Threat briefs

Exploitation attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices via CVE-2020-5902 are detected through regex pattern matching of exploit strings and directory traversal sequences in syslog data, potentially leading to remote code execution and system compromise.

A vulnerability in the LogFactory component of openGauss-connector-jdbc allows attackers to trigger arbitrary class instantiation via reflection by controlling JDBC logger class parameters.

A heap-based buffer overflow in the HllObjectUnpack function of openGauss-server allows authenticated database users to achieve memory corruption via malformed HyperLogLog (HLL) objects.

CVE-2026-108983 represents a critical vulnerability in GeoWebServer.exe involving default connection port configurations, carrying a CVSS base score of 9.8.

Adversaries utilize command-line utilities like 'dir' and 'findstr' to locate password manager databases and sensitive credential files to facilitate credential theft and privilege escalation.

Threat actors frequently utilize URL shortening services like TinyURL to obfuscate malicious URLs used in phishing campaigns, malware staging, or command-and-control (C2) communication.

The Braodo stealer and similar infostealer families utilize taskkill to terminate browser processes to unlock sensitive credential and session data files for exfiltration.

This detection identifies PowerShell activity using native cmdlets to fetch payloads from raw-content URLs on code hosting platforms, a technique frequently abused for stage-one payload delivery.

Adversaries leverage the Telegram desktop application on Windows to download malicious payloads and secondary tools by monitoring for associated file stream creation events.

Detection of anomalous Amazon CloudWatch Logs activity characterized by high-volume API requests, which may indicate automated discovery or exfiltration of sensitive telemetry data.

Detection of AWS IAM role creation events with trust policies configured to permit 'sts:AssumeRole' from external AWS accounts or wildcard principals, a common technique for establishing persistent backdoors.

Threat actors may stop an AWS EC2 instance and modify its user-data attribute to establish persistence or execute unauthorized code upon the next system startup.

An AWS identity performing a high volume of SendSSHPublicKey API calls may indicate automated lateral movement or unauthorized access attempts via EC2 Instance Connect.

Detection of anomalous bulk retrieval of sensitive data from AWS Secrets Manager using the BatchGetSecretValue API, which may indicate unauthorized credential harvesting or account takeover.

Unauthenticated remote attackers are exploiting CVE-2024-7593 in Ivanti Virtual Traffic Manager (vTM) to bypass authentication and create new administrator accounts, potentially leading to full system compromise.

CVE-2020-16152 is a high-severity local file inclusion vulnerability in Extreme Networks HiveOS and IQ Engine that permits root-level remote code execution via log poisoning.

CVE-2026-98260 is a kernel memory corruption vulnerability in the Infinity Core Timer subsystem allowing local privilege escalation to root on Android devices via a use-after-free condition.

A publicly available exploit for CVE-2026-98256 enables local privilege escalation on Android/ARM64 systems by leveraging a race condition in the InfinityCore Signal subsystem to gain a root shell.

A local privilege escalation vulnerability (CVE-2026-80775) in the InfinityCore Android kernel allows attackers to achieve root access via a race condition in the Futex subsystem.

CVE-2026-98385 is a local privilege escalation vulnerability in the InfinityCore Android scheduler stemming from a use-after-free condition in per-CPU cache statistics, allowing attackers to overwrite task credentials.

The LearnPress plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the 'checkout-email' parameter, allowing remote attackers to trigger insecure deserialization.

The light0011 CMS contains an improper access control vulnerability in its Captcha Validation component that allows remote attackers to manipulate authentication mechanisms.

An authenticated path traversal vulnerability in Camaleon CMS allows attackers to read arbitrary files from the host server via the 'download_private_file' endpoint.

Multiple vulnerabilities in Fortinet FortiSIEM allow unauthenticated remote attackers to execute arbitrary code on the affected appliance, risking complete platform compromise.

An unauthenticated remote SQL injection vulnerability (CVE-2026-111990) exists in the Appointment Cancellation Handler of the kishan0725 Hospital Management System.

An unauthenticated heap-based buffer overflow in snac2 versions before 2.93 allows remote attackers to trigger memory corruption via a specially crafted JSON payload.

The cgltf library through version 1.15 is susceptible to a heap out-of-bounds write vulnerability via maliciously crafted glTF or GLB files, potentially leading to arbitrary code execution.

Omnigent versions 0.3.0 through 0.13.x contain a path traversal vulnerability in bundles.py that allows authenticated attackers to escape restricted workspaces and read or write arbitrary files as the runner user.

WhoDB versions prior to 0.135.0 are vulnerable to path traversal via DuckDB filesystem functions in the query editor, enabling remote unauthenticated file read and write access.

ProjectSend versions prior to 2.7.0 are vulnerable to an authorization flaw allowing API token holders with management permissions to elevate privileges by modifying the token owner's credentials.