Threat briefs

An unauthenticated remote code execution vulnerability (CVE-2026-78006) exists in The Events Calendar plugin for WordPress due to insecure deserialization in the is_safe_widget_instance function.

This brief documents the execution mechanics of Microsoft System Center Configuration Manager (SCCM), identifying risks where adversary-controlled software or scripts are deployed through the SCCM client infrastructure.

This brief details a detection strategy for identifying potential command-and-control (C2) and exfiltration activity on macOS by monitoring for outbound connections to abused cloud services, paste sites, and tunnel providers.

A heap-based buffer overflow in the stb_vorbis library allows for arbitrary code execution via a maliciously crafted Ogg Vorbis audio file.

Central Dogma's Git mirror SSH client disables host-key verification, allowing on-path attackers to perform Man-in-the-Middle (MitM) attacks to exfiltrate sensitive configuration data or inject malicious commits.

An authorization bypass vulnerability in the Shopper framework allows authenticated users with limited privileges to perform unauthorized product deletions across any collection in the database.

Mockoon versions before 9.7.0 expose an unauthenticated, CORS-misconfigured admin API by default, allowing attackers to exfiltrate environment variables, hijack mock responses, and perform cross-origin secret theft.

The mysql_mcp_server package (v < 0.4.2) fails to implement security protections in SSE transport mode, enabling unauthenticated attackers to perform arbitrary SQL execution, data exfiltration, and potential remote code execution.

Central Dogma uses a hard-coded ZooKeeper replication secret that allows unauthenticated network actors to access configuration logs, perform session forgery, and gain cluster-wide command execution.

Prowler versions through 5.30.0 contain an improper authentication vulnerability where the SAML ACS finish flow incorrectly derives the target tenant from an asserted email domain, enabling cross-tenant account takeover.

The yayson library (<= 4.2.0) is vulnerable to prototype pollution when deserializing malicious JSON:API documents, allowing unauthenticated attackers to corrupt the global Object.prototype and potentially achieve RCE via gadget chains.

This detection identifies potential defense evasion where a newly observed network flow exporter subsequently acts as the source of suspicious security alerts within a 30-minute window.

This detection identifies suspicious DNS queries from Windows processes to high-risk top-level domains commonly used for command and control infrastructure.

Threat actors are using social engineering to deploy modified, backdoored ScreenConnect clients that automate multi-stage payload execution and self-propagation across connected remote hosts.

An unauthenticated authorization bypass vulnerability in Dolibarr allows remote attackers to access arbitrary sensitive files via the document storage endpoints.

SPIP versions before 4.4.18 are vulnerable to remote code execution due to improper validation of the arg parameter in the editer_objet action, allowing attackers to inject malicious serialized data into the job queue.

OmniRoute contains a critical remote code execution vulnerability (CVE-2026-88062) in the /api/acp/agents endpoint, allowing anonymous attackers to execute arbitrary code when requireLogin is disabled.

A social engineering campaign delivered via X direct messages leverages a Google Doc sidebar to deliver platform-specific malware, deploying NetSupport Manager on Windows and Atomic macOS Stealer (AMOS) on macOS.

The Eventin WordPress plugin contains a local file inclusion vulnerability in the event_layout parameter, allowing authenticated contributors to execute arbitrary PHP code.

MoguBlog versions through 6.2 are vulnerable to unauthenticated XML External Entity (XXE) injection via the WeChat callback handler, allowing arbitrary file read and outbound SSRF.

CVE-2026-7863 is an OS command injection vulnerability in TUBITAK BILGEM Pardus Software versions prior to 1.0.5, allowing unauthenticated attackers to execute arbitrary system commands.

CVE-2026-8303 is an incorrect privilege assignment vulnerability in Pardus-software versions prior to 1.0.5 that allows local attackers to perform privilege escalation.

WAVLINK WN535M1 and WN535M3 routers are vulnerable to unauthenticated arbitrary file writes via the sync_server daemon, enabling attackers to gain root-level persistence.

Anthropic has documented multiple threat actors leveraging AI models to automate end-to-end cyberattack workflows including reconnaissance, vulnerability research, credential harvesting, and large-scale data exfiltration.

A use-after-free and double-free vulnerability in the NetBSD kernel's COMPAT_NETBSD32 layer allows local users to trigger memory corruption or kernel panics via crafted recvmsg system calls.

A vulnerability in libp2p-rendezvous through version 0.17.1 allows malicious rendezvous servers to crash client nodes by providing an unbounded registration TTL value.

Hugo versions 0.43 through 0.164.0 include TailwindCSS in the default allowed execution list, enabling Node-based tools to bypass sandbox restrictions and perform unauthorized file read/write operations.

Multiple vulnerabilities in GitLab allow remote attackers to achieve arbitrary code execution, escalate privileges, bypass security controls, and perform other malicious actions.

Multiple vulnerabilities in the Angular framework allow remote, anonymous attackers to perform cross-site scripting (XSS), bypass security controls, and manipulate or disclose sensitive data.

Multiple vulnerabilities in the python-cryptography package for Red Hat Enterprise Linux, including CVE-2024-26130, may allow a remote, unauthenticated attacker to bypass security controls or cause a denial-of-service condition.