Threat briefs

OpenEMR versions up to 8.0.0.2 are vulnerable to SQL injection in the patient selection feature, which can be exploited by authenticated attackers due to insufficient input validation, potentially leading to unauthorized data access and modification.

A local privilege escalation vulnerability in cifs-utils (CVE-2026-104715) allows unprivileged users to gain root access by injecting malicious mount options into a user-controlled credentials file used by mount.cifs.

ClassroomIO versions 1.0.0 and earlier contain an authorization flaw in API routes allowing authenticated students to modify or delete arbitrary lesson content across courses.

An authorization bypass vulnerability in cool-admin-midway through version 8.0.0 allows department-restricted administrators to perform unauthorized administrative actions on users outside their assigned scope.

CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.

MacCMS versions v10 through 2026.1000.4056 are vulnerable to an unauthenticated account takeover via brute-force exploitation of the password recovery function.

An incorrect authorization flaw in ThinkCMF RestAdminBaseController allows restricted administrators to bypass access controls, leading to privilege escalation and unauthorized data access.

OpenHealth versions 0.2.0 and earlier are vulnerable to unauthenticated access within the /api/health-data/ endpoint, allowing remote attackers to read, modify, or delete sensitive medical records.

Driftregion iso14229 versions before 0.10.1 are vulnerable to an integer wraparound in Handle_0x38_RequestFileTransfer, allowing unauthenticated attackers to trigger an out-of-bounds read.

Snap7 versions up to 1.4.3 contain an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() triggered by malicious S7 peer responses, potentially leading to memory corruption or process crashes.

An unauthenticated denial-of-service vulnerability in DragonflyDB allows remote attackers to cause instance termination via unbounded memory allocation.

NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.

JuggleIM im-server versions through 1.8.16 contain a hardcoded administrator account that allows unauthenticated remote attackers to gain full administrative access to tenant applications and secrets via the console on port 8090.

Archon versions 0.2.13 through 0.11.1 contain a missing authentication vulnerability allowing unauthenticated, network-adjacent attackers to execute arbitrary commands via the /api/* control API.

BMC Helix Network Management on-prem versions prior to 26.3.01 allow unauthenticated attackers to bypass SAML authentication and gain administrator access.

Jooan JA-A12 IP cameras running specific firmware versions are vulnerable to unauthenticated remote code execution via a hard-coded credential flaw that allows command injection into the jooandiag daemon.

Sliver is vulnerable to a denial-of-service attack due to a lack of size constraints during PNG image decoding in its HTTP(S) listener, allowing unauthenticated attackers to exhaust server memory.

An infinite loop vulnerability in the Junrar Java library, identified as CVE-2026-97370, allows unauthenticated attackers to cause CPU exhaustion via crafted RAR4 archives.

The react/http library is vulnerable to a memory exhaustion Denial of Service (DoS) due to the lack of size constraints on incoming HTTP response headers (CVE-2026-104827).

An unauthenticated remote attacker can exploit CVE-2026-107805 in Nginx UI by sending malicious requests that trigger premature staging of large, unsigned request bodies, leading to disk space and I/O exhaustion.

An authenticated user can achieve remote code execution in Nginx-UI by uploading a maliciously crafted backup file that overwrites application configuration settings.

A build-time dependency issue in FrankenPHP causes cross-user session ID leakage when the PHP session extension is loaded as a shared module in worker mode.

Authenticated users can escalate privileges to administrator or manage plugins by invoking unauthorized JSON-RPC methods in Leantime.

The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.

The @opennextjs/cloudflare component contains a vulnerability (CVE-2026-100409) where inconsistent path decoding allows attackers to bypass middleware-based authorization and retrieve cached content.

A vulnerability in mise allows an attacker who can place a malicious .mise.toml file in a repository to bypass trust checks and execute arbitrary code via `[env] _.source` due to improper loading of trust settings.

The dio_http2_adapter library fails to sanitize Authorization, Cookie, and Proxy-Authorization headers when following cross-origin HTTP redirects, enabling credential theft.

An incomplete fix for an OpenAPI 3.1 validation flaw allows unauthenticated attackers to trigger process-crashing nil-pointer dereferences in kin-openapi by supplying array schemas without an 'items' keyword.

A vulnerability in the containerd CRI implementation (CVE-2026-95837) allows untrusted container checkpoints to bypass configured security contexts, enabling privilege escalation to root.

An unauthenticated remote denial-of-service vulnerability in Qwik allows attackers to terminate Node.js server processes by sending a maliciously crafted qwik-json payload, resulting in persistent service outages.