Threat briefs

ModelScope insecurely utilizes the unsafe yaml.Loader to parse model configuration files, allowing an attacker to achieve arbitrary code execution by supplying a poisoned repository containing malicious Python object construction tags.

The appium-mcp-server package up to version 0.1.61 contains a path traversal vulnerability in file writing tools, allowing unauthenticated attackers to overwrite sensitive system files.

The FS-Poster WordPress plugin versions up to 8.0.1 contain a remote code execution vulnerability allowing authenticated subscriber-level users to run arbitrary system commands via an unsanitized FFmpeg path parameter.

A local command injection vulnerability (CVE-2026-84233) in the rpm utility allows execution of arbitrary commands when rpmuncompress processes maliciously crafted filenames containing RPM macro syntax.

Talassoft Industrial Management Software versions 4 through 16 contain a hard-coded credentials vulnerability, enabling unauthorized attackers to retrieve sensitive embedded data.

Multiple vulnerabilities in WatchGuard Fireware OS, including the Mobile Security component, allow unauthenticated remote attackers to execute arbitrary code via specially crafted network traffic.

Threat actors are distributing 13 malicious Composer themes via Packagist to compromise streaming websites and deploy a WebKit-to-kernel exploit chain against iOS visitors for data exfiltration and cryptocurrency wallet theft.

Jolokia JSR-160 proxy contains an insufficient validation flaw, identified as CVE-2026-84218, which allows attackers to bypass denylists and trigger JNDI lookups leading to SSRF or remote code execution.

Klemsan KIO versions prior to 1.9 contain a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code due to improper input validation during code generation.

CVE-2026-18210 is a critical SQL injection vulnerability in the TRtek Products's Store application, allowing unauthenticated attackers to manipulate backend database queries.

Teracity E-OSB versions prior to V02.26.07.08.01 contain an SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

EasyAppointments versions 1.5.1 and earlier contain a blind SQL injection vulnerability in search endpoints that allows authenticated attackers to extract sensitive database content via malicious 'order_by' parameters.

A critical authentication bypass vulnerability (CVE-2026-15013) exists in the SAML Single Sign On - SSO Login plugin for WordPress, affecting all versions up to and including 5.4.3, enabling unauthenticated attackers to forge SAML assertions and achieve full administrator-level account takeover due to signature algorithm confusion.

Payload CMS versions prior to 3.73.0 are vulnerable to Blind SQL Injection via maliciously crafted JSON filter inputs processed by the Drizzle database adapter.

Wolf CMS versions up to 0.8.3.1 contain a remote code execution vulnerability in the FileManagerController allowing authenticated users with specific permissions to upload and execute arbitrary PHP files.

The Iranian threat actor Nimbus Manticore is distributing NodeRabbit and PollCat cross-platform RATs via trojanized coding challenges on LinkedIn to compromise developer systems.

A critical stack-based buffer overflow vulnerability in D-Link DIR-825M firmware allows unauthenticated remote attackers to achieve code execution via the /boafrm/formDiskFormat endpoint.

Adversaries abuse the Image File Execution Options (IFEO) registry keys to establish persistence or intercept process termination by configuring GlobalFlags and SilentProcessExit mechanisms.

Detects unauthorized modification of Windows Registry keys within CurrentControlSet used for persistent execution via system extensibility points.

Adversaries frequently disable or weaken Windows Defender security features to facilitate malware persistence and execution without detection.

Adversaries, including the DarkGate malware operators, modify sensitive registry keys associated with Terminal Services to facilitate session hijacking, unauthorized remote access, and defense impairment.

Detects unauthorized modifications to Microsoft Outlook security-related registry keys that may be used to weaken email protections or establish persistence.

Adversaries may achieve persistence by registering a malicious DLL within the Windows Time service (W32Time) configuration, allowing for arbitrary code execution upon system boot.

LibreNMS is vulnerable to stored cross-site scripting (XSS) due to improper output encoding of SNMP-polled data and syslog messages in legacy PHP templates, allowing attackers to execute arbitrary JavaScript in the browsers of authenticated users.

An unauthenticated remote command injection vulnerability in the ArmAngstromInstructionSet function of ICP DAS UA-2200 and UA-5200 devices allows remote attackers to execute arbitrary code via the ParameterArray argument.

The Nokri Job Board WordPress theme is vulnerable to unauthenticated account takeover due to improper password reset token validation, allowing attackers to reset passwords for arbitrary user accounts.

VMware Aria Operations for Networks versions 6.0 to 6.10 contain a vulnerability involving static SSH keys that allow unauthorized remote access and root-level privilege escalation.

Adversaries use findstr.exe to identify the presence of Sysmon by searching for its default driver altitude, 385201, regardless of whether the service name has been altered.

This brief outlines the detection of Windows Management Instrumentation (WMI) event subscriptions used by attackers for persistence and privilege escalation.

Adversaries frequently disable Windows Defender security features by modifying specific registry keys to impair endpoint detection and response capabilities.