Threat briefs

A stack-based buffer overflow vulnerability in the _tWlanTask function of the FAST FAC1203R router allows remote code execution via network-based manipulation.

OrdaSoft Real Estate Manager for Joomla versions 6.7.8 and earlier are vulnerable to unauthenticated SQL injection via the 'order_field' parameter, enabling unauthorized database access and data exfiltration.

Nginx Proxy Manager versions 2.16.0 and earlier lack rate-limiting on authentication endpoints, enabling unauthenticated attackers to perform credential stuffing and bypass MFA via brute-force.

An unauthenticated remote code execution vulnerability in mall4j through 4.0 allows attackers to reset arbitrary storefront passwords via the PUT /user/updatePwd endpoint.

An unauthenticated remote command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 allows attackers to execute arbitrary commands via the USB Device Management API.

A publicly disclosed vulnerability in Netcore POWER13 (version 2.0.240730.162638) allows remote attackers to manipulate the routerd.passwd_set function via /ubus, resulting in weak password recovery.

An OS command injection vulnerability in the packet-capture filter component of SUSE NeuVector allows for unauthenticated remote code execution on affected Kubernetes nodes.

Multiple vulnerabilities discovered in NetScaler ADC and NetScaler Gateway may allow an unauthenticated remote attacker to execute arbitrary commands, potentially leading to full appliance compromise.

Angular platform-server is vulnerable to XSS when ProcessingInstruction nodes containing untrusted input are nested within fallback raw-content elements during server-side rendering.

An authenticated deserialization vulnerability in ConvertPlus <= 3.6.3 allows subscribers to inject arbitrary PHP objects via the cp_display_preview_modal AJAX action.

A vulnerability in kube-compare (CVE-2026-87114) allows remote code execution on the operator workstation when processing a crafted 'container://' reference path.

A critical stack-based buffer overflow vulnerability (CVE-2026-101081) in the D-Link DI-8400 web administration interface allows remote attackers to trigger memory corruption and achieve remote code execution.

Unsloth Zoo and Unsloth are vulnerable to remote code execution due to improper input validation in the model-loading compile path, allowing arbitrary Python code execution via malicious config.json files.

Logsign SIEM versions 6.4.101 through 6.4.116 are vulnerable to a path traversal flaw, CVE-2026-90925, which may allow an unauthenticated attacker to access unauthorized files on the host system.

CVE-2026-86595 is an SQL injection vulnerability in Iron Mountain enVision versions prior to 260655 that allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

Netcore NR289-GE version 1.4.5102 is vulnerable to remote unauthenticated OS command injection via the ip argument in the /ap_ip.cgi component.

Logsign SIEM versions 6.4.101 through 6.4.116 contain a critical default credential vulnerability that permits unauthorized access via known usernames and passwords.

The threat actor Storm-3168 (JadePuffer) leveraged compromised service principal credentials to conduct high-speed reconnaissance and a large-scale destructive campaign against an Azure environment.

A command injection vulnerability in the code-ollama grep_search tool allows unauthorized arbitrary command execution by failing to sanitize shell metacharacters in attacker-controlled arguments.

NeedyMantis is a modular, multi-stage malware framework used by threat actors like Storm-3069 to establish persistence and perform follow-on operations via DLL sideloading and custom encrypted archives.

IBM App Connect Enterprise is affected by multiple vulnerabilities, including CVE-2024-45090 through CVE-2024-45094, which enable security bypass, denial-of-service, information disclosure, file manipulation, and cross-site scripting.

Multiple vulnerabilities across various MediaWiki extensions allow remote attackers to perform arbitrary code execution, security bypasses, cross-site scripting, and unauthorized data manipulation or disclosure.

A race condition in QEMU's 9pfs subsystem allows a malicious guest to trigger a use-after-free, enabling directory traversal escapes and potential code execution on the host.

The TerminalFix campaign uses social engineering to trick users into pasting malicious PowerShell commands under the guise of a Cloudflare verification process, leading to secondary payload execution.

Attackers frequently create new local user accounts on Linux systems to establish and maintain persistence following initial compromise.

This brief describes the detection of anomalous MQTT traffic to external brokers, a communication channel leveraged by malware like BambooToken and WailingCrab for command and control.

CVE-2026-86330 is an OS command injection vulnerability in the NooBaa cluster_internal_api component of Red Hat OpenShift Data Foundation, allowing authenticated administrative attackers to execute arbitrary system commands.

CVE-2026-82323 is an authorization bypass vulnerability in the Enocta Platform that allows attackers to manipulate user-controlled keys to escalate privileges and hijack trusted user sessions.

Apache ActiveMQ Artemis versions prior to 2.34.0 are vulnerable to remote code execution or state manipulation via insecure reflection in the FederationStreamConnectMessage.getFederationPolicy() method.

Dbgate versions up to 7.3.1 contain a path traversal vulnerability in the archive link creation component, allowing remote unauthenticated attackers to access arbitrary files on the filesystem via the linkedFolder parameter.