Threat briefs

The Eimzamip application (versions 1.6.4 through 1.6.5) is vulnerable to an unrestricted file upload flaw allowing remote attackers to upload malicious file types, potentially leading to unauthorized code execution.

IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 contain a reflected cross-site scripting (XSS) vulnerability allowing unauthenticated remote attackers to execute arbitrary JavaScript in the Web UI.

CVE-2026-19218 in AKIN Software MyRezzta versions 2.06.03 through 2.07.00 allows unauthorized account access via a flawed password recovery mechanism.

The Docling library contains a vulnerability (CVE-2026-105744) allowing arbitrary file read/write and potential command execution when processing untrusted LaTeX input with the Tectonic engine enabled.

The Midnight Mimosa campaign utilizes platform-signed, pre-installed malware on low-cost MediaTek Android devices to execute ad fraud, click fraud, and residential-proxy botnet enrollment.

An unauthenticated, remote attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in Cisco Finesse, Unified CCE, and Unified CCX to gain unauthorized access to internal resources and disclose sensitive information.

A critical authorization bypass vulnerability (CVE-2026-19083) in AKIN Software OctoCloud versions 1.12.06 allows unauthorized access to restricted application functionality.

A vulnerability in the OpenJPEG library allows a remote, unauthenticated attacker to cause a denial-of-service condition through the processing of maliciously crafted input.

An APT actor is targeting Taiwan-based researchers with AI-assisted event-themed spear-phishing and quishing, leveraging an adversary-in-the-middle (AitM) framework to intercept Google credentials and bypass MFA.

Openfind SecuShare Pro is vulnerable to an unauthenticated OS command injection flaw (CVE-2026-107459) allowing remote attackers to execute arbitrary commands on the host server.

Unauthenticated attackers can achieve arbitrary recursive directory deletion in Super Forms versions 6.3.316 and earlier by exploiting improper path validation in the submit_form function.

The @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages incorrectly trust a client-supplied wallet address, allowing attackers to bypass payment requirements by referencing any qualifying wallet address.

A local Denial of Service vulnerability exists in the PCRE library due to improper processing of specifically crafted regular expressions that cause application crashes.

Authenticated attackers can exploit a PHP Object Injection vulnerability in Uncanny Automator versions 7.6.1.1 and earlier to achieve arbitrary file deletion via a POP chain.

An improper input validation vulnerability (CVE-2026-106509) in Backstage plugin-techdocs-node allows authenticated users to achieve arbitrary code execution via crafted mkdocs.yml files.

An authenticated user can access internal task execution data in Backstage, potentially exposing credentials stored within Scaffolder tasks to unauthorized parties.

An authenticated user can exploit improper URL validation in Backstage plugin-catalog-backend to access unauthorized resources outside the intended source repository via crafted catalog entity placeholder directives.

A vulnerability in Backstage's backend-defaults package allows restricted service credentials to bypass defined access restrictions when routing requests through plugin delegation paths, potentially leading to unauthorized privilege escalation.

A vulnerability in the Backstage OIDC authentication module allows authenticated users to spoof identities when using email-based resolution with unverified email providers, leading to unauthorized access.

Authenticated users can exploit improper filesystem validation in Backstage Bitbucket scaffolder plugins to achieve unauthorized file access, modification, or deletion outside the intended working directory via CVE-2026-106486.

An authenticated user can exploit improper path validation in the Backstage plugin-scaffolder-backend-module-confluence-to-markdown (CVE-2026-106560) to write files outside the designated task workspace.

Hydra-core versions prior to 1.3.6 and 1.4.0.dev9 are vulnerable to arbitrary code execution due to improper validation of logging configuration passed to dictConfig, allowing attackers to invoke arbitrary Python callables.

An authentication-required blacklist bypass vulnerability in the Kunstmaan MediaBundle allows malicious administrators to upload arbitrary executable files via case-sensitive extension filtering, resulting in remote code execution.

PraisonAI versions prior to 1.6.78 are vulnerable to server-side request forgery (SSRF) due to an issue in the Crawl4AI/Chromium backend, allowing attackers to bypass existing SSRF validation by employing DNS rebinding and HTTP redirects to access and exfiltrate sensitive internal responses, including canary values.

The hydra-optuna-sweeper package allows arbitrary code execution by resolving and invoking untrusted callables provided through the custom_search_space configuration parameter.

A heap out-of-bounds write vulnerability (CVE-2026-106118) in the SixLabors ImageSharp library allows remote attackers to cause a process crash or potentially execute arbitrary code by supplying a maliciously crafted tiled TIFF image using fax compression.

An authenticated internal user can exploit improper input validation in the Backstage Sentry scaffolder module to trigger SSRF and disclose sensitive integration credentials.

Ghost versions 6.22.1 through 6.64.0 are vulnerable to stored cross-site scripting due to improper Content-Type handling in the local storage adapter, allowing staff-level users to execute malicious scripts on the site domain.

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

An authenticated user can exploit a path configuration weakness in @payloadcms/storage-s3 to overwrite arbitrary S3 objects across collections, bypassing security controls.