Threat briefs

Project CAV3RN is a modular espionage framework targeting entities in Israel that uses a .NET NativeAOT-compiled communication module to orchestrate DNS-controlled C2 transport switching between direct HTTPS and Google Apps Script relays.

GIMP contains multiple heap-buffer-overflow vulnerabilities in its APNG and DDS file format loaders, which can lead to arbitrary code execution when a victim opens a specially crafted image file.

Apache Airflow is affected by multiple vulnerabilities, specifically CVE-2024-48792 and CVE-2024-48793, which allow a remote, authenticated attacker to perform unauthorized information disclosure.

A vulnerability in Pega Platform allows a remote, authenticated attacker to bypass security controls, potentially leading to unauthorized access or actions within the platform environment.

A local memory corruption vulnerability in the Dell Qualcomm MIPI Camera Driver enables potential arbitrary code execution or denial-of-service conditions.

CVE-2026-68196 is a memory corruption vulnerability in the Microchip WILC1000 Linux kernel driver caused by insufficient validation of the association response length prior to header subtraction.

CVE-2026-68229 is a vulnerability in the Cedrus H.264 video decoding driver that improperly handles invalid reference list entries, potentially resulting in memory corruption or system instability.

CVE-2026-68147 addresses a memory management vulnerability in the Linux kernel fscrypt subsystem within the fscrypt_get_devices function, where improper dynamic allocation could lead to memory corruption or exhaustion.

A potential out-of-bounds memory vulnerability in the NXP i.MX 8 Image Signal Processor (ISI) driver could lead to system instability or memory corruption if triggered by an attacker with driver-level access.

CVE-2026-68310 in the MediaTek mt76 wireless driver for mt7915 chipsets allows for potential memory access issues due to inadequate validation during HE capability lookups.

CVE-2026-68192 describes a flaw in the brcmfmac Wi-Fi driver related to non-idempotent buffer release routines, potentially leading to memory management issues.

A memory leak vulnerability in the vdec_open error path of the meson video decoder driver could be leveraged to cause a denial-of-service condition via kernel memory exhaustion.

CVE-2026-68364 identifies a deadlock vulnerability in the AMD Linux kernel display driver's dc_lock mechanism during suspend, potentially enabling a local denial-of-service.

CVE-2026-68123 is a vulnerability in Open vSwitch related to GSO userspace truncation that may cause an underflow condition during packet processing, potentially impacting memory or system stability.

CVE-2026-68129 describes an RX queue stall in the Google Virtual Ethernet (gve) driver triggered by memory allocation failures, potentially causing network denial-of-service.

CVE-2026-68131 identifies a flaw in the Linux kernel rbd module where failure to reset result codes to zero during object map updates may lead to improper status reporting.

CVE-2026-68331 identifies a resource management vulnerability in the dpaa2-eth driver related to improper handling of MAC endpoint devices during disconnection, which may lead to system instability.

CVE-2026-68362 describes a NULL pointer dereference vulnerability in the Linux kernel ath11k driver that may lead to denial-of-service or potential code execution via crafted interactions.

The carl9170 Wi-Fi driver contains an out-of-bounds read vulnerability due to an off-by-two error in the TX status handler, potentially leading to memory disclosure or system instability.

Multiple vulnerabilities in the GNU cpio utility allow unauthenticated remote attackers to bypass security controls, cause denial of service, or manipulate data during file extraction.

A vulnerability in the Linux kernel fscrypt subsystem exists due to a missing superblock check in the find_or_insert_direct_key function, potentially impacting filesystem integrity.

Perl versions through 5.45.1 contain a vulnerability in the S_regmatch function leading to out-of-bounds heap reads and writes during regex processing, which may allow for arbitrary code execution.

An out-of-bounds read vulnerability in the ath6kl Wi-Fi driver's TX complete handler, identified as CVE-2026-68353, may allow an attacker to access unauthorized memory during packet processing.

CVE-2026-68256 describes a memory reference leak in the Linux kernel drm/amd/display driver occurring during specific DP alt mode timeout conditions.

A symlink traversal vulnerability in the go-git library (CVE-2026-71556) enables unauthorized write access outside of the intended worktree directory when processing malicious symbolic links.

A vulnerability in the jsoup library allows a remote attacker to execute arbitrary scripts in the context of a user's browser via Cross-Site Scripting (XSS).

CVE-2026-68412 identifies an error handling flaw in the cfg80211_wext_siwscan function of the Linux kernel wireless subsystem, potentially leading to instability during wireless scanning operations.

Intel has patched memory leaks and list corruption vulnerabilities in the stratix10-svc firmware component that could lead to system instability.

A local symlink following vulnerability in the MRTG daemon allows low-privileged users to achieve local privilege escalation by manipulating PID file ownership.

A vulnerability in openvt allows local privilege escalation when authentication checks incorrectly validate TTY ownership using symlink resolution, potentially leading to passwordless root login.