Threat briefs

Redpanda versions 26.2.2 and earlier insecurely expose the Admin API on port 9644 by default without authentication enabled, allowing remote attackers to perform superuser actions.

Roundup of Microsoft security advisories published in August 2026.

The Phalcon Volt template compiler fails to escape arguments in the join filter, allowing unauthenticated attackers to perform server-side template injection leading to remote code execution (CVE-2026-59989).

An attacker with ComponentDefinition management permissions can trigger a control-plane denial of service in KubeVela by injecting a symlink to /dev/zero within a remote Terraform repository, causing an OOM-induced controller crash.

The Trestle command-line tool is vulnerable to Server-Side Template Injection (SSTI) due to the unsafe re-evaluation of untrusted Markdown content as Jinja2 template code.

An improper authorization vulnerability in Vikunja allows authenticated users to destroy task organization data in other projects by supplying a target view ID within a crafted API request.

Yamcs versions prior to 5.11.13 contain an unauthenticated directory traversal vulnerability in the HTTP request handling components that allows remote attackers to read arbitrary files from the underlying host.

The WsgiDAV MySQLBrowserProvider sample module is vulnerable to blind SQL injection via unsanitized URL input, allowing unauthenticated attackers to extract database content.

An improper access control implementation in the piccolo_admin /api/tables/sessions/ endpoint allows authenticated non-superuser admins to leak plaintext session tokens and perform privilege escalation to superuser status via CVE-2026-55485.

An authentication bypass in 9router 0.4.80 and earlier allows remote attackers to spoof the 'Host' header, gaining unauthorized access to API proxy endpoints, enabling quota theft via AI relay and server-side request forgery (SSRF).

The Spinnaker rosco-manifests package is vulnerable to remote code execution (RCE) via improper YAML processing during Kustomize bake operations, allowing attackers to execute arbitrary code on rosco pods.

PowSyBl Core is vulnerable to OS command and argument injection (CVE-2026-55673) via unsanitized shell concatenation in its local command execution components, allowing unauthenticated remote command execution.

An Insecure Direct Object Reference vulnerability (CVE-2026-55228) in the Weblate GroupViewSet API allows authenticated project managers to gain unauthorized read access to private projects via manipulated team configurations.

A vulnerability in Incus allows unauthorized users to bypass project restrictions and copy custom storage volumes by exploiting missing authorization checks in the creation handler.

The MariaDB connector for Node.js (CVE-2026-55215) inadvertently sends database credentials during the handshake process before server identity is validated, enabling cleartext credential theft by an active man-in-the-middle.

An insufficient permission check in the Pimcore studio-backend-bundle allows authenticated users with standard object-editing privileges to create class definitions, leading to unauthorized schema modification and server-side file creation.

An unauthenticated remote denial-of-service vulnerability in alos-http allows attackers to crash the server process by sending a single malformed HTTP request starting with a '?' character.

An authentication bypass vulnerability in Portainer allows unauthenticated attackers to hijack uninitialized instances via the /api/restore and /api/users/admin/init endpoints.

An integer overflow vulnerability in the Klever node (klever-go) allows attackers to mint arbitrary amounts of KLV and other assets by bypassing split-royalty validation checks.

The free5GC Network Repository Function (NRF) fails to validate NF registration requests against 3GPP TS 29.510 standards, allowing unauthenticated attackers to inject fraudulent network function profiles into the 5G core service mesh.

The plone.app.portlets package is vulnerable to denial of service, SSRF, and stored XSS via the RSS feed portlet feature, allowing authenticated users with portlet management permissions to exhaust memory, perform internal network reconnaissance, or inject malicious scripts.

The plone.app.event package contains multiple vulnerabilities including DoS, SSRF, and stored XSS within its iCalendar import functionality, potentially allowing a logged-in editor to compromise server availability and security.

Pimcore components including Hotspotimage, ImageGallery, Block, and Video perform insecure PHP deserialization on database-stored metadata, enabling remote code execution via object injection.

Adversaries leverage the macOS Finder Sync plugin mechanism to maintain persistence by using the 'pluginkit' utility to register and enable malicious extensions.

Adversaries may use the systemsetup or launchctl commands to programmatically enable remote SSH services on macOS to facilitate persistence and lateral movement.

This detection identifies potential credential theft by monitoring untrusted processes or osascript attempting to access sensitive browser session cookies and password databases on macOS.

Adversaries abuse native macOS utilities like 'dscl', 'mkpassdb', and 'defaults' to extract user password hashes from ShadowHashData or system plist files to facilitate credential cracking and lateral movement.

Adversaries frequently use standard compression utilities like tar, zip, or gzip to aggregate sensitive files such as SSH keys, cloud credentials, and configuration files prior to exfiltration.

Exploitation attempts targeting Juniper Networks J-Web interface via the webauth_operation.php endpoint to achieve remote code execution.

An insecure deserialization vulnerability in Wazuh cluster communication allows a compromised worker node to achieve remote code execution as root on the master node.