Threat briefs

A path traversal vulnerability in Webmin and Usermin allows remote, unauthenticated attackers to read arbitrary files by exploiting improper input handling in the simplify_path function.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.

Vifm versions 0.8.1-beta through 0.14.4 are vulnerable to local command injection and privilege escalation due to insecure IPC FIFO reuse in shared temporary directories.

KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.

Rovr through 0.10.3 contains an OS command injection vulnerability triggered by opening files with malicious names containing shell metacharacters, enabling arbitrary code execution under the user's context.

Kubeflow Model Registry versions up to 0.3.17 contain a server-side request forgery vulnerability allowing namespace users to exfiltrate ServiceAccount tokens and gain cluster-wide privileges.

An authenticated low-privileged user can exploit a missing authorization vulnerability in youlai-boot to assign administrative permissions to their own role and elevate privileges.

iFlytek SkillHub versions through 0.2.22 contain a missing authorization vulnerability in the skill deletion API, allowing authenticated users to delete any user's skill data.

Wukong AICRM versions through 20260610 contain a missing authorization vulnerability that allows authenticated users to call administrative APIs, leading to account takeover via password reset.

Roo Code through 3.54.0 contains a command approval bypass in getCommandDecision() allowing attackers to execute denied shell commands by prefixing them with a redirection operator.

Dockhand versions prior to 1.0.45 allow unauthenticated remote attackers to perform full account takeover by exploiting an authentication bypass flaw in the global hook that incorrectly permits requests ending in static extensions.

Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.

A parsing discrepancy between tree-sitter-bash and the bash shell in Mistral Vibe allows attackers to bypass permission validation via backslash-newline line continuations to execute arbitrary commands.

The JTL-Connector for WooCommerce WordPress plugin is vulnerable to unauthenticated remote code execution via a flaw in session handling and file validation.

An unauthenticated remote code execution vulnerability in AGE-GATE WordPress plugin version 1.0 and earlier allows attackers to inject PHP code via unsanitized POST parameters.

An unauthenticated SQL injection vulnerability in the Abandoned Cart Pro for WooCommerce plugin allows attackers to exfiltrate data or escalate privileges to administrator by modifying user metadata.

The Snazzy Social Media Feed WordPress plugin (up to version 2.5) is susceptible to arbitrary file upload and remote code execution via insufficient sanitization in the standalone save-to-cache.php script.

An unauthenticated arbitrary file upload vulnerability in the Printcart Store (PCDesigner / NB Designer) WooCommerce plugin allows remote code execution via AJAX parameter manipulation.

An unauthenticated arbitrary shortcode execution vulnerability in Click to Chat for WhatsApp for WordPress allows attackers to trigger malicious shortcodes by manipulating the REQUEST_URI.

Microsoft's October 2026 security rollup addresses multiple vulnerabilities across its product ecosystem, including CVE-2026-96951 which is confirmed as actively exploited in the wild.

The Sarcoma ransomware-as-a-service group continues to target mid-market organizations globally, recently exfiltrating 1.2 TB of data from a new victim in the United States.

Detection of NirSoft utility bundle file creation on Windows hosts, a technique frequently used by threat actors for credential harvesting, reconnaissance, and data exfiltration.

This detection identifies potential unauthorized container image pushes to AWS ECR by monitoring for 'PutImage' API calls from users not present in an established allowlist, a common indicator of supply chain or lateral movement activity.

A heap out-of-bounds vulnerability in the .NET WPF runtime allows attackers to achieve remote code execution through crafted pixel-shader bytecode.

A high-severity remote code execution vulnerability (CVE-2026-70197) in .NET allows unauthenticated out-of-bounds writes on Windows when reusing SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets.

An improper privilege management vulnerability in Python (CVE-2026-85864) allows an authorized local attacker to perform unauthorized privilege escalation.

This correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.

A denial-of-service vulnerability (CVE-2026-58280) in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml components allows attackers to crash applications via uncontrolled recursion and resource exhaustion.

A memory exhaustion vulnerability in Microsoft.AspNetCore.Localization allows unauthenticated attackers to cause unbounded memory growth and denial of service in ASP.NET Core applications.

A spoofing vulnerability in the .NET System.Security.Cryptography.Xml library allows for certificate forgery and token spoofing via improper validation of KeyInfoX509Data serialized certificate formats.