Threat briefs

WSO2 Identity Server configured as a Resident Key Manager with database sharing is susceptible to an authorization issue where self-registered users can obtain tokens to access System REST APIs in WSO2 API Manager.

A vulnerability in the WireGuard VPN function involving improper input validation allows a remote attacker with high privileges to inject and execute system commands with root privileges.

CrowdStrike has introduced a native security integration with Anthropic’s Claude Cowork that deploys the Falcon Linux sensor inside agent virtual machines to mitigate supply chain and execution risks within isolated AI environments.

This detection-focused brief covers the monitoring of common Linux utilities used for local group and privilege enumeration.

Attackers are exploiting internet-exposed industrial refrigeration controllers using factory-default credentials to force units into defrost mode, causing temperature spikes and food spoilage across European retail chains.

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices to deploy botnet payloads and establish persistent backdoors.

The FluentCart WordPress plugin contains an arbitrary file deletion vulnerability in the deleteFile function that allows authenticated attackers to delete sensitive server files, potentially leading to remote code execution.

The SureCart WordPress plugin contains an authentication vulnerability in the VerificationCodeController REST endpoint, allowing unauthenticated attackers to brute-force verification codes to hijack user accounts.

The Contact Form Extender for Divi Builder plugin for WordPress contains an arbitrary file deletion vulnerability in versions 1.0.6 and below that allows unauthenticated attackers to delete sensitive files via the cfefd_remove_uploaded_file function.

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to authenticated SQL injection via the tracking_provider parameter, allowing attackers with Shop Manager privileges to exfiltrate database contents.

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.

The BuddyPress XProfile Image Field plugin for WordPress up to and including version 3.1.0 is vulnerable to arbitrary file deletion via unauthenticated registration metadata.

Octo STS versions prior to 0.11.2 contain an information disclosure vulnerability where sensitive trust policy details, including internal cloud account identifiers and repository references, are exposed via Exchange error messages to unauthorized OIDC token holders.

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to potentially execute OS commands via a crafted HTTP request.

A buffer overflow vulnerability in the zdp_wtp binary of Zyxel NWA110AX allows for LAN-based privilege escalation.

A queue pointer corruption vulnerability in libslirp allows an adjacent attacker to crash the host networking process via burst traffic, leading to a denial of service.

A missing authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation.

Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.

Detection rule identifies potentially destructive Azure resource group deletions by unusual principals using an ES|QL first-seen analysis to distinguish anomalous activity from established CI/CD teardown.

A privilege escalation vulnerability in the Linux kernel io_uring subsystem caused by incorrect compound page validation allows local attackers to achieve out-of-bounds memory access and modify process credentials.

The psqlODBC driver is vulnerable to memory corruption during loread operations because it fails to validate server-provided data lengths against buffer sizes.

PyMuPDF versions prior to 2.0 contain a stack-based buffer overflow in the JM_set_annot_callout_line function, allowing remote code execution via specifically crafted callout arguments in Page.add_freetext_annot.

A heap out-of-bounds write vulnerability in the Linux kernel SMB1 client allows an attacker-controlled server to overwrite process credentials and escalate privileges to root.

CVE-2024-0582 is a privilege escalation vulnerability in the Linux kernel io_uring subsystem that enables unauthorized write access to /etc/passwd via a Dirty Cred technique.

A command injection vulnerability in the pppoe_wrapper daemon on Amlogic-based Android TV boxes allows local attackers to achieve root privilege escalation by sending malicious payloads to a world-writable AF_UNIX socket.

A missing bounds check in Modem firmware allows an attacker operating a rogue base station to execute an out-of-bounds write, leading to remote privilege escalation without user interaction.

ReadyMedia versions 1.3.0 through 1.3.3 are vulnerable to a stack-based buffer overflow via crafted DFF audio files, potentially allowing remote code execution.

Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files.

Dell OpenManage Enterprise versions prior to 4.8.0 are susceptible to an OS Command Injection vulnerability, potentially allowing a low-privileged attacker with adjacent network access to execute commands.