Threat briefs

An authorization bypass vulnerability in the LangGraph SDK causes the actions= parameter on resource-scoped decorators to be ignored, potentially allowing authenticated users to perform unauthorized operations.

An insufficient character blacklist in @vue/server-renderer allows attackers to inject arbitrary HTML attributes by including carriage return characters in dynamic binding keys.

The fsspec library contains an un-sandboxed Jinja2 template injection vulnerability in its Kerchunk reference processing logic, allowing arbitrary code execution when processing malicious data catalogues.

The hickory-resolver DNS library is vulnerable to a denial-of-service condition (CVE-2025-27150) where a malicious authoritative nameserver can induce an infinite retry loop by returning truncated responses.

An unauthenticated remote denial-of-service vulnerability in @graphql-tools/utils allows attackers to crash node processes via prototype pollution in the mergeDeep utility function.

The @graphql-tools/executor-legacy-ws package incorrectly disables TLS certificate validation for WSS connections, enabling MITM attacks that can lead to credential interception.

A vulnerability in the vm2 library (CVE-2026-92947) allows sandboxed code to bypass security boundaries by reading and writing to the host-realm memory shared through Node.js Buffer pools.

The compression middleware for Node.js is vulnerable to a memory leak leading to Denial of Service when an attacker prematurely closes connections during compressed response transmission.

The Nx build system contains OS command injection vulnerabilities in `nx affected` and `nx import` commands, allowing attackers to execute arbitrary code via malicious git revision strings or remote branch names.

The @nx/docker package is vulnerable to OS command injection via insecure shell command construction, allowing arbitrary command execution during release processes through malicious configuration inputs.

The Seroval library is vulnerable to unauthenticated memory and CPU exhaustion due to an unchecked TypedArray length property during JSON deserialization, leading to event loop starvation.

The @socket.io/cluster-engine package is vulnerable to prototype pollution when processing attacker-controlled session IDs, allowing an attacker to cause a denial of service via process crash.

An improper validation of the 'require' configuration in the vm2 Node.js sandbox allows attackers to bypass nesting restrictions and achieve arbitrary code execution by spawning an inner NodeVM with elevated privileges.

A vulnerability in the vm2 sandbox library (CVE-2026-92954) allows sandbox-based code to terminate the host Node.js process by invoking host-realm functions that return unhandled rejected Promises.

A prototype pollution vulnerability in the tinypool Node.js worker pool library allows attackers to gain arbitrary code execution in child processes by injecting worker configuration options.

A flaw in the Capacitor WebView navigation guard allows attackers to force in-app navigation to an internal proxy path, enabling the execution of arbitrary remote content within the application's origin.

The simple-git library fails to block 'trailer.<token>.cmd' configuration in its unsafe-operation guard, enabling command injection when applications process untrusted user input.

The @simple-git/argv-parser library fails to classify the VISUAL environment variable as an unsafe editor, allowing attackers to bypass security guards and execute arbitrary code during Git operations.

An unauthenticated SQL injection vulnerability in the Patient Login Handler allows remote attackers to execute arbitrary SQL commands via the uname or psw parameters.

A critical SQL injection vulnerability (CVE-2026-14762) exists in code-projects Hotel and Tourism Reservation version 1.0, located in the `/admin/rooms.php` file's Room Management Page, allowing remote attackers to manipulate the `delete` argument for data compromise, with a public exploit now available.

The Django-Vue-Lyadmin project up to version 3.2.12 contains a hard-coded SECRET_KEY in backend/application/settings.py, allowing remote attackers to forge JWT tokens and gain unauthorized access.

The onetwothreeneth HospitalManagementSystem contains a remote SQL injection vulnerability in edit_accounts.php that allows unauthenticated attackers to execute arbitrary database queries.

The UNION HospitalManagementSystem is vulnerable to remote SQL injection via the patient_id parameter in patient_info.php, allowing unauthenticated attackers to manipulate database queries.

Authenticated attackers can exploit a PHP object injection vulnerability in FacturaScripts versions prior to 2026.7 by injecting serialized objects into WidgetSelect multiple-select fields, leading to arbitrary file deletion.

An authenticated user with secret creation permissions can exploit the HyperShift operator to execute arbitrary code in the control plane by injecting malicious plugins into kubeconfig secrets.

ClingSTUN is a Linux-based backdoor that leverages public Session Traversal Utilities for NAT (STUN) infrastructure to facilitate unauthorized proxy access and C2 communication.

A vulnerability in the Zabbix Frontend allows a remote, authenticated attacker to execute arbitrary scripts in a user's browser via a Cross-Site Scripting (XSS) attack.

Bouncy Castle for Java is affected by multiple vulnerabilities that allow remote attackers to perform privilege escalation, security bypass, data manipulation, information disclosure, or denial-of-service.

A local vulnerability in the GRUB 2 bootloader allows an attacker with physical access to bypass Secure Boot and execute arbitrary code during the boot process.

A vulnerability in Apache Traffic Server (CVE-2024-41754) allows a remote, unauthenticated attacker to bypass security policies, potentially resulting in unauthorized traffic manipulation.