Threat briefs

CVE-2025-23048 allows an attacker to bypass client certificate authentication in Apache HTTP Server versions 2.4.35 through 2.4.62 by resuming a TLS 1.3 session across virtual hosts with different CA configurations.

An unidentified threat actor is using a multi-stage .NET assembly-loading framework called NetamLoader to target government-specific Windows 10 builds via AppDomainManager injection and supply chain compromises.

OpenSTAManager is vulnerable to remote code execution due to insecure deserialization in the OAuth2 component, allowing unauthenticated attackers to execute arbitrary commands by injecting a malicious serialized object into the `zz_oauth2` table.

AdminNeo versions 4.6.0 through 5.5.0 contain a vulnerability where unsanitized X-Forwarded-Prefix headers allow cookie attribute injection, potentially leading to session hijacking and credential theft.

CVE-2024-27348 is a critical RCE vulnerability in Apache HugeGraph-Server (<= 3.7.1) that allows attackers to execute arbitrary Java code via the /gremlin endpoint, facilitating the deployment of web shells.

A missing authorization vulnerability in Tychesoftwares Order Delivery Date Pro for WooCommerce allows unauthenticated attackers to modify site options, facilitating privilege escalation via account takeover.

A critical unauthenticated SQL injection vulnerability (CVE-2025-25257) in FortiWeb allows remote code execution, with public exploit code now available.

A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.

A heap-based out-of-bounds read vulnerability in the Pjsip DNS parser allows unauthenticated remote attackers to cause a denial-of-service via a crafted DNS response.

A remote OS command injection vulnerability exists in the Initial Setup Wizard of WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4.

A format string vulnerability (CVE-2024-23113) in the FortiGate FGFM service on TCP port 541 allows unauthenticated remote code execution via specially crafted input.

An out-of-bounds heap write vulnerability in the imgproxy ICO loader allows unauthenticated attackers to trigger a deterministic worker crash (DoS) by supplying a crafted image file.

A vulnerability in Tenable Nessus Plugin versions prior to #202610282338 allows an attacker to compromise data confidentiality, as detailed in Tenable security bulletin tns-2026-33.

Multiple vulnerabilities within the SUSE Linux kernel across various distributions and modules could allow unauthorized actors to compromise data confidentiality, bypass security policies, or cause denial-of-service.

Attackers are hijacking Dahua IP cameras and recorders via the Easy4IP P2P cloud access feature by using brute-force attacks or exploiting CVE-2021-33044 and CVE-2021-33045 to gain unauthorized device control.

A race condition in the Linux kernel IPv4 TCP handshake allows remote unauthenticated attackers to trigger a use-after-free, potentially leading to kernel memory corruption or root code execution.

A vulnerability in the Presenton API component (up to version 0.9.11-beta) allows for remote, unauthenticated access.

ShowDoc versions 2.8.14 through 3.9.5 are vulnerable to authenticated remote code execution via a code injection flaw in the Mock feature's template processing.

The pypdf library may experience large memory usage when parsing crafted PDF files containing cross-reference streams.

A heap-based buffer overflow vulnerability in libheif versions 1.18.0 through 1.23.2 allows out-of-bounds heap writes via crafted HEIF files with mismatched chroma bit depths, potentially facilitating arbitrary code execution.

The Thelia Page Module before 2.0.4 is vulnerable to CSRF, allowing an attacker to trick a logged-in administrator into triggering unauthorized deletions of tags, documents, and images.

AJ-Report versions 1.7.1 and earlier contain a hard-coded JWT secret, enabling token forgery and unauthenticated remote code execution via the testTransform endpoint.

HTTP::Parser::XS versions before 0.18 for Perl are vulnerable to PATH_INFO truncation when an encoded NUL byte is present in the request path, potentially enabling security bypasses in downstream applications.

WebDyne for Perl is affected by multiple vulnerabilities involving session cookie attributes, path traversal, and unescaped request parameters.

Gravity Forms for WordPress versions up to and including 3.1.2 is vulnerable to unauthenticated PHP object injection via Post Custom Fields, which can lead to remote code execution when combined with specific gadget chains.

Digital Bazaar node-forge versions prior to 1.4.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the pem.decode() function, allowing unauthenticated attackers to cause high CPU usage via malformed PEM input.

The VOLTA infostealer, a self-deleting Windows malware, utilizes LLMs via OpenRouter to conduct automated victim profiling and monetize stolen assets.

The Acadlix LMS plugin for WordPress is vulnerable to arbitrary file deletion in the post_delete_assessment_file_by_id function due to insufficient file path validation and an improper permission callback, allowing unauthenticated attackers to delete files on the server.

The WP Directory Kit WordPress plugin is vulnerable to unauthenticated SQL injection via the idfield parameter due to insufficient input sanitization, enabling potential data exfiltration.

The Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress contains a Stored Cross-Site Scripting vulnerability via the 'REQUEST_URI' parameter in versions up to and including 22.3.2.