Threat briefs

A vulnerability in sqlparse versions 0.6.0 and earlier allows for PHP code injection via unescaped dollar sign sequences in SQL input processed by OutputPHPFilter.

An SQL injection vulnerability in NocoBase plugin-collection-sql allows authenticated privileged users to bypass validation and execute arbitrary SQL commands on the underlying PostgreSQL database.

A configuration error in Mercury framework versions 3.0.0 through 3.2.3 allows unauthenticated attackers to bypass endpoint restrictions and access the Jupyter Server terminal API for remote code execution.

CLI Bridge versions prior to 0.0.2 are vulnerable to path traversal through improper symlink resolution, potentially allowing arbitrary file writes outside the intended workspace root.

Progressive Robot hMailServer 6.0.0 through 6.3.6 contains a vulnerability allowing unauthenticated remote attackers to forge DKIM-signed emails for hosted domains via improper verification of sender identity during the signing process.

IBM MQ Operator contains an unrestricted Java deserialization vulnerability in MQ Classes for Java that allows authenticated attackers to cause a denial of service or execute arbitrary code.

IBM MQ contains a vulnerability in its MQOPEN operations that permits an authenticated attacker to induce a denial of service or trigger memory corruption through improper buffer size validation.

The @rvf/set-get library prior to version 7.0.4 is vulnerable to prototype pollution, allowing unauthenticated attackers to trigger a process-wide denial of service via malicious form field submissions.

An SSRF vulnerability in the SeleniumScrapingTool component of crewai-tools allows attackers to exfiltrate internal resources or cloud credentials via malicious prompt injection.

Authenticated users with the task_runner role in Semaphore UI versions up to 2.19.16 can achieve remote code execution by injecting malicious Ansible configuration parameters into task environment payloads.

docTR versions through 1.1.0 are vulnerable to arbitrary code execution via unsafe deserialization of pickle payloads within the load_pretrained_params() function.

An authorization bypass vulnerability in Camunda Platform allows authenticated attackers to access, download, or delete task comments and attachments by exploiting missing authorization checks in specific engine-rest sub-resources.

A supply-chain compromise of Rank Math SEO PRO version 3.0.123, distributed between October 15 and 16, 2026, introduced a backdoor enabling persistent access, credential theft, and unauthorized administrative control.

CVE-2023-22047 allows unauthenticated attackers to perform arbitrary file reads via the wsrp-url parameter in Oracle PeopleSoft Enterprise PeopleTools.

Attackers compromised Rank Math PRO version 3.0.123 between October 15 and October 16, 2026, injecting malware that provides persistent administrative access, credential theft, and server-side backdoor capabilities.

Multiple vulnerabilities, including remote code execution and cross-site scripting, affect Drupal versions 10.6.x, 11.3.x, and 11.4.x, requiring immediate patching to prevent unauthorized code execution.

A default credentials vulnerability in FlyCms through commit edfdf724 allows unauthenticated attackers to gain administrative access using the flycms account and admin123 password.

An unrestricted file upload vulnerability in the Criminal-Management-System allows remote attackers to upload arbitrary files via the my_img parameter in home.php.

Krayin CRM versions before 2.2.7 contain a broken object level authorization vulnerability in the EmailController, allowing authenticated users to manipulate or delete emails belonging to other users.

BentoML versions through 1.4.39 are vulnerable to Dockerfile instruction injection, allowing attackers to execute arbitrary commands during the containerization process by exploiting improper newline handling in template files.

The Television (tv) package, versions 0.15.0 through 0.15.9, is vulnerable to OS command injection due to improper sanitization of single quotes within the format_command function.

RisingWave versions before 3.1.0 contain a missing authorization vulnerability allowing low-privileged SQL users to perform arbitrary filesystem read and write operations.

Multiple D-Link router models contain hard-coded credentials in the MQTT Broker component, allowing for potential remote unauthorized access via public exploit code.

A vulnerability in the PyannoteDiarizationModelManager._load_fn function of the speaches-ai speaches library allows remote attackers to perform arbitrary code execution via malicious input.

An unauthenticated SQL injection vulnerability in the Registration-Edit Handler of the Events-Management-System allows remote attackers to compromise the backend database through unsanitized input parameters.

CheckCle versions up to 1.6.0 contain a critical missing authorization vulnerability allowing unauthenticated access to database records via improperly configured PocketBase API rules.

An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.

Red Hat Advanced Cluster Security for Kubernetes contains a SAML authentication flaw allowing attackers to replay unexpired assertions to obtain multiple valid session tokens.

An unauthenticated SQL injection vulnerability in the Administrative Mutation Handler of the Online Clinic Management System allows remote attackers to execute arbitrary database queries via the docid parameter.

DBeaver contains multiple security vulnerabilities that may allow a local or remote attacker to achieve arbitrary code execution or cause a denial-of-service condition.