Threat briefs

An authenticated Server-Side Request Forgery (SSRF) vulnerability in the Librarian PDF save endpoint allows attackers to perform unauthorized requests against internal network resources.

An authorization bypass vulnerability in Spring Security allows unauthenticated attackers to access restricted endpoints by injecting URL-encoded newline or carriage return characters into request paths protected by RegexRequestMatcher.

An argument injection vulnerability (CVE-2026-75913) in the CodeWhale git_show tool allows attackers to perform arbitrary file writes under the user's privilege level by manipulating the 'rev' parameter.

SiYuan versions prior to 3.8.1 are vulnerable to server-side request forgery through a DNS rebinding attack, enabling unauthorized access to cloud metadata services and internal network resources.

An information disclosure vulnerability in SiYuan's API allows unauthorized remote readers to retrieve cryptographic material necessary for offline, unthrottled GPU-based cracking of encrypted notebook master passwords.

The TypeSpec Spector mock server lacks authentication on its administrative shutdown endpoint, allowing any network-reachable attacker to terminate the server process via a single POST request.

The OpenChoreo cluster-gateway fails to authenticate callers to internal management APIs, allowing unauthorized actors to perform arbitrary Kubernetes API mutations and access Secrets across connected data planes.

Adversaries utilize native Windows utilities like cmd.exe and findstr.exe to search for sensitive private key files, a common post-exploitation technique used to facilitate credential theft, privilege escalation, and persistence.

Adversaries often execute 'crontab -l' to enumerate existing scheduled tasks, enabling the discovery of persistence mechanisms, legitimate job hijacking targets, or privilege escalation opportunities.

Adversaries are abusing the legitimate BrowserCore.exe component to perform unauthorized extraction of Entra ID Primary Refresh Tokens (PRTs) by invoking the binary outside of expected browser-managed contexts.

Versions of ntop nDPI before 6.0 are vulnerable to a heap-based buffer overflow in the ndpi_json_string_escape function, allowing attackers to trigger memory corruption via crafted network traffic.

Unidata netcdf-c through version 4.10.1 contains an out-of-bounds write vulnerability in the NC4_HDF5_inq_attname function that can lead to memory corruption and application crashes.

An authorization bypass vulnerability in ntopng prior to version 6.7.260717 allows authenticated non-administrator users to delete notification endpoints and recipients, disrupting alerting services.

An unauthenticated remote code execution or unauthorized access vulnerability in the freegpt-webui Backend Conversation API allows attackers to bypass authentication via input manipulation.

An authorization bypass vulnerability in jofpin trape 2.0, triggered by manipulating the vId or id arguments, allows remote attackers to gain unauthorized access.

PassMark PerformanceTest, BurnInTest, and OSForensics contain a vulnerability in the DirectIo64.sys driver that allows local users to clear arbitrary physical memory bits, enabling privilege escalation.

Nango versions prior to 0.71.6 contain an authentication bypass vulnerability allowing unauthenticated attackers to achieve remote code execution via the tRPC runner server.

An authenticated SQL injection vulnerability in ILIAS allows users with write permissions to execute stacked queries, leading to unauthorized database access and potential account takeover.

Chroma 1.5.9 is vulnerable to an unauthenticated denial-of-service attack due to insufficient bounds validation on HNSW index parameters during collection creation, allowing memory exhaustion.

IBM Operational Decision Manager is vulnerable to an unauthenticated SQL injection allowing attackers to achieve remote code execution via web shell placement.

An unauthenticated Local File Inclusion (LFI) vulnerability in the Divi Ajax Filter plugin for WordPress enables attackers to execute arbitrary PHP code via the custom_loop_template parameter.

Grafana Enterprise contains multiple vulnerabilities that allow an unauthenticated remote attacker to escalate privileges to a standard user or administrator level, posing a significant risk to authorization and access control within the deployment.

A vulnerability in the Checkmk Agent Receiver allows a remote, authenticated attacker to trigger a Denial of Service condition on the affected monitoring infrastructure.

VMware has released security updates for Fusion and Workstation to address multiple vulnerabilities, including CVE-2026-59346 and CVE-2026-59347, which could allow a remote attacker to execute arbitrary code.

SonicWall Network Security Manager (NSM) versions prior to 4.3.1-R4 contain multiple vulnerabilities, including CVE-2026-78327, CVE-2026-78328, and CVE-2026-81939, that allow for remote code execution, privilege escalation, and security policy bypass.

This brief covers the detection of an anomalous execution pattern where 32-bit processes in SysWOW64 launch 64-bit binaries in System32, a technique frequently used for privilege escalation and evasion.

The Lotus Blossom Chrysalis backdoor campaign leverages the Tiny C Compiler (TinyCC) to execute shellcode in memory by masquerading the compiler binary as a system process.

Adversaries frequently abuse the Windows %temp% directory to execute malicious payloads, including droppers and RATs, to evade security controls and achieve persistence without requiring administrative privileges.

Attackers frequently abuse the built-in 'wevtutil.exe' utility to clear Windows event logs, a common defense evasion technique used to disrupt forensic investigations and hide post-compromise activity.

This brief identifies potential data exfiltration by detecting the use of 'split' and 'dd' utilities to segment files for evasion of security controls on macOS endpoints.