Threat briefs

Google Workspace audit logs identify suspicious authentication attempts including unauthorized application access, programmatic login anomalies, and general suspicious sign-in events.

Adversaries use Set-Alias and New-Alias cmdlets in PowerShell to rename standard commands, obfuscating malicious scripts to bypass security monitoring and automated analysis.

Detection of the Dumpert hacktool, used to dump memory from the lsass.exe process to facilitate credential theft.

A memory corruption vulnerability in GIMP allows attackers to achieve arbitrary code execution by tricking a user into opening a maliciously crafted GIMPressionist preset file.

The YOP Poll plugin for WordPress, in versions up to 7.0.10, exposes REST nonces via postMessage to window.opener, enabling attackers to perform unauthorized administrative actions including account takeover.

The eesy_ID2WP WordPress plugin contains a path traversal vulnerability (CVE-2026-77193) via the id2wp_path parameter, allowing unauthenticated attackers to read arbitrary files from the hosting server.

A critical unauthenticated RCE vulnerability (CVE-2026-90817) in Vanderbilt REDCap allows attackers to bypass routing restrictions through the '__passthru' parameter, enabling unauthorized access to administrative controllers.

Adversaries manipulate the /etc/sudoers file or /etc/sudoers.d/ directory to establish persistence and gain unauthorized elevated privileges on Linux systems.

ShopXO versions up to 2.2.7 are vulnerable to remote path traversal attacks via the path_type argument in the Ueditor Upload Interface, allowing unauthorized file access.

A critical out-of-bounds write vulnerability in the D-Link DIR-825 firmware (version 3.00b32) allows remote attackers to trigger memory corruption via the peer_hostname parameter.

CVE-2026-94504 describes a stored cross-site scripting vulnerability in Ninja Forms version 3.15.3, allowing attackers to execute arbitrary scripts in an administrator's browser session via the legacy submission editor.

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

The java110 MicroCommunity platform up to version 2.0 contains a SQL injection vulnerability in the QueryServiceSMOImpl.fallBack function, allowing remote attackers to execute arbitrary database queries via the fallBackSql argument.

The Paytium: Mollie payment forms & donations plugin for WordPress contains an unauthenticated privilege escalation vulnerability allowing attackers to register as site administrators.

The zapros library fails to enforce memory bounds during response decompression, allowing remote servers to trigger denial-of-service via memory exhaustion (CVE-2026-61652).

The jawn-parser library is vulnerable to a denial-of-service condition where fragmented input triggers quadratic parsing effort, leading to CPU exhaustion.

The Formie plugin for Craft CMS is vulnerable to an unauthenticated submission hijacking flaw (CVE-2026-76087) where attackers can overwrite other users' in-progress forms by supplying arbitrary submission IDs.

An authorization flaw in the Klever-Go VM allows attackers to execute an account takeover by leveraging an incorrectly validated RecipientAddr parameter during indirect smart contract calls.

Authenticated users can achieve arbitrary code execution in OpenC3 COSMOS by writing malicious payloads into user-writable configuration overlays that are subsequently rendered as code by the application.

An unauthenticated SQL injection vulnerability in ReactPress allows attackers to exfiltrate database contents via malicious HTTP query parameter keys in API requests.

Elysia versions before 1.4.29 are vulnerable to a denial-of-service attack due to quadratic time complexity in the 'multipart/form-data' normalization process, leading to CPU exhaustion.

Detection of privilege escalation within Anthropic Claude for Enterprise where users are promoted to organization administrator, granting attackers control over security settings and API configurations.

Unauthorized deletion of Anthropic admin API keys may indicate an attacker disrupting security monitoring, disabling compliance logging, or covering tracks after establishing persistence.

This detection monitors for potential credential brute force or stuffing activity against Anthropic accounts by identifying multiple authentication failures for a single email address within one hour.

This brief covers the detection of unauthorized access to exported audit log archives in the Anthropic platform, a technique used by attackers to scout security visibility and identify detection gaps prior to control-plane abuse.

An authorization bypass vulnerability in the UnmountSegment function of the kvcache-ai mooncake RPC Path Handler allows unauthenticated remote attackers to perform unauthorized operations by manipulating client_id or segment_id arguments.

An unauthenticated remote SQL injection vulnerability in pmTicket Project-Management-Software allows attackers to execute arbitrary SQL commands via the 'conn_settings' parameter in /ajax/add_project.php.

An unauthenticated vulnerability in the OpenShift console /api/devfile/ endpoints allows remote attackers to perform Server-Side Request Forgery (SSRF) and cause Denial of Service (DoS) via memory exhaustion.

A misconfiguration in the OpenShift Console CatalogdHandler allows unauthenticated remote attackers to leak internal operator-catalog data and relay requests into the catalogd namespace.

DataLife Engine 18.0 contains a remote SQL injection vulnerability in the search module's strip_data function, allowing unauthorized database queries via the story argument.