Threat briefs

The @sd-jwt/decode and @sd-jwt/core libraries (0.19.0) fail to correctly validate SD-JWT disclosures, allowing an attacker to silently drop tampered claims.

A critical vulnerability in Flowise allows an authenticated remote attacker to bypass security controls and execute arbitrary code with the privileges of the application service.

The Canadian Centre for Cyber Security has released an advisory regarding multiple unidentified vulnerabilities impacting a wide range of Red Hat enterprise software products.

Multiple Barracuda appliance products are affected by pre-authentication authorization bypass and command injection vulnerabilities that may allow unauthenticated remote attackers to execute arbitrary commands.

SUSE Rancher is vulnerable to a meta proxy allowlist bypass that results in server-side request forgery (SSRF), allowing potential unauthorized internal network requests.

Adversaries with enterprise admin access may modify or delete GitHub Enterprise audit log streaming configurations to blind security monitoring or redirect logs to attacker-controlled infrastructure.

GitHub SSO recovery codes act as break-glass credentials bypassing IdP-enforced MFA, and their unauthorized generation, access, or usage indicates potential credential access or persistence attempts.

This detection identifies potential reconnaissance or credential harvesting by principals performing bulk retrieval of EC2 user data from more than 20 instances within a 10-minute window.

Multiple threat actors, including STORM-0940, are utilizing autonomous, LLM-driven offensive frameworks like ARTEX to conduct highly automated, high-velocity intrusions.

An improper neutralization vulnerability in the Amazon Virtual Engineering Workbench publishing component allows authenticated remote attackers to execute arbitrary code via crafted CloudFormation templates.

OpenAirInterface Core Network v2.2.1 contains a stack-based buffer overflow in the Nudm_UEAU Generate Authentication Data endpoint, allowing an unauthenticated attacker to terminate the UDM process.

A stack-based buffer overflow in the Kamailio ims_qos_npn module allows an unauthenticated remote attacker to cause a denial-of-service condition via a crafted SIP REGISTER request.

The Attendo Admin Android application version 3.0.13 and earlier contains hard-coded MQTT credentials in bundled configuration files, allowing unauthorized access to production data and potential message injection.

An authorization vulnerability in the Munshi company deletion workflow allows authenticated sub-users to permanently delete company records and associated data without the required permissions.

Control Web Panel versions prior to 1.12 contain an execution after redirect vulnerability in the user panel authentication flow that allows attackers with a valid username to bypass authentication and achieve unauthorized code execution.

A remote execution after redirect vulnerability in the studentdetails.php file of the CloudClassroom-PHP-Project application allows for remote exploitation via publicly available exploit code.

An authorization bypass vulnerability in SUSE Rancher Manager (CVE-2026-104623) allows authenticated users to spawn an unprivileged shell pod in the cattle-system namespace.

SUSE Rancher Fleet fails to restrict kubeconfig secret references, allowing a user to associate cluster definitions with management-level administrative credentials and execute arbitrary content with elevated privileges.

A use-after-free vulnerability in the GPU pdma component allows local privilege escalation without requiring user interaction.

Jpom versions 2.10.0 through 2.11.12 contain an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access and execute commands.

HotGo versions up to 2.15.1 contain an authentication bypass vulnerability allowing unauthenticated attackers to hijack user and administrator accounts via a predictable SMS verification code.

Google disrupted a botnet of over 1.3 million Android devices, including TV set-top boxes, found to contain a persistent firmware-level backdoor intentionally installed by manufacturer Videostrong.

Lara Dashboard versions prior to 1.3.2 are vulnerable to arbitrary file upload via the core-upgrades endpoint, allowing unauthorized administrators to achieve remote code execution.

The python-jose library through version 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs by exploiting the librarys acceptance of zero-length HMAC secrets.

DoraCMS through version 3.1.0 is vulnerable to a mass assignment flaw in the PUT /api/v1/user/api-keys/:id endpoint, allowing authenticated attackers to rebind API keys to other user accounts and perform unauthorized administrative actions.

A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.

GoFound versions 1.4.1 and earlier are vulnerable to unauthenticated path traversal via the database parameter, allowing attackers to delete arbitrary directories on the host file system.

QuickJS-NG before 0.16.0 contains an integer overflow in the js_proxy_get_own_property_names function that can lead to heap buffer overflows and potential code execution on 32-bit hosts via malicious Proxy ownKeys traps.

Netpbm is vulnerable to a heap-based buffer overflow in the sgitopnm utility via crafted SGI image files, potentially allowing for arbitrary code execution.

Camaleon CMS versions prior to 2.9.2 contain an authorization bypass vulnerability allowing low-privileged users to perform unauthorized file operations and modify user avatars.