Threat briefs

The probe-image-size package is vulnerable to a denial-of-service attack due to a regular expression exhibiting quadratic time complexity when processing maliciously crafted SVG payloads.

The @a2ui/web_core package (CVE-2026-10032) contains a critical cross-site scripting (XSS) vulnerability in the openUrl function, allowing arbitrary JavaScript execution via agent-supplied javascript: URIs.

An improper sanitization vulnerability in Gitea act_runner allows attackers to inject malicious Docker CLI flags into workflow container configurations, leading to full container escape and root-level command execution on the host.

An unauthenticated privilege escalation vulnerability (CVE-2026-15989) in the Super Forms WordPress plugin allows attackers to register administrative accounts via registration form injection.

The adm-zip Node.js library fails to filter SUID/SGID bits when extracting ZIP archives with 'keepOriginalPermission' enabled, allowing for root-level privilege escalation when archives are extracted by privileged processes.

Formwork prior to version 2.3.13 contains a path traversal vulnerability in the BackupController component allowing authenticated users to read or delete arbitrary files via base64-encoded payloads.

An untrusted pointer dereference vulnerability (CVE-2026-103764) in the Mooncake transfer engine allows unauthenticated attackers to perform arbitrary memory reads and writes, potentially leading to remote code execution.

Moxa has disclosed two critical vulnerabilities, CVE-2026-86325 and CVE-2026-86326, affecting MGate 3000 and 5000 series protocol gateways.

An authenticated user can configure malicious webhook endpoints in Trigger.dev (< 4.5.2) to perform server-side request forgery (SSRF) against internal services and cloud metadata endpoints.

An infinite loop vulnerability in the figlet Node.js library, tracked as CVE-2026-96780, allows unauthenticated attackers to exhaust CPU and memory resources if they can influence the 'width' parameter in applications using 'whitespaceBreak: true'.

Vibe-Trading-AI versions 0.1.0 through 0.1.6 contain path traversal vulnerabilities allowing unauthenticated attackers to read arbitrary files from the container filesystem due to overly permissive sandbox checks and a missing security envelope.

Multiple unauthenticated RCE and SSRF primitives in Vibe-Trading's LLM-callable tool registry allow remote attackers to achieve root-level code execution and internal network scanning.

Vibe-Trading v0.1.6 contains multiple critical vulnerabilities, including unauthenticated API access, unrestricted file uploads, and a command injection chain leading to container-level RCE when the API_AUTH_KEY is unset.

UTMStack versions prior to 11.2.16 are vulnerable to an authenticated SQL injection in the UtmAssetGroupService, allowing attackers to execute arbitrary commands with DBA privileges.

An authentication bypass vulnerability in the Dogtag PKI CMCAuthForEST plugin allows authenticated users to obtain CA-signed certificates with arbitrary subject names due to improper session attribute handling during EST fullcmc requests.

CVE-2025-22131 is a stored cross-site scripting vulnerability in PHPOffice PhpSpreadsheet caused by improper sanitization of XLSX sheet names in navigation HTML, allowing for session cookie theft.

Phproject versions before 1.8.7 contain a missing object-level authorization vulnerability in REST API issue endpoints that allows authenticated attackers to bypass security restrictions.

Weaver e-Bridge contains an unauthenticated arbitrary file read and SSRF vulnerability in the saveYZJFile endpoint, enabling attackers to access sensitive system files or scan internal network resources.

The CodeArt Google MP3 Audio Player plugin for WordPress contains an unauthenticated path-traversal vulnerability in direct_download.php that allows remote attackers to read sensitive configuration files.

H3C CAS CVM contains an unauthenticated arbitrary file upload vulnerability via path traversal, allowing remote attackers to achieve remote code execution by uploading malicious JSP files.

Copernik XML Factory versions prior to 0.1.2 fail to restrict XInclude resource resolution when using the stock JDK provider, enabling local file disclosure or SSRF via malicious XML inputs.

The Dulwich library stash pop implementation fails to validate symlinks, allowing attackers to write arbitrary files outside the repository worktree and achieve remote code execution.

The Dulwich Git library for Python fails to validate DOS drive letter prefixes on Windows, allowing a malicious Git repository to write files to arbitrary locations outside the designated worktree.

Multiple security vulnerabilities in Apache HTTP Server versions prior to 2.4.69 allow for remote code execution, denial of service, and data integrity compromise.

China-nexus threat actor UAT-11587 is conducting long-term cyber espionage across Asia using the custom Rust-based Antino backdoor and Microsoft 365 services for command-and-control.

CVE-2024-45440 is a full path disclosure vulnerability in Drupal 11.x-dev allowing unauthenticated attackers to leak server-side filesystem paths via the authorize.php endpoint.

A local privilege escalation vulnerability in Ivanti EPMM, tracked as CVE-2024-22026, allows an authenticated local attacker to achieve root access by installing unsigned RPM packages via the CLI 'install rpm url' command.

A critical buffer overflow vulnerability (CVE-2026-18397) in the Thales SConnect browser extension allows unauthenticated attackers to achieve remote code execution through malicious drive-by web pages.

A vulnerability in xdg-dbus-proxy versions prior to 0.1.9 allows a compromised Flatpak application to bypass security filters and escape the sandbox via malformed D-Bus reply serials.

An unauthenticated stored XSS vulnerability in the JetAppointment WordPress plugin allows attackers to inject malicious scripts via the friendlyTime parameter that execute in an administrator's browser context.