc()` method, which allows a low-privileged authenticated user to read and potentially delete any file accessible by the web server user due to a lack of path validation on the `file_path` request parameter.

An unauthenticated remote attacker can trigger a panic and crash the Pterodactyl Wings service by sending a maliciously crafted packet during the SFTP handshake.

PCMan FTP Server 2.0 is vulnerable to a stack-based buffer overflow via the pwd command, allowing unauthenticated remote code execution.

An unauthenticated vulnerability in DWR request processing allows attackers to execute arbitrary workflow rules by chaining method calls.