Threat briefs

The modern-tar library versions 0.3.5 through 0.8.5 are susceptible to a memory exhaustion denial-of-service vulnerability triggered by crafted, compressed archives.

IBM Maximo Application Suite versions 8.10 through 9.2 are susceptible to unauthenticated directory traversal, allowing remote attackers to read arbitrary files via crafted URL requests.

The fast-toml library up to version 0.5.4 is vulnerable to prototype pollution, allowing attackers to modify Object.prototype through crafted TOML input, potentially leading to denial of service or authorization bypass.

Servor versions 1.0.0 through 4.0.2 are vulnerable to path traversal via URL-encoded dot segments, allowing unauthenticated attackers to read arbitrary files and list directories.

The easy-pdf-merge package (versions 0.1.0 through 0.2.6) contains an OS command injection vulnerability via unsanitized input to child_process.exec(), allowing arbitrary code execution.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 are vulnerable to remote code execution due to improper control of code generation, allowing unauthenticated attackers to execute arbitrary code.

The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.

GPT-SoVITS through 20250606v2pro is vulnerable to unauthenticated OS command injection via the UVR5 WebUI, allowing attackers to execute arbitrary commands by injecting shell metacharacters into output path parameters.

A code generation flaw in Quarkus REST Data Panache allows unauthenticated attackers to bypass class-level security requirements when using @MethodProperties without explicit role re-declaration.

NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 are vulnerable to remote code execution due to improper validation of URL schemes in the IPC bridge, allowing arbitrary local binary execution via API response forgery.

A fail-open vulnerability in openstack-network-exporter allows adjacent network attackers to bypass authentication and exfiltrate sensitive OVS and OVN dataplane metrics when TLS is not properly configured.

A remote, unauthenticated SQL injection vulnerability in the login.php script of Kusalkasilva Learning-Management-System allows attackers to compromise database integrity.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 contain an improper privilege management vulnerability allowing local users to escalate privileges.

A misconfiguration in the OpenShift insights-operator ClusterRole grants the 'gather' service account cluster-wide read access to secrets, enabling privilege escalation for attackers who can spawn pods with that identity.

Contrast versions 1.8.0 through 1.24.0 are vulnerable to an improper verification flaw in the Coordinator peer recovery process that allows manifest history replay and potential Mesh CA key disclosure.

LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.

SurrealDB versions prior to 3.3.0 are vulnerable to an authorization bypass that allows users with table-level write permissions to leak restricted field data through manipulated JSON Patch operations.

Network-AI versions 5.14.0 through 5.15.1 contain a security control bypass in the ClaudeHookBridge PreToolUse hook, enabling prompt-injected agents to execute arbitrary scripts or deploy web shells.

CVE-2026-96012 is a privilege escalation vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 that allows authenticated attackers to bypass authorization controls.

An unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.

A vulnerability in ZcashFoundation Zebra 6.4.0 and 6.4.1 allows unauthenticated remote attackers to crash the node by sending a crafted version 6 transaction with a pre-NU6.3 consensus branch ID.

MONAI versions prior to 1.6.1 are vulnerable to remote code execution due to insecure deserialization of pretrained weights fetched over plaintext HTTP.

Edgeless Systems Contrast versions 1.8.0 through 1.24.0 contain a world-writable containerd configuration file vulnerability, allowing local unprivileged users to achieve privilege escalation.

Adminer versions prior to 6.1.1 are vulnerable to remote code execution (RCE) where authenticated SQLite users can bypass security restrictions using UTF-8 byte-order marks to inject and execute PHP code.

The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.

Grav versions 2.0.22 through 2.1.6 are vulnerable to an authentication bypass in the Clockwork profiler that trusts loopback REMOTE_ADDR headers, potentially exposing system configuration and secrets.

Grav Git Sync versions 1.0.2 through 3.4.12 contain a command injection vulnerability allowing authenticated users to execute OS commands via malicious profile inputs.

A privilege escalation vulnerability (CVE-2026-109317) in the Grav grav-plugin-api plugin before version 1.0.36 allows users with delegated management permissions to obtain super-admin access.

Craft CMS versions 5.10.2 through 5.10.13 contain a Twig sandbox bypass vulnerability allowing non-admin users with System Messages permissions to execute arbitrary PHP code.

SWUpdate through 2026.05.1 is vulnerable to certificate validation bypass in crypto/swupdate_cms_verify_openssl.c, allowing attackers to sign and install malicious update packages.