Threat briefs

An unauthenticated remote attacker can exploit a vulnerability in Metabase to perform SQL injection and escalate privileges.

An unidentified threat actor is leveraging a custom multi-platform toolset to exploit misconfigured guest user permissions in Salesforce and ServiceNow, performing high-volume data enumeration and exfiltration.

A proof-of-concept exploit has been published for a pre-authentication XML External Entity (XXE) vulnerability in SimpleSAMLphp and the Saml2 Library, enabling arbitrary file read by unauthenticated remote attackers.

Voltronic Power SNMP Web Pro version 1.1 contains an unauthenticated RCE vulnerability allowing attackers to upload and execute malicious CGI scripts as root by bypassing session validation.

Fleet is affected by multiple security vulnerabilities that allow unauthenticated or authenticated attackers to perform SQL injection, arbitrary code execution, and unauthorized data manipulation.

A local privilege escalation vulnerability in the Microsoft Windows Package Manager allows an authenticated local attacker to gain elevated privileges on the host system.

Adobe ColdFusion is susceptible to multiple vulnerabilities allowing remote code execution, privilege escalation, denial of service, information disclosure, and cross-site scripting.

Commvault Backup & Recovery is affected by multiple vulnerabilities that allow a remote, unauthenticated attacker to bypass security controls, execute arbitrary code, and perform server-side request forgery (SSRF), enabling potential full compromise of the backup infrastructure.

FreeRDP versions before 3.30.0 are vulnerable to memory corruption in the kerberos_DecryptMessage function, allowing a malicious peer to perform out-of-bounds read and write operations via crafted GSS Wrap tokens during authentication.

A local vulnerability in InsydeH2O UEFI firmware allows an attacker to execute arbitrary code at the firmware level, potentially enabling platform-wide persistence.

A local attacker can exploit a vulnerability in Intel UEFI Reference BIOS to perform unauthorized information disclosure, potentially compromising system integrity and security boundaries at the firmware level.

Microsoft Office products contain multiple vulnerabilities that allow a remote attacker to achieve arbitrary code execution, privilege escalation, information disclosure, file manipulation, and perform cross-site scripting (XSS) attacks.

SonicWall GMS contains multiple vulnerabilities allowing remote code execution with root privileges, privilege escalation, security bypass, and information disclosure.

SonicWall Email Security contains multiple local vulnerabilities that permit an attacker to execute arbitrary code with administrative privileges, leading to full appliance compromise.

FitSoft POS System contains a missing authentication vulnerability that allows unauthenticated remote attackers to gain unauthorized access and control over the platform.

An unauthenticated remote denial-of-service vulnerability in the Phoenix Contact PLCnext Engineer communication interface allows attackers to crash the service, requiring manual intervention.

The PROFINET service contains a buffer overflow vulnerability in its default configuration, allowing an unauthenticated remote attacker to trigger a device reboot or achieve remote code execution.

CVE-2026-15560 allows unauthenticated remote code execution in Red Hat JBoss EAP environments configured with the -secmgr flag due to insecure object unmarshalling.

A vulnerability in Apache Kafka allows a remote, unauthenticated attacker to trigger a Denial of Service condition by exploiting CVE-2024-27309.

An unauthenticated remote attacker can exploit a deserialization vulnerability in Apache Jackrabbit to achieve remote code execution.

A vulnerability in the web-based management interface of Cisco ASA and Secure Firewall Threat Defense allows an unauthenticated, remote attacker to trigger a device crash via crafted HTTP requests.

A threat actor compromised the Trivy ecosystem supply chain by publishing malicious releases of Trivy binaries, container images, and GitHub Actions to steal credentials, with observed impacts including exfiltration to attacker-controlled infrastructure and public repositories.

An authenticated tenant with Application creation permissions can exploit an improper input validation flaw in the multicloud-integrations Application propagation controller to achieve remote code execution on managed clusters.

Cisco Secure Firewall ASA and FTD devices are subject to active exploitation of a zero-day vulnerability, CVE-2026-20349, which allows remote, unauthenticated attackers to cause a denial-of-service condition via crafted HTTP requests.

IBM QRadar SIEM contains multiple vulnerabilities that enable a remote authenticated attacker to escalate privileges, execute arbitrary code, disclose information, and bypass security controls.

Threat actors are exploiting a remote code execution vulnerability (CVE-2024-27429) in N-able N-central to gain unauthorized access and deploy RMM payloads on managed systems.

CISA has added CVE-2024-40766 to its Known Exploited Vulnerabilities catalog after reports that ransomware actors are leveraging the flaw in SonicWall SMA 1000 series appliances to gain initial access to enterprise networks.

An authentication bypass vulnerability in the VentraConnect WordPress plugin allows unauthenticated attackers to hijack user accounts, including administrators, by spoofing verified email claims during Spotify OAuth flows.

A vulnerability in the multicloud-operators-channel component of Red Hat Advanced Cluster Management allows compromised agents to perform unauthorized reads of Secrets and ConfigMaps within hub Channel namespaces, risking credential exposure.

A vulnerability in the multicloud-operators-subscription controller allows a namespace administrator to exfiltrate sensitive secret contents by manipulating cross-namespace resource references.