Threat briefs

Versions of rsync prior to 3.5.0 contain multiple command and argument injection flaws that allow attackers to execute arbitrary code via malicious hostnames, environment variables, and shell command injections.

A path traversal vulnerability in rsync versions prior to 3.5.0 allows a malicious sender to perform arbitrary file writes outside the intended destination directory via crafted relative paths.

Ninja Tables Pro version 5.2.11 was compromised via a supply chain attack involving a decommissioned update server that distributed a tampered plugin build containing a PHP backdoor.

Siemens RUGGEDCOM APE1808 devices are impacted by multiple vulnerabilities (CVE-2026-23573, CVE-2026-59839) within the integrated Fortinet NGFW software, potentially allowing remote code execution or filesystem deletion.

Authenticated attackers with operator-level access can exploit a deserialization vulnerability (CVE-2025-7639) in AVEVA Enterprise SCADA to achieve remote code execution.

An unauthenticated OS command injection vulnerability in the Haiwell IoT Cloud HMI Gateway allows attackers to achieve arbitrary command execution with root privileges via the Net Check feature.

Siemens Solid Edge is affected by multiple memory corruption vulnerabilities, including out-of-bounds read/write and use-after-free, allowing arbitrary code execution via specially crafted PAR, PSM, or DFT files.

ANDRITZ HIPASE-250 and 250 SCALA devices (versions <=7.20) contain multiple high-severity vulnerabilities, including hard-coded credentials, missing authentication on critical functions, and insecure password storage, enabling potential remote exploitation.

Siemens LOGO! Soft Comfort versions prior to V9 contain hardcoded master keys and unsalted password hashes, allowing local attackers to decrypt project files or perform brute-force attacks.

Flow Neuroscience FL-100 and Halo Neuroscience FL-100 devices contain a hard-coded credential vulnerability that allows an attacker within Bluetooth range to manipulate brain stimulation parameters and bypass safety controls.

A critical OS command injection vulnerability (CVE-2026-3014) in Siemens Siveillance Video allows authenticated users with administrative permissions to achieve remote code execution in the context of the Management Server service.

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-34491) in Johnson Controls Metasys allows low-privileged users to execute arbitrary scripts in the context of other users' sessions, potentially leading to session hijacking.

Johnson Controls Airwall versions 4.0.4 and earlier are affected by CVE-2026-64887 and CVE-2026-34492, allowing attackers to potentially decrypt sensitive data or perform arbitrary file reads.

Siemens Desigo DXR and PXC controllers are vulnerable to a denial-of-service condition (CVE-2026-59693) triggered by malformed BACnet packets, requiring a manual device reboot.

Siemens License Server (SLS) contains vulnerabilities allowing remote file disclosure (CVE-2026-69109) and local privilege escalation (CVE-2026-69108).

Siemens Parasolid contains an out-of-bounds read vulnerability (CVE-2026-64629) in its X_T file parsing logic that can lead to arbitrary code execution or application crashes.

Fluent Forms Pro 6.2.7 was compromised through a supply chain attack involving a decommissioned update server that served a tampered plugin build, leading to unauthorized backdoor access, persistence, and privilege escalation.

A coordinated threat actor leveraged compromised GitHub Personal Access Tokens (PATs) across multiple organizations between May and June 2026 to perform reconnaissance, validate access, and exfiltrate large volumes of proprietary source code.

The rsync daemon before version 3.5.0 contains a vulnerability where unauthenticated attackers can inject a forged PROXY protocol header to bypass IP-based access control restrictions.

Rsync versions prior to 3.5.0 contain an arbitrary file write vulnerability that allows attackers to bypass path confinement by providing absolute paths to specific command-line options.

CVE-2026-6387 is an authentication bypass vulnerability in Lenovo System Update (versions prior to 5.08.04.85) that allows a local authenticated user to escalate privileges and execute arbitrary code.

Lenovo Dock Manager versions prior to 1.6.5.3 contain a local privilege escalation vulnerability due to an improperly protected key, allowing authenticated local users to gain elevated access.

Lenovo Accessories and Display Manager for Enterprise for Windows version 1.0.9 and earlier contains a hard-coded cryptographic key vulnerability (CVE-2026-63423) that allows local authenticated users to achieve arbitrary code execution with elevated privileges.

Lenovo Vantage and Commercial Vantage contain an improper link following vulnerability (CVE-2026-15994) that allows local authenticated users to achieve privilege escalation through file system manipulation.

Evooo1Bot is a modular Linux-based botnet that targets internet-facing devices to perform DDoS attacks, SSH brute-forcing, vulnerability exploitation, and SOCKS proxy relay operations.

An improper input validation in Pimcore's ClassDefinition UID and unsanitized SQL query construction allow authenticated users to perform UNION-based SQL injection and exfiltrate database contents.

The atomic-agents-stack dashboard HTTP server lacks sufficient path validation, enabling unauthenticated attackers to read arbitrary files from the underlying filesystem.

A remote authenticated attacker can exploit a vulnerability in WordPress to execute arbitrary code, requiring immediate focus on monitoring administrative actions and plugin modifications.

Serendipity versions prior to 2.6.0 contain a Server-Side Request Forgery vulnerability allowing authenticated admins to reach internal network resources using bypassed address filters.

A bypass of the GitPython safety guard allows arbitrary OS command execution via token smuggling when using single-character keyword arguments with split_single_char_options=False.