Threat briefs

CVE-2026-40417 is a privilege escalation vulnerability affecting Microsoft Dynamics Business Central due to weak authentication, allowing an authorized attacker to elevate privileges locally.

The Lazarus Group is distributing malicious npm packages that use Ethereum blockchain transaction data to resolve C2 infrastructure and download secondary JavaScript payloads.

IBM Application Gateway Operator versions 22.2 through 26.06 contain a Server-Side Request Forgery vulnerability due to improper URL validation in custom resources, potentially allowing unauthorized access to internal resources.

Plesk Obsidian versions prior to 18.0.80.1 and 18.0.79.5 are vulnerable to a blind SQL injection (CVE-2026-64636) which allows unauthenticated or low-privileged attackers to execute unauthorized database queries.

HashiCorp has released security advisory HCSEC-2026-25 addressing multiple vulnerabilities in Consul Community Edition and Consul Enterprise that require immediate patching.

Multiple Cisco Secure Endpoint products are affected by vulnerabilities within the integrated ClamAV engine, necessitating immediate review and patching as recommended by the vendor.

Detection logic identifies potential Kerberoasting by flagging previously unseen requester-to-service pairings utilizing the weak RC4-HMAC Kerberos encryption standard.

A vulnerability in the multicluster-global-hub manager component allows an attacker with a compromised managed hub's Kafka client certificate to impersonate other hubs and manipulate status data.

SPIP versions prior to 4.4.18 contain a code injection vulnerability in the navigation menu endpoint that allows authenticated editors to execute arbitrary OS commands on SQLite-backed installations.

ReadyEcommerce versions before 4.5.2 are vulnerable to unauthenticated time-based blind SQL injection in the product listing API, allowing attackers to exfiltrate database contents and potentially gain system-level access.

Corget GpsDget 2_3.2 is vulnerable to unauthenticated OS command injection via the HTTP SendEmail method, allowing root-level code execution.

An OS command injection vulnerability in Zyxel WAH7601 devices (CVE-2026-13206) allows unauthenticated remote attackers to execute arbitrary system commands.

TrueConf Client downloads application updates without verifying integrity, allowing a network attacker to substitute a tampered payload, leading to arbitrary code execution.

Multiple vulnerabilities in CoreDNS allow remote, unauthenticated attackers to trigger denial of service conditions, potentially disrupting critical name resolution infrastructure.

ClamAV is affected by multiple vulnerabilities that can be exploited by a remote, unauthenticated attacker to trigger a Denial of Service condition or perform unauthorized information disclosure.

Multiple vulnerabilities in the Bouncy Castle for Java FIPS library allow remote, anonymous attackers to trigger a denial-of-service condition.

GNU Emacs is impacted by multiple vulnerabilities that can be leveraged by an attacker to facilitate information disclosure, arbitrary code execution, and denial-of-service.

A vulnerability (CVE-2026-66151) in SonicWall Global VPN Client versions prior to 5.0.0.2008 allows remote attackers to trigger a denial of service condition.

An unauthenticated path traversal vulnerability (CVE-2026-19264) in Postiz enables remote attackers to read sensitive configuration files, facilitate JWT secret theft, and achieve full instance takeover through forged administrative sessions.

Progress released critical security advisories between June 2 and 4, 2026, addressing multiple vulnerabilities, including CVE-2026-7312, CVE-2026-7198, CVE-2026-7195, CVE-2026-7201, CVE-2026-7313, CVE-2026-8037, and CVE-2026-33691, in Sitefinity CMS, Sitefinity Insight, and Progress Kemp LoadMaster, which could lead to various impacts if exploited, necessitating immediate patching.

In December 2025, the threat actor Sandworm exploited an internet-facing firewall and a misconfigured cellular router to pivot through a private APN into a Polish energy facility's OT network, resulting in industrial sabotage.

Multiple integer overflow and underflow vulnerabilities in the GStreamer gst-plugins-ugly ASF demuxer allow remote attackers to cause application crashes or information disclosure via crafted media files.

A heap out-of-bounds write vulnerability in the GStreamer gst-plugins-bad adpcmdec element allows attackers to trigger memory corruption or arbitrary code execution via crafted WAV files.

SourceCodester Simple Doctors Appointment System 1.0 is vulnerable to remote SQL injection via the 'ID' parameter in the '/admin/ajax.php?action=delete_appointment' endpoint, with public exploit code currently available.

An unauthenticated arbitrary file upload vulnerability in Amasty Order Attributes for Magento 2 (versions before 4.0.0) allows attackers to upload files of any type to the store's media directory, which can lead to remote code execution (RCE) on misconfigured servers by uploading PHP files, enable malware hosting, facilitate stored cross-site scripting (XSS) via HTML/SVG uploads, or achieve path traversal to write files outside the intended directory.

Kingston FURY CTRL RGB Control Software version 2.0.65.0 contains a vulnerability in the NTIOLib_KSFX.sys driver that allows for local privilege escalation due to improper privilege management.

The EFM ipTIME AX8004M router version 15.09.0 is vulnerable to remote command injection via the /cgi/d.cgi CGI endpoint, allowing unauthenticated attackers to execute arbitrary system commands.

A publicly disclosed vulnerability in Uasoft Badaso 3.0.0-alpha allows remote attackers to bypass permission controls within the File API component.

An unauthenticated remote server-side request forgery (SSRF) vulnerability in the 'customAxios' function of adafap api-mcp allows attackers to make unauthorized requests from the server environment.

CVE-2026-71226 involves a memory corruption vulnerability in libkcapi due to improper handling of canceled asynchronous I/O (AIO) requests within the one-shot path.