Threat briefs

An unauthenticated remote attacker can crash the 389 Directory Server by sending crafted LDAP paged search requests, resulting in a denial of service condition.

A heap buffer overflow vulnerability in the SASL I/O layer of 389-ds-base allows a remote authenticated attacker to trigger an unsigned subtraction underflow and cause memory corruption.

The WP Fusion (Pro) plugin is vulnerable to unauthorized administrator account creation due to insufficient authorization checks in the ThriveCart Auto Login handler, allowing authenticated users to escalate privileges.

A vulnerability in 389 Directory Server allows unauthenticated attackers to elevate privileges by exploiting state confusion during SASL authentication, leading to unauthorized Directory Manager access.

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

CommonMark versions 1.5.0 through 2.09.0 are susceptible to a CPU-exhaustion denial-of-service attack due to inefficient attribute processing within the AttributesExtension.

Authenticated attackers can exploit CVE-2026-86427 in LibreNMS before version 26.8.0 to inject arbitrary rrdtool arguments, bypassing authorization controls to read unauthorized RRD files or execute commands.

An out-of-bounds read vulnerability in the 'lds' function of the 92181 markdown library allows remote attackers to trigger memory access errors via crafted inputs.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via the 'Biographical Info' field.

PocketMine-MP versions prior to 3.26.5 and 4.0.5 are vulnerable to a denial-of-service attack due to insufficient validation of player-submitted skin data lengths.

The BiHayat App contains a flaw in authentication rate limiting that permits attackers to bypass login protections and gain unauthorized system access.

Multiple vulnerabilities within the libxml2 library could allow remote attackers to bypass security restrictions, manipulate data, disclose sensitive information, or trigger a denial-of-service condition.

A vulnerability in the Bruno API client allows a remote, unauthenticated attacker to disclose sensitive information, potentially leading to unauthorized data exposure.

A vulnerability in CoreDNS allows a remote, unauthenticated attacker to manipulate DNS records, potentially enabling traffic redirection or DNS cache poisoning.

A local privilege escalation vulnerability in the PackageKit service, tracked as CVE-2024-1615, allows local attackers to bypass authorization checks and perform unauthorized package operations.

An authenticated remote attacker can exploit a vulnerability in MISP to gain unauthorized access to sensitive information due to improper access controls.

Threat actors are using compromised ConnectWise ScreenConnect instances to propagate a worm-like, four-stage VBScript infection chain that enables backdooring, UAC bypass, and cryptojacking on connected hosts.

Red Hat JBoss Enterprise Application Platform (EAP) contains a vulnerability in its Artemis component where default deserialization configurations permit arbitrary object deserialization, potentially leading to remote code execution.

A critical authentication bypass vulnerability, CVE-2026-86300, exists in the Tenda AC9 firmware version 15.03.05.14, allowing remote attackers to circumvent security controls via the Web Management interface.

An off-by-one vulnerability in the L2TP Control Message Parser of D-Link DIR-605 routers allows remote attackers to trigger memory corruption via a malicious peer_hostname argument.

An OS command injection vulnerability (CVE-2026-86299) in the Linksys RE7000 version 2.0.15 allows unauthenticated remote code execution via the PingTest Handler component.

An authentication bypass vulnerability in SourceCodester Simple Traffic Offense System 1.0 allows remote, unauthenticated attackers to manipulate user creation via the saveuser.php script.

Multiple vulnerabilities in Netgate pfSense Plus and CE allow remote attackers to execute arbitrary code or conduct cross-site scripting attacks, posing a high risk to network perimeter security.

Adversaries may use compromised long-term IAM access keys (AKIA* prefix) to enumerate AWS Backup vaults, plans, and protected resources as a precursor to ransomware activities.

Adversaries with compromised AWS credentials may request service quota increases to facilitate large-scale malicious operations, detectable by identifying rare identities invoking the RequestServiceQuotaIncrease API.

An attacker with compromised credentials possessing 'organizations:RegisterDelegatedAdministrator' permissions can escalate privileges by designating an attacker-controlled member account as a delegated administrator for sensitive services to gain organization-wide control.

Advantech WISE-6610 series gateways are vulnerable to unauthenticated remote command injection via the Basic Station Certificate-Deletion Handler, potentially leading to full system compromise.

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 contains a vulnerability in db.php that allows remote attackers to gain unauthorized access via hard-coded credentials.

The projeto-siga siga application is vulnerable to server-side request forgery (SSRF) via the DownloadExterno.getUrl function, allowing unauthenticated remote attackers to trigger unauthorized requests.

An unrestricted file upload vulnerability in U+Smart Enjoyment WebSite version 18.6001.1096.1000 allows unauthenticated remote attackers to execute arbitrary code via the /Report/Upload/UploadFormImg.ashx endpoint.