Threat briefs

GitPython versions up to 3.1.59 are vulnerable to an arbitrary code execution flaw where malicious tracked repository content is misidentified as a Git directory, causing hooks to execute during standard repository operations.

A vulnerability in the @astrojs/node adapter, identified as CVE-2026-102984, allows remote attackers to trigger a process crash by sending HTTP requests with malformed Host headers.

A vulnerability in Fastify's request validation logic (CVE-2026-84504) allows attackers to perform request body replacement when using $async JSON schema validators, leading to potential unauthorized state changes or data disclosure.

A path traversal vulnerability in Tornado's StaticFileHandler allows unauthenticated remote attackers to read arbitrary files via symbolic links within the static root directory.

A stored cross-site scripting (XSS) vulnerability in the CommonsMetadata component, tracked as CVE-2026-103584, allows attackers to inject 'javascript:' URIs into image metadata, leading to unauthorized script execution in the wiki origin.

A server-side request forgery vulnerability in decolua 9Router versions up to 0.5.55 allows remote attackers to manipulate the provider_options.baseUrl argument to trigger unauthorized requests.

DeepWiki-Open through commit d92819a is vulnerable to an unauthenticated arbitrary file read via the repo_url parameter in the GET /codemap/file endpoint.

An unauthenticated arbitrary file read vulnerability (CVE-2024-58387) in Inspur Haiyue HCM Cloud allows remote attackers to disclose sensitive system files via the /api/model_report/file/download endpoint.

An unauthenticated arbitrary file read vulnerability (CVE-2023-54403) in Yonyou U8 CRM allows attackers to bypass authentication and access sensitive files on the host server.

The iDocView /doc/upload endpoint is susceptible to unauthenticated server-side request forgery (SSRF), allowing remote attackers to read sensitive local files and scan internal network infrastructure.

ZeroClaw versions before 0.8.5 are vulnerable to path traversal via the plugins-wasm feature, allowing attackers to overwrite arbitrary files through crafted plugin manifest files.

An incorrect authorization vulnerability in OpenClaw Windows Node version < 2026.7.1 allows unauthenticated agents to achieve arbitrary command execution by bypassing command approval policies.

Attackers are actively exploiting an unauthenticated API authentication bypass vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager to gain administrative control via URL-encoded HTTP requests.

A stored XSS vulnerability in the PageForms extension allows attackers with page-edit permissions to inject malicious javascript: URIs via the redirect parameter.

Versions of yii2-starter-kit up to 4.2.0 are vulnerable to unauthorized access due to insecure default configurations allowing remote attackers to access debugging and code generation modules.

Deno versions 2.7.0 through 2.9.7 on Windows are vulnerable to command injection in the node:child_process module due to improper shell argument escaping.

The restbed framework through version 5.0.0 is vulnerable to memory exhaustion due to the lack of a maximum size limit on incoming HTTP request headers.

An authorization bypass vulnerability in MediaWiki's RevisionDelete API allows users with limited privileges to remove suppression bits, exposing protected content due to improper permission validation.

The Restaurant-Management-System contains a remote SQL injection vulnerability in the admin/delete1.php script, allowing unauthenticated attackers to manipulate the ID parameter.

MediaWiki is susceptible to an information disclosure flaw where the RESTBase-compatible API exposes the numeric user ID of hidden revision authors, allowing unauthenticated attackers to map IDs to usernames.

An improper handling of absolute-form HTTP request targets in @nestjs/platform-fastify allows attackers to bypass path-scoped middleware by inducing a path resolution mismatch between the router and the middleware layer.

urllib3 versions 1.26.0 through 2.7.0 fail to properly isolate TLS configurations between HTTPS proxies and target servers, enabling potential man-in-the-middle attacks through certificate verification bypass or credential exposure.

Axios versions prior to 1.20.0 are vulnerable to a denial-of-service condition where unhandled 'error' events on ClientHttp2Session objects cause the parent Node.js process to terminate.

The Axios fetch adapter fails to enforce the maxRedirects: 0 configuration, enabling redirect-based SSRF by allowing requests to follow unexpected internal redirects.

The @grpc/grpc-js library contains an authentication bypass vulnerability (CVE-2026-101916) where unauthorized client certificates may be treated as authorized when requireClientCertificate is disabled.

An unauthenticated remote attacker can cause denial of service by submitting large Markdown paragraphs that trigger O(M^2) CPU consumption in the league/commonmark TableStartParser.

A vulnerability in jackson-databind allows unauthenticated attackers to cause CPU exhaustion and denial of service by supplying specially crafted strings that bypass length constraints during XML datatype deserialization.

A high-severity denial of service vulnerability in @angular/router enables memory exhaustion in Node.js SSR environments through crafted URLs with numeric matrix parameters that trigger oversized V8 object allocation.

A vulnerability in Ollama (CVE-2024-37032) allows a remote, unauthenticated attacker to execute arbitrary code via insufficiently validated API requests.

A vulnerability in OPNsense allows a remote, authenticated attacker to bypass established security measures, potentially leading to unauthorized configuration changes or administrative access.