Threat briefs

An elevation of privilege vulnerability in the Microsoft.AspNetCore.Authentication.Negotiate package allows an attacker to misassociate an authenticated identity with an unintended LDAP principal due to improper validation of Kerberos principal SIDs.

An unencoded exception reflection vulnerability in the Blazor WebAssembly development server allows remote attackers to perform cross-site scripting (XSS) via the unauthenticated /_framework/debug endpoint.

North Korean state-controlled IT workers are scaling global employment fraud operations by utilizing domestic facilitators, KVM-over-IP hardware, and remote management tools to exfiltrate data and generate revenue.

Xorbits Xoscar versions 0.11.2 and earlier are vulnerable to unauthenticated remote code execution via insecure deserialization of data sent over the actor-pool TCP channel.

CVE-2026-84015 is a heap-based buffer overflow vulnerability in the Remote Access PPP EAP-TLS implementation that enables unauthenticated remote code execution via network-based exploitation.

An out-of-bounds write vulnerability (CVE-2026-83910) in the RPC Runtime allows unauthenticated remote attackers to achieve code execution over the network.

An unauthenticated remote attacker can leverage an integer underflow vulnerability in the DNS Server service to achieve arbitrary code execution via crafted network packets.

A heap-based buffer overflow vulnerability (CVE-2026-69639) in the Windows implementation of the Libarchive library enables unauthenticated remote code execution via malicious archive processing.

The odt2spip plugin for SPIP before 4.4.0 is vulnerable to OS command injection, allowing authenticated authors to execute arbitrary commands during document conversion.

The fuint platform contains a missing authentication vulnerability in the /clientApi/order/detail endpoint, allowing unauthenticated attackers to retrieve sensitive customer order PII via enumeration.

An insecure direct object reference vulnerability in FastBee versions through 2.1.0 allows authenticated low-privileged users to access and modify devices belonging to other tenants.

Makunet maku-boot versions 4.3.0 through 5.0.0 suffer from a missing authorization vulnerability, enabling authenticated users to exfiltrate cloud service credentials and send unauthorized emails.

Yshopmall through version 2.0.0 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated members to access, modify, or delete the shipping addresses of other users.

Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 contain a path traversal vulnerability in the fileManager component, allowing unauthenticated attackers to read sensitive files via the /rest/retrieveFileStream endpoint.

MateCloud versions 5.0.8 and earlier contain an authorization bypass vulnerability (CVE-2026-110108) allowing authenticated users to perform unauthorized administrative object storage operations.

Powerlevel10k versions through 1.20.0 execute malicious code via an insecure gitstatus installation script that disables TLS certificate verification and lacks integrity checks.

Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass where attackers with valid passwords can circumvent TOTP requirements by manipulating temporary login tokens.

A remote SQL injection vulnerability in SourceCodester Online Reviewer System 1.0 allows attackers to execute arbitrary SQL commands via the login endpoint.

SourceCodester Online Exam System 1.0 is vulnerable to unauthenticated remote SQL injection via the login endpoint, allowing potential authentication bypass.

CVE-2026-69227 is a critical vulnerability in Portal for ArcGIS that allows unauthenticated access to administrative /portaladmin/local API endpoints, potentially permitting unauthorized administrative actions.

AnyDesk contains a vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code with administrator privileges on affected Windows systems.

An authentication bypass vulnerability in the Splunk Enterprise Patroni REST API allows unauthenticated remote attackers to execute arbitrary system commands via configuration manipulation.

This analytic identifies potential exploitation, command-and-control communication, or protocol abuse by monitoring Zeek logs for HTTP requests using non-standard or unexpected methods.

This analytic identifies potential adversary activity by monitoring for non-standard SSH client banners in network traffic, which can indicate the use of custom offensive tooling, tunneling utilities, or malware for C2 and lateral movement.

This detection identifies anomalous HTTP POST requests containing heavily encoded bodies, specifically using hex escape sequences or base64 character blocks often used by adversaries to obfuscate C2 traffic or exfiltrated data.

Detection of access to the Ivanti Connect Secure bookmark endpoint associated with CVE-2023-46805 and CVE-2024-21887 via a GET request resulting in a 403 Forbidden response indicates a potential exploitation attempt.

An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.

SourceCodester Simple Cafe Billing System 1.0 is vulnerable to an improper authorization flaw in the User Management component that allows remote attackers to manipulate the 'Type' argument during user saving operations.

An unauthenticated SQL injection vulnerability in the Online-Appointment-Booking-System Admin CRUD endpoint allows remote attackers to execute arbitrary SQL commands via the cid or did parameters.

Swann Communications SWIFI-SE2KIC security cameras contain multiple authentication bypass vulnerabilities (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) that allow unauthenticated local network attackers to access live video streams and snapshots.