Advisory

An integer overflow vulnerability in the GIMP file-pvr plug-in allows heap-based buffer overflow via malicious .pvr files, potentially leading to arbitrary code execution or application crashes.

An integer overflow vulnerability (CVE-2026-102834) in JavaCV's IPCameraFrameGrabber allows a network attacker to cause a permanent CPU-spinning denial-of-service by sending a crafted HTTP Content-Length header.

The lopdf Rust library is vulnerable to stack exhaustion via unbounded recursion when parsing deeply nested PDF objects, allowing unauthenticated attackers to cause a denial-of-service via SIGABRT.

A nil-pointer dereference vulnerability (CVE-2026-100349) in kin-openapi causes a process crash when validating response headers that declare 'content' instead of 'schema'.

An authorization flaw in the Arcane user management API allows users with the 'users:update' permission to overwrite administrative credentials and hijack global administrator accounts.

The Claude Agent SDK for Python fails to validate the resume option, enabling an argument injection attack that allows arbitrary command execution via unauthorized MCP server configurations.

LMCache versions 0.3.9 through 0.5.5 are vulnerable to unauthenticated remote code execution due to insecure pickle deserialization within the multiprocess ZeroMQ transport layer.

CVE-2026-59963 allows an authenticated user to bypass object-level authorization and access, share, or exfiltrate private recipes via utility API endpoints.

Authenticated users can exploit a blind Server-Side Request Forgery vulnerability in Tandoor Recipes versions prior to 2.6.10 by manipulating AI provider URL inputs to map internal network resources.

An authenticated OS command injection vulnerability (CVE-2026-102608) in ZoneMinder versions prior to 1.38.3 allows remote code execution via unsanitized monitor names during event export operations.

An unauthenticated remote code execution vulnerability (CVE-2023-4634) in the WordPress Media Library Assistant plugin versions before 3.10 allows attackers to leverage Imagick processing for arbitrary code execution.

An unauthenticated arbitrary file read vulnerability (CVE-2025-10952) in the ml-logger stream_handler allows remote attackers to enumerate and exfiltrate sensitive files from the host filesystem.

LingGuo-Drama through commit 8a6924a is vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing unauthorized access, modification, and deletion of user projects.

99AI versions 4.3.0 and earlier contain a missing authentication vulnerability in the /api/chatLog/exportExcel endpoint, enabling unauthenticated attackers to exfiltrate sensitive user chat logs.

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to access private knowledge bases by enumerating sequential ID values.

Authenticated users can exploit an SQL injection vulnerability in the WebVella ERP EQL query API to exfiltrate sensitive data from user and role tables.

An IDOR vulnerability in Shaiwz data-platform-open allows authenticated users to access, enumerate, and modify foreign workspace datasources by manipulating numeric IDs in API requests.

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows unauthorized tenants to escalate privileges and access sensitive financial data by forging the unsigned X-USERINFO header.

Magistrala through version 1.0.0 contains an authorization bypass flaw allowing authenticated workspace members to perform unauthorized certificate operations across different tenants.

APIPark versions through 1.9.7-beta are vulnerable to an authorization bypass allowing authenticated team managers to manipulate team IDs to access, modify, or delete resources belonging to other teams.

Course-tencent-cloud through version 2.0.1 contains an authentication bypass vulnerability allowing attackers to brute force 6-digit verification codes due to a lack of rate limiting or invalidation.

An insecure direct object reference vulnerability in Cube-studio versions through 2026.09.01 allows authenticated users to perform unauthorized administrative actions on notebooks and services via sequential ID manipulation.

Chaskiq version 2.0.3 and earlier contains a server-side request forgery vulnerability in the createUrlUpload GraphQL mutation, allowing unauthenticated attackers to access internal resources including cloud metadata services.

ChronoFrame versions 1.0.0 and earlier are vulnerable to a missing authentication flaw in API handlers, allowing unauthenticated attackers to reconfigure instance storage and site settings.

The bbs-go application up to version 4.4.6 is vulnerable to an authentication bypass via the /api/login/google_one_tap endpoint due to missing validation of the Google ID token audience claim.

An authorization vulnerability in the sshportal management shell allows authenticated non-admin users to retrieve decrypted backend private SSH keys and bypass access controls.

OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass vulnerability allowing attackers to forge administrator session tokens via a hard-coded app_secret.

Helical Insight versions through 7.0.0 contain an authenticated SQL injection vulnerability in the /executeDatasource endpoint that allows attackers to manipulate backend database queries.

ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.

HestiaCP versions prior to 1.10.5 contain an authorization bypass vulnerability allowing non-privileged administrators to impersonate the ROOT_USER and execute arbitrary cron tasks.

AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.

The netdisk-fast-download package through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt cloud-drive credentials via a hard-coded AES key.

An insecure direct object reference vulnerability in Jeepay versions 3.2.9 and earlier allows authenticated merchant users to overwrite arbitrary payment channel configurations, enabling payment redirection or service disruption.

Huly Platform versions through 0.7.432 contain a missing authorization vulnerability in the mergeSpecifiedPersons RPC, enabling authenticated account takeover.

Jpom versions through 2.11.12 contain an authorization bypass vulnerability allowing authenticated users to perform unauthorized file operations on SSH hosts across different workspaces.

Netcore NR256CN routers up to version 1.5.140116 are vulnerable to a pre-authentication stack buffer overflow in the Boa web server's user_ok() function, allowing remote code execution or denial-of-service.

WhaTicket Community through commit cf04795 is vulnerable to an authentication bypass via the /auth/signup endpoint, allowing unauthenticated attackers to self-register with administrator privileges.

A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.

An unauthenticated authentication bypass vulnerability (CVE-2026-111692) in DataBuff ai-apm-web allows attackers to forge administrative session tokens using a hardcoded HMAC secret.

Simple Admin Core versions up to 1.8.7 contain a critical authentication bypass vulnerability allowing attackers to forge administrative JWTs using a hard-coded secret.

WeRSS version 1.5.3 and earlier contains a remote code execution vulnerability allowing unauthenticated attackers to bypass eval denylists via template parameters.

IceCMS versions through 4.1.5 contain a missing authentication vulnerability allowing unauthenticated attackers to perform full account takeover via the /User/updateUser API endpoint.

Misaka Danmu Server versions 2.8.9 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to modify sensitive configuration keys via the /api/ui/config-history/rollback endpoint.

FastapiAdmin versions through 3.0 contain an authentication bypass vulnerability allowing unauthenticated attackers to obtain superuser sessions via unprotected auto-login endpoints.

Webreaper Damselfly versions 4.5.3 and earlier contain an authentication bypass vulnerability in API routes that allows unauthenticated attackers to escalate privileges and perform administrative actions.

Moxa has disclosed two critical vulnerabilities, CVE-2026-109812 and CVE-2026-109813, affecting the AIG-302 industrial computing series firmware version 1.4.1 and earlier.

Google Chrome contains multiple vulnerabilities that can be exploited by a remote, anonymous attacker to achieve arbitrary code execution or cause a denial-of-service condition.

A vulnerability in Matomo allows a remote, authenticated attacker to disclose sensitive information, potentially leading to unauthorized data exposure.

A vulnerability in Nutanix AOS and Nutanix Prism Central allows a remote, unauthenticated attacker to bypass security controls and execute arbitrary code with administrative privileges.

Devolutions Server contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security controls, perform information disclosure, and escalate privileges.

Multiple vulnerabilities in Red Hat OpenShift and RHEL, involving Quarkus and Netty components, enable remote attackers to perform information disclosure or trigger denial-of-service conditions.

A vulnerability in FasterXML Jackson allows a remote, unauthenticated attacker to trigger a denial of service (DoS) condition in applications using the library for data processing.

Apache Airflow is affected by multiple vulnerabilities that could allow an attacker to bypass security measures or perform unauthorized information disclosure.

A high volume of failed tool invocations against an AWS Bedrock AgentCore Gateway may indicate an adversary attempting to discover injection points or authorization bypasses within AI agent infrastructure.

This threat brief details the detection of shell or scripting interpreters spawned by processes containing LLM prompt-injection or jailbreak language, which attackers use to coerce GenAI agents into executing malicious commands.

This threat brief details the potential for unauthorized data collection via Model Context Protocol (MCP) tools within OpenAI ChatGPT Enterprise, where attackers may leverage new or unusual connectors to exfiltrate organizational data from internal repositories.

Cisco AI Defense alerts indicate potential iterative prompt injection or unauthorized data exfiltration attempts against generative AI applications, characterized by bursts of high-risk guardrail violations.

Cisco AI Defense alerts indicate that generative AI applications have bypassed privacy guardrails, resulting in the exposure of personally identifiable information or payment card information in allowed responses.

Apache Camel's camel-ftp component contains a path traversal vulnerability (CVE-2026-79983) allowing unauthorized file operations outside the intended directory via malicious server-supplied file listings.

The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

An authenticated attacker can trigger a heap-based buffer overflow in spice-server during VM live migration by exploiting an integer truncation vulnerability in the GLZ encoder dictionary restore path.

An unauthenticated stored XSS vulnerability in GoSMTP Pro (<= 1.2.3) allows attackers to inject arbitrary web scripts via email log body content.

The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.

An observable response discrepancy vulnerability (CVE-2026-14177) in Ikas E-Commerce Infrastructure allows unauthorized actors to perform account footprinting by analyzing varying platform responses.

An arbitrary file upload vulnerability in the DoubleScale CRM plugin for WordPress up to version 1.5.1 allows authenticated subscribers to achieve remote code execution when the Helpdesk module is enabled.

The SureCart plugin for WordPress (<= 4.9.4) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victims viewing specific e-commerce pages.

An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.

An authentication bypass vulnerability (CVE-2026-75903) in the Vulnity Security plugin for WordPress allows unauthenticated attackers to retrieve credentials and gain administrative access via misconfigured Nginx path restrictions.

The WPConsent WordPress plugin up to version 1.1.9 is vulnerable to stored Cross-Site Scripting (XSS) via mXSS, allowing unauthenticated attackers to execute arbitrary scripts in a user's browser session.

The YaySMTP WordPress plugin (<= 2.7.7) is vulnerable to arbitrary file upload due to insufficient validation in the putFile function, allowing authenticated users to achieve remote code execution.

Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.

The CP Multi View Events Calendar plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the CalendarTitle parameter.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Search Regex WordPress plugin version 3.5 is vulnerable to PHP Object Injection, allowing authenticated users with subscriber access to achieve remote code execution via a POP chain.

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthenticated PHP object injection in versions up to 3.7.4, which can be leveraged for RCE if secondary plugins provide a viable POP chain.

An unauthenticated account takeover vulnerability in the Theme My Login WordPress plugin allows attackers to change arbitrary user passwords due to improper identity validation.

The Schema & Structured Data for WP & AMP plugin is vulnerable to unauthenticated stored XSS via the 'saswp_review_text' parameter due to insufficient input sanitization and an exposed, ineffective nonce.

An unauthenticated stored DOM-based XSS vulnerability (CVE-2026-95686) in the Opti-Behavior plugin for WordPress allows attackers to inject malicious scripts via a publicly accessible nonce-protected ingest endpoint.

Unauthenticated attackers can exploit insufficient input sanitization in the Hide My WP Ghost plugin to inject persistent malicious scripts into WordPress pages.

The PilotPress WordPress plugin (<= 2.0.43) contains a logic flaw in the update_cc_details() AJAX handler that allows an authenticated attacker to trigger an administrative account takeover.

The NotificationX plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the name parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

An unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (<= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.

The User Profile Builder plugin for WordPress is vulnerable to unauthenticated stored XSS in the 'First Name' field when Email Confirmation is enabled, allowing script injection into user profiles.

The Nexter Extension plugin for WordPress is vulnerable to privilege escalation (CVE-2026-111114) allowing authenticated users to restore elevated roles due to improper state cleanup during bulk demotions.

An authorization bypass vulnerability in the Klarna for WooCommerce plugin allows unauthenticated attackers to enumerate store orders and exfiltrate customer PII via the order-pay endpoint.

The InstaWP Connect plugin for WordPress, versions 0.1.4.1 and earlier, contains a privilege escalation vulnerability allowing authenticated users to extract the master API key and mint administrator session tokens.

The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.

The Modula Image Gallery plugin for WordPress is vulnerable to unauthenticated information exposure via the REST API, allowing attackers to retrieve plaintext credentials for password-protected galleries.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.

The FluentCart plugin for WordPress up to version 1.7.0 contains an IDOR vulnerability allowing unauthenticated attackers to exfiltrate customer billing and shipping PII via sequential ID enumeration.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to unauthenticated arbitrary file upload in the initMailPart function, potentially leading to remote code execution.

The MailOptin WordPress plugin contains a vulnerability in the subscribe_to_email_list endpoint that allows unauthenticated attackers to overwrite arbitrary user accounts, including administrators, via insecure parameter handling.

An arbitrary file upload vulnerability in the Mang Board plugin for WordPress allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.

The My Calendar WordPress plugin is vulnerable to unauthenticated privilege escalation via a reflected GET parameter that triggers arbitrary function calls, allowing attackers to overwrite administrator credentials.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.

The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.

An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

An unauthenticated stored XSS vulnerability in the Colibri Page Builder plugin for WordPress allows attackers to inject malicious scripts via the comment parameter that execute in the context of user browsers.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.

Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.

An authenticated user with the Monitor role in WildFly can exploit a path traversal vulnerability in the take-snapshot operation to perform unauthorized reads of sensitive configuration files.

A local improper authorization vulnerability in Lenovo Baiying PC Client allows an authenticated user to achieve privilege escalation through arbitrary code execution.

A vulnerability in the Lenovo Legion Zone application allows an attacker on the same logical network to execute arbitrary code on the host system.

A Server-Side Request Forgery (SSRF) vulnerability in the bitcoinj Payment Request Handler component allows remote attackers to perform unauthorized requests via manipulation of the pki_type argument.

A local privilege escalation vulnerability in cifs-utils (CVE-2026-104715) allows unprivileged users to gain root access by injecting malicious mount options into a user-controlled credentials file used by mount.cifs.

ClassroomIO versions 1.0.0 and earlier contain an authorization flaw in API routes allowing authenticated students to modify or delete arbitrary lesson content across courses.

An authorization bypass vulnerability in cool-admin-midway through version 8.0.0 allows department-restricted administrators to perform unauthorized administrative actions on users outside their assigned scope.

CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.

MacCMS versions v10 through 2026.1000.4056 are vulnerable to an unauthenticated account takeover via brute-force exploitation of the password recovery function.

An incorrect authorization flaw in ThinkCMF RestAdminBaseController allows restricted administrators to bypass access controls, leading to privilege escalation and unauthorized data access.

OpenHealth versions 0.2.0 and earlier are vulnerable to unauthenticated access within the /api/health-data/ endpoint, allowing remote attackers to read, modify, or delete sensitive medical records.

Driftregion iso14229 versions before 0.10.1 are vulnerable to an integer wraparound in Handle_0x38_RequestFileTransfer, allowing unauthenticated attackers to trigger an out-of-bounds read.

Snap7 versions up to 1.4.3 contain an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() triggered by malicious S7 peer responses, potentially leading to memory corruption or process crashes.

An unauthenticated denial-of-service vulnerability in DragonflyDB allows remote attackers to cause instance termination via unbounded memory allocation.

NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.

JuggleIM im-server versions through 1.8.16 contain a hardcoded administrator account that allows unauthenticated remote attackers to gain full administrative access to tenant applications and secrets via the console on port 8090.

Archon versions 0.2.13 through 0.11.1 contain a missing authentication vulnerability allowing unauthenticated, network-adjacent attackers to execute arbitrary commands via the /api/* control API.

BMC Helix Network Management on-prem versions prior to 26.3.01 allow unauthenticated attackers to bypass SAML authentication and gain administrator access.

Jooan JA-A12 IP cameras running specific firmware versions are vulnerable to unauthenticated remote code execution via a hard-coded credential flaw that allows command injection into the jooandiag daemon.

An infinite loop vulnerability in the Junrar Java library, identified as CVE-2026-97370, allows unauthenticated attackers to cause CPU exhaustion via crafted RAR4 archives.

The react/http library is vulnerable to a memory exhaustion Denial of Service (DoS) due to the lack of size constraints on incoming HTTP response headers (CVE-2026-104827).

A build-time dependency issue in FrankenPHP causes cross-user session ID leakage when the PHP session extension is loaded as a shared module in worker mode.

Authenticated users can escalate privileges to administrator or manage plugins by invoking unauthorized JSON-RPC methods in Leantime.

The @opennextjs/cloudflare component contains a vulnerability (CVE-2026-100409) where inconsistent path decoding allows attackers to bypass middleware-based authorization and retrieve cached content.

The dio_http2_adapter library fails to sanitize Authorization, Cookie, and Proxy-Authorization headers when following cross-origin HTTP redirects, enabling credential theft.

An incomplete fix for an OpenAPI 3.1 validation flaw allows unauthenticated attackers to trigger process-crashing nil-pointer dereferences in kin-openapi by supplying array schemas without an 'items' keyword.

A vulnerability in the containerd CRI implementation (CVE-2026-95837) allows untrusted container checkpoints to bypass configured security contexts, enabling privilege escalation to root.

An unauthenticated remote denial-of-service vulnerability in Qwik allows attackers to terminate Node.js server processes by sending a maliciously crafted qwik-json payload, resulting in persistent service outages.

Claude Code and Claude Desktop failed to verify the integrity of git checkouts during plugin installation, allowing attackers to substitute pinned commits with malicious code via branch name collision.

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

Dgraph versions up to 25.3.8 expose an unauthenticated HTTP administrative API on port 6080, allowing remote attackers to perform unauthorized cluster membership operations and cause denial of service.

Argo CD fails to validate AppProject destination and resource restrictions during PreDelete and PostDelete hook execution, allowing attackers to escalate privileges via the application-controller.

A namespace-level administrator can manipulate the KEDA operator to send its highly-privileged cluster ServiceAccount token to a tenant-controlled destination, resulting in full cluster-wide privilege escalation.

Podman versions 4.4.0 through 6.1.2 allow container checkpoint images to override runtime security configurations, potentially bypassing user-defined sandbox constraints via the io.podman.annotations.checkpoint.runtime.name annotation.

A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.

Authenticated users with QinQ edit privileges can leverage an OS command injection vulnerability in Netgate pfSense CE 2.7.0 through 2.9.0 to execute arbitrary commands as root.

LightLLM versions through 1.2.0 are susceptible to an unauthenticated denial-of-service attack via the /generate endpoint caused by unsafe deserialization.

CVE-2026-3786 is a high-severity SQL injection vulnerability in Easycms version 1.6 and earlier that allows remote attackers to execute arbitrary database commands via the _order parameter.

A stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote, unauthenticated attackers to achieve arbitrary code execution via crafted FTP commands.

WooCommerce Designer Pro version 1.9.26 and earlier is vulnerable to unauthenticated arbitrary file upload due to insufficient validation in the wcdp_save_canvas_design_ajax function, facilitating remote code execution.

Neterbit NW-431F LTE routers are vulnerable to unauthenticated information disclosure via the /sms.json endpoint, allowing attackers to retrieve SMS messages including potential one-time passcodes.

A stack-based buffer overflow in the boa web server component of NEXTU FLATA AX1500 routers allows unauthenticated remote attackers to achieve arbitrary code execution via the hostname parameter.

CISA Malcolm versions v26.07.1 and earlier contain multiple high-severity vulnerabilities, including authentication bypass, SSRF, and authorization flaws, allowing unauthenticated or low-privileged users to gain administrative control.

Multiple high-severity vulnerabilities in Eclipse Milo, including improper authorization and memory management flaws, allow unauthenticated remote attackers to bypass access controls, delete protected nodes, or crash services.

Multiple critical vulnerabilities in EseeCloud App and firmware allow remote, unauthenticated attackers to gain device control, perform unauthorized device rebinding, and perform bulk enumeration of registered IoT cameras.

Multiple critical vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 enable remote, unauthenticated attackers to manipulate medical records, exfiltrate sensitive patient data, and induce denial-of-service conditions.

An authenticated path traversal vulnerability in Thermo Fisher Torrent Suite Software (CVE-2026-107777) allows remote attackers to read arbitrary files from the affected server.

Drupal core contains a critical remote code execution vulnerability, identified as CVE-2026-014, requiring immediate updates to patched versions.

A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability in Ansible Operator Plugins to achieve arbitrary code execution via crafted Custom Resource specifications.

A heap-based buffer overflow in the api.cgi component of Wavlink WN530HG4B firmware allows unauthenticated remote attackers to execute arbitrary code via malformed input to the api=info&client=app handler.

An unauthenticated remote code execution vulnerability (CVE-2026-110957) in the Wavlink WL-WN530BE2-A router allows attackers to inject OS commands via the REMOTE_ADDR parameter in api.cgi.

Multiple vulnerabilities in SonicWall Network Security Manager versions prior to 4.4.0, including CVE-2026-100232 and CVE-2026-96540, allow unauthenticated attackers to achieve remote code execution and bypass security policies.

Multiple vulnerabilities, including remote code execution and cross-site scripting, affect Drupal versions 10.6.x, 11.3.x, and 11.4.x, requiring immediate patching to prevent unauthorized code execution.

Multiple vulnerabilities across Symfony components, including expression-language, http-foundation, and yaml, enable remote attackers to cause a denial-of-service condition.

An authenticated remote attacker can exploit a vulnerability in Gitea to achieve arbitrary code execution with administrator privileges, leading to full system compromise.

A vulnerability in OpenVPN allows a remote, authenticated attacker to trigger an information disclosure or a denial-of-service condition via crafted inputs.

PJSIP contains multiple vulnerabilities, including heap buffer and integer overflows in SIP message processing, which can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition or potentially execute arbitrary code.

A vulnerability in Netgate pfSense allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

A vulnerability in the Rancher container management platform allows a remote, authenticated attacker to perform a privilege escalation, potentially gaining unauthorized administrative access within the cluster environment.

CVE-2017-11610 is a remote code execution vulnerability in Supervisor versions 3.3.2 and earlier that allows authenticated attackers to execute arbitrary system commands via the XML-RPC interface.

A proof-of-concept exploit has been published for CVE-2024-36823, a high-severity information disclosure vulnerability affecting Ninjaframework Ninja 7.0.0.

An unauthenticated remote code execution vulnerability (CVE-2024-9047) in the WordPress File Upload plugin version 4.24.11 and below allows path traversal and arbitrary file manipulation via the wfu_file_downloader.php script.

CikaBika Bot is a Rust-based Remote Access Trojan (RAT) delivered via phishing that utilizes Discord for command-and-control and Ngrok for exfiltration of sensitive victim data.

CVE-2025-59501 is a privilege escalation vulnerability in the Microsoft Configuration Manager (SCCM) AdminService API that allows authenticated, low-privileged users to achieve full administrative control when Entra ID integration is enabled.

CVE-2024-5764 is a vulnerability in Sonatype Nexus Repository Manager where a static encryption key in the Java PasswordCipher class permits the decryption of sensitive data, now supported by a public exploit script.

CVE-2026-110912 allows an unauthenticated attacker on a local L2 network to disclose kernel heap and stack memory by sending malformed ARP requests with oversized length fields.

An authenticated RCE vulnerability in the Email Customizer for WooCommerce plugin allows subscriber-level users to inject and execute arbitrary PHP code.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

The Checkout Field Manager plugin for WordPress contains an authorization bypass vulnerability allowing low-privileged authenticated users to delete arbitrary files from the Media Library.

The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.

An unauthenticated remote code execution vulnerability exists in 10Web Booster versions 2.34.10 and earlier due to insecure file handling and nonce leakage.

Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XXE injection, enabling remote attackers to perform SSRF, steal NTLMv2 hashes, and conduct arbitrary file read operations.

MoviePilot versions through 3.1.5 are vulnerable to command injection via the ExecuteCommandTool, allowing unauthenticated or low-privileged actors to achieve remote code execution.

IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.

An unauthenticated buffer overflow vulnerability in the SODOLA SL902-SWTGW124AS embedded HTTP server allows remote attackers to cause a denial of service via oversized multipart/form-data headers.

Better Auth @better-auth/sso versions 1.7.0-rc.2 through 1.7.2 contain an authentication bypass vulnerability allowing attackers to impersonate other users via malicious SSO provider registration.

Heym versions 0.0.55 through 0.0.120 contain a privilege escalation vulnerability allowing shared collaborators to exfiltrate workflow credentials by overwriting error handlers.

An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.

Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.

GitPython versions prior to 3.2.0 contain a remote code execution vulnerability where the Git.ls_remote method improperly handles URLs, allowing arbitrary command execution via malicious remote-helper strings.

OpenSIPS versions 3.6.8 and 4.0.1 and earlier are vulnerable to a remote out-of-bounds read in the rtpproxy_offer and rtpproxy_answer functions, which can lead to denial-of-service or information disclosure.

A vulnerability in Lenovo XClarity Controller 3 allows a remote, unauthenticated attacker to gain administrative privileges on the affected system, representing a significant security risk for managed infrastructure.

The sar2html 4.0.0 application is vulnerable to remote SQL injection via the 'sort' parameter in sar2html.py, enabling unauthenticated attackers to execute arbitrary database queries.

An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.

Gitingest versions 0.3.1 and earlier contain a symlink following vulnerability that allows unauthenticated attackers to read arbitrary files from the server's filesystem.

Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 and earlier are vulnerable to remote configuration manipulation via an unauthenticated UDP configuration protocol.

CVE-2026-86848 is a critical out-of-bounds access vulnerability in DPDK lib/vhost vhost-crypto caused by a double-fetch of a guest descriptor index, enabling a malicious guest to compromise the host backend.

A use-after-unmap vulnerability in the DPDK VDUSE handler allows for potential memory corruption and system instability due to improper vring pointer invalidation.

Authenticated users can achieve remote code execution in FV Flowplayer Video Player for WordPress <= 7.5.54.7212 by bypassing incomplete file type validation in the check_mimetype function.

A time-of-check time-of-use vulnerability in the DPDK lib/vhost component enables a heap buffer overflow via the VDUSE control-queue handler, potentially allowing arbitrary code execution.

The ADP Desktop SDK improperly transmits sensitive information in clear text, allowing local network attackers to intercept credentials and gain unauthorized access to Autodesk services.

An improper input validation vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated attacker to achieve remote code execution via a buffer overflow in AutoDiscovery VPN messages.

An infinite loop vulnerability (CVE-2026-102046) in the netsctp.ko kernel module of Juniper Junos OS allows unauthenticated remote attackers to cause a denial of service on MX Series devices via crafted SCTP traffic.

A vulnerability in the DPDK Generic Segmentation Offload (GSO) library allows remote or guest-supplied packets to trigger out-of-bounds memory read or write operations due to insufficient header size validation.

PCMan FTP Server versions through 2.0.7 contain a buffer overflow vulnerability in the PORT command handler that allows remote attackers to execute arbitrary code or trigger a denial of service.

An OS command injection vulnerability in the TACACS component of Juniper Junos OS Evolved allows authenticated, low-privileged users to achieve root-level code execution.

An unauthenticated heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Junos OS allows remote attackers to trigger denial-of-service or potentially execute arbitrary code via malformed IPv4 packets.

A coordinated disruption action targeting the CoGUI, CoAceV, and CoFish_Ws phishing kits has impacted an ecosystem responsible for billions of malicious messages harvesting credentials and payment data from global organizations.

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to unauthenticated SSRF via the x-portkey-custom-host header, allowing attackers to access internal loopback and Docker host services.

An authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller (NIC) allows remote attackers to spoof request attributes and access protected paths by manipulating unsanitized X-Forwarded-* headers.

NGINX Gateway Fabric contains a configuration injection vulnerability in the AuthenticationFilter Custom Resource Definition that allows authenticated attackers to escape directive contexts and manipulate the shared NGINX data-plane configuration.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.

Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.

Beganovich snappdf versions 1.1.0 through 6.0.x are vulnerable to OS command injection via the setUrl() function on Windows, allowing unauthenticated attackers to achieve arbitrary code execution.

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function allowing arbitrary command execution via crafted filenames.

The buildebooks package before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute arbitrary system commands via crafted EPUB filenames.

MyReport Updater versions through 2.1.1 are vulnerable to local privilege escalation allowing low-privileged users to achieve SYSTEM execution via malicious DLL injection in osk.exe.

Report One MyReport Updater versions 2.1.1 and earlier contain an unauthenticated gRPC service vulnerability allowing remote attackers to hijack the update process and achieve SYSTEM-level code execution.

Kan versions 0.5.5 through 0.6.0 contain an unauthenticated SSRF vulnerability in the /api/download/attatchment endpoint that allows attackers to probe internal services and cloud metadata.

Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.

Swetrix Cloud versions before 5.1.0 contain a missing authorization vulnerability in the ProjectController component that allows authenticated attackers to hijack arbitrary projects.

NullHub versions through 2026.5.29 contain a missing authentication vulnerability allowing unauthenticated remote access to management API endpoints.

L-SMASH versions through 2.14.5 contain a double free vulnerability in the NALU importer, allowing remote attackers to trigger heap corruption via a crafted Annex-B elementary stream.

Kaneo versions before 2.1.6 contain a missing authorization vulnerability (CVE-2025-71433) allowing authenticated users to bypass membership checks and perform unauthorized operations on arbitrary workspaces.

Gravitee API Management versions up to 4.12.22 allow unauthenticated remote attackers to forge JWTs using a default signing secret to impersonate any user, including administrators.

Cloud Commander versions 19.20.2 through 19.21.1 are vulnerable to a path traversal flaw in the GET /api/v1/pack endpoint allowing unauthenticated file exfiltration.

The thumbnail Python package through version 1.5 is vulnerable to OS command injection in the generate_thumbnail() function, enabling arbitrary code execution via shell metacharacter injection into system calls.

Stills versions prior to 25.24.2 are vulnerable to OS command injection via crafted media file paths containing shell metacharacters, enabling arbitrary command execution with Node.js process privileges.

Video-stitch versions prior to 2.0.0-beta.1 contain an OS command injection vulnerability allowing attackers to achieve remote code execution by injecting shell metacharacters into file name parameters processed by ffmpeg.

The nodejs-whisper package through version 0.3.1 contains an OS command injection vulnerability in the convertToWavType() function that allows unauthenticated command execution via crafted audio file paths.

The transcribe2texts package through version 1.0.6 is vulnerable to OS command injection via the transcribeAudio function, allowing unauthenticated attackers to achieve arbitrary code execution by injecting shell metacharacters into the audioPath parameter.

The whisper-node library through version 1.1.1 is vulnerable to OS command injection via unsanitized input in the whisper() function, allowing attackers to execute arbitrary shell commands.

The @mborne/extract library before version 0.2.1 is vulnerable to OS command injection via unsanitized archivePath or targetDir inputs passed to shelljs exec().

The doc-recog library through version 1.1.6 is vulnerable to OS command injection via crafted document paths passed to the recog() or tag() functions.

The pypdftk library (<= 0.5) is vulnerable to OS command injection via insecure path handling in its core functions, allowing arbitrary command execution when using subprocess.Popen.

The webp-converter package before 3.0.0 is vulnerable to OS command injection due to unsafe execution of libwebp binaries via execFile with shell enabled.

The git-diff package before 2.0.7 is vulnerable to OS command injection via the gitDiff API, allowing arbitrary command execution with Node.js process privileges through crafted input strings.

The vlife application through version 2.0.1 contains a hardcoded HS256 JWT signing key in TokenUtil, allowing unauthenticated attackers to forge tokens and gain administrative privileges.

The office-converter library through version 1.0.2 is vulnerable to OS command injection via the fileName parameter, allowing arbitrary code execution with Node.js process privileges.

A vulnerability in libssh (CVE-2023-6004) allows a remote, authenticated attacker to disclose sensitive information due to improper handling of SSH agent forwarding requests.

A vulnerability in IBM QRadar SIEM allows a remote, unauthenticated attacker to induce a denial-of-service condition affecting the platform availability.

PgBouncer contains multiple vulnerabilities that can be exploited by a remote, unauthenticated attacker to cause a denial-of-service condition, bypass security controls, or escalate privileges to administrator level.

Multiple vulnerabilities in Ubiquiti UniFi network management software allow remote, unauthenticated attackers to execute arbitrary OS commands, bypass security controls, and disrupt service.

A vulnerability in the BlueZ Bluetooth stack allows a remote, unauthenticated attacker to trigger a denial-of-service condition on affected Linux systems.

Multiple vulnerabilities in AMI AptioV UEFI firmware allow local attackers to achieve arbitrary code execution, data manipulation, privilege escalation, and information disclosure.

A vulnerability in Fortinet FortiOS allows a remote, unauthenticated attacker to trigger a denial of service condition on the target appliance.

Multiple vulnerabilities in Fortinet FortiSIEM allow unauthenticated remote attackers to execute arbitrary code on the affected appliance, risking complete platform compromise.

Multiple vulnerabilities in Fortinet FortiAnalyzer and FortiManager enable remote, unauthenticated attackers to perform SQL injection attacks, potentially resulting in unauthorized data access.

Multiple vulnerabilities across several Fortinet products, including FortiOS and FortiManager, permit remote code execution, privilege escalation, and denial-of-service.

Multiple vulnerabilities, including CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, in MongoDB Server allow remote attackers to achieve arbitrary code execution or denial of service.

A local privilege escalation vulnerability in the Linux kernel vhost subsystem allows an attacker to achieve root access by exploiting a lack of range checking in vhost_vq_meta_fetch().

Radar versions prior to 1.12.2 contain a missing authorization vulnerability allowing attackers to execute commands via the /api/local-terminal WebSocket endpoint.

An unauthenticated authentication bypass vulnerability (CVE-2026-97657) in Abandoned Cart Pro for WooCommerce versions 10.8.0 and earlier allows attackers to perform account takeovers via XOR-malleation of recovery tokens.

The insights-runtime-extractor DaemonSet fails to correctly drop privileges when scanning containers, allowing malicious workloads to execute code as root in the host user namespace.

CVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.

Threat actors are using typosquatted domains to harvest WatchGuard VPN credentials via fake portals before delivering legitimate software to maintain victim trust.

The SimpleForm plugin for WordPress (<= 3.10.0) is vulnerable to unauthenticated administrator account creation due to missing capability checks on the wp_ajax_nopriv_simpleform_wp_register AJAX action.

Adversaries leverage nslookup within PowerShell execution flows to retrieve malicious payloads encoded in DNS TXT records, bypassing traditional network egress filtering.

Detection of Windows event log files (.evtx) created outside of standard system directories, which may indicate log tampering, data staging, or forensic evasion.

Mistral Vibe versions before 2.25.4 are susceptible to a command permission gate bypass that enables arbitrary command execution via the bash promptvars feature.

A path traversal vulnerability in Webmin and Usermin allows remote, unauthenticated attackers to read arbitrary files by exploiting improper input handling in the simplify_path function.

Vifm versions 0.8.1-beta through 0.14.4 are vulnerable to local command injection and privilege escalation due to insecure IPC FIFO reuse in shared temporary directories.

KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.

Rovr through 0.10.3 contains an OS command injection vulnerability triggered by opening files with malicious names containing shell metacharacters, enabling arbitrary code execution under the user's context.

Kubeflow Model Registry versions up to 0.3.17 contain a server-side request forgery vulnerability allowing namespace users to exfiltrate ServiceAccount tokens and gain cluster-wide privileges.

An authenticated low-privileged user can exploit a missing authorization vulnerability in youlai-boot to assign administrative permissions to their own role and elevate privileges.

iFlytek SkillHub versions through 0.2.22 contain a missing authorization vulnerability in the skill deletion API, allowing authenticated users to delete any user's skill data.

Wukong AICRM versions through 20260610 contain a missing authorization vulnerability that allows authenticated users to call administrative APIs, leading to account takeover via password reset.

Roo Code through 3.54.0 contains a command approval bypass in getCommandDecision() allowing attackers to execute denied shell commands by prefixing them with a redirection operator.

Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.

A parsing discrepancy between tree-sitter-bash and the bash shell in Mistral Vibe allows attackers to bypass permission validation via backslash-newline line continuations to execute arbitrary commands.

The JTL-Connector for WooCommerce WordPress plugin is vulnerable to unauthenticated remote code execution via a flaw in session handling and file validation.

An unauthenticated remote code execution vulnerability in AGE-GATE WordPress plugin version 1.0 and earlier allows attackers to inject PHP code via unsanitized POST parameters.

An unauthenticated SQL injection vulnerability in the Abandoned Cart Pro for WooCommerce plugin allows attackers to exfiltrate data or escalate privileges to administrator by modifying user metadata.

The Snazzy Social Media Feed WordPress plugin (up to version 2.5) is susceptible to arbitrary file upload and remote code execution via insufficient sanitization in the standalone save-to-cache.php script.

An unauthenticated arbitrary file upload vulnerability in the Printcart Store (PCDesigner / NB Designer) WooCommerce plugin allows remote code execution via AJAX parameter manipulation.

An unauthenticated arbitrary shortcode execution vulnerability in Click to Chat for WhatsApp for WordPress allows attackers to trigger malicious shortcodes by manipulating the REQUEST_URI.

Detection of NirSoft utility bundle file creation on Windows hosts, a technique frequently used by threat actors for credential harvesting, reconnaissance, and data exfiltration.

This detection identifies potential unauthorized container image pushes to AWS ECR by monitoring for 'PutImage' API calls from users not present in an established allowlist, a common indicator of supply chain or lateral movement activity.

An improper privilege management vulnerability in Python (CVE-2026-85864) allows an authorized local attacker to perform unauthorized privilege escalation.

A denial-of-service vulnerability (CVE-2026-58280) in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml components allows attackers to crash applications via uncontrolled recursion and resource exhaustion.

A high-severity remote code execution vulnerability (CVE-2026-70197) in .NET allows unauthenticated out-of-bounds writes on Windows when reusing SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets.

A memory exhaustion vulnerability in Microsoft.AspNetCore.Localization allows unauthenticated attackers to cause unbounded memory growth and denial of service in ASP.NET Core applications.

A spoofing vulnerability in the .NET System.Security.Cryptography.Xml library allows for certificate forgery and token spoofing via improper validation of KeyInfoX509Data serialized certificate formats.

A heap out-of-bounds vulnerability in the .NET WPF runtime allows attackers to achieve remote code execution through crafted pixel-shader bytecode.

An elevation of privilege vulnerability in the Microsoft.AspNetCore.Authentication.Negotiate package allows an attacker to misassociate an authenticated identity with an unintended LDAP principal due to improper validation of Kerberos principal SIDs.

An unencoded exception reflection vulnerability in the Blazor WebAssembly development server allows remote attackers to perform cross-site scripting (XSS) via the unauthenticated /_framework/debug endpoint.

North Korean state-controlled IT workers are scaling global employment fraud operations by utilizing domestic facilitators, KVM-over-IP hardware, and remote management tools to exfiltrate data and generate revenue.

Citrix has released security bulletins addressing multiple vulnerabilities across UniconOS and XenServer products, including CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701.

Xorbits Xoscar versions 0.11.2 and earlier are vulnerable to unauthenticated remote code execution via insecure deserialization of data sent over the actor-pool TCP channel.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.

CVE-2026-84015 is a heap-based buffer overflow vulnerability in the Remote Access PPP EAP-TLS implementation that enables unauthenticated remote code execution via network-based exploitation.

An out-of-bounds write vulnerability (CVE-2026-83910) in the RPC Runtime allows unauthenticated remote attackers to achieve code execution over the network.

An unauthenticated remote attacker can leverage an integer underflow vulnerability in the DNS Server service to achieve arbitrary code execution via crafted network packets.

A heap-based buffer overflow vulnerability (CVE-2026-69639) in the Windows implementation of the Libarchive library enables unauthenticated remote code execution via malicious archive processing.

Dockhand versions prior to 1.0.45 allow unauthenticated remote attackers to perform full account takeover by exploiting an authentication bypass flaw in the global hook that incorrectly permits requests ending in static extensions.

The odt2spip plugin for SPIP before 4.4.0 is vulnerable to OS command injection, allowing authenticated authors to execute arbitrary commands during document conversion.

The fuint platform contains a missing authentication vulnerability in the /clientApi/order/detail endpoint, allowing unauthenticated attackers to retrieve sensitive customer order PII via enumeration.