Threat Intelligence Database

The Phoca Download extension for Joomla contains a critical vulnerability (CVE-2026-57828) that allows authenticated users to upload executable files without restriction. This arbitrary file upload flaw can lead to full remote code execution (RCE) on affected systems. The vulnerability affects versions 1.0 through 6.1.2 of the extension. No official patch or remediation guidance is currently provided by the vendor. The vulnerability has a high CVSS 4.0 score of 9.0, indicating critical severity.

The rsjoomla.com RSFiles extension for Joomla contains a critical vulnerability (CVE-2026-57827) that allows unauthenticated attackers to upload arbitrary executable files. This unrestricted file upload leads to full remote code execution (RCE) on affected systems. The vulnerability affects versions 1.0 through 1.17.11 of the RSFiles extension. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a maximum CVSS 4.0 score of 10.0, indicating critical severity.

This content discusses the distinction between precision and accuracy metrics in Security Operations Center (SOC) detections. Precision measures how often alerts generated by a detection are correct, reflecting the practical workload on analysts. Accuracy measures how often the detection is correct overall, including true negatives and false negatives, but requires more comprehensive data that many SOCs lack. The article cautions against overreliance on accuracy metrics without proper data and suggests precision as a more honest starting point for evaluating detection quality.

CVE-2026-56289 is a vulnerability identified as a loop with an unreachable exit condition in GNU patch version 3.0. This issue relates to a software defect where a loop may never terminate due to its exit condition being unreachable. No CVSS score or detailed impact information is provided. There are no known exploits in the wild and no patch or remediation details have been disclosed.

CVE-2026-56288 is a NULL pointer dereference vulnerability identified in GNU patch version 3.0. This type of vulnerability can cause the affected software to crash or behave unexpectedly when it attempts to access memory through a NULL pointer. The information provided does not include details on exploitation methods or impact beyond the dereference issue. No patch or remediation information is currently available from the vendor advisory. There is no evidence of known exploits in the wild at this time.

This security update for libexif addresses three vulnerabilities involving integer overflow and underflow in the handling and decoding of MakerNotes, specifically affecting Nikon MakerNote processing. These issues could lead to information disclosure, crashes, and denial of service. The update fixes CVE-2026-40385, CVE-2026-40386, and CVE-2026-32775. No CVSS score is provided, but the impact includes medium severity issues such as crashes and information leaks.

A security update for the SUSE Linux Enterprise 11 SP4 kernel addresses multiple vulnerabilities, including use-after-free bugs, race conditions, and improper handling of network protocols. The update fixes 10 distinct CVEs affecting components such as SCSI, TCP, bonding, ALSA, KVM, networking, and Bluetooth subsystems. These vulnerabilities could lead to memory corruption or unexpected behavior in kernel modules.

The sankislayer package on PyPI version 1.0.0 contains obfuscated malicious code that implements a Telegram bot designed to join and participate in a spamming botnet. This botnet is centrally controlled and can spam Telegram channels by repeatedly posting messages, changing photos, or altering titles. The package is classified as malicious with clear intent to abuse third-party APIs for spamming purposes.

The npm package 'execfences' contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by its installation.

Netty's DNS resolver component (DnsResolveContext) fails to validate the origin (bailiwick) of CNAME records in DNS responses, leading to potential DNS cache poisoning via bailiwick bypass. This vulnerability affects applications using Netty's DNS resolver. The issue arises because the resolver blindly caches all CNAME records from DNS answers without verifying that the data originates from an authoritative source for the queried domain or its parent domains, violating recommended DNS security practices. This can allow attackers to poison DNS caches, potentially causing clients to resolve to malicious IP addresses.