Threat briefs

A critical stack-based buffer overflow in the devdiscover service of the FAST FAC1900R network device allows remote code execution due to improper handling in the copy_msg_element function.

A critical stack-based buffer overflow vulnerability in the devdiscover service of FAST FAC1200R routers allows unauthenticated remote attackers to achieve code execution via malformed advertisement frames.

CVE-2026-100721 is a sandbox escape vulnerability in vm2 versions before 3.12.2, allowing untrusted guest code to execute arbitrary code in the host context via an authorization bypass in the external-module resolver.

An unrestricted file upload vulnerability in Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System allows unauthenticated attackers to execute arbitrary code via web shell deployment.

A vulnerability in RustDesk allows a remote authenticated attacker to gain unauthorized access to sensitive information.

Malicious or compromised npm packages leverage installation lifecycle scripts to launch obfuscated PowerShell or download cradles, enabling initial access and secondary payload deployment.

Malicious npm packages and supply-chain compromises often utilize installation scripts to spawn curl processes that download secondary payloads from remote servers.

Parallels Desktop versions prior to 27.0.0 are vulnerable to local privilege escalation via an argument injection flaw in the root-privileged prl_disp_service.

Detection of potential privilege escalation or credential access attempts via repeated sudo authentication failures on macOS hosts.

Adversaries leverage macOS launch agent and daemon registration to establish persistence by executing binaries from temporary or world-writable directories to evade standard security monitoring.

Adversaries establish persistence on macOS by registering launch agents or daemons using dot-prefixed property list files to evade detection by hiding configuration artifacts.

This brief details a detection strategy for identifying the unauthorized deletion of AWS Lambda functions, a technique used by adversaries to disrupt operations, hide backdoors, or erase evidence.

Apache Roller 6.1.5 is susceptible to unauthenticated remote code execution via insecure Java deserialization on the XML-RPC endpoint, which is triggered by an attacker-supplied 'ex:serializable' extension type before authentication is processed.

An unauthenticated remote command injection vulnerability in the aaPanel BaoTa File Merge Handler allows attackers to execute arbitrary system commands via the split_file_path parameter.

An unauthenticated server-side request forgery (SSRF) vulnerability in OctoberCMS allows remote attackers to manipulate the realSourcePath argument to perform unauthorized internal network requests.

An unauthenticated remote authorization bypass vulnerability exists in the Netcore NBR100V2 router, allowing attackers to manipulate system configurations via the ACL Handler component.

CVE-2019-8451 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Atlassian Jira Server gadgets servlet that allows attackers to access internal network resources.

A stack-based buffer overflow vulnerability in the p2pcam HTTP Parser component of Eyeplus 57.0.0.0308 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Netcore NBR200V2 version 1.3.241127.071246 is vulnerable to remote command injection via the Traceroute Diagnostic Feature, allowing unauthenticated attackers to execute arbitrary commands.

The youtube-downloader package contains an SSRF vulnerability in the stream function of public/stream.php allowing remote attackers to perform unauthorized outbound requests.

Privoce VoceChat Server versions up to 0.5.36 are vulnerable to server-side request forgery via the open_graphic_parse endpoint, allowing remote attackers to perform unauthorized outbound requests.

An OS command injection vulnerability in the TOTOLINK N150RT web interface allows unauthenticated remote attackers to execute arbitrary commands via the wlanif parameter.

A memory corruption vulnerability in the OpenDKIM dkim_canon_selecthdrs function allows remote attackers to trigger an out-of-bounds write via crafted DKIM signature headers.

An unauthenticated remote code execution vulnerability (CVE-2026-100886) exists in the Debug Service component of multiple Seetong NVR/DVR models, allowing attackers to bypass authentication entirely.

A vulnerability in Flatpak's extract_extra_data() allows malicious repositories to perform path traversal and write arbitrary files to the host filesystem, potentially leading to root access on system-wide installations.

Vulnerable pnpm versions expand sensitive environment variables within proxy settings in malicious pnpm-workspace.yaml files, enabling credential exfiltration during configuration loading.

Craft CMS versions before 4.17.12 and 5.9.18 are vulnerable to authenticated remote code execution via malicious behavior injection in the field layout hydration path.

The python-utcp library versions before 1.1.4 contain a server-side request forgery vulnerability due to improper validation of HTTP redirects within the HttpCommunicationProtocol.call_tool method.

The utcp-http library before version 1.1.4 fails to validate the OAuth2 tokenUrl field in remote OpenAPI specifications, allowing attackers to redirect and capture client credentials.

An improper sanitization vulnerability in Fleet's macOS app install/uninstall script generator allowed arbitrary command execution as root via malicious Homebrew cask metadata.