Threat briefs

A vulnerability in libssh (CVE-2023-6004) allows a remote, authenticated attacker to disclose sensitive information due to improper handling of SSH agent forwarding requests.

A vulnerability in IBM QRadar SIEM allows a remote, unauthenticated attacker to induce a denial-of-service condition affecting the platform availability.

PgBouncer contains multiple vulnerabilities that can be exploited by a remote, unauthenticated attacker to cause a denial-of-service condition, bypass security controls, or escalate privileges to administrator level.

Multiple vulnerabilities in Ubiquiti UniFi network management software allow remote, unauthenticated attackers to execute arbitrary OS commands, bypass security controls, and disrupt service.

A vulnerability in the BlueZ Bluetooth stack allows a remote, unauthenticated attacker to trigger a denial-of-service condition on affected Linux systems.

Multiple vulnerabilities in AMI AptioV UEFI firmware allow local attackers to achieve arbitrary code execution, data manipulation, privilege escalation, and information disclosure.

IBM WebSphere Application Server versions 8.5 and 9.0 are vulnerable to an authentication bypass in the CSIv2 inbound propagation handler, potentially allowing remote unauthorized access.

Citrix has released security bulletins addressing multiple vulnerabilities across UniconOS and XenServer products, including CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701.

A vulnerability in Fortinet FortiOS allows a remote, unauthenticated attacker to trigger a denial of service condition on the target appliance.

Multiple vulnerabilities in Fortinet FortiAnalyzer and FortiManager enable remote, unauthenticated attackers to perform SQL injection attacks, potentially resulting in unauthorized data access.

Multiple vulnerabilities across several Fortinet products, including FortiOS and FortiManager, permit remote code execution, privilege escalation, and denial-of-service.

Multiple vulnerabilities, including CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, in MongoDB Server allow remote attackers to achieve arbitrary code execution or denial of service.

Microsoft disrupted a Chinese-language cybercriminal ecosystem where Storm-3119 provided illicit cloud infrastructure to Storm-2990, whose phishing kits facilitated large-scale credential theft globally.

A local privilege escalation vulnerability in the Linux kernel vhost subsystem allows an attacker to achieve root access by exploiting a lack of range checking in vhost_vq_meta_fetch().

CVE-2026-6951 is a remote code execution vulnerability in the simple-git library, resulting from a filter bypass that allows command injection through the --config option and the Git ext protocol.

MikroORM versions 6.6.9 and 7.0.5 are vulnerable to SQL injection when specially crafted objects are interpreted as raw SQL query fragments, potentially allowing attackers to execute arbitrary SQL commands.

Radar versions prior to 1.12.2 contain a missing authorization vulnerability allowing attackers to execute commands via the /api/local-terminal WebSocket endpoint.

An unauthenticated authentication bypass vulnerability (CVE-2026-97657) in Abandoned Cart Pro for WooCommerce versions 10.8.0 and earlier allows attackers to perform account takeovers via XOR-malleation of recovery tokens.

The insights-runtime-extractor DaemonSet fails to correctly drop privileges when scanning containers, allowing malicious workloads to execute code as root in the host user namespace.

The SimpleForm plugin for WordPress (<= 3.10.0) is vulnerable to unauthenticated administrator account creation due to missing capability checks on the wp_ajax_nopriv_simpleform_wp_register AJAX action.

Exploitation attempts against Citrix ADC via CVE-2023-3519, a SAML processing overflow, detected through specific POST requests, could lead to arbitrary code execution, privilege escalation, or service disruption.

Threat actors are using typosquatted domains to harvest WatchGuard VPN credentials via fake portals before delivering legitimate software to maintain victim trust.

CVE-2026-96940 is an elevation of privilege vulnerability in Microsoft Exchange Server that allows authenticated attackers to escalate privileges within the server environment.

Adversaries leverage nslookup within PowerShell execution flows to retrieve malicious payloads encoded in DNS TXT records, bypassing traditional network egress filtering.

Detection of Windows event log files (.evtx) created outside of standard system directories, which may indicate log tampering, data staging, or forensic evasion.

Mistral Vibe versions before 2.25.4 are susceptible to a command permission gate bypass that enables arbitrary command execution via the bash promptvars feature.

SAP has released security updates addressing four critical-severity vulnerabilities, including SSRF, code injection, and authorization bypasses, across multiple enterprise platforms.

An authenticated user can exploit CVE-2022-43571, a code injection vulnerability within Splunk Enterprise or Splunk Cloud's dashboard PDF generation component, leading to remote code execution (RCE) and potential compromise of the Splunk environment.

Multiple WSO2 products are vulnerable to a path traversal flaw that allows unauthenticated attackers to perform unrestricted file uploads, resulting in potential remote code execution.

A vulnerability in the Royal Elementor Addons plugin for WordPress allows an unauthenticated, remote attacker to manipulate files on the server via improper access control.