Threat briefs

Threat actors achieve persistence on macOS by injecting curl commands into shell profile scripts to execute malicious payloads automatically upon user login or terminal initialization.

This brief addresses the detection of unauthorized shared object (.so) file creation in sensitive system directories, a technique commonly used by attackers for persistence and code injection on Linux systems.

Adversaries are exploiting Linux-based Java applications to establish remote shells by spawning command-line interpreters following inbound network connections.

A remote attacker can exploit a critical vulnerability, CVE-2026-61500, in Rejetto HFS versions 3.0.0 through 3.2.0 by recovering the session-cookie signing key due to poor randomness, forging an administrator session, and achieving remote code execution.

An unauthenticated server-side request forgery (SSRF) vulnerability in feelcrm-os 1.0.0 allows remote attackers to force the server to perform unauthorized HTTP requests by manipulating the url parameter.

The Totolink A3002MU router (v1.0.0-B20230403.1455) contains a critical authentication bypass vulnerability in the /bin/boa web server component, allowing remote unauthenticated access.

The itsourcecode Online Admission System Project 1.0 contains an unauthenticated SQL injection vulnerability in the login interface, allowing remote attackers to manipulate database queries.

A server-side request forgery vulnerability in ChatGPTNextWeb NextChat up to version 2.16.1 allows remote attackers to manipulate the x-base-url header to perform unauthorized requests from the application server.

CVE-2026-105172 is a remote SQL injection vulnerability in itsourcecode Online Admission System 1.0, reachable via the User parameter in /login1.php, for which public exploit code is available.

The alexpechkarev/google-maps Laravel package up to version 12.16 disables TLS certificate verification, allowing on-path attackers to perform man-in-the-middle attacks to intercept API keys and tamper with traffic.

Legcord versions 1.1.0 through 1.3.0 contain a path traversal vulnerability in IPC handlers that allows arbitrary file system manipulation and command execution when triggered via cross-origin script injection.

The maclof kubernetes-client library versions 0.17.0 through 0.31.x fails to verify TLS certificates during kubeconfig parsing, enabling on-path attackers to perform MitM attacks to intercept credentials.

The Drug Recommendation System 1.0 contains a SQL injection vulnerability in the 'cmdschool' parameter of the student registration module, allowing unauthenticated remote attackers to execute arbitrary database queries.

An improper access control vulnerability in Langfuse allows unauthenticated attackers to hijack Slack integrations and exfiltrate sensitive project prompt data via the /api/public/slack/install endpoint.

An unauthenticated SQL injection vulnerability in the 'fooddonateform.php' component of the food-waste-management-system allows remote attackers to execute arbitrary database commands via the 'image-choice' argument.

The gist RubyGem versions prior to 6.1.0 contain an improper certificate validation vulnerability that allows on-path attackers to intercept and modify GitHub API traffic by exploiting the hardcoded use of OpenSSL::SSL::VERIFY_NONE.

Twine 2 desktop versions through 2.12.0 contain a cross-site scripting flaw in the importStories function that can be leveraged via an IPC bridge to achieve arbitrary code execution.

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 are vulnerable to an authentication bypass via the AddIDPLink endpoint, allowing unauthenticated attackers to link malicious external IdP identities to victim accounts.

An unauthenticated remote code execution vulnerability in the Hummingbird WordPress plugin allows attackers to inject and execute arbitrary PHP code via unsanitized cookie headers in the debug log.

The gopay library versions prior to 1.5.119 contain a flaw in defaultClient() that disables TLS certificate verification, enabling man-in-the-middle attacks to intercept sensitive payment data.

The go-micro library versions prior to 6.0.0 insecurely configure TLS validation by default, enabling man-in-the-middle attacks to intercept traffic and harvest credentials.

WWBN AVideo versions 12.4 through 29.2.0 are vulnerable to stored cross-site scripting (XSS) due to improper sanitization of doubly-encoded HTML entities in video titles, allowing authenticated attackers to execute arbitrary scripts in the context of gallery and playlist pages.

RainyGao DocSys versions up to 2.02.85 contain a remote SQL injection vulnerability in the Database Management component, allowing unauthenticated attackers to execute arbitrary SQL commands via the url argument.

mooSocial versions up to 3.2.4 are vulnerable to remote SQL injection via the rating argument in the /stores/all-products endpoint, with public exploit code currently available.

SciPhi-AI R2R versions up to 3.6.6 contain a vulnerability in the JWT Secret Handler component that uses hard-coded credentials, allowing remote attackers to bypass authentication.

Beaver Builder Page Builder for WordPress (<= 2.11.0.5) is vulnerable to unauthenticated arbitrary shortcode execution via improper input validation in the Sidebar module.

InternLM MindSearch version 0.1.0 is vulnerable to remote code injection via the ExecutionAction.run function, allowing attackers to execute arbitrary code on the host system.

W CMS versions 3.18.0 and earlier are vulnerable to remote code execution and arbitrary file deletion due to insufficient path validation in the media management API.

CVE-2025-10502 is a heap buffer overflow vulnerability in the Chromium ANGLE graphics engine that could allow an attacker to trigger memory corruption or achieve arbitrary code execution via a malicious webpage.

LaraDashboard versions prior to 1.4.8 contain an improper privilege management flaw that allows authenticated Admin users to escalate privileges to Superadmin, potentially leading to remote code execution.