Threat briefs

An authorization vulnerability in @payloadcms/plugin-multi-tenant allows authenticated users to assign themselves to unauthorized tenants by leveraging default field access configurations.

An improper input sanitization vulnerability in Payload CMS database adapters allows attackers with collection access to execute SQL injection attacks via JSON and block fields.

Next.js versions 16.0.0 through 16.3.7 are susceptible to Server-Side Request Forgery (SSRF) when processing images from attacker-controlled remote URLs configured in remotePatterns.

Langflow versions 1.10.0 and earlier use a non-cryptographic PRNG to derive Fernet keys from short SECRET_KEYs, allowing unauthenticated attackers who obtain the secret key file to perform offline decryption of all stored user credentials.

The lz4-java library is vulnerable to a race condition during native library extraction that allows a local user to perform arbitrary code execution or a denial of service.

A critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.

Multiple vulnerabilities in X.Org X11 and Xwayland allow local attackers to execute arbitrary code or trigger a denial of service state.

Adversary-in-the-Middle (AiTM) phishing attacks leverage reverse proxies to capture and replay authenticated Okta session cookies, bypassing multi-factor authentication (MFA) protections.

North Korea-affiliated threat actors are leveraging Web3-based command-and-control infrastructure and open-source supply chain poisoning to extract high-privilege cloud credentials from developer environments and CI/CD pipelines.

D-Tale versions 3.15.1 and earlier are vulnerable to unauthenticated remote code execution due to a hardcoded Flask secret key and unsafe pandas query evaluation.

An unauthenticated remote attacker can trigger a permanent 100% CPU utilization loop in iperf3 versions prior to 3.22 by sending a crafted control-channel message followed by a specific UDP datagram.

An unauthenticated prototype pollution vulnerability in the Payload Import Export plugin allows remote attackers to achieve code execution via malicious input.

A heap-based buffer overflow in the Cyrus SASL DIGEST-MD5 plugin, tracked as CVE-2026-107161, allows remote malicious servers to cause memory corruption in client applications.

Cisco has released critical security patches for Smart Software Manager On-Prem addressing four internally discovered vulnerabilities, including CVE-2026-76480, CVE-2026-76482, CVE-2026-76483, and CVE-2026-76484.

Gophish versions 0.12.1 and earlier are vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing authenticated users to modify or hijack unauthorized administrative objects.

An unvalidated buffer length parameter in the libexpat XML_ParseBuffer function allows remote attackers to trigger a heap buffer over-read, potentially leaking sensitive memory for ASLR bypass.

A privilege escalation vulnerability in wger allows gym trainers to deactivate higher-privileged accounts, resulting in administrative lockout.

PraisonAI AgentMail versions before 4.6.78 are vulnerable to CVE-2026-61428, an authentication bypass flaw in webhook mode that allows unauthenticated attackers to inject messages with spoofed sender addresses, enabling them to trigger replies to attacker-controlled addresses and bypass email filtering.

Fresh deployments of Homer use a hardcoded default password for the admin account, allowing unauthenticated remote attackers to gain full administrative access via CVE-2026-62252.

The Quasar Icon Genie CLI tool is vulnerable to path traversal via malicious JSON configuration profiles, allowing attackers to overwrite arbitrary files on the local filesystem.

The @quasar/app-vite package (<= 3.2.0) is vulnerable to attribute injection in SSR and SSG renderer paths where unsanitized nonce values can be used to inject arbitrary HTML attributes.

The Quasar Framework development server exposes environment variables, cookies, and request headers via an unauthenticated error page that is also susceptible to HTML injection due to an incomplete sanitization routine.

The @quasar/ssl-certificate development utility caches TLS private keys with overly permissive filesystem permissions, enabling local unauthorized access and impersonation of development endpoints.

PraisonAI versions 4.6.77 and earlier are vulnerable to arbitrary code execution via command injection in the deploy/api.py and deploy/docker.py modules due to unsanitized f-string interpolation.

The Quasar Framework's server-side rendering (SSR) mechanism in versions prior to 2.22.0 fails to escape HTML characters in meta tags, allowing attackers to inject and execute arbitrary JavaScript in the victim's browser.

Flowise versions <= 3.1.2 are vulnerable to data exfiltration and SSRF via a flawed regex-based Python validator that fails to restrict pre-imported pandas and numpy methods.

An authenticated remote attacker can exploit a vulnerability in NetBox to perform information disclosure through improper request handling.

Veeam Backup Enterprise Manager contains multiple vulnerabilities that enable remote attackers to perform Cross-Site Scripting (XSS), execute arbitrary code, and manipulate application data.

Multiple vulnerabilities in the PCRE2 library allow a remote, unauthenticated attacker to cause a denial of service (DoS) condition or perform sensitive information disclosure.

Multiple vulnerabilities in the PCRE2 library, including CVE-2024-6727, allow remote, unauthenticated attackers to trigger a Denial of Service condition through crafted regular expressions.