Threat briefs

Vanus versions 0.8.0 through 0.9.0 contain a critical vulnerability allowing unauthenticated remote attackers to gain cluster-admin privileges using a hardcoded default administrative token.

CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.

An SQL injection vulnerability in the Support Genix WordPress plugin allows remote attackers to execute arbitrary database queries, potentially leading to full unauthorized data access or modification.

The QuantumCloud Conversational Forms for ChatBot plugin is vulnerable to remote object injection via insecure deserialization in versions up to 1.5.1, potentially facilitating remote code execution.

CVE-2026-110383 is an authorization bypass vulnerability in the Electronic Signature Add-on for Fluent Forms that permits attackers to manipulate access control levels due to improper user-controlled key handling.

A stored cross-site scripting (XSS) vulnerability (CVE-2026-110382) in the Simply Schedule Appointments WordPress plugin allows unauthenticated or low-privileged users to inject malicious scripts into administrative pages.

The Login with phone number plugin by Hamid Alinia contains an incorrect privilege assignment vulnerability, CVE-2026-110373, which enables unauthenticated or low-privileged users to escalate their access levels.

An incorrect privilege assignment vulnerability in the Brainstorm Force OttoKit suretriggers plugin allows remote attackers to escalate privileges on affected installations.

CVE-2026-109894 is a critical SQL injection vulnerability in the Arraytics Booktics plugin that allows unauthenticated attackers to execute arbitrary database queries.

The ThemeGrill eStore WordPress plugin contains a reflected cross-site scripting vulnerability (CVE-2026-108485) that allows attackers to execute arbitrary scripts in a user's browser session.

A SQL injection vulnerability exists in code-projects Hotel and Tourism Reservation System version 1.0 due to improper sanitization of the 'tour' GET parameter in the tour.php file, potentially allowing remote attackers to execute arbitrary SQL queries.

An unauthenticated remote SQL injection vulnerability in the nemoTyrant manong 'arr2sql' function allows attackers to execute arbitrary database commands.

Malware families utilize reg.exe to modify Windows policy registry keys, impairing security features and disabling administrative tools to maintain persistence and evade detection.

MLflow FileStore is vulnerable to a path traversal attack allowing arbitrary file creation through malicious trace_id parameters in the start_trace_v3 API endpoint.

CVE-2026-37066 is a path traversal vulnerability in Veno File Manager 4.4.9 that allows an authenticated super administrator to perform arbitrary file reads via specific administrative endpoints.

Fleet versions prior to 4.83.0 are susceptible to a memory exhaustion denial of service attack via crafted gzip-compressed request bodies.

PAYCOMET for WooCommerce versions 5.45 and earlier are vulnerable to reflected cross-site scripting (XSS), allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

The Gantry 5 Framework is vulnerable to an information disclosure flaw where improper error handling results in the generation of error messages containing sensitive data, allowing unauthorized retrieval.

Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 are vulnerable to an improper hostname validation flaw, allowing attackers to intercept workspace API keys via crafted redirect links.

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

FreeRDP versions before 3.0.0 and 3.6.0 before 3.32.0 are vulnerable to heap memory disclosure and denial-of-service attacks triggered by a malicious RDP server sending crafted progressive tile sequences.

Detection of system shell spawning from Celery worker processes indicates potential command or prompt injection exploitation within Python-based AI agent task frameworks.

Adversaries, including ransomware operators, frequently target and disable critical Windows services such as antivirus and backup agents to facilitate lateral movement and payload execution.

The GetPaid plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the mmdwqzpoxadd parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser.

The European VAT Compliance Assistant for WooCommerce plugin is vulnerable to unauthenticated stored cross-site scripting via the CF-IPCountry HTTP header.

An insecure installation directory permission flaw in Apache Lounge allows local users to achieve SYSTEM-level privilege escalation via DLL search order hijacking.

An unauthenticated stored XSS vulnerability in the User Registration & Membership plugin allows attackers to inject arbitrary scripts via the checkbox field due to missing nonce validation.

The User Registration & Membership plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution due to insufficient sanitization of the HTTP_REFERER header.

An authorization bypass vulnerability in the WP Booking System plugin allows authenticated subscribers to access sensitive booking email logs by manipulating request parameters, exposing PII.

An unauthenticated Stored Cross-Site Scripting vulnerability in The EU VAT Assistant for WooCommerce plugin (<= 2.1.30.260413) allows attackers to inject malicious scripts that execute in the administrator's context, potentially leading to account takeover.