Threat briefs

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection vulnerability (CVE-2026-16346) that allows authenticated remote attackers to execute arbitrary OS commands.

SolarWinds Observability Self-Hosted is vulnerable to unauthenticated remote code execution via insecure deserialization, allowing remote attackers to execute arbitrary code.

Roundup of Adobe security advisories published in September 2026.

Bridge is vulnerable to a heap-based buffer overflow that allows for arbitrary code execution when a user opens a maliciously crafted file.

An out-of-bounds write vulnerability in Bridge, tracked as CVE-2026-75658, allows for arbitrary code execution when a user opens a specially crafted malicious file.

CAI Content Credentials is susceptible to an uncontrolled resource consumption vulnerability (CVE-2026-75632), allowing an unauthenticated remote attacker to trigger a denial-of-service condition without user interaction.

The LTSecurity LTK3500SF device stores root and guest account credentials in a recoverable format, allowing attackers to gain full administrative access via SSH or Telnet.

An unauthenticated remote code execution vulnerability (CVE-2026-28324) exists in SolarWinds Observability Self-Hosted due to insufficient integrity checks in non-default, non-secure configurations.

The Global Group, a RaaS operation evolved from Black Lock and Mamona, distributes ransomware via phishing-delivered ISO files and legitimate tool abuse to perform double-extortion attacks.

EvilTokens is a Phishing-as-a-Service (PhaaS) platform operated by threat actor Storm-2992 that facilitates adversary-in-the-middle (AiTM) attacks by abusing OAuth device code authentication flows to compromise user accounts.

The @roomi-fields/notebooklm-mcp package is vulnerable to arbitrary file write via path traversal in the vault_batch tool and /batch-to-vault endpoint, allowing attackers to plant malicious files in unauthorized directories.

Sync-in Server v2.3.0 and earlier is vulnerable to a 2FA bypass in the /api/auth/token endpoint, allowing attackers with known credentials to obtain unrestricted JWTs without providing TOTP codes.

An improper input validation vulnerability in psd-tools (CVE-2026-59991) allows attackers to trigger massive, unvalidated memory allocations using maliciously crafted PSD files, leading to OOM-kill of the host service.

Arista VeloCloud Orchestrator (VCO) On-Prem is vulnerable to CVE-2026-93952, which is confirmed to be under active exploitation in the wild.

Multiple security vulnerabilities identified in Erlang/OTP across various version branches require immediate patching to mitigate potential risks.

This detection identifies anomalous bursts of failed GKE API requests that may indicate credential stuffing, RBAC probing, or reconnaissance activity within Google Kubernetes Engine environments.

CVE-2026-95271 is an improper authentication vulnerability in dgtlmoon changedetection.io versions up to 0.60.7, allowing remote attackers to bypass security via the check_authentication function.

An unauthenticated, on-path attacker can trigger a denial-of-service condition in MikroTik RouterOS by sending malformed BGP UPDATE packets with out-of-bounds prefix-lengths.

CVE-2026-43641 is an OS command injection vulnerability in the Virtualizor billing module that allows unauthenticated remote attackers to achieve root-level code execution via serialized billing data.

A critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager is currently being exploited in the wild, allowing attackers to gain full system control.

OpenPLC Runtime v3 contains a cross-site scripting vulnerability that allows attackers to hijack operator session cookies and issue unauthorized commands to industrial control processes.

An out-of-bounds write vulnerability (CVE-2026-87121) in the lwIP TCP/IP Stack MQTT client allows unauthenticated remote attackers to achieve full code execution on affected devices.

A critical file upload vulnerability (CVE-2026-50093) in the Siemens Siveillance Control OIS web module allows unauthenticated or low-privileged remote attackers to achieve root-level code execution.

An unauthenticated path traversal vulnerability (CVE-2026-67367) in Siemens SIMOVE Fleetmanager and SIPLANT allows remote attackers to read arbitrary files from the underlying operating system.

An unauthenticated remote attacker can exploit an improper input validation vulnerability (CVE-2026-89207) in Siemens WTV676 and WTV776 devices to force them into protection mode, resulting in a permanent loss of remote web access.

The lwIP TCP/IP stack contains a double free vulnerability (CVE-2026-91018) that could allow an attacker with adjacent network access to trigger memory corruption or remote code execution.

Aureus ERP versions prior to 1.5.0 contain an authorization bypass in the ChatterPanel component, allowing authenticated users to access and manipulate arbitrary messages via ID enumeration.

Databasement versions before 1.7.14 are vulnerable to an authentication bypass where invitation tokens are improperly validated and cached, allowing attackers to hijack accounts and gain access to managed database credentials.

CVE-2026-94640 allows a remote, unauthenticated attacker to trigger a denial of service in the rpcbind service through the submission of a flood of unique RPC requests that exhaust system memory.

Authenticated attackers can execute arbitrary shell commands as root on multiple Lantronix console manager models by exploiting an undocumented MFC EEPROM read command that triggers command injection via a system call.