Threat briefs

OpenCSG CSGHub version 2.6.0-ce and earlier contains an authorization bypass vulnerability allowing remote, unauthenticated attackers to retrieve private repository files by injecting a malicious current_user parameter.

An improper authorization vulnerability in the Codestar framework integration within the Product Gallery Slider & Additional Variation Images for WooCommerce plugin allows Shop Managers to escalate privileges to administrator via arbitrary WordPress option modification.

An SQL injection vulnerability in the Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection.

An authentication bypass vulnerability in ape-volo-admin before version 3.6.1 allows unauthenticated attackers to forge administrative tokens using a hardcoded JWT signing key found in appsettings.json.

Multiple vulnerabilities in Redmine allow remote attackers to perform cross-site scripting (XSS), bypass security policies, or trigger denial-of-service conditions.

Tenable Identity Exposure is affected by multiple vulnerabilities that allow for remote code execution, denial-of-service, and data confidentiality breaches.

FortiGuard Labs reports on a BITTER cyberespionage campaign targeting South Asian organizations using three attack chains and the PapRAT remote access trojan.

A vulnerability in Microsoft Visual Studio could allow a remote, unauthenticated attacker to perform unauthorized information disclosure or data manipulation.

Multiple vulnerabilities in Microsoft Edge allow for remote code execution, privilege escalation, and unauthorized data access, requiring immediate updates to patched versions.

Multiple vulnerabilities in the Traefik proxy allow attackers to circumvent implemented security controls, potentially leading to unauthorized access.

Collabora Online contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security measures, conduct Cross-Site Scripting (XSS) attacks, or perform unauthorized information disclosure.

A critical, unpatched vulnerability in Linksys routers allows remote, unauthenticated attackers to escalate privileges to administrator, disclose sensitive information, manipulate files, or trigger a denial-of-service.

A vulnerability in multiple JetBrains integrated development environments allows a remote, unauthenticated attacker to bypass security controls.

A vulnerability in JetBrains Toolbox App and IntelliJ IDEA allows a remote, unauthenticated attacker to bypass security measures.

An attacker with compromised organization owner credentials may enable private repository forking to exfiltrate proprietary source code to personal accounts, necessitating monitoring of GitHub audit logs for organization-level configuration changes.

Adversaries may disable GitHub Dependabot alerts or security updates at the repository, organization, or enterprise level to conceal the introduction of malicious or vulnerable dependencies.

Topluyo Desktop for Linux versions prior to 2026.9.2410 are vulnerable to OS Command Injection via the openExternalLinks function in utils.js, allowing unauthenticated attackers to achieve RCE through malicious link-handling.

Threat actors are leveraging Microsoft Teams to impersonate support personnel, socially engineering users into granting remote access via Quick Assist to deploy portable runtimes and conduct AD CS abuse (ESC1 and ESC8).

An unknown actor compromised an official Anthropic distribution channel to push a malicious version of the Claude VS Code extension, enabling persistent SSH backdoors and credential theft on developer workstations.

ManageEngine Eventlog Analyzer and Log360 versions prior to 13062 contain an authenticated remote code execution vulnerability in the log forwarding feature.

The Admin REST API is vulnerable to blind SQL injection due to improper input sanitization, allowing an authenticated administrator to extract database information or disrupt service.

The @fastify/http-proxy plugin fails to re-encode parameterized route parameters when using rewritePrefix, allowing remote attackers to inject path separators or delimiters to bypass path restrictions and access unauthorized upstream resources.

The @fastify/reply-from plugin contains a path traversal vulnerability where backslash dot-segments allow attackers to bypass proxy prefix constraints, enabling unauthorized access to unintended upstream endpoints.

CVE-2026-18199 is an authenticated remote code execution vulnerability in Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601.

CVE-2022-29464 is an unauthenticated arbitrary file upload vulnerability in the WSO2 FileUploadServlet that enables remote code execution via directory traversal and malicious JSP deployment.

The North Korean-aligned actor TraderTraitor (UNC4899) stole $6.43 billion from Binance using recruitment-themed social engineering and trojanized Terraform providers to deploy multi-stage cross-platform malware.

Adversaries can maintain persistence on macOS by modifying screensaver plist files to execute malicious .saver bundles, an activity detectable by monitoring for modifications by untrusted or script-based processes.

Adversaries can achieve persistence on macOS by modifying 'com.apple.loginwindow.plist' to execute malicious scripts or binaries with root privileges via LoginHook or LogoutHook keys.

Threat actors are utilizing the CyberStrikeAI framework to automate post-exploitation tasks, including reconnaissance and lateral movement, through a server-side LLM orchestrator and a Golang-based C2 implant.

A critical OS command injection vulnerability in the DNS Resolution Handler of Wavlink WN551X3-A allows unauthenticated remote attackers to execute arbitrary commands via the data argument, with a public proof-of-concept exploit now available.