Vulnerability intelligence

CVE-2025-29009 is an unauthenticated arbitrary file upload vulnerability affecting the Webkul Medical Prescription Attachment Plugin for WooCommerce, a WordPress plugin, in all versions up to and including 1.2.3. The vulnerability is caused by a lack of server-side validation for file extensions or MIME types within the plugin's `wkwcpa_handle_prescription_session` AJAX handler. Because the handler accepts file uploads via the `wkwc_pa_prescription_attachment[]` parameter without verifying the file type, it allows users to upload arbitrary files to the server. To exploit this vulnerability, an unauthenticated attacker can retrieve the necessary `ajaxNonce` from the public WooCommerce storefront, where it is embedded in the `wkwcpaFrontObj` JavaScript object. Using this nonce, the attacker can upload a PHP web shell directly to the server's uploads directory. The plugin's response returns the full, accessible URL of the uploaded file, enabling the attacker to execute remote code on the affected site's server.

CVE-2026-81376 is a security feature bypass vulnerability affecting Microsoft Visual Studio Code versions 1.0.0 through 1.136.1. The flaw stems from an incomplete comparison operation within the application's security evaluation logic, which is categorized as a protection mechanism failure. When Visual Studio Code assesses a security decision, the comparison logic omits certain necessary factors. An attacker can exploit this by crafting input that satisfies the partial check while violating the omitted factors, allowing them to bypass the editor's built-in security controls. Exploitation of this vulnerability requires user interaction, such as opening a repository, workspace, or file supplied by the attacker. Once triggered over a network, the bypass can lead to a scope change, enabling the compromised component to affect resources outside its intended security boundary. This can result in behaviors such as the unexpected launching of command shells, scripting interpreters, or network utilities, as well as unauthorized modifications to configuration files within the workspace. Microsoft has addressed this issue in Visual Studio Code version 1.136.2.

An analysis of popular cybersecurity articles and official advisories indicates that **CVE-2026-61624** is a Server-Side Request Forgery (SSRF) vulnerability. The flaw is classified under CWE-918 and is associated with the handling of remote requests. *(Note: If you are referring to the widely reported Fortinet path traversal vulnerability that was actively exploited in late 2026 to deploy the PEERSTITCH malware, that flaw is tracked under **CVE-2025-61624**. It allows authenticated administrators with read-write permissions to write or delete arbitrary files on the underlying filesystem via crafted CLI requests.)*

CVE-2026-102764 is an improper origin validation vulnerability affecting the internal messaging components of BeyondTrust Remote Support (formerly Bomgar) appliances. The flaw impacts all supported versions of the software up to and including 26.2.3. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to perform arbitrary file operations on the appliance. This capability can allow attackers to gain host-level control, escalate privileges to root, and access credentials stored or brokered by the system. The vulnerability was exploited as a zero-day starting in late August 2026 by a suspected China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). During these intrusions, the threat actors deployed custom backdoors, such as the SAWFLY web shell and BARECLAW tunneler, to maintain persistence and harvest credentials. BeyondTrust released patches on October 9, 2026, which were automatically deployed to SaaS customers, while self-hosted customers running versions 24.3.1 through 26.2.3 are advised to manually apply the BT26-05-RS update. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.