Threat briefs

An evidence validation flaw in @hulumi/policies versions prior to 1.3.2 allows attackers to suppress security violations by submitting valid, but unrelated, evidence from other resources.

The @hulumi/drift package versions prior to 1.3.2 are susceptible to malicious reconciliation plan injection due to insufficient validation of externally supplied execute plans.

CVE-2024-22939 is a Cross-Site Request Forgery (CSRF) vulnerability in Sunkaifei Flycms version 1.0 allowing unauthorized modification of article categories via the category_edit endpoint.

An unauthenticated privilege escalation vulnerability (CVE-2026-18366) in the Events Manager WordPress plugin allows attackers to compromise user accounts and escalate privileges via REST API exploitation.

PowerJob versions up to 5.1.2 contain a server-side request forgery vulnerability in the MuConnectionManager component that allows remote, unauthenticated attackers to perform unauthorized network requests.

Colorful iGameCenter 2.0.0.81 is vulnerable to local privilege escalation due to improper input validation within the WinRing0x64.sys IOCTL dispatch handler.

A vulnerability in the Administrative Servlet of Soarkey StudentManagement and 学生信息管理系统 allows remote attackers to bypass authorization via manipulation of the action argument in AdminDao.doGet.

Online Medicine Delivery System 1.0 contains a SQL injection vulnerability in the login interface, allowing remote unauthenticated attackers to bypass authentication or access database contents.

This brief documents the risks and detection strategies for internal Windows SMB (TCP 139/445) traffic traversing the network perimeter, a common indicator of unauthorized remote access or data exfiltration.

This brief details detection logic for identifying potentially malicious RPC traffic originating from internal segments toward external networks, a common vector for initial access and lateral movement.

Publicly accessible Remote Procedure Call (RPC) services on TCP port 135 facilitate initial access and backdoor establishment by threat actors.

The exposure of VNC services to the public internet enables unauthorized remote access, providing adversaries a vector for initial access or persistent backdoors.

Adversaries, including the BadPatch malware family, utilize non-standard port 26/TCP for SMTP-based command and control and data exfiltration to evade traditional security monitoring.

Adversaries, including FIN7, utilize the downloading of RAR archives and PowerShell scripts from external sources to retrieve encoded or encrypted payloads to facilitate initial access and lateral movement.

Kamailio versions up to 5.5.0 and 6.0.7 contain an out-of-bounds read vulnerability in the get_4bytes function that allows remote attackers to trigger memory errors.

An unauthenticated remote file upload vulnerability in the Cozmoslabs Profile Builder WordPress plugin (CVE-2026-82607) allows remote attackers to upload arbitrary files to the server via admin-ajax.php.

The TOTOLINK NR1800X router is vulnerable to remote command injection via the setUssd function in cgi-bin/cstecgi.cgi, enabling unauthenticated attackers to execute arbitrary system commands.

Detects the execution of a binary from archive-related paths within a user's Temp directory, potentially indicating attempts to bypass Mark-of-the-Web (MOTW) or exploit vulnerabilities like CVE-2025-0411.

Concrete CMS versions prior to 9.5.1 contain an IDOR vulnerability in the get_rating endpoint that allows unauthenticated attackers to enumerate message IDs and disclose rating data for private content.

A path traversal vulnerability in the AJCloud AJY IPC jdbhttpd web service allows unauthenticated remote attackers to read arbitrary files with root privileges via crafted URI requests.

CVE-2026-82549 is a remote code execution vulnerability in the SecurityModeComplete Handler of Linux Foundation Magma 1.9.0, currently subject to public exploit availability.

Admidio versions prior to 5.0.12 contain a blind SQL injection vulnerability in the relation_type_list parameter, allowing unauthenticated attackers to exfiltrate database contents.

NextChat versions 2.15.8 through 2.16.1 are vulnerable to credential theft due to weak URL validation in the proxy endpoint, allowing attackers to exfiltrate the server's OpenAI API key.

CVE-2024-27956 is a critical vulnerability in the Valvepress Automatic WordPress plugin (versions 3.92.0 and earlier) that allows unauthenticated remote code execution via a publicly available exploit.

Keploy versions 3.1.0 through 3.6.25 contain a vulnerability where the agent control-plane HTTP server binds to all interfaces without authentication, enabling unauthorized access to TLS session keys and recording management endpoints.

Jina AI reader contains a server-side request forgery vulnerability caused by a missing private-address guard when deployed outside of Google Cloud, allowing unauthenticated attackers to access internal network resources.

A race condition vulnerability in the update_file_usage function of FileCodeBox versions up to 2.3 allows remote attackers to manipulate file usage limits.

A remote memory corruption vulnerability in the TOTOLINK A720R router allows unauthenticated attackers to trigger a crash or potentially achieve code execution via the cstecgi.cgi script.

An integer underflow vulnerability in the CFE_SB_GetUserDataLength function of the NASA cFS cFE Software Bus (up to version 7.0.1) allows remote attackers to trigger memory corruption via manipulated message size arguments.

CVE-2026-82478 is a stack-based buffer overflow in the NASA Trick simulation environment (version 19.6.0) that enables remote attackers to trigger memory corruption via the TCP Socket Handler.