Threat briefs

HortusFox versions prior to 6.2 are vulnerable to remote code execution via an insufficient validation flaw in the theme import process allowing arbitrary file uploads to the web root.

Planka versions 2.2.0 through 2.2.1 contain a vulnerability in the TOTP verification endpoint that lacks rate-limiting, allowing attackers with known user passwords to brute-force two-factor authentication tokens.

SambaBox versions prior to 5.4.1 are vulnerable to OS command injection, allowing unauthenticated attackers to execute arbitrary commands with application privileges.

Mooncake Store versions up to 0.3.13.post1 are vulnerable to a missing authorization flaw in the coro_rpc master port that allows unauthenticated attackers to trigger unauthorized object deletion via replica eviction.

Mooncake Store versions through 0.3.13.post1 contain a missing authentication vulnerability in the coro_rpc port, allowing unauthenticated attackers to perform unauthorized deletion operations.

The lrz receive utility in lrzsz versions before 0.13.0 fails to properly sanitize absolute pathnames in restricted mode, allowing malicious ZMODEM senders to overwrite arbitrary files writable by the receiving user.

An integer overflow in libmikmod versions prior to 3.3.14 allows remote attackers to trigger heap buffer overflows via crafted DSM module files, potentially resulting in code execution.

Attackers are leveraging obfuscated PowerShell command lines to dynamically invoke cmdlets via array index values of exported module commands, effectively bypassing signature-based detection for sensitive function names.

The proxy-addr package is vulnerable to IP spoofing due to improper validation of IPv4-mapped IPv6 trust subnets, allowing attackers to manipulate X-Forwarded-For headers and bypass IP-based security controls.

A bug bounty hunter is leveraging LLM-generated JavaScript information stealers distributed via malicious npm packages to identify vulnerabilities for bounty submissions.

A vulnerability in GnuPG identified as CVE-2024-23342 allows a remote, anonymous attacker to manipulate files, posing a risk to data integrity.

A remote, unauthenticated attacker can exploit a vulnerability in Camunda Platform to escalate privileges and gain unauthorized administrative access.

An unauthenticated remote attacker can exploit a vulnerability across multiple Atlassian products, including Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira, to achieve unauthorized information disclosure.

A vulnerability in HPE Integrated Lights-Out (iLO) allows a remote, unauthenticated attacker to escalate privileges, posing a risk of unauthorized administrative access to server hardware.

The Mail Mint WordPress plugin versions 1.31.0 and earlier are vulnerable to unauthenticated remote code execution via a PHP Object Injection flaw in the handle_form_submission function.

Adversaries are masquerading as legitimate processes by renaming Python binaries to evade security controls and execute malicious payloads on Windows endpoints.

Adversaries may hide malicious software such as remote-access tools from the Windows Programs and Features list by executing the HideUL utility or modifying the SystemComponent registry value.

SourceCodester Simple Student Information System version 1.0 is vulnerable to remote SQL injection in the searchquery.php file, allowing unauthenticated attackers to manipulate database queries.

Roundup of Qualcomm security advisories published in October 2026.

The bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL is vulnerable to remote SQL injection via the 'Username' argument in /admin_transaction.php, allowing unauthorized database access.

Authenticated attackers with subscriber-level access can achieve remote code execution in ACPT (Premium) versions up to 2.0.66 by injecting malicious Twig expressions via the REST API.

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the user_email parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative log views.

An unauthenticated remote attacker can exploit CVE-2026-94293 to perform unauthorized modifications to submodel data and exfiltrate sensitive information via the Asset Administration Shell.

A critical remote stack-based buffer overflow vulnerability in the Tenda AC5 router allows unauthenticated attackers to execute arbitrary code via the wifiPwd parameter.

A vulnerability in PyMongo (CVE-2026-96748) allows attackers to inject malicious host entries into connection strings via percent-encoded delimiters, potentially leading to unauthorized data routing or credential theft.

PickMall Lilishop up to version 4.2.4 contains an improper authorization vulnerability in the Mobile Binding component, allowing remote attackers to manipulate the Username argument to bypass authorization controls.

OSSRS srs versions 7.0-a1 and earlier are vulnerable to an unauthenticated remote execution flaw in the System API component due to missing authentication controls in the systemAPI.Run function.

A critical command injection vulnerability in the TOTOLINK X6000R firmware allows unauthenticated remote attackers to execute arbitrary system commands via the /cgi-bin/cstecgi.cgi endpoint.

An incorrect authorization vulnerability in Camunda Platform 7.24.x allows unauthenticated remote attackers to create new administrator accounts by exploiting logic flaws in the first-run setup endpoint.

Progress Software has issued patches for vulnerabilities in Telerik Fiddler Classic, including CVE-2026-77805, and the Sitefinity Next.js SDK.