Threat briefs

Budibase Server versions before 3.40.0 contain a NoSQL injection vulnerability in the MongoDB query execution endpoint, enabling authenticated attackers to bypass filters and perform unauthorized database operations.

Network-AI versions prior to 5.15.1 are vulnerable to a command injection bypass where inconsistent quote handling between SandboxPolicy and the executor allows attackers to evade blocklist checks.

CVE-2026-73614 in ClaudeHookBridge allows attackers to bypass security deny-lists by appending malicious command strings beyond a 500-character truncation threshold, resulting in potential arbitrary code execution.

A vulnerability in Red Hat WildFly and JBoss Enterprise Application Platform allows a remote, unauthenticated attacker to trigger a denial-of-service condition.

GitLab contains multiple security vulnerabilities that allow attackers to perform cross-site scripting, bypass security constraints, escalate privileges, disclose sensitive information, or trigger denial-of-service conditions.

JFrog Artifactory is affected by multiple vulnerabilities enabling authentication bypass, privilege escalation, user impersonation, and unauthorized data manipulation or disclosure.

Multiple vulnerabilities in Absolute Secure Access allow a remote, authenticated attacker to trigger a Denial of Service condition, impacting system availability.

A vulnerability in Fortinet FortiSIEM allows a remote, authenticated attacker to manipulate system data, posing a risk to data integrity within the security platform.

A remote, unauthenticated attacker can exploit a vulnerability in Fortinet FortiManager to bypass security controls, necessitating immediate monitoring of management interface traffic.

A vulnerability in X.Org X11 (CVE-2023-6478) allows a remote, authenticated attacker to trigger a Denial of Service condition through resource exhaustion.

Multiple vulnerabilities in MongoDB allow remote attackers to achieve arbitrary code execution, bypass security controls, manipulate data, disclose sensitive information, or trigger a denial-of-service.

Nagios Core and XI contain a CSRF protection bypass vulnerability (CVE-2026-48551) that allows unauthenticated attackers to execute commands as an authorized user via manipulated double-submit cookies.

IBM i versions 7.3 through 7.6 contain an uncontrolled search path element vulnerability that allows a remote authenticated attacker to execute arbitrary code with elevated privileges.

A vulnerability in the hdaudio component of NetBSD allows a local attacker to escalate privileges to administrator status and trigger a denial-of-service condition.

A local privilege escalation vulnerability (CVE-2026-0299) in the Palo Alto Networks GlobalProtect app allows authenticated local users to escalate to SYSTEM or root privileges via untrusted search path exploitation.

Multiple vulnerabilities have been identified in etcd that could allow a remote attacker to bypass security controls or trigger a denial of service condition.

Langflow is affected by multiple vulnerabilities that allow an unauthenticated attacker to achieve remote code execution and bypass security controls.

A vulnerability in the gnome-remote-desktop component of Red Hat Enterprise Linux enables a remote, unauthenticated attacker to cause a denial of service condition.

Fortinet has patched multiple high-severity vulnerabilities, including authentication bypasses in FortiWeb and FortiManager, alongside a buffer overflow in FortiClient for Windows.

The Armored Likho (Eagle Werewolf) threat actor is deploying a new Rust-based cyber-espionage 'Still Toolkit' via a malicious fundraising-themed dropper to exfiltrate Telegram session data and perform covert audio surveillance.

Jewelbug, a China-linked mercenary APT, uses a custom C2 platform called XG-Web to conduct both state-sponsored espionage and large-scale cryptocurrency theft using custom backdoors and malicious browser extensions.

The JWR phishing framework is a sophisticated, operator-steered PhaaS platform that uses persistent WebSocket connections to capture PII, payment credentials, and device fingerprints in real-time.

Monitoring for non-standard additions to the Windows Defender Firewall exception list to identify potential defense impairment activity by unauthorized processes.

Detection logic for the abuse of the Windows mofcomp utility, which is frequently leveraged by attackers to compile malicious Managed Object Format (MOF) files for WMI event subscription persistence.

Multiple critical vulnerabilities, including CVE-2026-59309 and CVE-2026-59310 with CVSS 9.8, affect VMware vCenter and ESX/ESXi products, enabling unauthorized access without credentials, arbitrary code execution, virtualization escape, information disclosure, and defense evasion, which could lead to full system compromise and data breaches.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Fluent Forms versions up to 6.2.11 allows attackers to inject malicious scripts that execute in the context of administrative users viewing submission logs.

The ansible_jailexec connection plugin performs file operations with host-side root privileges while following symlinks, allowing an attacker to escape a FreeBSD jail and gain root access on the host.

An arbitrary file upload vulnerability exists in the GoDAM WordPress plugin versions up to and including 1.12.2 due to insufficient file type validation in the `save_video_file()` function, allowing unauthenticated attackers to upload arbitrary files to the server and potentially achieve remote code execution.

A publicly available exploit targets CVE-2026-14840, a vulnerability in the YOP Poll plugin (v7.0.5) that allows attackers to bypass voting rate limits by spoofing IP addresses via the X-Forwarded-For HTTP header.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are susceptible to privilege escalation due to improper authorization when processing crafted SQL queries.