Threat briefs

An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.

Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.

GitPython versions prior to 3.2.0 contain a remote code execution vulnerability where the Git.ls_remote method improperly handles URLs, allowing arbitrary command execution via malicious remote-helper strings.

OpenSIPS versions 3.6.8 and 4.0.1 and earlier are vulnerable to a remote out-of-bounds read in the rtpproxy_offer and rtpproxy_answer functions, which can lead to denial-of-service or information disclosure.

The sar2html 4.0.0 application is vulnerable to remote SQL injection via the 'sort' parameter in sar2html.py, enabling unauthenticated attackers to execute arbitrary database queries.

The Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers libraries are susceptible to a billion laughs denial-of-service attack, where crafted YAML files with nested anchors cause memory exhaustion and process termination during conversion.

A vulnerability in Lenovo XClarity Controller 3 allows a remote, unauthenticated attacker to gain administrative privileges on the affected system, representing a significant security risk for managed infrastructure.

Multiple vulnerabilities in the Exim mail transfer agent allow remote, unauthenticated attackers to perform memory corruption, security constraint bypass, and denial-of-service.

CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog, including code injection, path traversal, and authentication flaws affecting Palo Alto Networks, Cisco, and Ahsay products.

An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.

A missing authorization vulnerability in holaOS channel-gateway connectors (CVE-2026-110769) allows unauthorized messaging-platform users to trigger arbitrary agent tasks on the host system.

Gitingest versions 0.3.1 and earlier contain a symlink following vulnerability that allows unauthenticated attackers to read arbitrary files from the server's filesystem.

An unauthenticated remote OS command injection vulnerability in the HNAP CGI handler of D-Link DIR-868L firmware version 2.01b05 allows attackers to execute arbitrary system commands via the SOAPACTION header.

Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 and earlier are vulnerable to remote configuration manipulation via an unauthenticated UDP configuration protocol.

An unauthenticated heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Junos OS allows remote attackers to trigger denial-of-service or potentially execute arbitrary code via malformed IPv4 packets.

CVE-2026-86848 is a critical out-of-bounds access vulnerability in DPDK lib/vhost vhost-crypto caused by a double-fetch of a guest descriptor index, enabling a malicious guest to compromise the host backend.

A use-after-unmap vulnerability in the DPDK VDUSE handler allows for potential memory corruption and system instability due to improper vring pointer invalidation.

Authenticated users can achieve remote code execution in FV Flowplayer Video Player for WordPress <= 7.5.54.7212 by bypassing incomplete file type validation in the check_mimetype function.

A time-of-check time-of-use vulnerability in the DPDK lib/vhost component enables a heap buffer overflow via the VDUSE control-queue handler, potentially allowing arbitrary code execution.

The ADP Desktop SDK improperly transmits sensitive information in clear text, allowing local network attackers to intercept credentials and gain unauthorized access to Autodesk services.

An improper input validation vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated attacker to achieve remote code execution via a buffer overflow in AutoDiscovery VPN messages.

An OS command injection vulnerability in the TACACS component of Juniper Junos OS Evolved allows authenticated, low-privileged users to achieve root-level code execution.

An infinite loop vulnerability (CVE-2026-102046) in the netsctp.ko kernel module of Juniper Junos OS allows unauthenticated remote attackers to cause a denial of service on MX Series devices via crafted SCTP traffic.

A vulnerability in the DPDK Generic Segmentation Offload (GSO) library allows remote or guest-supplied packets to trigger out-of-bounds memory read or write operations due to insufficient header size validation.

Telegram Desktop versions prior to 7.2.9 contain an IPC record-separator injection vulnerability in the Core::Sandbox component, allowing remote attackers to exfiltrate local session data via crafted tg:// links.

A coordinated disruption action targeting the CoGUI, CoAceV, and CoFish_Ws phishing kits has impacted an ecosystem responsible for billions of malicious messages harvesting credentials and payment data from global organizations.

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to unauthenticated SSRF via the x-portkey-custom-host header, allowing attackers to access internal loopback and Docker host services.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

An authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller (NIC) allows remote attackers to spoof request attributes and access protected paths by manipulating unsanitized X-Forwarded-* headers.

NGINX Gateway Fabric contains a configuration injection vulnerability in the AuthenticationFilter Custom Resource Definition that allows authenticated attackers to escape directive contexts and manipulate the shared NGINX data-plane configuration.