Threat briefs

The JS Help Desk WordPress plugin versions 3.0.4 and earlier are vulnerable to SQL injection via the `multiformid` parameter in the `storeTickets()` function, allowing unauthenticated attackers to extract sensitive information from the database.

plank/laravel-mediable through version 6.4.0 is vulnerable to arbitrary file upload via client-supplied MIME types, potentially leading to remote code execution if the uploaded file is stored in a web-accessible location.

An incorrect key length constant in libcrux-poly1305 versions before 0.0.5 causes the `libcrux_poly1305::mac` function to panic due to out-of-bounds memory access when used as a standalone MAC.

macOS is vulnerable to synthetic mouse event attacks, allowing threat actors to bypass security mechanisms and interact with protected UI components to perform unauthorized actions like dumping keychains and loading kernel extensions.

A path traversal vulnerability exists in Mako versions 1.3.11 and earlier on Windows, allowing attackers to read arbitrary files outside the configured template directory by using backslashes in URIs to bypass directory traversal checks.

This rule uses alert data to identify hosts with multiple alerts across different ATT&CK tactics, indicating a higher likelihood of compromise and enabling analysts to prioritize triage and response based on accumulated risk score.

Multiple Microsoft Entra ID Protection alerts associated with a single user in a short timeframe may indicate an ongoing attack or compromised account, stemming from suspicious sign-in activity such as anomalous IP addresses or risky sign-ins.

A vulnerability in NATS.io versions before v2.12.6 or v2.11.15 allows MQTT clients to bypass ACL checks for MQTT subjects due to ACLs not being applied in the `$MQTT.>` namespace, potentially allowing unauthorized access and control of MQTT communications.

An unauthenticated peer can crash a Nimiq node by sending a malformed election macro block containing an invalid BLS voting key, leading to a denial of service.

A SQL injection vulnerability exists in nocobase plugin-collection-sql versions 2.0.32 and earlier due to missing validation on the sqlCollection:update endpoint, allowing attackers with collection management permissions to execute arbitrary SQL queries and exfiltrate data.

A vulnerability in OpenClaw versions 2026.4.2 and earlier allows lower-trust runtime output to be injected into trusted system events, potentially leading to prompt injection.

OpenEDR's ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY capabilities may indicate remote command execution and potential abuse of OpenEDR's remote management features by threat actors for lateral movement or command-and-control.

Atypical login activity where a user account, normally logging in from a high-volume, single source IP, suddenly authenticates from a different IP address, potentially indicating account takeover or stolen credentials.

This rule identifies attempts to coerce local NTLM authentication via HTTP using the Windows Printer Spooler service as a target, which adversaries may use to elevate privileges on a compromised system.

This rule detects potential privilege escalation attempts on Linux systems by identifying processes running with root privileges but initiated by non-root users, indicative of SUID/SGID abuse.

A remote attacker can exploit an unrestricted file upload vulnerability (CVE-2026-5001) in PromtEngineer localGPT up to version 4d41c7d1713b16b216d8e062e51a5dd88b20b054 via the do_POST function in backend/server.py.

A command injection vulnerability exists in radare2 versions prior to 6.1.4, where a crafted PDB file with newline characters in symbol names can inject arbitrary radare2 commands, leading to arbitrary OS command execution.

This rule detects rare network connections via the SMB protocol to external networks, where SMB is commonly abused to exfiltrate data or leak NTLM credentials via UNC path injection.

A memory access vulnerability exists in the SAIL image library's XWD codec due to inconsistent handling of pixel format, potentially leading to crashes or code execution when processing specially crafted image files.

Scriban versions before 7.0.0 are vulnerable to a stack overflow exception due to deeply nested array initializers bypassing the ExpressionDepthLimit, leading to uncontrolled recursion and process termination when parsing templates with untrusted input, similar to GHSA-wgh7-7m3c-fx25.

OpenEDR's ITSMService process, used for remote management, is being abused to create suspicious files on compromised systems, potentially leading to unauthorized file uploads, data staging, or malicious file deployment.

A cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) could allow attackers to execute arbitrary JavaScript within a user's session, potentially leading to unauthorized access to sensitive information.

A stack-based buffer overflow vulnerability (CVE-2026-4552) exists in the Tenda F453 router version 1.0.0.3, allowing remote attackers to execute arbitrary code by manipulating the 'page' argument in the /goform/VirtualSer endpoint, due to insufficient input validation in the fromVirtualSer function.

A machine learning job detected a user accessing an uncommon group name for privileged operations, potentially indicating privilege escalation or unauthorized account manipulation on a Windows system.

Anomalous NewCredentials logon events triggered by uncommon processes may indicate access token manipulation for privilege escalation.

Detection of a rollback script (.rbs) file deletion under C:\Config.Msi by a non-msiexec.exe process, indicating a potential MSI rollback privilege escalation attack.

This rule identifies attempts to execute Jscript/Vbscript files from an archive file, a common delivery method for malicious scripts on Windows systems.

WWBN AVideo versions up to 26.0 are vulnerable to an arbitrary local file read via the `chunkFile` parameter in the `POST /objects/aVideoEncoder.json.php` endpoint, allowing authenticated users to read sensitive server files.

WWBN AVideo versions up to 26.0 are vulnerable to a denial-of-service attack where unauthenticated remote attackers can exhaust disk space by sending arbitrary POST data to a specific endpoint.

Xerte Online Toolkits versions 3.15 and earlier are vulnerable to unauthenticated remote code execution due to a missing authentication check in the elFinder connector, allowing arbitrary file operations that can be chained with other vulnerabilities.