Threat briefs

Claude Code and Claude Desktop failed to verify the integrity of git checkouts during plugin installation, allowing attackers to substitute pinned commits with malicious code via branch name collision.

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

Dgraph versions up to 25.3.8 expose an unauthenticated HTTP administrative API on port 6080, allowing remote attackers to perform unauthorized cluster membership operations and cause denial of service.

Argo CD fails to validate AppProject destination and resource restrictions during PreDelete and PostDelete hook execution, allowing attackers to escalate privileges via the application-controller.

A namespace-level administrator can manipulate the KEDA operator to send its highly-privileged cluster ServiceAccount token to a tenant-controlled destination, resulting in full cluster-wide privilege escalation.

Podman versions 4.4.0 through 6.1.2 allow container checkpoint images to override runtime security configurations, potentially bypassing user-defined sandbox constraints via the io.podman.annotations.checkpoint.runtime.name annotation.

A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.

The PRC-nexus actor ARMORY CASTLE is exploiting the arbitrary file upload vulnerability CVE-2026-102764 in BeyondTrust Remote Support appliances to deploy web shells, escalate privileges, and harvest credentials.

Multiple vulnerabilities in the Vim text editor allow an unauthenticated attacker to achieve arbitrary code execution with the privileges of the user running the application.

Authenticated users with QinQ edit privileges can leverage an OS command injection vulnerability in Netgate pfSense CE 2.7.0 through 2.9.0 to execute arbitrary commands as root.

LightLLM versions through 1.2.0 are susceptible to an unauthenticated denial-of-service attack via the /generate endpoint caused by unsafe deserialization.

CVE-2026-3786 is a high-severity SQL injection vulnerability in Easycms version 1.6 and earlier that allows remote attackers to execute arbitrary database commands via the _order parameter.

A stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote, unauthenticated attackers to achieve arbitrary code execution via crafted FTP commands.

The Perfmatters plugin for WordPress versions up to 2.5.9.1 is vulnerable to arbitrary file deletion via path traversal, allowing authenticated attackers with minimal privileges to delete sensitive files.

Threat actors are employing the LegionRelay command-and-control framework to facilitate malicious operations against organizations within Ukraine, necessitating network-based detection for C2 traffic.

CVE-2024-4701 is a critical remote code execution vulnerability in Netflix Genie 4.3.0, enabling attackers to execute arbitrary code by uploading a malicious shared library that triggers upon container login.

WooCommerce Designer Pro version 1.9.26 and earlier is vulnerable to unauthenticated arbitrary file upload due to insufficient validation in the wcdp_save_canvas_design_ajax function, facilitating remote code execution.

Neterbit NW-431F LTE routers are vulnerable to unauthenticated information disclosure via the /sms.json endpoint, allowing attackers to retrieve SMS messages including potential one-time passcodes.

OpenSSH is susceptible to multiple security flaws, most notably a signal handler race condition in the sshd server known as regreSSHion, which can enable remote code execution with root privileges.

A stack-based buffer overflow in the boa web server component of NEXTU FLATA AX1500 routers allows unauthenticated remote attackers to achieve arbitrary code execution via the hostname parameter.

CISA Malcolm versions v26.07.1 and earlier contain multiple high-severity vulnerabilities, including authentication bypass, SSRF, and authorization flaws, allowing unauthenticated or low-privileged users to gain administrative control.

Multiple high-severity vulnerabilities in Eclipse Milo, including improper authorization and memory management flaws, allow unauthenticated remote attackers to bypass access controls, delete protected nodes, or crash services.

Multiple critical vulnerabilities in EseeCloud App and firmware allow remote, unauthenticated attackers to gain device control, perform unauthorized device rebinding, and perform bulk enumeration of registered IoT cameras.

Multiple critical vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 enable remote, unauthenticated attackers to manipulate medical records, exfiltrate sensitive patient data, and induce denial-of-service conditions.

An authenticated path traversal vulnerability in Thermo Fisher Torrent Suite Software (CVE-2026-107777) allows remote attackers to read arbitrary files from the affected server.

Cisco Secure Email Gateway contains a critical vulnerability in the Advanced Malware Protection (AMP) feature allowing unauthenticated remote code execution with root privileges, which is currently being exploited in the wild.

Drupal core contains a critical remote code execution vulnerability, identified as CVE-2026-014, requiring immediate updates to patched versions.

A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability in Ansible Operator Plugins to achieve arbitrary code execution via crafted Custom Resource specifications.

A heap-based buffer overflow in the api.cgi component of Wavlink WN530HG4B firmware allows unauthenticated remote attackers to execute arbitrary code via malformed input to the api=info&client=app handler.

An unauthenticated remote code execution vulnerability (CVE-2026-110957) in the Wavlink WL-WN530BE2-A router allows attackers to inject OS commands via the REMOTE_ADDR parameter in api.cgi.