Threat briefs

An integer underflow vulnerability in facil.io through version 0.7.6 allows unauthenticated remote attackers to crash the server process via a crafted Content-Disposition header with an empty field name, leading to a Denial of Service.

A detection rule has been developed for Amazon Bedrock that identifies the deletion of guardrails, indicating a potential attempt by an attacker or insider to disable AI model safety controls and facilitate unsafe or unauthorized responses.

Crypto mining malware, often deployed by various threat actors, connects to designated mining pools to perform unauthorized cryptocurrency mining, leading to significant system performance degradation and illicit resource consumption.

A reflected cross-site scripting (XSS) vulnerability exists in SiYuan desktop applications before version 3.7.2, specifically within the bazaar plugin readme handler, allowing attackers to execute arbitrary code by crafting a malicious 'siyuan://' deep link, which leads to Remote Code Execution (RCE) with full Node.js access due to insecure Electron renderer configuration.

SiYuan before v3.7.2 is vulnerable to stored cross-site scripting (XSS) due to improper escaping of the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing attackers with editor permissions to inject malicious onload handlers that execute arbitrary code in the Electron renderer with full Node.js access, leading to remote code execution.

Authenticated attackers can exploit stored and reflected cross-site scripting (XSS) vulnerabilities, identified as CVE-2026-66394, in SiYuan versions prior to v3.7.3 by bypassing the application's SVG sanitization to execute arbitrary scripts within the application's origin, potentially leading to session hijacking and data exfiltration.

Threat actors are observed abusing the legitimate Windows utility rundll32.exe to execute malicious DLLs from remote UNC network paths, facilitating execution and lateral movement within compromised environments.

An eval injection vulnerability, identified as CVE-2026-61511, exists in vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1, specifically within the vB5_Template_Runtime::runMaths() method, allowing unauthenticated remote attackers to achieve arbitrary PHP code execution by manipulating the pagenav[pagenumber] parameter through the unauthenticated ajax/render template route with phpfuck-style encoding.

Elastic has developed a machine learning detection rule to identify anomalous compiler activity on Linux systems, which can indicate unauthorized software deployment, ad-hoc changes, or privilege escalation attempts by adversaries.

Elastic has released a machine learning detection rule designed to identify rare and unusual process executions across multiple Linux hosts within an entire fleet, aiming to uncover potential malware or suspicious behaviors indicative of persistence or other malicious activity.

An Elastic machine learning rule detects unusual user logon times, which can indicate credential compromise or unauthorized access, particularly when attackers operate from different time zones or during non-business hours, prompting investigation into the affected user account and related activities.

NitroShare Desktop versions up to and including 0.3.4 are vulnerable to a path traversal flaw in their LAN file transfer server, allowing unauthenticated attackers on the same network to craft malicious filenames containing directory traversal sequences within the JSON item header. Exploiting this, attackers can write arbitrary files outside the intended transfer root to any location the current user has write access, including the Windows Startup folder, leading to persistent code execution upon user login.

Siemens Teamcenter versions V2312 (before V2312.0014), V2406 (before V2406.0012), V2412 (before V2412.0009), V2506 (before V2506.0005), and V2512 are vulnerable to cross-site scripting (XSS) due to improper encoding or filtering of user-supplied data, potentially leading to arbitrary code execution by other users.

A critical cross-site scripting (XSS) vulnerability has been identified in Zabbix, which a remote, unauthenticated attacker can exploit to execute malicious scripts within a user's browser session, potentially leading to unauthorized actions or data theft.

Multiple vulnerabilities in ffmpeg allow a remote, anonymous attacker to cause memory corruption, execute arbitrary code, trigger a denial-of-service condition, or disclose confidential information. The attacker does not require authentication to exploit these flaws.

A vulnerability in the Containerized Data Importer (CDI) for Kubernetes, identified as CVE-2026-17527, allows privilege escalation and data exfiltration through an improperly configured `cdi.kubevirt.io:view` ClusterRole, enabling attackers with partial access to clone and access data from any PersistentVolumeClaim in the cluster.

A critical local privilege escalation (LPE) vulnerability, tracked as CVE-2026-17523 and identified as an Expired Pointer Dereference (CWE-825), exists within the kernel, primarily affecting Red Hat Enterprise Linux 8, enabling an unprivileged local user to execute arbitrary code within the kernel, leading to root privileges and full control over the compromised system.

A remote, anonymous attacker can exploit a vulnerability in OpenCTI to bypass security measures and disclose sensitive information, potentially leading to unauthorized access to critical threat intelligence data and circumvention of protective controls within the platform.

Multiple vulnerabilities in the libssh2 library allow a remote, unauthenticated attacker to potentially disclose sensitive information, cause a denial-of-service condition, or execute arbitrary code.

A low-privileged local attacker can exploit CVE-2026-14837, an improper signature verification vulnerability, in multiple Lenze products including models c430, c520, c550, i950 GenA, and i950 GenB to bypass the verification of the SSH enable file signature, subsequently enabling SSH access on the affected device, resulting in unauthorized administrative access and complete system compromise.

A critical missing authorization vulnerability, CVE-2026-66012, in SiYuan before version 3.7.2 allows a remote unauthenticated attacker to exploit the POST /mcp kernel endpoint when the Publish server is in anonymous mode, leading to arbitrary file writes, sensitive credential exposure, malicious plugin execution, and ultimately administrator takeover on affected systems.

The WPForms Pro plugin for WordPress, in versions up to and including 1.10.1.1, is vulnerable to arbitrary file upload via the ajax_chunk_upload_finalize function, allowing unauthenticated attackers to upload executable files due to improper file type validation occurring after file contents are written to disk, which can lead to remote code execution on the affected server.

An unauthenticated arbitrary file upload vulnerability (CVE-2026-58480) in Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 allows attackers to bypass extension validation via double-extension files, leading to remote code execution by forcing the web server to execute uploaded PHP files.

CVE-2026-63720 details a code injection vulnerability in datamodel-code-generator versions prior to 0.70.0, allowing attackers to achieve remote code execution by providing a malicious `customBasePath` value within input schemas that is unsafely embedded into a Python import statement.

An authenticated attacker with Subscriber-level access or higher can exploit a PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress, affecting versions up to and including 6.2.6. This deserialization of untrusted input, when combined with a POP chain, allows attackers to change user passwords and potentially achieve administrator account takeover. Exploitation is contingent on user update integration being enabled and a user meta field being mapped.

A vulnerability in the iconv() function of the GNU C Library (versions 2.43 and earlier) can cause a crash due to an assertion failure when handling IBM1390 or IBM1399 character sets, potentially leading to remote application denial-of-service.

An unauthenticated path traversal vulnerability (CVE-2026-65694) in the static file controller of Microweber CMS, affecting versions through 2.0.20, allows remote attackers to read arbitrary files by supplying directory traversal sequences in the 'path' query parameter via a single unauthenticated HTTP GET request, potentially disclosing sensitive information like environment configuration files containing credentials or system files.

Multiple out-of-bounds write vulnerabilities (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314) in Rockwell Automation Arena versions prior to V17.00.01 could allow an attacker to execute arbitrary code by convincing a user to open a malicious file.

An unauthenticated Slowloris denial of service vulnerability exists in the default `serve()` path of AWS's `aws-smithy-http-server` framework (versions <= 0.66.4), allowing remote attackers to exhaust server resources by initiating numerous incomplete connections.

An authorization bypass vulnerability (GHSA-xg4h-6gfc-h4m8) in etcd's Watch API allows an authenticated user with READ permission on a single key to exploit the `clientv3.WithFromKey()` function, gaining unauthorized access to monitor and receive events for all keys lexicographically greater than or equal to their permitted key in clusters with authentication enabled.