Threat briefs

An SQL injection vulnerability (CVE-2026-85215) in GG Soft Software Services Inc. Paperwork allows unauthenticated attackers to execute arbitrary SQL commands, risking unauthorized data access and modification.

Zebra versions prior to 6.0.0 are vulnerable to an unauthenticated denial-of-service attack via the submission of non-standard high-sigop P2SH transactions that exhaust system resources.

Unauthenticated remote peers can exploit a vulnerability in Zebrad versions prior to 6.2.1 by submitting mempool transactions with invalid Halo2 proofs, leading to a denial-of-service condition.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

The Divi Membership plugin for WordPress contains an unauthenticated privilege escalation vulnerability (CVE-2026-19652) allowing attackers to register as administrators through improper input validation.

Multiple vulnerabilities within the KDE desktop environment components Dolphin and KShell allow an attacker to execute arbitrary code, compromising the integrity of affected Linux desktop systems.

Multiple vulnerabilities in Wind River VxWorks 7 allow a local attacker to perform denial-of-service attacks, potentially execute arbitrary code, and disclose or manipulate sensitive data.

BigBlueButton contains multiple vulnerabilities that allow a remote attacker to achieve arbitrary code execution, information disclosure, data manipulation, and cross-site scripting (XSS) attacks.

HCL BigFix is affected by multiple security vulnerabilities (CVE-2024-22248, CVE-2024-22249, CVE-2024-22250, CVE-2024-22251, CVE-2024-22252) that could allow a remote attacker to conduct cross-site scripting (XSS), disclose sensitive information, or manipulate data.

Multiple vulnerabilities in CODESYS Control Runtime and Gateway Client allow a remote attacker to manipulate data or cause a denial-of-service condition.

An authenticated, low-privileged attacker can achieve remote code execution in Foreman by bypassing the templating engine's safemode sandbox to invoke unauthorized functions.

A vulnerability in OpenCTI allows a remote, authenticated attacker to escalate their privileges to administrator level.

A missing authentication vulnerability in the WatchGuard Endpoint Security kernel memory access driver allows local attackers to perform arbitrary kernel memory access, potentially facilitating privilege escalation.

CloudSyncD is a persistent macOS backdoor delivered through a social engineering campaign involving a trojanized Zoom installer that leverages user-provided credentials for privilege escalation.

An unauthenticated authorization bypass vulnerability in WPMobile.App (<= 11.82) allows attackers to exfiltrate password-reset URLs via the mail-to-push feature and perform account takeover.

An authentication bypass vulnerability in the YesWiki triples delete API allows authenticated users to delete arbitrary semantic triples, potentially resulting in site-wide denial of service.

An incorrect signature operation count in Zebra zebrad 4.5.0 and zebra-script 7.0.0 causes consensus divergence when processing specific P2SH multisig transactions, potentially leading to a denial-of-service condition for affected nodes.

An unvalidated coinbase height input in Zebra prior to 6.3.0 allows malicious peers to induce synchronization stalls and prevent nodes from reaching the latest chain tip.

An SQL injection vulnerability (CVE-2026-80298) in HAVELSAN Sef - AI Chatbot Platform versions before 2.1 allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

Detection of potentially unauthorized process execution using the Microsoft-signed Windows Performance Toolkit utility XBootMgrSleep.exe to bypass security controls.

Laranode versions prior to 1.2.1 are vulnerable to a path traversal attack via the /filemanager/upload-file endpoint, allowing authenticated users to achieve arbitrary file write and remote code execution.

PictShare versions prior to 3.7.1 are vulnerable to an unauthenticated information disclosure flaw in the API::info() endpoint, allowing attackers to retrieve sensitive metadata and delete arbitrary files.

PictShare versions prior to 3.7.1 contain a vulnerability where insecure PRNG usage for delete_code generation allows unauthenticated attackers to delete arbitrary files from hosted instances.

Threat actors may rename the legitimate schtasks.exe Windows utility to evade security monitoring while establishing persistence or executing tasks.

The W3 Total Cache plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-87920, allowing unauthenticated attackers to execute arbitrary web scripts via flawed Output-Buffer Regex rewriting.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of the Comment Author Name, allowing unauthenticated attackers to execute arbitrary scripts.

The CMB2 plugin for WordPress (<= 2.13.0) is vulnerable to Stored XSS via the file_list field type, allowing unauthenticated attackers to inject malicious scripts into public-facing forms or user meta boxes.

The GSpeech TTS plugin for WordPress (<= 3.22.0) is vulnerable to Stored Cross-Site Scripting via improper input sanitization and output-buffer manipulation, allowing unauthenticated attackers to execute arbitrary JavaScript.

The MW WP Form WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the 'post_id' parameter, enabling unauthenticated attackers to bypass CSRF protections and execute arbitrary scripts in victim sessions.

Adversaries can gain persistence and perform proxy execution by modifying the WSL InstallLocation registry key to redirect binary execution to malicious payloads.