Threat briefs

Adversaries leverage network sniffing utilities such as Wireshark and tcpdump on Windows endpoints to conduct reconnaissance, intercept sensitive traffic, and exfiltrate credentials.

Adversaries frequently leverage the 'dir' command piped to 'findstr' for reconnaissance to identify sensitive files and credentials on compromised Windows systems.

A critical authentication vulnerability (CVE-2026-65400) in macOS Screen Sharing allows remote, unauthenticated attackers to bypass security controls and gain unauthorized access to target systems.

Threat actors are leveraging a phishing-as-a-service platform to conduct spearphishing attacks impersonating RingCentral, targeting Microsoft 365 credentials.

A memory management mismatch in the llama.cpp Android JNI wrapper leads to heap metadata corruption, enabling potential denial of service or arbitrary code execution.

A vulnerability in the dracut initramfs emergency-hook mechanism allows an attacker with access to the local network to perform command injection and achieve root code execution during system boot.

A local privilege escalation vulnerability in Sophos Endpoint allows an authenticated local attacker to execute arbitrary code with administrative privileges.

A local arbitrary code execution vulnerability in the gpsd component of Red Hat Enterprise Linux allows a local attacker to execute arbitrary code.

DeepCool DisplayService 1.2.12 exposes an unauthenticated LocalSystem named pipe control channel, allowing local users to perform improper access control manipulations and gain elevated privileges.

StableBit DrivePool version 2.3.13.1687 contains a local privilege escalation vulnerability in the DrivePoolService component stemming from improper permission management and insecure deserialization.

An unauthenticated account takeover vulnerability (CVE-2026-14364) in the TrueBooker plugin allows attackers to reset arbitrary user passwords due to missing identity validation.

PowerISO version 9.3.0.0 contains a vulnerability in the scdemu.sys kernel driver that enables local attackers to perform privilege escalation through improper privilege management.

PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 are vulnerable to command injection via the Gitblame, Hgblame, and Svnblame reports when processing files containing shell metacharacters.

A vulnerability in Cisco IOS and Cisco IOS XE allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition on affected network devices.

A race condition in the llama.cpp Android JNI wrapper allows attackers to trigger a use-after-free vulnerability, potentially leading to remote code execution through vtable pointer hijacking.

A use-after-free vulnerability in llama-server allows for potential remote code execution via a TOCTOU race condition in tokenization endpoints when using the --sleep-idle-seconds configuration.

A heap buffer overflow vulnerability in llama.cpp builds b4882 through b9058 allows attackers with write access to the slot_save_path directory to achieve arbitrary code execution via malicious KV cache state files.

Autodesk Revit contains an out-of-bounds read vulnerability in its PDF parsing engine that can be exploited for arbitrary code execution or information disclosure.

A local privilege escalation vulnerability in udisks2 allows authenticated console users to bypass authorization checks in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method to mount filesystems as privileged users.

An out-of-bounds read vulnerability in the TimescaleDB Dictionary compression reverse row iterator allows authenticated attackers with DML access to disclose sensitive backend memory and shared buffer pool contents.

Dinky v1.2.5 and development builds contain an authentication bypass in the SysConfigController.getAll handler, allowing unauthenticated remote attackers to retrieve cleartext system credentials and service tokens.

An authenticated command injection vulnerability (CVE-2026-63725) in sysPass allows administrative users to execute arbitrary OS commands through unsanitized backup path configurations.

Contiki-NG's LwM2M TLV parser contains an out-of-bounds read vulnerability that allows unauthenticated attackers to disclose heap memory contents via crafted CoAP WRITE requests.

Ground Station versions prior to 0.6.0 are susceptible to an unauthenticated denial-of-service vulnerability in the Socket.IO service_control event handler, allowing remote attackers to terminate critical satellite-tracking processes via a restart_service command.

A publicly disclosed SQL injection vulnerability (CVE-2026-19062) in the house application by chiuwingyan allows unauthenticated remote attackers to execute arbitrary SQL commands via the zuname parameter.

Dinky v1.2.5 contains a path traversal vulnerability in the /download/uploadFromRsByLocal endpoint, which is protected by a hardcoded authentication token, allowing unauthenticated attackers to achieve arbitrary file write and remote code execution.

Unauthenticated attackers can achieve Remote Code Execution (RCE) on default IBM Langflow OSS deployments, versions 1.0.0 through 1.10.0, by chaining access to the `/api/v1/auto_login` endpoint, which mints SUPERUSER tokens, with the `/api/v1/validate/code` endpoint, which executes user-supplied code via `exec()`.

Attackers are exploiting unpatched TLS listeners by flooding them with incomplete ACME ALPN handshakes to exhaust server-side resources like goroutines and worker threads.

Traefik's `ForwardAuth` and snippet-based authentication middleware has a high severity authentication bypass vulnerability because it does not sanitize header aliases with underscores, allowing attackers to spoof trust context and bypass authentication on protected routes.

An unauthenticated attacker can achieve account takeover by leveraging unverified OAuth email matching in Statamic CMS, allowing unauthorized authentication as existing users including administrators.