Threat briefs

A missing authorization vulnerability (CVE-2026-18650) in HAVELSAN Liman MYS versions 2.2.3 through 2.3.0 allows authenticated users to escalate privileges.

A missing authorization vulnerability in HAVELSAN Liman MYS (versions 2.2.3 through 2.3.0) allows low-privileged users to access restricted system functions.

Puwell IP Camera firmware versions 2.x through 4.x contain an authentication bypass vulnerability (CVE-2026-61514) allowing unauthenticated attackers to control device functions via TCP port 23456.

Multiple critical vulnerabilities in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources version 26.0 allow unauthorized access, web shell upload, session hijacking, and remote code execution. Upgrade to version 26.1 immediately.

Multiple unauthenticated remote command injection vulnerabilities in the GL.iNet GL-MT3000 router allow arbitrary code execution via the /cgi-bin/glc component. Public exploit code is available; patch firmware immediately.

Threat actors are actively exploiting a patch bypass vulnerability (CVE-2026-18577) in N-able N-central to gain administrative control and establish persistent remote access via Cloudflare tunnels.

An unauthenticated path-traversal vulnerability in the Apache Kyuubi REST API (CVE-2026-52680) allows remote attackers to write arbitrary files to the filesystem, leading to remote code execution.

Multiple vulnerabilities, including CVE-2026-17543, CVE-2026-17544, CVE-2026-7260, and CVE-2026-9672, have been identified in PHP, potentially enabling SQL injection and denial-of-service attacks.

An authenticated remote code execution vulnerability (CVE-2026-67340) in ArcadeDB engine versions before 26.7.2 allows attackers to escape script sandboxing and execute arbitrary OS commands.

The Realtyna Organic IDX and WPL Real Estate plugins contain an arbitrary file upload vulnerability (CVE-2026-14483) allowing unauthenticated remote code execution via static, default API credentials.

Threat actors are increasingly abusing reputable PaaS providers to host multi-stage AitM phishing campaigns that use browser service workers and the Ultraviolet library to intercept credentials and MFA tokens.

Multiple vulnerabilities in Red Hat Enterprise Linux within DBI and perl-GD components allow local or remote attackers to execute arbitrary code, manipulate data, or trigger denial-of-service conditions.

A vulnerability in Zyxel firewall firmware allows a remote, authenticated attacker to achieve arbitrary code execution on the device.

A local vulnerability in Red Hat Enterprise Linux AI enables attackers to execute arbitrary code, potentially resulting in full system compromise or denial-of-service.

Multiple Denial of Service vulnerabilities in IBM Tivoli Netcool/OMNIbus, potentially involving vulnerable Immutable.js libraries, allow unauthenticated remote attackers to disrupt service availability.

Multiple vulnerabilities in the PJSIP pjmedia library can be exploited by a remote, unauthenticated attacker to trigger a denial of service condition, potentially disrupting telecommunications services.

LibreNMS versions prior to 26.5.0 are affected by multiple vulnerabilities including RCE, SSRF, and XSS, posing a significant risk for unauthorized system access and network reconnaissance.

Nearly half of malware samples with command-and-control activity bypass DNS resolution by connecting directly to hardcoded IP addresses, rendering traditional DNS-based defenses ineffective.

An authenticated path traversal vulnerability in Zyxel ATP and USG series firmware allows administrators to execute arbitrary configuration files, potentially leading to command execution.

A critical command injection vulnerability in the nas-web RPC Wrapper of GL.iNet GL-MT3000 routers allows unauthenticated remote attackers to execute arbitrary system commands via the /cgi-bin/glc interface.

An out-of-bounds heap read vulnerability (CVE-2026-69244) in the AIOHTTP C-based HTTP response parser allows a malicious server to trigger a denial-of-service condition via malformed chunked responses.

Guzzle versions before 7.15.2 and 8.0.1 are vulnerable to a host-based security check bypass where transport handlers interpret non-canonical URI hostnames differently than application-level validation, potentially enabling SSRF.

The cryptography library fails to perform constant-time operations during PKCS#7 EnvelopedData decryption, creating a Bleichenbacher oracle that allows attackers to recover content-encryption keys via error and timing analysis (CVE-2026-69247).

An exponential complexity vulnerability in the certificate chain validation logic of the Python cryptography library allows for denial-of-service attacks via resource exhaustion using crafted, redundant certificate chains.

FirmaCheck for Windows versions prior to 1.3.16 are susceptible to local privilege escalation and arbitrary code execution due to an unvalidated OpenSSL configuration file path.

An unauthenticated server-side request forgery (SSRF) vulnerability in the Jina AI Reader crawler allows remote attackers to perform unauthorized requests, with public exploit code currently available.

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands as the webconfig user, with subsequent escalation to root.

An unauthenticated remote OS command injection vulnerability in the Sangfor Operation and Maintenance Security Management System allows attackers to execute arbitrary system commands via the /fort/portal_login endpoint.

A memory exhaustion vulnerability in socket.io-parser (CVE-2026-69185) allows remote attackers to trigger denial-of-service by sending specially crafted packets containing a large number of binary attachments.

The fast-uri package exhibits a URI parsing discrepancy compared to the native Node.js WHATWG URL parser, allowing attackers to bypass host-based security policies through malicious backslash-encoded authorities.