Threat Library

A critical stack-based buffer overflow vulnerability affects Pyramid Solutions NetStaX EtherNet/IP Stack products prior to v5.6.1, used across industrial control system (ICS) devices. Exploitation via oversized Class 3 explicit-message requests could cause memory corruption, device crashes, or remote code execution without any CIP error notification, posing significant risk to critical manufacturing, energy, water, and chemical sectors.

A critical authorization flaw in MOOS essential-moos pShare (through 10.0.1) allows any publisher on the bus to send crafted PSHARE_CMD messages that reconfigure network routes and listeners at runtime. This enables attackers to redirect or duplicate sensitive inter-process communication traffic to attacker-controlled destinations without authentication, posing severe risks to robotics and autonomous system deployments that rely on MOOS for message passing.

A critical authentication bypass vulnerability exists in the optional MOOSDB HTTP server component of MOOS core-moos through version 10.4.0, allowing unauthenticated attackers to write arbitrary MOOS variables including actuator and override commands. This could enable remote attackers to hijack control of autonomous vehicles or robotic systems that rely on MOOS-IvP for mission control and coordination.

python-jose through version 3.5.0 contains an incomplete fix for a prior key-confusion vulnerability (CVE-2024-33663), allowing attackers who possess a service's RSA/EC public key to forge valid HS256-signed JWTs when the verifying application does not explicitly restrict accepted algorithms. This enables full authentication bypass against any system relying on python-jose for JWT verification without strict algorithm allowlisting.

Taipy, a Python framework used to build data and AI application front-ends, ships with a Socket.IO server configuration that combines wildcard CORS origins with credentialed connections enabled. This allows any malicious webpage to establish authenticated WebSocket sessions with a victim's running Taipy application and directly invoke state changes and backend callbacks without CSRF protection, effectively granting remote attackers unauthorized control over application logic and data.

A critical unauthenticated remote buffer overflow vulnerability has been identified in TOTOLINK CP450 4.1.0 routers, exploitable via the topicurl parameter in the /cgi-bin/cstecgi.cgi endpoint. With a CVSS score of 9.9, this flaw allows remote attackers to potentially execute arbitrary code or crash the device without authentication.

Cisco disclosed a critical unauthenticated remote code execution vulnerability (CVE-2026-20212, CVSS 9.8) affecting 10 Silicon One-based Nexus 9000 switch models, allowing attackers to execute code as root without credentials. Alongside this, Cisco released an IOS XR hardening bundle addressing 7 CVEs, two rated 9.8, with no available workarounds for any affected IOS XR version, making immediate patching the only mitigation.

A set of internally discovered memory corruption bugs affecting Thunderbird and its ESR branches could potentially be exploited to achieve code execution. Mozilla has patched the issue across Firefox and Thunderbird release and ESR channels, and no public exploitation has been confirmed at this time.

Internal security research identified multiple memory corruption bugs in Thunderbird 154 that could potentially be exploited by attackers. Mozilla has patched these issues in Thunderbird 155 and Firefox 155, though no public exploitation has been confirmed. The high CVSS score reflects the potential severity if these flaws were weaponized.

A critical integer overflow vulnerability has been identified in the Graphics: ImageLib component of Mozilla Firefox and Thunderbird, carrying a CVSS score of 9.8. The flaw could allow attackers to achieve memory corruption and potentially remote code execution through crafted image content. Mozilla has released patches in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

A critical site isolation flaw in the DOM Navigation component affects Firefox, Firefox ESR, and Thunderbird, potentially allowing cross-origin data leakage or sandbox bypass. With a CVSS score of 9.8, successful exploitation could let attackers bypass browser security boundaries to access sensitive cross-site data. Mozilla has released patches in Firefox 155, Firefox ESR 153.2, and Thunderbird 155/153.2.

A vulnerability described only as 'Other issue' has been identified in Firefox Focus for Android, carrying a CVSS score of 9.8, indicating potential for severe impact if exploited. The issue has been resolved in Firefox 155, and the vagueness of the public description suggests Mozilla has withheld technical details pending broader patch adoption.

A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being actively exploited to forge tokens granting administrative access. Attackers exploiting this flaw can gain full control over artifact repositories used in software build and deployment pipelines, enabling malicious package injection and data exfiltration.

A critical SQL injection vulnerability in the widely-used All-in-One WP Migration and Backup WordPress plugin allows unauthenticated attackers to execute remote code and fully compromise affected sites. With millions of active installations, this flaw poses a significant risk of mass exploitation, website defacement, and data theft.

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection flaw in the Sangoma Switchvox VoIP platform, to achieve remote code execution and deploy reverse shells. The vulnerability allows attackers to gain full control of vulnerable systems without credentials, posing a serious risk to organizations running exposed Switchvox deployments.

A critical vulnerability in Submariner's cert-auth mode allows a malicious cluster to inject arbitrary ipsec.conf directives via an unsanitized CableName field in a Custom Resource Definition. This enables remote code execution as root on gateway nodes through leftupdown hook abuse, fully compromising the multi-cluster networking layer.

CVE-2026-83549 is an OS command injection vulnerability in SonicWall SMA1000 Appliances that allows an authenticated remote attacker with administrative privileges to execute arbitrary OS commands, leading to full remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with an unusually short three-day remediation window, indicating active exploitation or imminent risk. Organizations using SMA1000 appliances for secure remote access should prioritize immediate patching.

CVE-2026-83548 is a server-side request forgery vulnerability in SonicWall SMA1000 Appliances that allows a remote, unauthenticated attacker to reach sensitive internal functionality and perform unauthorized operations. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a compressed remediation window, indicating active or imminent exploitation in the wild. Organizations using SMA1000 for secure remote access should treat this as an urgent patching priority.

Sangoma Switchvox, a VoIP PBX platform, contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request. This flaw has been added to CISA's Known Exploited Vulnerabilities catalog with an extremely tight remediation window, indicating active exploitation in the wild. Successful exploitation can lead to database compromise and remote code execution on the underlying host.

Kestra OSS, an open-source workflow and orchestration platform, contains an OS command injection vulnerability (CVE-2026-49869) that allows unauthenticated remote attackers to create and execute arbitrary workflows without credentials. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild, with a remediation due date of September 5, 2026.