Threat briefs

Purchase Order Management System (POMS) version 1.0 is vulnerable to unauthenticated SQL injection via the password parameter, allowing for exfiltration or out-of-band communication via the MySQL load_file function.

An authorization bypass vulnerability in the Krayin laravel-crm CanInstall middleware allows remote attackers to manipulate the admin-config-setup endpoint to circumvent security controls.

Attackers are abusing legitimate Remote Monitoring and Management (RMM) tools by masquerading them as documents or unrelated software lures to establish unauthorized remote access on Windows endpoints.

Adversaries are actively abusing legitimate, digitally signed remote monitoring and management (RMM) software, often delivered via public cloud storage or file-sharing services, to maintain persistent command-and-control access in Windows environments.

Attackers utilize curl or wget within the ESXi shell to download malicious payloads and scripts for hypervisor exploitation, a common precursor to ransomware deployment.

Obot versions up to commit d7e6970 contain a default configuration vulnerability that exposes the application with administrative privileges and Docker socket access to unauthenticated network actors.

Budibase versions prior to 3.45.0 contain an arbitrary file read vulnerability caused by enabled external JSON reference resolution during OpenAPI/Swagger file imports.

A filter injection vulnerability in the n8n Supabase node (CVE-2026-103248) allows attackers to perform unauthorized data exfiltration, modification, or deletion by injecting malicious filter expressions.

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that allows unauthenticated attackers to spoof iOS or iPadOS devices using predictable identifiers.

Ground-station versions prior to 0.8.0 are susceptible to an authentication bypass vulnerability in the setup.restore command, allowing unauthenticated attackers to execute arbitrary SQL, inject admin users, and achieve full application takeover.

A path traversal and arbitrary file write vulnerability in Red Hat's oc-mirror utility allows attackers to write files outside the intended destination directory during catalog image extraction.

The Forminator Forms plugin for WordPress is vulnerable to Stored XSS via the 'postdata-1[post-custom]' parameter in versions 1.57.2 and below, allowing unauthenticated attackers to execute arbitrary scripts.

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the gateway field.

The Form Maker by 10Web WordPress plugin contains a stored cross-site scripting vulnerability in longitude and latitude fields that allows unauthenticated attackers to execute arbitrary scripts in the context of other users.

The Appointment Hour Booking plugin for WordPress is vulnerable to Stored DOM-based XSS via the Schedule Calendar List Renderer due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts.

An improper role validation vulnerability in the WPC Shop as a Customer for WooCommerce plugin allows authenticated attackers to perform account takeover and gain administrative access via the wpcsa_login endpoint.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via billing fields, allowing unauthenticated attackers to execute arbitrary scripts in administrative sessions.

The Autoptimize WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the REQUEST_URI path, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

An unauthenticated remote attacker can exploit a path traversal vulnerability in Cimetrics BACstac to read or overwrite arbitrary files via maliciously crafted BACnet File Object names.

China-aligned actor TA419 is conducting targeted, long-tail credential phishing campaigns against US and Japanese AI policy and national security experts using AitM techniques and a custom Frameless BitB toolkit to capture MFA-protected Microsoft 365 sessions.

An unauthenticated IDOR vulnerability in the LearnPress WordPress plugin allows unauthorized access to private course materials by manipulating the course and item identifiers in AJAX requests.

The ByteCoreStack MCP Connector for AI Tools plugin for WordPress is vulnerable to privilege escalation via insufficient meta key validation, allowing Subscriber-level users to escalate to Administrator.

An authentication bypass vulnerability in The Ultimate Multisite plugin allows unauthenticated attackers to log in as any WordPress user, including administrators, by manipulating the AJAX checkout process.

The Extendify plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'styles.blocks' parameter, allowing arbitrary script injection.

ZongXR Supermarket version 1.0.0.0 contains an authentication bypass vulnerability in the OrderController.addOrder function, enabling remote unauthorized order manipulation via the userId parameter.

The LatePoint WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution due to improper input validation during the booking flow.

An unauthenticated remote code execution vulnerability in Fuel CMS (CVE-2018-16763) allows attackers to inject and execute arbitrary PHP code via the filter parameter, leading to full system compromise.

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to achieve arbitrary script execution in an administrator's browser session.

Adversaries leverage legitimate Microsoft Defender Antivirus exclusion settings via PowerShell, WMI, and GPO to bypass real-time scanning and hide malicious payloads from endpoint detection.

The russh library fails to validate SSH channel IDs for client-side message callbacks, allowing a malicious SSH server to trigger application-level logic errors or denial-of-service via spoofed channel lifecycle events.