Threat briefs

CVE-2026-86344 is a denial-of-service vulnerability in 389-ds-base where an unauthenticated remote attacker can exhaust the server thread pool by sending malformed LDAP messages.

Mooncake versions through 0.3.13.post1 contain an authentication bypass in the HTTP metadata server, allowing unauthenticated attackers to manipulate transfer engine keys, redirect data, or trigger denial-of-service.

An unauthenticated information disclosure vulnerability in the FileRise Pro portal endpoint allows attackers to retrieve sensitive configuration data, including internal storage paths and client contact information.

A vulnerability in the Confluent Kafka Python client's HashiCorp Vault KMS integration allows man-in-the-middle attackers to intercept sensitive traffic due to improper TLS certificate validation.

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to CSRF in the admin API, allowing unauthenticated attackers to perform state-changing operations via malicious web pages.

Podgrab is vulnerable to an unauthenticated denial-of-service attack where an attacker can trigger a Go runtime crash by exploiting unsynchronized concurrent access to shared maps in the WebSocket handler.

The Zod schema-validation library is vulnerable to uncontrolled resource consumption, allowing unauthenticated attackers to trigger out-of-memory crashes by submitting large, specially crafted arrays to applications using unconstrained array schemas.

A ReDoS vulnerability in the basic-ftp library allows a malicious FTP server to trigger quadratic-time CPU consumption during directory listing, causing a client-side denial of service.

The pypdf library contains a vulnerability, CVE-2026-102999, that allows an attacker to cause excessive execution times by providing a crafted PDF with numerous embedded files.

A vulnerability in the pypdf library, tracked as CVE-2026-103000, allows attackers to trigger excessive memory consumption and potential denial of service by providing crafted PDFs with large alphabetical page labels.

The devalue package for Node.js is vulnerable to a denial-of-service attack where specially crafted input causes quadratic string expansion during the serialization process, leading to memory and CPU exhaustion.

The devalue library improperly serializes Node.js Buffer objects, exposing up to 64 KB of process-wide memory to end users in SSR environments via CVE-2026-92708.

The jackson-core library suffers from a denial-of-service vulnerability (CVE-2026-89425) where malformed tokens in DataInput-backed parsers cause unbounded memory consumption, leading to potential JVM process crashes.

JupyterLab is vulnerable to a cross-site scripting (XSS) attack via the system clipboard that allows unauthorized JavaScript execution within the user's session when pasting cells from an external source.

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

A prototype pollution gadget in the Piscina library allows unauthenticated attackers to execute arbitrary code or manipulate worker environments by injecting properties via Object.prototype.

The vm2 sandbox library (v3.11.3-3.11.6) allows attackers to bypass restrictions and execute arbitrary native code in the host process by calling crypto.setEngine() with a path to a malicious dynamic library.

The vm2 sandboxing library fails to properly secure the 'node:test' builtin module in Node.js 24+, allowing an attacker to escape the sandbox via a double-prefix require and execute arbitrary host code.

Kiteworks appliances are vulnerable to a suite of critical flaws, including remote code execution, SQL injection, and command injection, allowing for full system compromise, data exfiltration, and administrative account takeover.

Attackers can achieve persistent unauthorized access to GitHub repositories by abusing OAuth application grants, which remain valid even after user password resets.

Attackers are leveraging Python scripts, compromised dependencies, and insecure model deserialization to establish persistence on macOS by creating malicious LaunchAgent and LaunchDaemon plist files.

This detection monitors for the first time a Python process spawns a shell on a macOS host, a common indicator of post-exploitation activity such as malicious model deserialization or compromised dependency execution.

This brief details a detection strategy for identifying post-exploitation credential theft where Python processes access sensitive files such as SSH keys, keychain databases, and browser cookies for the first time on a macOS host.

Adversaries are exploiting Amazon Bedrock APIs by submitting malformed inference parameters to trigger repeated validation exceptions, potentially for model evasion, cost harvesting, or testing defensive boundaries.

Detection of failed API calls attempting to enable Amazon Bedrock foundation model access, serving as a high-signal indicator for credential boundary-testing and potential LLMjacking.

Adversaries with compromised human IAM credentials can create rogue Bedrock Agents to establish persistent AI-driven footholds for data exfiltration, service pivoting, or C2 signaling.

Threat actors are leveraging stolen Amazon Bedrock API keys, intended for model invocation, to perform unauthorized destructive control-plane actions such as disabling guardrails and logging to facilitate LLMjacking or sabotage.

Threat actors who compromise administrative accounts in the Anthropic platform can create durable Admin API keys to maintain long-term programmatic access that persists beyond interactive session revocation.

The deletion of Anthropic extra-usage spend limits acts as a precursor for resource hijacking and financial abuse, allowing adversaries with compromised credentials to conduct large-scale, unrestricted API consumption.

Adversaries are performing reconnaissance within Anthropic organizations by chaining user and group enumeration actions, signaling intent for account takeover or unauthorized data access.