Threat briefs

An authorization bypass vulnerability in MediaWiki allows attackers to bypass EmailUserAuthorizeSend hooks via the action=emailuser API, potentially enabling unauthorized email transmission if specific security policies are implemented.

Cacti versions prior to 1.2.31 contain an input validation bypass in the command blocklist, allowing an authenticated administrator to pass restricted characters.

CVE-2026-106765 identifies that @rog0x/mcp-docker-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

The @rog0x/mcp-git-tools package version 1.0.1 contains a vulnerability that allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

The sagemath-mcp-server package version 1.0.1 contains a vulnerability that allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces.

i-doit Pro version 25 and below is susceptible to a path traversal vulnerability in the file_manager parameter, allowing authenticated attackers to read sensitive files via manipulated HTTP requests.

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator to overwrite global Zimlet configurations and execute malicious JavaScript in a victim's session.

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox.

AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.

A heap-based buffer overflow in the media.swcodec component of Google Android 16.0 allows for remote code execution via a ROP chain triggered by a maliciously crafted video file.

A vulnerability in rsyslog allows a remote, unauthenticated attacker to manipulate files on the host system, for which no patch is currently available.

An unpatched vulnerability in the expat XML parsing library allows a remote, unauthenticated attacker to cause a Denial of Service condition.

Arista VeloCloud Orchestrator (VCO) is under active exploitation by attackers using a critical SQL injection vulnerability (CVE-2026-114625) to escalate from low-privilege tenant accounts to superuser operator status.

IBM SPSS Modeler contains a vulnerability that allows an authenticated, remote attacker to manipulate files on the host system.

A vulnerability in the TianoCore EDK2 PXE driver enables a remote, unauthenticated attacker to execute arbitrary code with Ring-0 privileges or trigger a denial-of-service condition.

A vulnerability in the Qt framework allows remote, anonymous attackers to trigger a denial of service condition.

Multiple critical vulnerabilities in Oracle Fusion Middleware allow unauthenticated attackers to achieve remote code execution, unauthorized data access, and privilege escalation.

An unvalidated output path header in the Apache Camel camel-docling component allows authenticated attackers to perform path traversal and write converted files to arbitrary directories on the host filesystem.

The Apache Camel AWS2-S3 component is vulnerable to Expression Language Injection. The Camel-AWS2-S3 producer evaluates untrusted S3 object keys from the CamelAwsS3Key header as Simple expressions.

Adversaries abuse AWS Systems Manager (SSM) Session Manager to gain interactive shell access and perform remote command execution on EC2 instances or managed hybrid nodes.

CISA has added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog due to documented evidence of active in-the-wild exploitation.

Threat actors utilize the Linux 'unshare' utility to manipulate system namespaces for container escapes and privilege escalation, allowing unauthorized access to host resources.

This rule identifies suspicious child processes executed via a web server, which may indicate web shell usage, vulnerability exploitation, or unauthorized command execution for persistence.

Adversaries may utilize the OpenSSL utility to generate password hashes for creating unauthorized local accounts or modifying existing credentials to maintain persistence on compromised Linux systems.

Attackers utilize the wget utility with post-upload flags to exfiltrate staged local data to external servers, a technique observable through process creation monitoring.

Non-root users querying specific system hardware files to identify virtualized environments for reconnaissance or sandbox evasion.

Adversaries exploit Base64 encoding to obfuscate malicious payloads on Linux systems, piping the decoded output directly to interpreters to execute code while evading disk-based security controls.

Detection logic identifying unsigned binaries or scripting utilities establishing network connections to various Large Language Model API endpoints for potential command and control.

A heap-based buffer overflow in Pillow’s ImagingJpegDecode function occurs when processing lossless (SOF3) JPEG files, leading to out-of-bounds memory writes during scanline decompression.