Threat briefs

Multiple vulnerabilities in SonicWall Network Security Manager versions prior to 4.4.0, including CVE-2026-100232 and CVE-2026-96540, allow unauthenticated attackers to achieve remote code execution and bypass security policies.

Multiple vulnerabilities across Symfony components, including expression-language, http-foundation, and yaml, enable remote attackers to cause a denial-of-service condition.

An authenticated remote attacker can exploit a vulnerability in Gitea to achieve arbitrary code execution with administrator privileges, leading to full system compromise.

A vulnerability in OpenVPN allows a remote, authenticated attacker to trigger an information disclosure or a denial-of-service condition via crafted inputs.

PJSIP contains multiple vulnerabilities, including heap buffer and integer overflows in SIP message processing, which can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition or potentially execute arbitrary code.

A vulnerability in Netgate pfSense allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

A vulnerability in the Rancher container management platform allows a remote, authenticated attacker to perform a privilege escalation, potentially gaining unauthorized administrative access within the cluster environment.

CVE-2017-11610 is a remote code execution vulnerability in Supervisor versions 3.3.2 and earlier that allows authenticated attackers to execute arbitrary system commands via the XML-RPC interface.

A proof-of-concept exploit has been published for CVE-2024-36823, a high-severity information disclosure vulnerability affecting Ninjaframework Ninja 7.0.0.

The Profitori plugin for WordPress, versions 2.0.6.0 through 2.1.1.3, contains a critical vulnerability (CVE-2025-4631) that allows unauthenticated remote attackers to escalate user privileges to Administrator via the REST API.

An unauthenticated remote code execution vulnerability (CVE-2024-9047) in the WordPress File Upload plugin version 4.24.11 and below allows path traversal and arbitrary file manipulation via the wfu_file_downloader.php script.

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload via the 'temporaryFileUploads' parameter in versions up to 3.1.8.9, enabling remote code execution.

MaxKB AI assistant platform is vulnerable to unauthenticated remote command execution due to prompt injection flaws in the 'execute' tool and insufficient sandbox escaping protections.

CikaBika Bot is a Rust-based Remote Access Trojan (RAT) delivered via phishing that utilizes Discord for command-and-control and Ngrok for exfiltration of sensitive victim data.

CVE-2025-59501 is a privilege escalation vulnerability in the Microsoft Configuration Manager (SCCM) AdminService API that allows authenticated, low-privileged users to achieve full administrative control when Entra ID integration is enabled.

CVE-2024-5764 is a vulnerability in Sonatype Nexus Repository Manager where a static encryption key in the Java PasswordCipher class permits the decryption of sensitive data, now supported by a public exploit script.

CVE-2026-110912 allows an unauthenticated attacker on a local L2 network to disclose kernel heap and stack memory by sending malformed ARP requests with oversized length fields.

An authenticated RCE vulnerability in the Email Customizer for WooCommerce plugin allows subscriber-level users to inject and execute arbitrary PHP code.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

The Checkout Field Manager plugin for WordPress contains an authorization bypass vulnerability allowing low-privileged authenticated users to delete arbitrary files from the Media Library.

The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.

An unauthenticated remote code execution vulnerability exists in 10Web Booster versions 2.34.10 and earlier due to insecure file handling and nonce leakage.

Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XXE injection, enabling remote attackers to perform SSRF, steal NTLMv2 hashes, and conduct arbitrary file read operations.

MoviePilot versions through 3.1.5 are vulnerable to command injection via the ExecuteCommandTool, allowing unauthenticated or low-privileged actors to achieve remote code execution.

IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.

An unauthenticated buffer overflow vulnerability in the SODOLA SL902-SWTGW124AS embedded HTTP server allows remote attackers to cause a denial of service via oversized multipart/form-data headers.

Better Auth @better-auth/sso versions 1.7.0-rc.2 through 1.7.2 contain an authentication bypass vulnerability allowing attackers to impersonate other users via malicious SSO provider registration.

Heym versions 0.0.55 through 0.0.120 contain a privilege escalation vulnerability allowing shared collaborators to exfiltrate workflow credentials by overwriting error handlers.