Threat briefs

A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 allows for sensitive data leakage or request failure by incorrectly mixing response bodies between consecutive requests on the same connection.

Wavlink WL-WN530BE1-A firmware through version M30BE1_V251117 is vulnerable to unauthenticated remote code execution via an OS command injection flaw in the /protocol.csp endpoint.

An authenticated stack-based buffer overflow in the TP-Link Tapo C320WS camera allows remote code execution as root via the Wi-Fi onboarding process.

ApostropheCMS versions prior to 4.33.0 contain a vulnerability in the Rich Text CSV conversion route allowing unauthenticated attackers to trigger disk exhaustion through unmanaged temporary file accumulation.

SolarWinds Observability Self-Hosted contains a broken authorization schema vulnerability that permits low-privileged users to access or modify restricted information, leading to unauthorized privilege escalation within the application.

Hitachi Energy MicroSCADA X SYS600 is affected by multiple vulnerabilities, including CSV injection, authentication bypass, and privilege escalation, which could allow attackers to gain unauthorized access or control over host systems.

Moxa has disclosed two critical vulnerabilities, CVE-2026-109812 and CVE-2026-109813, affecting the AIG-302 industrial computing series firmware version 1.4.1 and earlier.

Multiple vulnerabilities in WAGO industrial controller firmware allow an authenticated low-privileged user to achieve root-level OS command injection and bypass configuration authorization checks.

Multiple memory corruption and validation vulnerabilities in HMS Networks PEAK-System Windows drivers allow local attackers to induce a system kernel crash.

Detection of PowerShell script blocks utilizing high-entropy character distributions to mask obfuscated, compressed, or encrypted malicious payloads.

Attackers disable security-sensitive audit policy subcategories on Windows systems to evade detection and impair forensic capabilities by preventing the logging of critical activities.

Adversaries may enable SeDebugPrivilege from non-SYSTEM accounts to perform memory dumping, process injection, or privilege escalation by interacting with privileged system processes.

An out-of-bounds heap write vulnerability in the FX_MEDIA driver allows an attacker to gain control of the instruction pointer via a maliciously crafted FAT image.

DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 is vulnerable to unauthenticated remote command injection via the set_table function in mainfunction.cgi.

The Crass Ruby gem is vulnerable to a denial of service condition where maliciously crafted CSS numeric exponents trigger excessive CPU and memory consumption.

CVE-2026-105312 is a high-severity privilege escalation vulnerability allowing a tenant to perform cross-tenant Strimzi control-plane actions by injecting arbitrary container images into privileged operator-managed pods.

CVE-2026-105949 is an authentication bypass vulnerability in Cruise Control due to improper security constraint configuration and flawed servlet path routing, allowing unauthenticated access to admin endpoints.

ROS# versions prior to V2.2.2 are vulnerable to path traversal (CVE-2026-41551) due to insufficient sanitization of user input, potentially enabling remote attackers to read arbitrary files.

An input validation vulnerability in Apache Camel’s SagaProcessor allows unauthorized actors to hijack saga associations via the Long-Running-Action header, potentially leading to incorrect compensation or workflow manipulation.

Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain an authentication bypass vulnerability in operator WebSocket endpoints, allowing attackers to access exec and log sessions using self-minted bearer tokens.

An unauthenticated denial-of-service vulnerability in Eclipse ioFog Controller (versions 3.8.0 through 3.9.1) allows attackers to crash the controller process by sending malicious JSON payloads to template-processing routes.

The Kroxylicious Azure Key Vault KMS provider fails to validate vaultName parameters during EDEK wire-deserialization, enabling SSRF attacks to exfiltrate Azure bearer tokens.

This brief provides a detection approach for identifying unauthorized access to the Local Security Authority Subsystem Service (LSASS) memory, a common technique used by attackers to harvest credentials.

CVE-2026-85296 allows cross-partner signing key leakage in Apache Camel AS2 deployments due to improper state management of per-request keys in shared instance fields.

Osclass versions up to 8.3.1 are vulnerable to a remote SQL injection attack due to insufficient sanitization of the sPattern argument in the Item::findUserItems function.

CVE-2026-85260 is an information disclosure vulnerability in the Apache Camel MLLP component where sensitive HL7 clinical messages are written to application logs by default, exposing protected health information.

CVE-2021-27137 is a stack-based buffer overflow vulnerability in DD-WRT's UPnP component that allows an unauthenticated attacker to trigger remote code execution on affected router devices.

WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected by a REST API batch-route flaw that can combine with a related SQL injection issue to enable unauthenticated remote code execution.

A vulnerability in GNUTLS (CVE-2026-42010) allows a remote attacker to bypass authentication on servers configured with RSA-PSK by sending a specially crafted username containing a NUL character, leading to unauthorized access.

A server-side request forgery (SSRF) vulnerability in n8n-MCP prior to version 2.47.4 allows authenticated attackers to send HTTP requests to arbitrary URLs, potentially accessing sensitive information.