THREAT OPS › Threat News

Threat Intelligence News

11855 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[akira] CF Supply posted to leak siteransomware_live · 2026-08-13
[NVD] CVE-2026-6471 (HIGH 7.2) — Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. nvd · 2026-08-13
[NVD] CVE-2026-6470 (MEDIUM 4.3) — Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type fnvd · 2026-08-13
[NVD] CVE-2026-6469 (LOW 3.8) — Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies thnvd · 2026-08-13
[NVD] CVE-2026-6464 (HIGH 8.1) — Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql pronvd · 2026-08-13
[NVD] CVE-2026-49827 (CRITICAL 9.8) — WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registranvd · 2026-08-13
[NVD] CVE-2026-19385 (HIGH 8.8) — Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affectednvd · 2026-08-13
[NVD] CVE-2026-18408 (HIGH 8.8) — Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fnvd · 2026-08-13
[NVD] CVE-2026-18024 (MEDIUM 4.3) — Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before Postgrenvd · 2026-08-13
[NVD] CVE-2026-16241 (LOW 3.8) — Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or nvd · 2026-08-13
[NVD] CVE-2026-16239 (HIGH 8.8) — Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 arenvd · 2026-08-13
[NVD] CVE-2026-16238 (HIGH 8.8) — Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affecnvd · 2026-08-13
[NVD] CVE-2026-15742 (HIGH 8.8) — Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before Pnvd · 2026-08-13
[NVD] CVE-2026-15741 (HIGH 8.8) — SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. nvd · 2026-08-13
[NVD] CVE-2026-14681 (MEDIUM 4.2) — Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption anvd · 2026-08-13
[NVD] CVE-2026-14680 (HIGH 8.8) — Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures nvd · 2026-08-13
[NVD] CVE-2026-14679 (HIGH 8.2) — Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.nvd · 2026-08-13
[NVD] CVE-2026-14678 (MEDIUM 4.3) — Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are nvd · 2026-08-13
[NVD] CVE-2026-14677 (HIGH 8.8) — Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVEnvd · 2026-08-13
[NVD] CVE-2026-14676 (HIGH 8.8) — Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected.nvd · 2026-08-13
[NVD] CVE-2026-14673 (LOW 3.8) — Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within majnvd · 2026-08-13
[NVD] CVE-2026-14672 (MEDIUM 5.3) — Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challnvd · 2026-08-13
[NVD] CVE-2026-14671 (HIGH 8.8) — Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan canvd · 2026-08-13
[NVD] CVE-2026-14670 (HIGH 8.8) — Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.nvd · 2026-08-13
[NVD] CVE-2026-14669 (HIGH 8.8) — Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 arenvd · 2026-08-13
[NVD] CVE-2026-14668 (HIGH 8.1) — Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory vnvd · 2026-08-13
[NVD] CVE-2026-14666 (MEDIUM 4.2) — Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other envd · 2026-08-13
[NVD] CVE-2026-14664 (HIGH 8.8) — Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data gronvd · 2026-08-13
[NVD] CVE-2026-14663 (MEDIUM 6.5) — Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decrynvd · 2026-08-13
[NVD] CVE-2026-14662 (HIGH 8.8) — Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running tnvd · 2026-08-13
The Model Is the Malware | What Four Agentic Intrusions Tell Defenderssentinelone · 2026-08-13
Multi-Functional Linux Botnet “Evooo1Bot”fortinet_research · 2026-08-13
The State of Ransomware Q2 2026checkpoint_research · 2026-08-13
[payload] Zara Investment Holding posted to leak siteransomware_live · 2026-08-13
[NVD] CVE-2026-73604 (MEDIUM 6.5) — Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection Unvd · 2026-08-13
[NVD] CVE-2026-73603 (MEDIUM 5.3) — Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keynvd · 2026-08-13
[NVD] CVE-2026-73602 (CRITICAL 9.9) — Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path trnvd · 2026-08-13
[NVD] CVE-2026-73601 (HIGH 8.8) — Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abusenvd · 2026-08-13
Flow Neuroscience FL-100cisa_advisories · 2026-08-13
Siemens Parasolidcisa_advisories · 2026-08-13
Siemens License Server (SLS)cisa_advisories · 2026-08-13
Siemens Desigo DXR and PXC Controllerscisa_advisories · 2026-08-13
Johnson Controls Inc. Airwallcisa_advisories · 2026-08-13
Johnson Controls Metasyscisa_advisories · 2026-08-13
Siemens Siveillance Videocisa_advisories · 2026-08-13
Siemens LOGO! Soft Comfortcisa_advisories · 2026-08-13
ANDRITZ HIPASE-250 and 250 SCALAcisa_advisories · 2026-08-13
Siemens Solid Edgecisa_advisories · 2026-08-13
Siemens Simcenter Femapcisa_advisories · 2026-08-13
Haiwell IoT Cloud HMI Gatewaycisa_advisories · 2026-08-13
AVEVA Enterprise SCADAcisa_advisories · 2026-08-13
Hitachi Energy APM Edge Productcisa_advisories · 2026-08-13
WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraudthehackernews · 2026-08-13
[AiLock] DAISEN posted to leak siteransomware_live · 2026-08-13
[AiLock] Yaomasa posted to leak siteransomware_live · 2026-08-13
North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiringthehackernews · 2026-08-13
Cloud Infrastructure Security: Risks and Best Practicesorca_security · 2026-08-13
New Android malware lets criminals use your bank card in real timemalwarebytes_blog · 2026-08-13
Separating AI’s Technological Problems from Its Capitalism Problemsschneier · 2026-08-13
Dissecting the JWR phishing frameworktalos · 2026-08-13
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuitsmalwarebytes_blog · 2026-08-13
Srsly Risky Biz: Data extortion is booming. Hooray!riskybiz_news · 2026-08-13
[NVD] CVE-2026-14298 (MEDIUM 6.5) — Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion onvd · 2026-08-13
Automate Security Response Playbooks with Orca Workflowsorca_security · 2026-08-13
[NVD] CVE-2026-3639 (MEDIUM 6.4) — The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. Thnvd · 2026-08-13
Armored Likho expands its cyber-espionage toolkitsecurelist · 2026-08-13
LiteLLM Supply Chain Attack: Inside the AI Breach That Exposed 2,500+ Companiessocradar_blog · 2026-08-13
[thegentlemen] Safeware posted to leak siteransomware_live · 2026-08-13
Attackers Exploit SharePoint Authentication Bypass After Public PoC Releasethehackernews · 2026-08-13
[incransom] clgroup posted to leak siteransomware_live · 2026-08-13
ZDI-26-567: Norton Utilities Ultimate NortonUtilitiesSvc Link Following Local Privilege Escalation Vulnerabilityzdi_published · 2026-08-13
ZDI-26-566: BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerabilityzdi_published · 2026-08-13
ZDI-26-565: Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerabilityzdi_published · 2026-08-13
ZDI-26-564: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerabilityzdi_published · 2026-08-13
ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerabilityzdi_published · 2026-08-13
ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerabilityzdi_published · 2026-08-13
ZDI-26-574: Linux Kernel Net Scheduler Connection Tracking Race Condition Local Privilege Escalation Vulnerabilityzdi_published · 2026-08-13
ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerabilityzdi_published · 2026-08-13
MongoDB Multiple Vulnerabilitieshkcert · 2026-08-13
IBM WebSphere Products Multiple Vulnerabilitieshkcert · 2026-08-13
Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th)sans_isc · 2026-08-13
Fortinet Products Multiple Vulnerabilitieshkcert · 2026-08-13
[blacknevas] Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... posted to leak siteransomware_live · 2026-08-13
Malware Crypting Services and the Threat Actors Who Sell Themrecordedfuture · 2026-08-13
[Breach] Carhartt — 12,933,413 accounts exposedhibp_breaches · 2026-08-13
[GHSA] GHSA-cxgv-hp74-jj7r (high) — Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)github_advisories · 2026-08-12
[NVD] CVE-2026-49481 (CRITICAL 9.6) — UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be innvd · 2026-08-12
[NVD] CVE-2026-47718 — FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.nvd · 2026-08-12
[NVD] CVE-2026-47717 (HIGH 7.5) — FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.nvd · 2026-08-12
[SilentRansomGroup] Riker Danzig Scherer Hyland & Perretti posted to leak siteransomware_live · 2026-08-12
[NVD] CVE-2026-73501 (CRITICAL 9.1) — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution caunvd · 2026-08-12
[NVD] CVE-2026-73500 — etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, eachnvd · 2026-08-12
[NVD] CVE-2026-73499 — etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographicnvd · 2026-08-12
[NVD] CVE-2026-73498 (HIGH 7.7) — MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _uploadnvd · 2026-08-12
[NVD] CVE-2026-71846 (MEDIUM 6.5) — A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the invd · 2026-08-12
[NVD] CVE-2026-19003 (HIGH 7.8) — A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selecnvd · 2026-08-12
[NVD] CVE-2026-66898 (CRITICAL 9.9) — A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An atnvd · 2026-08-12
[NVD] CVE-2026-19654 (HIGH 7.5) — A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escnvd · 2026-08-12
[NVD] CVE-2026-19130 (MEDIUM 5.8) — A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` lanvd · 2026-08-12
[NVD] CVE-2026-19004 (HIGH 8.1) — An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This nvd · 2026-08-12