Threat Intelligence Database

SQLFluff versions prior to 4.1.0 contain a recursive stack overflow vulnerability in the parser component. This flaw allows an attacker who can submit SQL queries for linting to cause a denial of service by crafting queries with excessive nesting, leading to resource exhaustion. Versions 4.1.0 and later include a configurable recursion limit enabled by default to mitigate this issue.

SQLFluff versions prior to 4.2.0 are vulnerable to uncontrolled resource consumption in its SQL parser. This vulnerability allows an untrusted user to submit a maliciously long SQL query to trigger a denial of service (DoS) by exhausting system resources. The issue is addressed in version 4.2.0 and later by introducing a configurable parse node limit enabled by default. No known exploits are reported in the wild.

This content is an analytical report summarizing Frost & Sullivan’s 2025 Frost Radar insights on the evolution of Cloud Security Posture Management (CSPM). It highlights CSPM's transition from periodic compliance checks to continuous risk-based governance integrated within Cloud Native Application Protection Platforms (CNAPPs). The report emphasizes trends such as integrated posture management, risk prioritization, code-to-cloud visibility, platform consolidation, and AI-driven enhancements in CSPM. It does not describe a specific security vulnerability or exploit.

The ISC Stormcast for July 6th, 2026, is a daily threat intelligence podcast update from the SANS Internet Storm Center. The provided information does not describe a specific vulnerability or security threat but rather references a general threat intelligence resource.

This report discusses the use of DNS NAPTR records in the context of RCS (Rich Communication Services), a modern messaging protocol increasingly adopted on iOS and Android. NAPTR records are used to locate SIP servers for RCS message transport, enabling secure SIP over TLS with TCP. The report notes that while NAPTR records can include regular expressions for rewriting domain names, in current RCS usage these expressions are empty and the records primarily direct to SRV records. There is no indication of active exploitation or vulnerabilities in the NAPTR usage described.

Since early 2026, Check Point Research has tracked Cavern Manticore, an Iran-linked APT group using a new modular command-and-control (C2) framework. This threat actor primarily targets Israeli organizations, focusing on IT providers and government sectors. Cavern Manticore is linked to Iran's Ministry of Intelligence and Security (MOIS) and has connections to the OilRig group. The framework is modular, indicating flexible and potentially evolving capabilities. No specific affected software versions or exploits in the wild have been reported. The threat is assessed as medium severity based on available information.

A race condition vulnerability exists in Windows Defender Antivirus (MsMpEng.exe) between the cleanup routine and Volume Shadow Copy creation. Exploitation can lead to local privilege escalation to SYSTEM, cause Windows Defender to crash, and leave the system unprotected for the session. The exploit leverages fake ISO mounting and real-time priority escalation to outpace Defender's cleanup process. No patch or official remediation information is provided.

KNX visualisering is affected by a broken access control vulnerability that allows unauthorized access or actions. This issue affects Windows and Linux platforms and has publicly available exploit code written in Perl. No specific affected versions or patch information are provided.

A PHP Object Injection vulnerability exists in Joomla Extension version 4.1.4. This vulnerability allows an attacker to inject malicious PHP objects, potentially leading to unauthorized code execution or other impacts depending on the application context. Exploit code is publicly available in Python.

The website pechotonbac.fr is reported as a potential phishing site that claims to provide access to baccalaureate exam results. Users attempting to visit the site receive browser warnings indicating phishing activity. There is no confirmed exploit or detailed technical analysis available. The report originates from a Reddit cybersecurity discussion seeking information about the site's legitimacy.