Threat briefs

GitHub Copilot CLI versions prior to 1.0.43 are vulnerable to arbitrary code execution via a malicious bare git repository nested within a project directory, exploiting git's automatic bare repository discovery and the `core.fsmonitor` configuration setting.

A vulnerability in Engine.IO versions 6.5.0 through 6.6.6 allows unauthenticated attackers to cause a process crash by sending a crafted WebTransport upgrade request.

Authenticated users without file upload permissions can exploit a missing authorization check in Kirby CMS to exhaust server storage via incomplete chunked file uploads, leading to denial-of-service.

Detection of attackers using PowerShell to download executable, script, or library files from untrusted remote domains as part of command and control activity.

An unauthenticated remote code execution vulnerability (CVE-2026-82919) exists in the cu silicon library versions 0.1.5 and earlier due to missing authentication controls in the create_app function.

The Hospital-Management-System version 1.0 is vulnerable to remote SQL injection via the Contact parameter in /search.php, enabling potential unauthorized data access.

A local integer overflow vulnerability in the MmioWritePath function of the MSI Dragon Center driver allows local attackers to escalate privileges via manipulation of argument count or element size parameters.

A memory corruption vulnerability in GDB's STABS parser allows an attacker to achieve arbitrary code execution by providing a crafted ELF binary containing malicious debug sections.

CVE-2023-49970 is a critical SQL injection vulnerability in the Customer Support System version 1.0 allowing unauthenticated attackers to execute arbitrary database commands via the 'subject' parameter.

CVE-2024-1512 is an unauthenticated union-based SQL injection vulnerability in the MasterStudy LMS WordPress plugin via the 'user' parameter, allowing remote database compromise.

The FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.

MegaEase EaseProbe versions up to 2.3.0 are vulnerable to remote access control bypass via manipulation of HTTP headers including X-Forwarded-For, X-Real-IP, and True-Client-IP.

The ActiveInbox Chrome extension up to version 7.10.24 contains hard-coded Google OAuth Client Secrets in its service worker, potentially enabling unauthorized API access and OAuth flow manipulation.

An XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider allows unauthenticated attackers to perform arbitrary remote file reads via malicious XML input.

The URDSCSI.sys kernel driver in ieungSoft Ultra RAMDisk Pro 1.82 contains an improper privilege management vulnerability that allows local attackers to achieve privilege escalation.

The Keep Backup Daily plugin for WordPress before 2.1.4 contains a vulnerability allowing unauthenticated attackers to trigger database backups and retrieve them via predictable filenames.

CVE-2026-26174 is a race condition vulnerability in Windows Server Update Service that allows an authorized attacker to elevate privileges locally.

Detection logic for identifying unauthorized attempts to read the Linux /proc/<pid>/syscall interface, a technique used for process discovery and preparation for process injection.

Attackers with iam:PassRole and Bedrock resource creation permissions can escalate privileges by creating AgentCore resources with attached high-privilege IAM roles.

Threat actors may attach the AmazonSESFullAccess policy to IAM entities to establish phishing infrastructure and send emails using a victim organization's verified domain.

Attackers can abuse the Windows Application Shim infrastructure via sdbinst.exe to achieve persistence and arbitrary code execution by installing malicious compatibility databases.

Attackers utilize the Windows Application Compatibility Shim (AppCompat) mechanism to achieve persistence and arbitrary code execution by registering malicious shim databases.

A suspected Chinese-speaking operator is targeting Philippine governmental and defense entities by exploiting ownCloud and LiteSpeed Cache vulnerabilities to exfiltrate personnel data and deploy loaders.

Detection of Windows Event 4742 indicating a computer account change performed by an ANONYMOUS LOGON account, which is abnormal and could signify malicious activity, particularly Zerologon exploitation.

An unauthenticated attacker can create or update documents in the target XWiki instance by exploiting the XAR import functionality through the `/wikis/{wikiName}` REST endpoint due to missing authentication and authorization checks, as detailed in CVE-2026-33137.

A functional exploit for CVE-2023-46818 in ISPConfig allows authenticated high-privileged users to achieve Remote Code Execution via PHP code injection in language_edit.php.

NASA earthdata-search version 1.0.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the scaleImage function, allowing remote attackers to perform unauthorized requests.

The Online Shopping System 1.0 contains an unauthenticated SQL injection vulnerability in the search functionality of /action.php, allowing remote attackers to execute arbitrary database queries.

The ProfilePress WordPress plugin contains an unauthenticated RCE vulnerability (CVE-2026-66047) caused by a predictable 32-bit connect token in the AJAX handler, allowing remote attackers to install malicious plugins.

An unauthenticated remote attacker can cause a denial of service in SmallRye GraphQL by exploiting improper BigInteger scalar coercion to trigger resource exhaustion.