Threat briefs

Adversaries modify Windows Registry keys related to Microsoft Defender Firewall 'AuthorizedApplications' to bypass network restrictions and ensure persistence for malicious binaries.

Adversaries modify specific registry keys to disable Microsoft Defender Firewall exceptions, potentially enabling unauthorized lateral movement or command-and-control communication.

Wazuh versions 3.9.0 through 4.14.7 are vulnerable to an arbitrary file overwrite attack in MasterHandler that allows cluster workers to gain root remote code execution by modifying critical configuration files.

An unauthenticated remote attacker can crash the yt-dlp-web-ui application through version 4.0.0 by triggering a NULL pointer dereference via the Service.Formats JSON-RPC method.

Serena versions prior to 2.0.0 contain a path traversal vulnerability in Project.is_path_in_project() that allows attackers to access sensitive files outside the project root via malicious symlinks.

Froxlor versions 2.0.0 through 2.3.13 are vulnerable to stored cross-site scripting (XSS) via the customer theme setting, allowing authenticated customers to compromise administrator sessions.

NLTK versions up to 3.10.3 contain a path traversal vulnerability in the WekaClassifier component that allows attackers to probe or write files outside of defined data roots.

CVE-2026-109520 is a local privilege escalation vulnerability in Colorful iGameCenter 2.0.0.82 allowing unauthorized actions via manipulated IOCTL requests to the AMDRyzenMasterDriver.sys driver.

YouTransfer versions up to 0.0.7, 1.0.6, and 1.1.0 contain a path traversal vulnerability in the Template Rendering component that allows remote, unauthenticated file access.

IBM WebSphere Application Server and Liberty are susceptible to an unauthenticated remote denial-of-service attack via CVE-2026-103499, which permits uncontrolled resource consumption.

An SSRF vulnerability in the Conductor-OSS A2AService allows remote attackers to manipulate the agentUrl parameter to force unauthorized internal requests.

This brief covers the detection of unauthorized root certificate installation on Linux systems, a technique used by attackers to intercept encrypted traffic and disable TLS warnings.

A vulnerability in gnome-remote-desktop on Red Hat Enterprise Linux allows a remote attacker to trigger an infinite loop in VNC TLS I/O handlers, leading to high CPU consumption and service denial.

The TRENDnet TEW-432BRP router (version 3.10B20) is susceptible to remote code execution via a stack-based buffer overflow in the /goform/formTcpipSetup function.

A vulnerability in the FreeType font rendering engine, identified as CVE-2024-1300, allows a remote, unauthenticated attacker to trigger a denial-of-service condition via specially crafted font files.

Multiple vulnerabilities in Siemens SIMATIC S7 products enable unauthenticated or local attackers to execute arbitrary code, escalate privileges, manipulate data, or cause a denial-of-service.

This detection brief identifies potential account takeover attempts by monitoring for the provisioning of a new MFA device within one hour of a Windows password reset event.

CVE-2024-20767 is a critical arbitrary file read vulnerability in Adobe ColdFusion caused by improper access control, allowing unauthenticated attackers to exfiltrate sensitive files from the host server.

Roundup of Siemens security advisories published in October 2026.

The Biletiva Ticketing Platform is vulnerable to client-side enforcement of server-side security, allowing unauthorized state manipulation via crafted client-side requests.

An authentication bypass vulnerability in the AdithyaYelloju Restaurant-Management-System allows remote attackers to gain unauthorized access via manipulated login credentials.

The wmapd daemon in Wavlink WL-WN592AX6 firmware version 250422 is vulnerable to remote, unauthenticated OS command injection, allowing full device takeover.

An unauthenticated stored XSS vulnerability in AcyMailing WordPress plugin version 11.1.0 and earlier allows attackers to inject malicious scripts via the customField[] parameter.

The Bit Integrations plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via improper input sanitization in the notification_content parameter, allowing script injection when specific BuddyBoss notification flows are active.

SourceCodester Library Management System 1.0 is vulnerable to an unrestricted file upload flaw via the 'image' argument in 'admin/add_admin.php', potentially enabling remote code execution.

SourceCodester E-Learning System 1.0 contains an unrestricted file upload vulnerability in the save_users function, allowing remote attackers to upload arbitrary files to the server.

SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.

An authentication bypass vulnerability (CVE-2026-12415) in the Invoice Generator plugin for WordPress (versions up to and including 1.0.0) allows unauthenticated attackers to perform privilege escalation by modifying the email address of any user, including administrators, and subsequently gaining full account control via a password reset.

An authenticated, remote attacker can exploit a flaw in Grafana to perform unauthorized information disclosure due to improper access control.

CVE-2025-31161 in CrushFTP is being exploited to gain unauthorized access and execute malicious commands, with activity linked to Hellcat ransomware operations.