Threat briefs

An authorization vulnerability in Budibase <= 3.38.1 allows authenticated low-privileged users to generate arbitrary S3 pre-signed upload URLs using server-side datasource credentials.

The http4s Ember backend is vulnerable to a denial of service attack via HPACK bomb due to improper header size accounting, allowing remote attackers to trigger Java heap memory exhaustion.

Arctic Wolf Labs identified 249 Dark Caracal malware samples utilizing an Ethereum-based C2 architecture to target the communications sector in Latin America.

Multiple vulnerabilities in Wibu-Systems CodeMeter Runtime allow attackers to bypass security, disclose sensitive data, manipulate information, escalate privileges, or induce denial-of-service conditions.

Multiple vulnerabilities across several OpenSSL branches allow remote attackers to cause denial of service or bypass security policies.

A local information disclosure vulnerability in Veeam Backup & Replication, identified as CVE-2024-40713, allows authenticated local attackers to gain unauthorized access to sensitive data.

Multiple vulnerabilities in the libTIFF library allow a local attacker to trigger a Denial of Service condition through the processing of maliciously crafted TIFF files.

A local, unprivileged attacker can exploit CVE-2024-41611 in PolicyKit to trigger a denial of service condition, potentially leading to system instability.

GitLab is affected by multiple vulnerabilities that allow remote code execution, denial of service, data manipulation, and security control bypass.

A heap buffer overflow in the SQLite SQLAR extension (CVE-2026-39113) occurs when an attacker triggers sqlar_uncompress with a 64-bit size value that gets truncated during memory allocation, leading to heap corruption and potential denial of service.

DNN is affected by multiple high-severity vulnerabilities allowing attackers to achieve remote code execution, escalate privileges, and conduct SSRF or cross-site scripting attacks.

Multiple vulnerabilities, CVE-2026-66152 and CVE-2026-66153, in SonicWall NetExtender Linux Client versions prior to 10.3.6 allow attackers to bypass security policy enforcement.

Multiple vulnerabilities, including CVE-2026-58070 and CVE-2026-65641, affect Veeam Backup & Replication and Veeam ONE, potentially allowing unauthorized access to sensitive backup data and security policy bypass.

Attackers with high-level IAM permissions may delete Amazon Detective behavior graphs to impair forensic investigations by destroying historical relationship mapping and telemetry analysis data.

Adversaries with EKS administrative permissions may exploit EKS access entries to temporarily grant themselves cluster-admin access, establish persistent Kubernetes RBAC backdoors, and delete the access entry to conceal their activity.

Detection rule monitoring for the creation of binfmt configuration files which can be abused by threat actors to execute arbitrary code or maintain persistence on Linux systems.

Adversaries may delete Amazon GuardDuty threat intelligence sets to blind detection capabilities by removing custom feeds of known-malicious IP addresses and domains.

Agent DVR version 5.1.6.0 is vulnerable to an authenticated arbitrary file upload via the audio upload component, potentially leading to remote code execution.

Public availability of multiple proof-of-concept exploits for CVE-2023-21768, a local privilege escalation vulnerability in the Windows Ancillary Function Driver (AFD), increases the risk of local users elevating processes to SYSTEM privileges.

A critical unauthenticated SQL injection vulnerability (CVE-2026-76904) in the GeoTools library allows remote attackers to execute arbitrary SQL via the jsonArrayContains filter function.

A critical pre-authentication Remote Code Execution vulnerability in Metabase allows unauthenticated attackers to execute arbitrary system commands via malicious H2 database connection strings.

An exploit chain targeting SUSE Linux systems leverages CVE-2025-6018 and CVE-2025-6019 to achieve local privilege escalation to root by abusing PAM environment injection and a race condition in UDisks2.

Exploitation of CVE-2023-35078 in Ivanti EPMM allows unauthenticated remote API access, potentially leading to data theft, unauthorized modifications, or further system compromise.

A vulnerability in Nginx allows a remote attacker to execute arbitrary code and cause a denial-of-service condition, affecting Nginx Open Source versions 1.x before 1.30.2, versions after 1.31.0 before 1.31.1, Nginx Plus versions 37.x before 37.0.1.1, and versions Rx before R36 P5 or R32 P7.

Threat actors are actively exploiting vulnerabilities in Android-based automotive head units to install malicious software that enrolls the devices into a residential proxy botnet.

CVE-2022-34721 is a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) extension, which is being actively exploited in the wild to gain unauthorized code execution.

The IC3 has issued an advisory regarding the active exploitation of Siemens S7 Series PLCs within US critical infrastructure sectors using CVE-2026-4357 to disrupt operational technology.

An Insecure Direct Object Reference (IDOR) vulnerability in AbsysNet 2.3.1 allows remote, unauthenticated attackers to hijack active user sessions via brute-force enumeration of session identifiers.

An unauthenticated path traversal vulnerability (CVE-2025-10951) in the geyang/ml-logger library enables attackers to perform arbitrary file access via the log_handler and stream_handler components.

Multiple vulnerabilities in the util-linux package allow a local attacker to escalate privileges, bypass security measures, manipulate data, or trigger a denial-of-service condition.