Threat Library

The AI Copilot – Content Generator WordPress plugin (versions up to 1.5.6) contains an authorization bypass vulnerability allowing unauthenticated attackers to create administrator accounts and fully take over affected sites. The flaw stems from a nonce value being exposed in publicly accessible JavaScript, rendering the plugin's authorization check ineffective on any page rendering the [aiwu-form] shortcode or public chatbot.

A critical, previously unknown SQL injection vulnerability in Metabase, a widely used open-source business intelligence and analytics platform, was exploited in zero-day attacks to breach customer instances and exfiltrate data. Confirmed victims include Framework and Tally, both of which have publicly disclosed the incidents. The flaw allows attackers to bypass authentication and query controls to access sensitive underlying database contents.

Dell Virtual Storage Integrator (VSI) for VMware vSphere Client versions prior to 10.11.1.0 contain a critical sensitive information disclosure vulnerability that allows unauthenticated remote attackers to steal active session credentials. Exploitation enables full impersonation of authenticated users, including administrators, within vSphere environments.

CVE-2026-8037 is an unauthenticated command injection vulnerability in Progress LoadMaster that allows attackers to execute arbitrary commands on the appliance via unsanitized input on multiple management endpoints. CISA has added this to its Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Organizations using LoadMaster for load balancing and application delivery, including in front of internal services, should treat this as an urgent patching priority.

Cisco disclosed 12 vulnerabilities affecting Catalyst SD-WAN Software and IOS XE Software, including three critical flaws with CVSS scores of 9.8, discovered during an internal security review. These issues affect SD-WAN devices regardless of configuration and IOS XE devices running in autonomous or controller mode, posing significant risk to enterprise network infrastructure.

CVE-2026-53984 is a critical unauthenticated vulnerability in Ground Station software prior to version 0.6.0, allowing any network peer to destroy or tamper with the entire SQLite database via an exposed Socket.IO event handler. Attackers can wipe operational data or inject fabricated orbital-source URLs to redirect the ground station to attacker-controlled servers, enabling data manipulation and potential downstream compromise.

A critical vulnerability in boringproxy (through 0.10.0) allows low-privileged authenticated users to inject arbitrary SSH public keys into the server's authorized_keys file via a newline injection flaw in the tunnel creation endpoint's domain parameter. Successful exploitation grants attackers persistent SSH shell access to the proxy server and enables theft of cleartext credentials, tunnel private keys, and TLS certificates stored in the local database. Given the CVSS score of 9.9, this represents a full compromise path from limited tunnel-creation privileges to complete host takeover.

Apache NiFi versions 2.0.0 through 2.10.0 contain a broken access control vulnerability in the Asset management REST API tied to Parameter Contexts. An attacker with write access to one Parameter Context can delete Assets belonging to a different Parameter Context they are not authorized for, by manipulating the supplied identifiers. This affects deployments that rely on differentiated authorization across Parameter Contexts as a security boundary.

Apache NiFi versions 1.10.0 through 2.10.0 contain a broken authorization flaw in the Parameter Context update REST API that fails to enforce component-level authorization checks. An authenticated user with only Parameter Context modification rights can alter parameter values affecting components they are not authorized to manage, potentially triggering code execution via scripting-based parameters during automatic validation. Organizations should upgrade to NiFi 2.11.0 immediately, especially those using component-level authorization policies.

A critical unauthenticated remote code execution vulnerability has been identified in JetBrains TeamCity, exploitable via insecure deserialization in the agent polling protocol. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with an unusually short remediation window, indicating active or imminent exploitation. Organizations running TeamCity build servers should treat this as an urgent patching priority.

A critical unauthenticated remote code execution vulnerability affects MaxSite CMS, allowing attackers to inject arbitrary PHP code into the application's configuration file via the install endpoint. Exploitation results in persistent RCE as the web-server process user, requiring no authentication and enabling full compromise of the affected host.

MaxSite CMS versions 109.5 and earlier contain a critical authentication bypass in the AJAX dispatcher, allowing unauthenticated attackers to reach admin-gated plugin endpoints. Exploitation requires only a crafted X-Requested-With header and a base64-encoded path pointing to any *-ajax.php file, enabling actions like poll manipulation and potentially more severe abuse depending on the targeted plugin.

kotaemon, an open-source RAG (retrieval-augmented generation) UI and document QA toolkit through version 0.12.0, contains a critical unauthenticated insecure deserialization vulnerability in its check_connection endpoint. Attackers can supply crafted YAML/JSON payloads with a manipulated __type__ field to instantiate arbitrary Python classes, ultimately achieving remote code execution via subprocess.check_output injection.

A critical unauthenticated command injection vulnerability affects Puwell IP Camera firmware versions 2.x through 4.x, allowing remote attackers to achieve root-level code execution via a crafted JSON payload sent to the exposed DebugShell service on TCP port 34567. Given the CVSS score of 9.8 and lack of any authentication barrier, this vulnerability is likely to be rapidly weaponized by botnet operators and IoT malware families for mass exploitation.

A critical SQL Injection vulnerability in Adobe Campaign Classic (CVE-2026-48330) allows an unauthenticated attacker to execute arbitrary SQL commands and achieve remote code execution in the context of the current user, with no user interaction required. With a maximum CVSS score of 10.0 and a scope change, successful exploitation could grant attackers elevated access, full control over the marketing automation platform, and lateral movement into connected infrastructure.

The INC Ransomware group has become the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, with a sharp increase in activity since early August 2026. Multiple victims have already been listed on the group's data leak site, indicating active and successful exploitation in the wild.

A critical command injection vulnerability affects GL-iNet GL-MT3000 routers up to firmware version 4.4.5, residing in the server.set_peer function of the wg-server.so native plugin exposed via /cgi-bin/glc. The flaw allows unauthenticated or low-privilege remote attackers to inject arbitrary OS commands through the public_key parameter, and a public exploit is already available, significantly increasing the risk of active exploitation.

A critical command injection vulnerability affects the s2s.enable_echo_server function within the s2s.so native plugin on GL-iNet GL-MT3000 routers up to version 4.4.5. The flaw allows unauthenticated remote attackers to inject arbitrary OS commands via the 'port' argument, and a public exploit is already available. Given the CVSS score of 9.8 and remote exploitability, affected devices are at immediate risk of full compromise.

Krayin CRM 2.2.4 contains a critical missing authentication vulnerability that allows unauthenticated attackers to overwrite the primary administrator account by exploiting a flaw in the installer middleware bypass logic. Successful exploitation grants full administrative access to all CRM data, including customer records, credentials, and any integrated API keys or tokens.

A critical remote code execution vulnerability exists in OpenEMR through 8.2.0, allowing authenticated administrators to inject PHP payloads into the categories database table via SQL manipulation. The payload is later executed through an unsanitized eval() call in the CategoryTree component, which can be triggered by unauthenticated or low-privilege pages, resulting in full command execution as the web server user.