Threat briefs

CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.

DataCap versions 2025.1.1 and earlier are vulnerable to a missing authorization flaw that allows authenticated users to escalate privileges via administrative API calls.

An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.

SQLite versions prior to 3.54.0, when compiled with FTS5, contain a heap buffer overflow vulnerability that allows local memory corruption or process crashes via crafted prefix MATCH queries.

The @nx/maven and @nx/gradle plugins contain an OS command injection vulnerability where unsafely interpolated nx.json configuration options lead to arbitrary command execution during project-graph analysis.

Fleet contains multiple vulnerabilities that can be exploited by an authenticated remote attacker to bypass security controls, escalate privileges, perform information disclosure, manipulate data, or trigger a denial-of-service condition.

A vulnerability in Adobe Digital Editions allows an unauthenticated remote attacker to bypass security measures and gain unauthorized write access to files on the host system.

ServiceNow AI Platform contains multiple vulnerabilities that allow a remote, authenticated attacker to achieve remote code execution, bypass security controls, and perform unauthorized data manipulation or disclosure.

Composer contains multiple vulnerabilities allowing remote, anonymous attackers to bypass security controls, manipulate files, or perform unauthorized information disclosure.

Mattermost has released a security advisory addressing multiple vulnerabilities affecting versions up to 11.10.0 and earlier maintenance releases.

An unauthenticated remote code execution vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited in the wild, enabling attackers to gain control over affected systems.

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections.

The SQLite command-line shell through version 3.54.1 is vulnerable to command injection because the .recover command emits malicious dot-commands stored in the database schema, which execute when the output is piped back into the shell.

Jellyfin versions up to 12.4 contain an SSRF vulnerability where authenticated users can bypass image validation by submitting gzip-compressed SVG payloads in data URIs to interact with internal network resources or read local files.

phpMyAdmin versions up to 5.2.3 are susceptible to a CSRF vulnerability allowing remote attackers to execute arbitrary SQL queries by tricking authenticated users into submitting malicious non-AJAX POST requests.

Lago versions through 1.55.0 contain an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check.

CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.

CakePHP versions through 5.4.3 contain an SQL injection vulnerability in the WindowExpression::range() and frame() methods that allows attackers to execute arbitrary SQL via crafted input passed to the OVER clause.

OPNsense contains a vulnerability that allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters, which allows unauthenticated attackers to log out users and clear local stores.

The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35.

Traggo server v0.8.3 is vulnerable to an unauthenticated Denial of Service due to a lack of complexity and size limits on the /graphql endpoint, allowing attackers to exhaust CPU and memory resources.

CVE-2022-22947 is a critical remote code execution vulnerability in Spring Cloud Gateway allowing attackers to execute arbitrary code via malicious SpEL expressions injected into dynamic route configurations.

An out-of-bounds write vulnerability in Apple's AVEVideoEncoder component allows for kernel-level denials of service through specifically crafted high-resolution H.264 compression sessions.

The Gravity Forms plugin for WordPress (all versions up to, and including, 3.1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the List Field due to insufficient input sanitization and output escaping.

The Food Store WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting via the service_time parameter in versions up to 1.5.5, allowing attackers to inject malicious scripts into administrative or user-facing pages.

Cisco patched an actively exploited logic vulnerability (CVE-2026-76418) in the SSL VPN service of ASA and FTD software that allows unauthenticated attackers to trigger a device reload and denial-of-service condition.

VAPOR PANDA is conducting a large-scale global espionage campaign using the AI agent framework ARTEX to automate parallel intrusions against government, defense, and technology sectors.

An unauthenticated remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server <= 7.4.3 allows attackers to execute arbitrary code via Lua injection into session files by leveraging a NULL byte truncation flaw in username handling.