The CSSOM library up to version 0.5.0 is vulnerable to a denial of service attack via malicious CSS declarations that trigger excessive memory allocation.

A vulnerability in source-map-js versions 1.2.1 and earlier allows unauthenticated attackers to trigger synchronous event loop blocking by supplying malformed indexed source maps containing extreme offset line values.

The adm-zip library is vulnerable to a denial of service (DoS) attack where a maliciously crafted ZIP archive forces excessive memory allocation by misrepresenting uncompressed file sizes.

Adversaries may register new MFA devices for compromised AWS IAM roles to maintain persistence, escalate privileges, or facilitate lateral movement by assuming roles via the AWS Security Token Service (STS).

Detection of failed API calls attempting to enable Amazon Bedrock foundation model access, serving as a high-signal indicator for credential boundary-testing and potential LLMjacking.

This detection brief identifies potential data exfiltration or unauthorized collection by monitoring for unusual AWS DynamoDB Scan operations performed by users or roles exhibiting non-typical behavior.

Adversaries may use the CreateTrail API to establish unauthorized logging configurations that redirect audit data to attacker-controlled destinations or circumvent existing monitoring controls.

This brief covers the detection of automated reconnaissance activities, such as vulnerability scanning and fuzzing, which manifest as significant spikes in web server error logs.

Adversaries leverage the POSIX shell 'trap' built-in to bind malicious payloads to interrupt signals, enabling automated execution for persistence or privilege escalation when specific signals are received.

Adversaries may use chmod or install to set SUID or SGID bits on files, allowing malicious code to execute with elevated privileges for persistence or escalation.

Threat actors are exploiting web application command injection vulnerabilities to execute arbitrary code by submitting crafted HTTP requests containing interpreter invocations, downloader utilities, or shell commands.

Detection rule identifies first-time seen USB storage devices mounted on Windows and macOS endpoints to help analysts monitor for potential initial access, lateral movement, or data exfiltration.

This brief outlines the identification and response strategy for Remote File Inclusion (RFI) attacks, where adversaries exploit web server vulnerabilities to fetch remote payloads or disclose sensitive local files.

Adversaries utilize trailing space characters in binary filenames to masquerade as legitimate system tools, exploiting file handling behaviors to disguise malicious activity.

Attackers may force HTTP protocol downgrades from secure versions like HTTP/2 to legacy versions to exploit header parsing inconsistencies and facilitate request smuggling or cache poisoning.

Adversaries leverage the legitimate OpenSSL command-line utility to encrypt sensitive files for ransomware extortion or to obfuscate data prior to exfiltration.

Adversaries leverage compromised dependencies in Node.js or Bun development workflows to perform anomalous DNS lookups for command-and-control, staging, or exfiltration activities.

This brief documents techniques used to abuse the Kubernetes kubectl CLI for command and control or data exfiltration by manipulating network configurations through port-forwarding and proxying.

An unauthenticated remote attacker can exploit CVE-2026-91149 in Cockpit by exhausting system resources through numerous simultaneous connections to the cockpit-tls service.

A vulnerability in WebSocketServerExtensionHandler allows an attacker to trigger unbounded per-connection queue growth, leading to resource exhaustion and denial of service.

The Netty SpdySessionHandler component is vulnerable to a denial of service attack via uncontrolled concurrent stream allocation, potentially exhausting JVM heap and direct memory.

A vulnerability in RedisArrayAggregator allows remote attackers to trigger memory exhaustion via a crafted RESP payload that forces eager allocation of array capacity.

An unauthenticated remote attacker can trigger a denial of service in Red Hat RESTEasy by submitting a crafted image that causes excessive memory allocation within the JVM via the IIOImageProvider component.

Ourphp versions 7.2.0 and earlier are vulnerable to reflected cross-site scripting (XSS) via the 'out' parameter in the 'ourphp_out.php' endpoint, allowing unauthorized script execution in a victim's browser session.

The go-openapi/swag library is vulnerable to a stack overflow in its jsonutils component, allowing remote unauthenticated attackers to cause a denial-of-service by submitting deeply nested JSON documents.

The HAPI FHIR SHCParser component contains an unbounded DEFLATE decompression flaw (CVE-2026-81875) allowing attackers to trigger memory exhaustion and denial-of-service.

A malformed HTTP chunked body triggers an infinite loop in the react/http ChunkedDecoder, causing 100% CPU usage and service disruption in both server and client implementations.

The redis-parser library up to version 3.0.0 is vulnerable to a denial of service attack where crafted RESP byte streams trigger unbounded recursion, exhausting the V8 call stack and crashing the host Node.js process.

ExifReader version 4.41.0 is susceptible to a heap exhaustion denial-of-service vulnerability due to an unbounded object allocation loop when parsing malicious ISO-BMFF iloc box structures.

An improper input validation vulnerability (CVE-2025-6625) in Schneider Electric Modicon M340 controllers and communication modules allows unauthenticated attackers to cause a denial-of-service via crafted FTP commands.

The roxmltree library is vulnerable to a denial of service attack due to quadratic-time attribute and namespace validation during XML parsing, allowing attackers to cause excessive CPU consumption.

InternLM LMDeploy version 0.17.0 and earlier is vulnerable to a denial-of-service attack due to improper session management in DistServe mode, allowing unauthenticated attackers to cause an out-of-memory failure on the prefill worker.

Multiple vulnerabilities in corosync, libevent, and libsoup within Red Hat Enterprise Linux could allow attackers to execute arbitrary code, bypass security controls, disclose data, or cause denial-of-service.

A vulnerability in Eclipse Jetty, identified as CVE-2024-8184, allows a remote unauthenticated attacker to manipulate displayed information and gain unauthorized access to sensitive data.

A critical vulnerability in Nextcloud Hub, tracked as CVE-2024-28112, allows remote attackers to execute arbitrary code on the underlying application server.

ScadaLTS 2.8.1-rc is vulnerable to an authenticated blind SQL injection via the sortBy parameter in the /api/events/search endpoint, allowing low-privileged users to exfiltrate database contents.

An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.

A vulnerability in BIND 9 resolvers configured with DNS64 allows an authoritative server to cause a process crash through malformed responses, resulting in a denial of service.

An unauthenticated attacker can trigger a denial of service in Keycloak by sending repeated malformed SAML requests that cause native memory exhaustion due to improper zlib memory management.

A vulnerability in BIND 9 allows remote attackers to cause the 'named' process to abort by sending a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by premature connection closure.

Oracle Hyperion is affected by multiple security vulnerabilities (CVE-2024-21054, CVE-2024-21055) that allow remote attackers to compromise system confidentiality, integrity, and availability.

An improper eviction logic in the http4s DigestAuth middleware allows unauthenticated remote attackers to cause heap exhaustion and service failure by triggering unbounded growth of the internal nonce map.

An unauthenticated remote denial-of-service vulnerability in the emp3r0r C2 server (CVE-2026-61554) allows attackers to exhaust server resources by injecting arbitrary request bodies before session authentication.

Adversaries manipulate Linux firewall configurations using utilities like iptables, nftables, or ufw to create or modify rules, facilitating unauthorized network access or the disruption of security controls.

Adversaries are targeting macOS hosts via SSH brute force or password spraying, which can be identified by analyzing failed authentication logs generated by the sshd-session process.

Attackers frequently abuse the native Windows whoami utility for situational awareness, specifically to verify privilege escalation and identify current user contexts, necessitating monitoring of suspicious parent-child process chains.

An unauthenticated remote attacker can exploit a reflected XSS vulnerability in the Teamcenter authentication redirect flow to execute arbitrary JavaScript in the context of an authenticated user session.

Hirschmann HiOS Switch Platform devices are susceptible to a remote unauthenticated denial-of-service vulnerability due to improper input validation in the integrated web server.

A vulnerability in the Governikus AusweisApp2 software allows a remote, unauthenticated attacker to execute a Cross-Site Scripting (XSS) attack.

GNU libextractor versions prior to 1.15 contain a stack-based buffer overflow in the process_star_office function that can be triggered by malicious OLE2 stream data to cause application crashes.

A memory corruption vulnerability in libTIFF allows a local attacker to cause a crash or Denial of Service condition through a specially crafted TIFF file.

A memory corruption vulnerability in libarchive (CVE-2024-20696) allows a local attacker to cause a Denial of Service condition through the processing of specially crafted archive files.

Multiple vulnerabilities in MediaWiki allow remote, unauthenticated attackers to conduct Cross-Site Scripting (XSS) attacks by exploiting insufficient input validation within the application.

An improper access control vulnerability in the Royal Elementor Addons plugin for WordPress allows unauthenticated remote attackers to disclose sensitive configuration or user information via REST API endpoints.

This detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.

SIPp versions 3.7.7 and earlier contain a buffer overflow vulnerability in the get_peer_tag() function that allows remote attackers to cause a denial of service.

Nodemailer versions 9.1.0 through 10.0.4 are vulnerable to a denial of service attack where malicious email headers trigger quadratic time complexity in the addressparser component, exhausting CPU resources.

An unauthenticated denial of service vulnerability in Net-SNMP versions up to 5.9.5.2 allows remote attackers to hang the snmpd process by initiating idle connections to the SMUX module.

A vulnerability in libp2p-rendezvous through version 0.17.1 allows malicious rendezvous servers to crash client nodes by providing an unbounded registration TTL value.

Adversaries gain persistence on Linux systems by creating or modifying initialization scripts in /etc/init.d/ or /etc/init/, allowing for malicious code execution with root privileges during system boot.

An improperly exported MiracastService component on Android TV devices using MediaTek chipsets allows local attackers to manipulate Wi-Fi Direct states and cause denial of service via a confused deputy attack.

Adversaries can establish durable, phishing-resistant persistence in Microsoft Entra ID by registering unauthorized Windows Hello for Business (WHfB) credentials to survive password resets and session revocations.

Detection logic identifies internal reconnaissance activity characterized by a single source IP probing a large volume of unique destination ports using SYN packets.

Detection of potentially unauthorized IPSEC NAT Traversal (NAT-T) tunnels indicates potential command and control (C2) or exfiltration activity masked by encrypted traffic.

ION-DTN versions prior to 4.2.1-a.1 are vulnerable to a remote denial-of-service attack, allowing unauthenticated attackers to terminate the process by sending a malformed BPv7 bundle.

Multiple vulnerabilities in the Dell Intel NPU driver allow a local attacker to cause a denial of service condition through insufficient input validation.

The MergingDigest.fromBytes method in t-digest versions 3.1 through 3.3 fails to validate centroid means during deserialization, allowing attackers to inject NaN values that trigger a denial-of-service via algorithmic complexity degradation.

CVE-2026-0302 allows local users with low privileges to achieve OS command injection by influencing input consumed during Checkov scanning processes.

A vulnerability in Fortinet FortiSIEM allows a remote, unauthenticated attacker to perform an open redirect, enabling the redirection of users to malicious or untrusted websites.

The NLTK library is vulnerable to Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions being processed without timeouts, allowing CPU exhaustion.

The HTTPX2 library, prior to version 2.12.0, is vulnerable to a decompression amplification attack where malicious compressed HTTP responses can trigger large, unbonded memory allocations, leading to denial-of-service via memory exhaustion.

The js-yaml library fails to correctly account for empty mappings when enforcing maxTotalMergeKeys, allowing attackers to trigger excessive CPU consumption through specially crafted YAML documents.

An unauthenticated remote attacker can crash Node.js applications using the multer package by sending a specifically crafted multipart/form-data request that triggers an uncaught RangeError.

A vulnerability in libtpms (CVE-2024-0230) allows an attacker on an adjacent network to trigger a denial of service condition, potentially leading to service instability.

Multiple vulnerabilities in the python-cryptography package for Red Hat Enterprise Linux, including CVE-2024-26130, may allow a remote, unauthenticated attacker to bypass security controls or cause a denial-of-service condition.

Adversaries achieve persistence on macOS by creating or modifying launch agent or daemon plist files and immediately loading them into the launchd subsystem using the launchctl utility.

An unauthenticated remote attacker can crash the 389 Directory Server by sending crafted LDAP paged search requests, resulting in a denial of service condition.

The league/commonmark library is susceptible to a denial of service attack via crafted Markdown input that triggers quadratic CPU complexity in slug normalization.

CommonMark versions 1.5.0 through 2.09.0 are susceptible to a CPU-exhaustion denial-of-service attack due to inefficient attribute processing within the AttributesExtension.

Adversaries may use compromised long-term IAM access keys (AKIA* prefix) to enumerate AWS Backup vaults, plans, and protected resources as a precursor to ransomware activities.

The h3 library is vulnerable to a denial of service attack due to improper input validation of cookie chunk counts, allowing an attacker to trigger an O(n²) cleanup loop that hangs the server process.

PocketMine-MP versions prior to 4.7.2 are vulnerable to a denial-of-service attack due to improper exception handling when parsing skin geometry data.

CVE-2026-39031 is a critical credential security flaw in Lansweeper lsrunase 2.0 and lsencrypt 2.0 that allows attackers to perform offline decryption of stored passwords.

Adversaries often execute 'crontab -l' to enumerate existing scheduled tasks, enabling the discovery of persistence mechanisms, legitimate job hijacking targets, or privilege escalation opportunities.

Chroma 1.5.9 is vulnerable to an unauthenticated denial-of-service attack due to insufficient bounds validation on HNSW index parameters during collection creation, allowing memory exhaustion.

A vulnerability in the Checkmk Agent Receiver allows a remote, authenticated attacker to trigger a Denial of Service condition on the affected monitoring infrastructure.

Dell BSAFE Micro Edition Suite and BSAFE SSL-J are affected by a vulnerability (CVE-2024-38640) that allows unauthenticated attackers to trigger a Denial of Service condition through malicious packet transmission.

The Phoenix web framework lacks limits on channels per transport, allowing an unauthenticated attacker to cause a DoS by exhausting Erlang VM process limits via CVE-2026-56811.

An unauthenticated memory exhaustion vulnerability in MOOS-IvP pMarineViewer (<= 24.8.1) allows attackers to stall the operator display by flooding the application with unbounded NODE_REPORT messages.

The parsedmarc library before version 11.0.1 is vulnerable to remote denial-of-service exploitation via crafted email attachments that trigger memory exhaustion through unbounded decompression.

An attacker-controlled server can trigger an out-of-memory denial of service in ffuf (<= 2.1.0) by serving a decompression bomb that bypasses existing size constraints.

This brief details a detection capability for monitoring the creation of Portable Executable files using Sysmon Event ID 29 to identify unauthorized binary drops.

A NULL pointer dereference vulnerability in the GStreamer RTSP support library allows remote, unauthenticated attackers to trigger a denial of service by sending a malformed RTSP request containing specifically crafted whitespace in Digest authentication headers.

Tornado fails to restrict the number of fields parsed in application/x-www-form-urlencoded request bodies, allowing an unauthenticated attacker to cause a denial-of-service by stalling the event loop.

Mistune versions 3.3.0 through 3.3.2 are susceptible to a denial of service attack via uncontrolled recursion during the rendering of deeply nested emphasis markers.

ION-DTN versions prior to 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function, allowing unauthenticated remote attackers to trigger unauthorized memory access via truncated SDNV values.

The Browserslist package is vulnerable to a volumetric denial-of-service attack due to a missing cache eviction policy in its internal query result storage, leading to unbounded heap growth and potential OOM crashes in long-running processes.

Detection of unauthorized modifications to Internet Explorer registry keys, which can be leveraged by attackers for persistence or defense impairment.

A vulnerability in the libtasn1 library tracked as CVE-2024-11111 allows a remote, anonymous attacker to cause a Denial of Service condition, potentially impacting applications that rely on the library for ASN.1 structure processing.

A vulnerability in VMware Tanzu Spring Framework identified as CVE-2024-38816 allows a remote, unauthenticated attacker to bypass security restrictions.

CVE-2024-57429 is a Cross-Site Request Forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0, allowing attackers to perform administrative account takeover via malicious web requests.

A vulnerability in Engine.IO versions 6.5.0 through 6.6.6 allows unauthenticated attackers to cause a process crash by sending a crafted WebTransport upgrade request.

Attackers can abuse the Windows Application Shim infrastructure via sdbinst.exe to achieve persistence and arbitrary code execution by installing malicious compatibility databases.

An unauthenticated remote attacker can cause a denial of service in SmallRye GraphQL by exploiting improper BigInteger scalar coercion to trigger resource exhaustion.

Agentejo Cockpit CMS versions up to 2.6.3 contain a stored XSS vulnerability via the asset upload endpoint, allowing attackers to execute arbitrary JavaScript by uploading and accessing malicious .shtml files.

Multiple vulnerabilities in GIMP (CVE-2024-10332, CVE-2024-10333) allow a local attacker to cause a denial-of-service condition or perform information disclosure via malicious input files.

A vulnerability in rsyslog identified as CVE-2024-43355 allows a remote, anonymous attacker to cause a service crash via a Denial of Service attack.

A vulnerability in the Undertow web server used in JBoss EAP and WildFly allows remote attackers to trigger denial of service through WebSocket resource exhaustion due to unconfigurable limits.

Adversaries, including the BadPatch malware family, utilize non-standard port 26/TCP for SMTP-based command and control and data exfiltration to evade traditional security monitoring.

Phpgurukul Online Birth Certificate System version 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) via the profile name field, allowing authenticated attackers to execute arbitrary JavaScript in the context of other users.

Documenso versions prior to 2.13.0 allow unauthenticated attackers to perform arbitrary PDF file uploads via the /api/files/upload-pdf endpoint, potentially resulting in resource exhaustion.

A stored cross-site scripting (XSS) vulnerability in Phpgurukul Teachers Record Management System version 1.0 allows authenticated administrators to execute arbitrary JavaScript in the context of other users.

The datadog-opentelemetry Rust library is vulnerable to a remote denial-of-service attack due to unbounded parsing of the W3C tracestate header, allowing unauthenticated attackers to exhaust CPU and memory resources.

An authentication state race condition in free5GC AUSF allows an attacker to perform a targeted denial-of-service by overwriting authentication contexts keyed by SUPI, preventing successful subscriber authentication.

An unauthenticated remote denial-of-service vulnerability in alos-http allows attackers to crash the server process by sending a single malformed HTTP request starting with a '?' character.

SvelteKit versions 2.49.0 through 2.53.2 are susceptible to a denial-of-service attack due to a deserialization expansion issue in the experimental remote functions feature.

CVE-2022-28601 allows an authenticated low-privileged user to bypass 2FA by overwriting a target account's associated phone number via the plugin's profile management endpoint.

A public proof-of-concept exploit has been released for CVE-2025-4611, a medium-severity vulnerability in the Slim Seo product that allows low-privilege remote exploitation.

JFrog Artifactory suffers from a path traversal vulnerability that allows an authenticated user to write files to unauthorized locations on the server by manipulating remote-repository configurations.

A vulnerability in the Ethernet function of multiple Mitsubishi Electric factory automation products allows remote attackers to trigger a denial-of-service condition via specially crafted UDP packets.

SourceCodester Student Result Management System 1.0 contains a path traversal vulnerability (CVE-2025-4720) in the drop_student.php endpoint, allowing authenticated attackers to perform arbitrary file deletion via the 'img' parameter.

Red Hat Libuser contains a race condition vulnerability allowing authenticated local users to corrupt /etc/passwd, potentially leading to privilege escalation or denial of service.

RustDesk versions before 1.4.7 are susceptible to a denial-of-service attack where unauthenticated attackers trigger memory exhaustion through malformed TCP frame headers.

Attackers with high-level IAM permissions may delete Amazon Detective behavior graphs to impair forensic investigations by destroying historical relationship mapping and telemetry analysis data.

Detection rule monitoring for the creation of binfmt configuration files which can be abused by threat actors to execute arbitrary code or maintain persistence on Linux systems.

The icalendar Python library contains an algorithmic complexity vulnerability (CVE-2026-55099) in the Component.__eq__ method that allows for denial of service via deeply nested subcomponents.

A local vulnerability in the RPM package management utility allows an attacker to execute arbitrary code with the privileges of the user executing the command.

A vulnerability in Devolutions Remote Desktop Manager allows a remote, unauthenticated attacker to manipulate data, leading to unauthorized modification risks.

This brief details a detection strategy for identifying unauthorized collection of clipboard data on Linux systems by monitoring the execution of common clipboard utilities from uncommon parent processes.

Adversaries may exploit AWS SNS by subscribing to topics using rare or unauthorized protocols to exfiltrate sensitive data or establish command-and-control communication channels.

Adversaries with compromised credentials may modify AWS Lambda configurations by injecting unauthorized layers to establish persistence, run arbitrary code, or intercept data.

Adversaries targeting AWS environments may delete critical S3 bucket configurations, such as policies, encryption, and lifecycle rules, to impair security controls and conceal malicious activity.

The justhtml library version 1.9.1 and earlier is vulnerable to a denial of service attack where malicious, deeply nested HTML tags trigger a Python RecursionError during parsing.

The Keystone @keystone-6/core package is vulnerable to a GraphQL input validation flaw, CVE-2026-63421, where negative values in the 'take' argument bypass configured result limits.

A vulnerability in the Red Hat multicluster engine (MCE) allows authenticated tenants to delete unauthorized ManagedCluster resources due to a missing ownership check in the clusterclaims-controller.

IBM AIX and PowerVM VIOS contain a remote, unauthenticated denial-of-service vulnerability (CVE-2026-19446) triggered by sending a crafted UDP packet to an RPC service, resulting in system unavailability.

An unauthenticated remote denial-of-service vulnerability in FreeIPA, tracked as CVE-2026-73197, allows attackers to exhaust system memory by sending oversized form POST requests to the migration endpoint.

An authenticated remote attacker can exploit a vulnerability in Cisco Unified Contact Center Enterprise to perform unauthorized file manipulation.

A vulnerability in the MLflow machine learning lifecycle platform allows unauthenticated remote attackers to bypass security controls, resulting in potential data disclosure or unauthorized data manipulation.

Multiple cryptographic implementation vulnerabilities in the libcrux library (CVE-2026-76234) allow for denial of service and improper cryptographic validation.

A heap-based memory leak in the cockpit-ws service allows unauthenticated remote attackers to trigger a denial of service via malformed Cookie headers.

A vulnerability identified as CVE-2024-38148 in Microsoft 365 Copilot allows remote, unauthenticated attackers to potentially access unauthorized sensitive information within the service environment.

Oracle has disclosed a series of 25 vulnerabilities affecting Hyperion, enabling remote, anonymous, or authenticated attackers to compromise system confidentiality, integrity, and availability.

Detection of adversarial reconnaissance activities leveraging the Get-AppLockerPolicy PowerShell cmdlet to map host-based application execution restrictions.

Adversaries are leveraging unauthorized device registration in Microsoft Entra ID to obtain Primary Refresh Tokens (PRT) and maintain persistent, authenticated access to cloud environments.

The Expat library through version 2.8.3 contains an algorithmic complexity vulnerability in its XML attribute parsing logic that allows unauthenticated attackers to cause CPU exhaustion and denial of service.

A vulnerability in Checkmk allows a remote, authenticated attacker to disclose sensitive information due to insufficient authorization controls.

A vulnerability in libpng allows a remote, anonymous attacker to trigger a Denial of Service (DoS) condition via specially crafted image input, leading to potential application instability.

An out-of-bounds read vulnerability in bcg729 versions up to 1.1.2 allows unauthenticated network-adjacent attackers to cause a process crash or heap memory exposure via malformed RTP payloads.

An unauthenticated remote attacker can crash the INDI indiserver daemon via a stack-based buffer overflow triggered by malformed XML input containing excessively long tags.

A public proof-of-concept exploit for CVE-2026-73633 allows unauthenticated attackers to perform denial-of-service attacks by forcing excessive CPU and memory consumption via the Apache Struts JSON plugin.

Proxmox Backup Server contains a vulnerability (CVE-2024-8916) that allows a local attacker to manipulate files and disclose sensitive information due to improper access controls.

A vulnerability (CVE-2026-14456) in OpenSSL versions 3.5.x, 3.6.x, and 4.0.x allows remote attackers to trigger a denial of service condition.

IBM i versions 7.3 through 7.6 are susceptible to a buffer overflow vulnerability allowing unauthenticated remote attackers to trigger a denial-of-service condition via malformed requests.

Siemens RUGGEDCOM APE1808 devices are impacted by multiple vulnerabilities (CVE-2026-23573, CVE-2026-59839) within the integrated Fortinet NGFW software, potentially allowing remote code execution or filesystem deletion.

Siemens Desigo DXR and PXC controllers are vulnerable to a denial-of-service condition (CVE-2026-59693) triggered by malformed BACnet packets, requiring a manual device reboot.

A vulnerability in Red Hat WildFly and JBoss Enterprise Application Platform allows a remote, unauthenticated attacker to trigger a denial-of-service condition.

Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.

An information disclosure vulnerability (CVE-2026-0301) in Palo Alto Networks PAN-OS URL Filtering allows unauthenticated attackers to access sensitive memory data if custom response pages are enabled.

A local authentication bypass vulnerability in the Palo Alto Networks Prisma Access Agent for Windows enables an administrative user to disable security inspections and manipulate network traffic.

An unauthenticated remote denial-of-service vulnerability in the Phoenix Contact PLCnext Engineer communication interface allows attackers to crash the service, requiring manual intervention.

A vulnerability in the web-based management interface of Cisco ASA and Secure Firewall Threat Defense allows an unauthenticated, remote attacker to trigger a device crash via crafted HTTP requests.

TECNO Hi Browser version 2.23.1.1 is vulnerable to path traversal via malicious Content-Disposition headers, allowing arbitrary file writes outside the intended download directory.

Apache Gravitino versions 1.0.0 through 1.2.1 contain an authenticated SSRF vulnerability (CVE-2026-49876) allowing attackers to perform internal network reconnaissance or access metadata services.

An out-of-bounds read and infinite loop vulnerability in libexpat versions prior to 2.8.3, triggered by improper Unicode surrogate pair handling, allows for denial-of-service via malformed XML.

A vulnerability in the Red Hat OpenShift oauth-proxy component, identified as CVE-2024-5254, allows a remote authenticated attacker to bypass security controls and manipulate data.

A vulnerability in the GoPacket sFlow ExtendedGatewayFlow decoder allows unauthenticated remote attackers to trigger a massive memory allocation, resulting in a Denial of Service.

CVE-2026-68182 identifies a flaw in the comedi_parport module of the Comedi Linux driver framework involving improper handling of premature interrupts.

A remote denial-of-service vulnerability in iperf3, tracked as CVE-2026-71217, allows unauthenticated attackers to trigger resource exhaustion through crafted control-channel JSON packets.

CVE-2026-68310 in the MediaTek mt76 wireless driver for mt7915 chipsets allows for potential memory access issues due to inadequate validation during HE capability lookups.

CVE-2026-68192 describes a flaw in the brcmfmac Wi-Fi driver related to non-idempotent buffer release routines, potentially leading to memory management issues.

CVE-2026-68364 identifies a deadlock vulnerability in the AMD Linux kernel display driver's dc_lock mechanism during suspend, potentially enabling a local denial-of-service.

CVE-2026-68131 identifies a flaw in the Linux kernel rbd module where failure to reset result codes to zero during object map updates may lead to improper status reporting.

CVE-2026-68331 identifies a resource management vulnerability in the dpaa2-eth driver related to improper handling of MAC endpoint devices during disconnection, which may lead to system instability.

CVE-2026-68256 describes a memory reference leak in the Linux kernel drm/amd/display driver occurring during specific DP alt mode timeout conditions.

CVE-2026-68412 identifies an error handling flaw in the cfg80211_wext_siwscan function of the Linux kernel wireless subsystem, potentially leading to instability during wireless scanning operations.

Intel has patched memory leaks and list corruption vulnerabilities in the stratix10-svc firmware component that could lead to system instability.

HashiCorp has released security advisory HCSEC-2026-25 addressing multiple vulnerabilities in Consul Community Edition and Consul Enterprise that require immediate patching.

CVE-2026-34502 is a heap buffer overflow vulnerability in the Apache Portable Runtime (APR) Utility library's memcached client that could allow remote attackers to cause memory corruption or arbitrary code execution.

A size_t underflow vulnerability in the singleoptionhelp function of the popt library could lead to memory corruption, potentially causing denial of service or arbitrary code execution.

This brief addresses the detection of the 'id' command executed by the root user on Linux systems, a behavior frequently utilized by attackers for situational awareness during post-exploitation and privilege escalation verification.

Nimbuspwn refers to a collection of Linux privilege escalation vulnerabilities in the networkd-dispatcher service that attackers can exploit via directory traversal to achieve root-level code execution.

Apache Lucy, a retired project, contains an uncontrolled recursion vulnerability (CVE-2026-61483) for which no patch will be issued due to the project's end-of-life status.

Apache Qpid Broker-J versions through 10.0.1 are vulnerable to a pre-authentication denial of service attack where an attacker triggers a StackOverflowError through crafted type nesting.

Sonic 3 A.I.R. versions before commit 2492d18 are vulnerable to a remote denial-of-service attack due to improper bounds checking on UDP packet IDs, leading to memory exhaustion and server crashes.

An unauthenticated remote denial-of-service vulnerability (CVE-2026-71314) in Nuxt allows attackers to trigger memory exhaustion via unbounded 'v-for' iteration within server-side rendered components.

Attackers are exploiting unpatched TLS listeners by flooding them with incomplete ACME ALPN handshakes to exhaust server-side resources like goroutines and worker threads.

A memory exhaustion vulnerability in socket.io-parser (CVE-2026-69185) allows remote attackers to trigger denial-of-service by sending specially crafted packets containing a large number of binary attachments.

Adversaries are abusing native Windows OpenSSH and Plink binaries to establish unauthorized reverse SSH tunnels, bypassing inbound connectivity controls for C2 and lateral movement.

This detection brief monitors Linux hosts for the use of standard system utilities and scripting interpreters to decode Base64 data, a common technique employed by adversaries to obfuscate malicious payloads and command-and-control traffic.

Adversaries leverage Linux background utilities such as setsid, nohup, and disown to execute processes in new sessions, enabling them to ignore termination signals and decouple malicious tasks from parent process trees.

Threat actors utilize curl or nscurl on macOS to query public IP geolocation services for reconnaissance, enabling them to assess network context and stage follow-on malicious activity.

An unauthenticated remote attacker can trigger a panic and crash the Pterodactyl Wings service by sending a maliciously crafted packet during the SFTP handshake.

A vulnerability in Netty's HTTP/2 decompressor allows an unauthenticated attacker to trigger an uncontrolled memory leak leading to a JVM OutOfMemoryError via crafted HTTP/2 DATA frames.

A resource exhaustion vulnerability (CVE-2026-16308) in IBM Enterprise Build of Quarkus allows remote, unauthenticated attackers to cause a denial of service via unbounded accumulation of multipart MIME headers.

An unauthenticated attacker can trigger a denial-of-service in OliveTin by flooding the OAuth2 login endpoint, causing unbounded memory growth due to the lack of expiration for stored login states.

An unauthenticated remote attacker can cause a denial-of-service in MCP Ruby SDK servers by sending oversized JSON-RPC requests that trigger unbounded memory allocation.

Multiple security vulnerabilities identified in GitLab CE and EE versions 19.x can result in remote denial of service, data confidentiality breaches, and reflected cross-site scripting.

Multiple vulnerabilities in Red Hat Enterprise Linux packages perl-Archive-Tar and httplib2 can be exploited by a remote, anonymous attacker to cause a Denial of Service condition.

This brief details a behavioral detection strategy for identifying potential web shell deployment and persistence mechanisms by monitoring anomalous file creation activities originating from common web server processes on Linux.

An improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.

CVE-2026-67215 describes a denial-of-service vulnerability in cJSON through version 1.7.19, where an attacker can trigger uncontrolled recursion and stack exhaustion by supplying a crafted RFC 6902 JSON Patch to cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), leading to process crash.

An Elastic Defend for Containers rule detects when an interactive shell is spawned inside a running Linux container, indicating a potential container breakout attempt or an attacker's unauthorized access to the underlying host through the execution of shells such as bash, sh, or zsh with interactive flags.

This detection rule targets the execution of interactive shell sessions within Linux containers, often initiated by an attacker using commands like `kubectl exec`, to identify potential compromise attempts or unauthorized access leading to container breakout or further environmental compromise.

Elastic Defend for Containers detects the enumeration of installed tools within a Linux container using the `which` command, a common adversary technique (T1518, T1613) for post-compromise discovery and living-off-the-land actions, enabling subsequent payload download, cluster manipulation, or reconnaissance without deploying new binaries.

Adversaries gaining initial access to a Kubernetes pod often read the service account namespace file, located at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` or `/run/secrets/kubernetes.io/serviceaccount/namespace`, to identify the container's namespace and understand its context, enabling further discovery and lateral movement within the Kubernetes environment.

This brief details the detection of commands such as 'id', 'whoami', 'capsh', 'getcap', and 'lsns' executed within Linux containers by adversaries seeking to enumerate privilege boundaries, user context, and Linux capabilities for privilege escalation or host escape, as detected by Elastic Defend for Containers.

Elastic's Defend for Containers detects adversaries utilizing the `jq` command within Linux containers to enumerate cluster and service information, posing a reconnaissance threat to the containerized environment.

This rule detects the use of common Linux utilities such as du, nice, find, locate, and ls to repeatedly enumerate the /var/lib/kubelet/pods directory on a Kubernetes cluster, indicating an attacker attempting to discover running pods, their IDs, volumes, and runtime artifacts from a compromised container or node.

Adversaries leverage DNS enumeration tools such as nslookup, dig, host, or getent hosts inside compromised Linux containers to discover internal Kubernetes services and network configuration, facilitating lateral movement and further exploitation.

A remote, authenticated attacker can exploit a vulnerability in PackageKit to bypass security mechanisms.

An Elastic machine learning rule detects atypical user context switching on Windows systems, leveraging tools like 'runas,' which may indicate account takeover or privilege escalation, prompting defenders to investigate user accounts, activity timestamps, and source devices for potential compromise.

This threat involves the detection of unusual Windows services, which can indicate unauthorized service execution, malware, or persistence mechanisms, with a machine learning job identifying atypical services by comparing them against known legitimate patterns to aid in early threat detection and response.

Elastic Security's machine learning rule `v3_windows_anomalous_process_creation_ea` detects unusual parent-child process relationships on Windows systems, indicating potential malware execution or persistence mechanisms and allowing for early detection of new or emerging threats that bypass traditional antivirus.

An Elastic Security machine learning rule detects rare and unusual processes on individual Windows hosts, indicating potential unauthorized services, malware execution, or persistence mechanisms.

An Elastic machine learning rule detects rare processes on Linux hosts, indicating potential persistence mechanisms, unauthorized services, or malware execution by an unknown threat actor, impacting system integrity and security.

An Elastic machine learning rule detects unusual Linux process discovery activity from atypical user contexts, indicating a potentially compromised account performing reconnaissance for privilege escalation or persistence on Linux systems.

Elastic has developed a machine learning detection rule to identify unusual user command activity related to system information discovery on Linux systems, indicating potential post-compromise reconnaissance for privilege escalation or persistence.

An Elastic machine learning rule detects anomalous access to the cloud instance metadata service by unusual Windows processes, indicating potential credential harvesting or sensitive data extraction by adversaries within cloud environments.

An Elastic machine learning rule detects rare and unusual DNS queries that indicate potential malicious network activity, including initial access via phishing or malicious documents, persistence, command-and-control (C2) communication, or data exfiltration attempts by adversaries.

Elastic's machine learning rule identifies rare and anomalous web user agents originating from local systems, indicating potential command-and-control, data exfiltration, or persistence activities by malware or specialized tools, enabling detection engineers to investigate unusual web browsing from non-browser processes.

Elastic's machine learning job identifies rare and unusual URLs accessed through web browsing or network traffic, signaling potential initial access, persistence, command-and-control, or data exfiltration activities that deviate from normal user behavior or legitimate application traffic patterns.

Elastic's machine learning models detect clusters of suspicious Windows processes that share a common parent process and exhibit unusually high malicious probability scores, aiming to uncover stealthy attacks, including those leveraging Living off the Land Binaries (LOLBins) and masquerading techniques, which might otherwise evade traditional detection methods.

Elastic's machine learning job, utilizing the ProblemChild supervised model and unsupervised techniques, detects Windows hosts exhibiting clusters of suspicious processes with unusually high malicious probability scores, often indicative of defense evasion through Living Off The Land Binaries (LOLbins) and masquerading techniques.

A machine learning job from Elastic's ProblemChild integration detects suspicious Windows processes, classified as malicious by a supervised ML model and anomalous due to unusual user contexts identified by an unsupervised ML model, indicating potential misuse of LOLbins or masquerading tactics for defense evasion.

Elastic's machine learning detection rule identifies anomalous privileged operations by a user from an uncommon device within Windows environments, indicating potential compromised accounts, stolen credentials, or insider threats escalating privileges, which can lead to unauthorized access and system compromise.

An Elastic machine learning rule detects an unusual spike in concurrent active Okta sessions initiated by a user, indicating potential adversary abuse of valid credentials for privilege escalation or persistence through the execution of multiple privileged operations.

Elastic's machine learning rule identifies anomalous execution of privileged commands by a user on Linux systems, indicative of potential privilege escalation or misuse of valid accounts.

An Elastic machine learning job has identified unusually high median command line entropy for privileged commands executed by a user on Linux, suggesting possible privileged access activity through obfuscated or complex command lines which can be a sign of suspicious or unauthorized use of privileged access, potentially indicating privilege escalation or defense evasion.

Elastic Security's machine learning rule detects a high count of source IP addresses establishing Remote Desktop Protocol (RDP) connections with a single destination IP, indicating potential lateral movement attempts by threat actors using multiple compromised systems for persistence and redundancy.

A machine learning detection rule identifies lateral movement by flagging an unusual spike in the number of destination IPs establishing Remote Desktop Protocol (RDP) connections with a single source IP, indicating an attacker attempting to expand access within the network to discover valuable assets or further access points.

An Elastic machine learning job detects unusually large file transfers by remote hosts, indicating potential lateral movement or data exfiltration by adversaries who consolidate data into single large files to avoid detection.

An Elastic machine learning rule detects potential Domain Generation Algorithm (DGA) activity, commonly used by malware for command and control (C2) communication, by analyzing DNS requests from source IP addresses to identify aggregate patterns indicative of DGA usage.

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

Elastic has released a machine learning detection rule designed to identify potential data exfiltration attempts by flagging anomalous spikes in the volume of data written to external devices, indicating illicit data copying or transfer activities by threat actors.

Elastic's machine learning job identifies potential data exfiltration activity to unusual geo-locations by detecting anomalies in network traffic patterns, indicating adversaries leveraging command and control channels to transfer data outside normal organizational patterns.

A machine learning job by Elastic detects potential data exfiltration by identifying anomalous network traffic patterns where high bytes are sent to an unusual destination port, suggesting data is being exfiltrated via command and control channels.

Elastic's machine learning rule detects potential data exfiltration by identifying anomalous network traffic, specifically large data transfers to unusual geo-locations via IP addresses, indicating possible exfiltration over command and control channels.

A null pointer dereference vulnerability, CVE-2026-67184, in TinyWeb through version 0.0.8 allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string, leading to a denial of service.

A critical memory leak vulnerability, CVE-2026-67183, in TinyWeb versions up to 0.0.8 allows unauthenticated attackers to exhaust server memory by sending ordinary HTTP requests, leading to worker process termination and denial of service.

A reachable assertion vulnerability exists in the `Request::remove_prefix` function of the Rouille web server framework, affecting versions 0.1.6 through 3.6.2, allowing remote, unauthenticated attackers to crash the server and cause a denial of service by sending a crafted percent-encoded URL.

Attackers, including ransomware families like Conti and Cactus, and wipers such as BiBi, abuse the legitimate Windows `RstrtMgr.dll` (Restart Manager) by loading it into uncommon processes to terminate applications, including security software and those holding locks on files, facilitating data encryption or destruction.

An unauthenticated remote denial-of-service vulnerability exists in facil.io versions 0.7.5 through 0.7.6, allowing attackers to crash the server by sending a POST request with a 'Transfer-Encoding: chunked' header containing a negative chunk size value, which corrupts internal state and leads to a fault.

A denial-of-service vulnerability exists in facil.io versions 0.6.0 through 0.7.6, specifically in its multipart body parser, allowing an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a malformed multipart/form-data request with a partial closing boundary, effectively disabling the server until manual restart.

An integer underflow vulnerability in facil.io through version 0.7.6 allows unauthenticated remote attackers to crash the server process via a crafted Content-Disposition header with an empty field name, leading to a Denial of Service.

Elastic has developed a machine learning detection rule to identify anomalous compiler activity on Linux systems, which can indicate unauthorized software deployment, ad-hoc changes, or privilege escalation attempts by adversaries.

Elastic has released a machine learning detection rule designed to identify rare and unusual process executions across multiple Linux hosts within an entire fleet, aiming to uncover potential malware or suspicious behaviors indicative of persistence or other malicious activity.

This Elastic machine learning rule detects anomalous network activity originating from Linux processes that typically do not engage in network communication, signifying potential command-and-control, lateral movement, persistence, or data exfiltration activity, often via process exploitation or injection.

An Elastic machine learning rule detects unusual user logon times, which can indicate credential compromise or unauthorized access, particularly when attackers operate from different time zones or during non-business hours, prompting investigation into the affected user account and related activities.

Elastic's machine learning job detects rare PowerShell script executions on Windows hosts, identified by their script block hash, indicating potential malware activity or persistence mechanisms that deviate from an established baseline.

An Elastic machine learning job detects anomalous PowerShell script behavior, specifically focusing on unusual data characteristics like obfuscation, indicating potential malicious scripts adversaries use for execution and defense evasion on Windows systems.

Elastic Security's machine learning rule detects an unusual spike in Windows user account management events, including account creation, modification, or deletion, indicating potential privilege escalation or unauthorized activity by an adversary.

Elastic Security's statistical model identifies command-and-control (C2) beaconing activity in network logs on Windows and Linux systems by analyzing network traffic patterns and excluding known benign processes, enabling defenders to detect and respond to stealthy adversary communications for persistence and data exfiltration.

An unauthenticated Slowloris denial of service vulnerability exists in the default `serve()` path of AWS's `aws-smithy-http-server` framework (versions <= 0.66.4), allowing remote attackers to exhaust server resources by initiating numerous incomplete connections.

An attacker can exploit CVE-2026-14257, a denial of service vulnerability in the `brace-expansion` Node.js library, by crafting an input with deeply chained brace groups that causes the expanded string length to grow without bound, leading to an uncatchable out-of-memory process crash in any application processing untrusted input via `expand()` directly or through dependencies like `minimatch` or `glob`.

A denial of service vulnerability (CVE-2026-44907) affects multiple versions of the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages, allowing threat actors to trigger out-of-memory exceptions or excessive CPU usage by sending specially crafted HTTP requests to server function endpoints.

A high-severity vulnerability in the `httplib2` Python client library allows a remote attacker to trigger a denial-of-service condition by sending a crafted HTTP response with a small, highly compressed payload that expands excessively upon decompression, causing memory exhaustion or OOM-kill in the client process.

An attacker can exploit a vulnerability in the pypdf library by crafting a PDF containing a malformed, not terminated inline image. When this malicious PDF is processed by pypdf, such as during text extraction, it triggers an infinite loop, leading to a denial of service. The issue is resolved in pypdf version 6.14.1.

A high-severity denial of service vulnerability, CVE-2026-64611, exists in the `cfIEEE1284NormalizeMakeModel()` function of libcupsfilters, allowing a network-adjacent attacker to cause sustained CPU consumption and system unresponsiveness by broadcasting a specially crafted printer advertisement with an empty model field in the IEEE-1284 device ID.

A vulnerability in CoreDNS, specifically within the `k8s_external` plugin, allows for a denial of service when performing a headless AXFR, as the `k8s_external` plugin can emit an empty transfer batch, which subsequently causes the `transfer` plugin to panic.

CVE-2026-44621 describes a vulnerability in Libunbound applications where, when configured with the 'unwanted-reply-threshold' option, they can be abruptly terminated, leading to a denial of service.

A memory leak vulnerability, CVE-2024-7708, in Eclipse Jetty's server handling of HTTP 100-Continue requests can be exploited by an attacker to trigger an OutOfMemory error, leading to a Denial of Service state for affected servers.

The n8n AI Agents module in versions prior to 2.27.4 and between 2.28.0 and 2.28.1 failed to enforce configured 'Allowed HTTP Request Domains' restrictions, allowing an authenticated member-level user with 'use-only' access to a shared credential to bypass these domain restrictions and exfiltrate sensitive secrets to an attacker-controlled server.

A vulnerability in Netty's HTTP/3 `Http3FrameCodec`, tracked as CVE-2026-56816, allows an unauthenticated remote attacker to cause a denial of service by sending crafted reserved HTTP/3 frames with an excessively large, unvalidated payload length, leading to server memory exhaustion.

FFmpeg versions 0.6.3 through 8.1.2 are vulnerable to a remote denial of service (DoS) via CVE-2026-64834, allowing an attacker to trigger an infinite loop in the `rtp_asf_fix_header` function by sending a crafted RTP/ASF stream, leading to CPU exhaustion and service unavailability.

A critical vulnerability (CVE-2026-13204) in Internet Systems Consortium (ISC) BIND 9 can lead to a denial-of-service condition where the server exits unexpectedly due to an assertion failure during DNSSEC validation of specific NSEC/NSEC3 record configurations. This allows an unauthenticated attacker to cause a BIND 9 DNS resolver to crash, disrupting DNS resolution services.

This vulnerability affects BIND 9 resolver (`named`) and can lead to unexpected program termination (denial of service). The issue occurs when the resolver receives specific, delayed, or out-of-order responses to queries for CNAME or DNAME and A records. Specifically, if an authoritative server delays a DNAME or self-referential CNAME response while providing an A record, the `named` process may crash.

A resource exhaustion vulnerability, CVE-2026-11605, affects specific versions of ISC BIND 9, where DNSSEC validation disproportionately consumes CPU resources when processing superfluous RRSIG records, potentially leading to a denial of service.

Information has been published regarding CVE-2026-64191, which addresses an issue in the i2c stub related to rejecting I2C block transfers with invalid lengths.

The pyasn1 library is vulnerable to uncontrolled resource consumption (excessive CPU and memory) when converting BER/CER/DER-encoded REAL values to Python floats, which can lead to a denial of service (DoS) in applications that decode untrusted ASN.1 data and then perform operations like printing, logging, comparing, or arithmetic on the decoded `univ.Real` objects.

A critical denial of service vulnerability, CVE-2026-59892, exists in `@opentelemetry/propagator-jaeger` versions prior to 2.9.0, allowing an unauthenticated remote attacker to terminate Node.js applications configured with `JaegerPropagator` by sending a malformed percent-encoded value in `uber-trace-id` or `uberctx-*` HTTP headers, leading to an uncaught `URIError`.

The JavaScript library linkify-it is vulnerable to a quadratic-complexity Denial of Service (DoS) (CVE-2026-59887) due to an inefficient regular expression in its `mailto:` schema validator, which allows an unauthenticated attacker to block application event loops by supplying specially crafted input with repeated 'mailto:' strings.

A high-severity algorithmic complexity vulnerability (CVE-2026-59880) in the Immutable.js library's `Immutable.Map` and `Immutable.Set` allows an attacker to craft object keys that cause hash collisions, degrading performance from O(1) to O(N²) and leading to a CPU-bound denial of service in applications, particularly those running on single-threaded Node.js environments that ingest untrusted input as object keys.

A vulnerability in Immutable.js List methods (`#set`, `#setSize`, `#setIn`, `#updateIn`) allows a remote, unauthenticated attacker to trigger an infinite loop or heap exhaustion by providing a crafted numeric string index in the range `[2 ** 30, 2 ** 31)`. This leads to an unrecoverable Denial of Service (DoS) by causing a tight CPU spin or process abortion, with an additional silent data corruption issue in `setSize`. This vulnerability impacts application availability but not confidentiality or integrity, and can be triggered by a single small HTTP request.

A moderately critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-13233, in the Drupal OpenAI Provider (`ai_provider_openai`) module allows attackers to achieve local file reads or access internal network services by manipulating the upstream AI API response, with a public exploit now available.

A stack overflow vulnerability, identified as CVE-2026-38752, exists in the evaluate() function within the AWK editor (editors/awk.c) of BusyBox commit 371fe9, which allows attackers to trigger a Denial of Service (DoS) condition by providing a specially crafted AWK script.

A denial-of-service vulnerability (CVE-2026-59200) exists in Pillow's `PdfParser.PdfStream.decode()` function across versions 5.1.0 to 12.2.x, allowing an unauthenticated attacker to craft a malicious PDF file that, when processed by a vulnerable application, triggers excessive memory allocation (e.g., a ~950 KB file expanding to 1 GB), leading to server Out-of-Memory termination or severe service degradation.

A Denial of Service (DoS) vulnerability (CVE-2026-59873) exists in the `node-tar` library (npm/tar <= 7.5.18) due to a lack of hard upper bounds on total decompressed data or entry counts, allowing an unauthenticated attacker to craft a small 'Gzip Bomb' archive that exhausts server resources like disk space and CPU, leading to system-wide failure and service outages.

An unauthenticated remote attacker can cause a denial of service in `engine.io` by sending invalid binary POST requests with `Content-Type: application/octet-stream` to Engine.IO protocol v4 polling transports, leading to exhaustion of server-side resources such as HTTP connections, sockets, and file descriptors due to improper connection closure.

The mistune Python library, when used with the 'strikethrough', 'mark', or 'insert' plugins enabled, is vulnerable to an algorithmic-complexity denial-of-service (DoS) attack where an attacker can send specially crafted markdown input causing quadratic parsing time, leading to high CPU utilization and potential service outages.

A vulnerability in Pillow's `PcfFontFile._load_bitmaps()` function allows for a decompression bomb check bypass when loading PCF fonts. Attacker-controlled glyph dimensions from the PCF `METRICS` section are passed directly to `Image.frombytes()` without validation, leading to excessive memory allocation. This can be exploited to cause denial of service (resource exhaustion) through either persistent attacks by providing matching bitmap data or transient attacks by providing a small PCF file with large declared dimensions, leading to a large C-heap buffer allocation before an exception. Systems loading PCF fonts from untrusted sources are at risk.

A vulnerability, CVE-2026-54060, in the Pillow library's `FontFile.compile()` method allows attackers to craft malicious BDF or PCF font files that bypass standard decompression bomb checks, causing an unchecked, massive memory allocation when processed, which can lead to a Denial of Service (DoS) via an Out-Of-Memory (OOM) crash in vulnerable applications.

A denial of service vulnerability, CVE-2026-55514, exists in vLLM versions from 0.12.0 up to, but not including, 0.24.0, allowing an authorized remote user to send a specially crafted `/v1/completions` request that leverages pure prompt embeds with an M-RoPE-enabled model to trigger an assertion failure, causing the vLLM server application to fatally crash.

A quadratic Denial of Service (DoS) vulnerability exists in Tornado's `HTTPHeaders.add` method due to inefficient string concatenation for repeated header names, which, when processing a maliciously crafted HTTP request with numerous repeated headers, can block the server's single event loop for an extended period, leading to a high severity DoS if `max_header_size` is increased from its default 64KB.

A high-severity denial-of-service vulnerability (CVE-2026-64612) exists in libcupsfilters and cups-filters, allowing an unauthenticated attacker to cause the CUPS image filter process to abort by submitting a specially crafted PNG print job, leading to service disruption.

This threat brief details how Linux systems making DNS queries to commonly abused top-level domains may indicate malware-related command and control (C2) communications, data exfiltration, or payload downloads, often blending into normal name resolution, signaling a potential compromise of servers, workstations, or containerized workloads.

A detection rule by Elastic identifies potential privilege escalation within AWS environments by flagging when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user, indicating an attempt by an adversary to expand permissions, gain elevated access, or maintain persistence.

This detection rule identifies suspicious activity in AWS environments where a single principal, from a consistent source IP, rapidly performs read-only S3 control-plane API calls across more than 15 distinct S3 buckets within a 10-second window, indicative of automated reconnaissance, security scanning, or post-compromise enumeration aiming to map S3 bucket access, policies, and versioning.

A new detection rule identifies rare instances where an identity performs AWS Organizations or IAM account enumeration APIs for the first time within a specified lookback window, indicative of an attacker attempting to map the AWS environment after compromising credentials.

An Elastic detection rule identifies when a single AWS identity, using the AWS CLI, performs more than five distinct read-only discovery API calls (such as Describe*, List*, Get*, and Generate*) across various AWS services within a 10-second window, indicating reconnaissance by an adversary using compromised credentials or an exploited EC2 instance to map the AWS infrastructure for potential targets and further exploitation.

This brief details how attackers exploit Local File Inclusion (LFI) vulnerabilities on web servers such as Nginx, Apache, IIS, and Traefik, by using directory traversal or direct sensitive file path requests to disclose system information, credentials, and configuration files, potentially leading to remote code execution and system compromise.

SurrealDB versions prior to 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when the 'db' parameter is set without a corresponding namespace, allowing unauthenticated attackers to crash the server by sending a malformed WebSocket message to the /rpc endpoint.

Attackers commonly establish persistence on compromised Linux WordPress web servers by creating malicious PHP files, often web shells, within the WordPress plugin directory, enabling remote access and command execution following initial compromise of a public-facing application.

Unauthenticated attackers can exploit CVE-2024-58368 in SurrealDB versions prior to 1.1.0 by sending crafted HTTP REST API requests with malformed ID, DB, or NS headers, leading to an uncaught exception and server crash, resulting in denial of service.

A remote denial-of-service vulnerability (CVE-2026-62299) has been discovered in the CoreDNS rewrite-plugin that can lead to a nil-pointer panic when a downstream plugin returns an EDNS0 response without an OPT record, potentially causing service disruption.

IBM PowerVM Novalink is vulnerable to CVE-2026-9171, a denial-of-service attack where a remote unauthenticated attacker can send a specially-crafted request to cause the server to consume excessive memory resources, leading to system unavailability.

A denial of service vulnerability, identified as CVE-2026-59885, exists in the pyasn1 library caused by quadratic complexity in the processing of OBJECT IDENTIFIER and RELATIVE-OID, which can lead to a denial of service.

A remote denial of service vulnerability, CVE-2026-15709, exists in the libsoup library's websocket permessage-deflate extension, allowing an attacker to trigger a denial of service through unbounded decompression.

A remote denial of service vulnerability, CVE-2026-15711, exists in the libsoup library's WebSocket connection handling due to an oversized control frame protocol violation, allowing an attacker to cause service disruption.