Threat briefs

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4_build_2024-12-26 contains multiple critical vulnerabilities, including command injection, hard-coded credentials, and lack of firmware signing, allowing remote unauthenticated attackers to gain full system control.

A critical command injection vulnerability (CVE-2026-22755) in various VIVOTEK network camera firmware allows unauthenticated remote attackers to execute arbitrary commands with root privileges.

An unauthenticated attacker within radio range can trigger a denial-of-service on the Baicells Nova 430H eNodeB by sending malformed NAS payloads during connection setup (CVE-2026-96274).

An unauthenticated remote code execution vulnerability, tracked as CVE-2024-52317, exists in Octopus Deploy due to improper input validation.

Node.js contains multiple vulnerabilities enabling remote, unauthenticated attackers to execute arbitrary code, bypass security controls, perform denial-of-service, disclose sensitive information, manipulate files, or escalate privileges.

A vulnerability in the Ghostscript interpreter allows a local attacker to escalate privileges by processing specifically crafted documents.

Multiple vulnerabilities in various Apache Airflow providers allow attackers to perform file manipulation, SQL injection, information disclosure, and security bypasses.

A high-severity vulnerability, CVE-2024-29826, in DENX U-Boot allows an attacker on an adjacent network to achieve arbitrary code execution.

This detection monitors for processes executing from temporary or user-writable directories that perform DNS queries to AWS management endpoints, a pattern frequently utilized by post-exploitation tools to bypass CLI-based security controls.

Roundup of Apple security advisories published in September 2026.

The Cargo extension for MediaWiki is vulnerable to reflected XSS via unescaped field-alias text in export error messages, allowing unauthenticated attackers to execute arbitrary scripts in the wiki's origin.

A heap-based buffer overflow in the RPM Package Manager allows for out-of-bounds writes and potential code execution when processing maliciously crafted RPM files containing specific symlink entries.

A missing authorization vulnerability (CVE-2026-87748) in Interprobe Qorela DC allows authenticated users to escalate privileges and perform unauthorized actions.

An arbitrary file upload vulnerability in the Ultra Addons for Contact Form 7 plugin, tracked as CVE-2026-82901, allows unauthenticated attackers to execute arbitrary code when the PDF Generator module is enabled.

NeedyMantis is a modular, post-compromise malware framework used by threat actors to maintain long-term persistence through DLL sideloading and custom encrypted archives.

West African threat actors are leveraging compromised university email accounts to distribute job-based advance fee fraud by harvesting credentials via legitimate third-party form services.

CVE-2026-0899 is an out-of-bounds memory access vulnerability in the Chromium V8 JavaScript engine that may result in memory corruption, process crashes, or arbitrary code execution.

A local attacker can exploit a vulnerability within the KDE desktop environment to execute arbitrary code with the privileges of the Session Manager.

Attackers with unauthorized access to a CrowdStrike management console can leverage the 'runscript' functionality to execute arbitrary PowerShell commands on remote Windows hosts.

Tacomall 1.0.0 is vulnerable to an improper authorization flaw in the OrgStaffServiceImpl.add function, allowing remote attackers to manipulate isAdmin or jobId arguments to achieve unauthorized access.

A path traversal vulnerability in Flatpak allows malicious applications to overwrite or replace critical host system files with symlinks during deployment, with root-level impacts for system-wide installations.

Rebuild versions up to 4.4.7 and 4.5.0-beta5 are vulnerable to an improper authentication flaw in the login component that permits remote attackers to bypass authentication via manipulated requests.

MODSetter SurfSense up to version 2.0.3 is vulnerable to remote command injection via the MCP Connector Integration component, allowing unauthenticated attackers to execute arbitrary system commands.

The fast-uri library incorrectly parses URI authorities containing unbalanced brackets, allowing attackers to bypass SSRF denylists and security filters by causing a discrepancy between the parsed host and the host resolved by underlying HTTP clients.

Adversaries are abusing the legitimate AWS IoT Secure Tunneling localproxy binary in destination mode to establish unauthorized remote access tunnels through AWS-managed infrastructure.

Adversaries utilize cloud enumeration and exploitation frameworks to perform reconnaissance and identify privilege escalation paths following the compromise of cloud credentials on endpoint devices.

A SQL Server stored procedure parameter truncation vulnerability (CVE-2026-101878) in Bitwarden Server allows attackers to authenticate as other users by crafting overlapping SSO identifiers.

An improper privilege management vulnerability in RaspAP raspap-webgui allows remote attackers to manipulate sudo configuration files, potentially leading to unauthorized privilege escalation.

A vulnerability in the OpenDMARC Internationalized Domain Name Handler (up to 1.4.2) allows remote attackers to trigger an encoding error in the opendmarc_policy_query_dmarc function, with public exploit code currently available.

An unauthenticated remote OS command injection vulnerability in the Netcore NAP930 router allows attackers to execute arbitrary system commands via the sid argument in the network_tools CGI component.