Threat briefs

Adversaries with compromised credentials may abuse the AWS STS GetCallerIdentity API to verify access and identify the current account context, serving as a primary indicator of initial cloud reconnaissance.

Adversaries with high-level privileges may delete AWS Web Application Firewall (WAF) Web ACLs to disable security controls and facilitate unauthorized access to protected applications.

Adversaries targeting AWS environments may delete critical S3 bucket configurations, such as policies, encryption, and lifecycle rules, to impair security controls and conceal malicious activity.

This detection monitors for the first occurrence of an AWS identity accessing AWS Systems Manager (SSM) SecureString parameters with the decryption flag enabled, indicating potential unauthorized retrieval of stored sensitive credentials.

An adversary who has compromised an AWS service instance, such as EC2 or Lambda, may leverage assigned IAM roles to programmatically retrieve sensitive credentials from AWS Secrets Manager using the GetSecretValue API.

The threat actor UAT-10147 is deploying a sophisticated cross-platform backdoor named SPECTRE, featuring kernel-level rootkits, BYOVD defense evasion, and AI-assisted development artifacts to target IIS and Linux infrastructure.

itsourcecode Payroll System 1.0 is vulnerable to unauthenticated remote SQL injection via the Username parameter in the login function, potentially allowing full database compromise.

Heptabase contains a stored cross-site scripting (XSS) vulnerability allowing authenticated remote attackers to execute arbitrary JavaScript in the context of other users.

An unauthenticated remote arbitrary file read vulnerability (CVE-2026-78212) in 4MOSAn Management Center allows attackers to download sensitive system files via path traversal.

An unauthenticated SQL injection vulnerability in the PlanController.getImmediatePlans function of the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System allows remote attackers to execute arbitrary SQL commands.

A prototype pollution vulnerability in the Ractive.js 'Ractive#set' function allows remote attackers to modify object prototype attributes, potentially leading to further exploitation.

An unauthenticated OS command injection vulnerability in 4MOSAn GCB Doctor allows remote attackers to execute arbitrary system commands via an unremoved ADOdb test page.

Microsoft Exchange Server contains multiple vulnerabilities that can be exploited by an authenticated remote attacker to achieve privilege escalation, arbitrary code execution, security control bypass, data manipulation, and denial-of-service.

An unauthenticated SQL injection vulnerability in itsourcecode Sales and Inventory System 1.0 allows remote attackers to manipulate the User parameter in processlogin.php to execute arbitrary SQL commands.

A critical stack-based buffer overflow vulnerability in the UTT HiPER 1250GW HTTP handler allows remote authenticated attackers to execute arbitrary code via a crafted 'pvid' parameter.

The exceljs-hardened library before version 5.0.0 is vulnerable to prototype pollution, allowing unauthenticated remote attackers to inject malicious properties into Object.prototype via crafted cell note data.

Ghostwriter versions prior to 7.1.2 are vulnerable to an authorization bypass via the report template swap endpoint, allowing authenticated attackers to enumerate and exfiltrate sensitive client-scoped template contents.

An out-of-bounds write vulnerability in the libwebsockets LECP CBOR recording function (CVE-2026-78161) allows remote attackers to trigger memory corruption via crafted CBOR data.

Open5GS 2.8.0 contains an out-of-bounds read vulnerability in the pcrf_rx_aar_cb function that allows a remote attacker to potentially cause a service crash or information disclosure.

Open5GS 2.8.0 contains a remote heap-based buffer overflow vulnerability (CVE-2026-78156) in the S6a Authentication-Information-Request Handler that can be triggered by manipulating the Visited-PLMN-Id argument.

An unauthenticated remote code execution vulnerability (CVE-2026-78154) in open-wearables versions 0.6.2 and earlier allows attackers to bypass authentication in the invitation code redemption endpoint.

An unauthenticated SQL injection vulnerability in the Barangay Resident Profiling Management System version 1.0 allows remote attackers to execute arbitrary database queries via the 'Search' argument in residents.php.

Tenda CH22 router firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the /goform/editFileName endpoint, allowing potential full system compromise.

The justhtml library version 1.9.1 and earlier is vulnerable to a denial of service attack where malicious, deeply nested HTML tags trigger a Python RecursionError during parsing.

The justhtml library before version 1.15.0 contains multiple vulnerabilities in URL sanitization, HTML serialization, and Markdown passthrough that allow attackers to inject malicious HTML and JavaScript.

JoomGallery versions 4.3.0 and earlier are vulnerable to an access control bypass via the JSON view component, allowing unauthenticated attackers to retrieve protected image metadata and bypass password gates to download private content.

TaxHacker versions 0.8.2 and earlier contain a hard-coded credential vulnerability in the JWT Secret Handler, allowing potential remote exploitation via the BETTER_AUTH_SECRET argument.

An access control vulnerability in docker-socket-proxy (CVE-2026-78122) allows unauthenticated adjacent attackers to bypass restrictions and exfiltrate container filesystems via unauthorized API requests.

The Security Hardener plugin for WordPress contains an authorization bypass vulnerability in versions 2.4.4 and earlier that allows authenticated subscribers to escalate privileges to administrator.

The PPWP WordPress plugin contains a PHP Object Injection vulnerability in the post_protection_roles parameter, allowing authenticated attackers to achieve remote code execution if a compatible POP chain exists in the environment.