---METADATA---
VENDOR: Shenzhen Libituo Technology
PRODUCT: LBT-T300-HW1
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been found in the Shenzhen Libituo Technology LBT-T300-HW1 device, which may allow for unauthorized system access.

Executive Summary:
A high-severity flaw in the LBT-T300-HW1 device could allow an attacker to compromise the device and potentially the connected network.

Vulnerability Details

CVE-ID: CVE-2026-7674

Affected Software: Shenzhen Libituo Technology LBT-T300-HW1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw affects the device's operational integrity, potentially allowing an attacker to exploit the interface or management services to gain unauthorized access or control.

Business Impact

A CVSS score of 8.8 highlights the high risk associated with this vulnerability. Successful exploitation could lead to full device compromise, allowing an attacker to use the device as a pivot point to attack other systems on the network.

Remediation Plan

Immediate Action: Check for and apply the latest firmware updates for the LBT-T300-HW1 from the vendor.

Proactive Monitoring: Monitor network logs for unusual activity or unauthorized connection attempts involving the device.

Compensating Controls: Isolate the device from critical network segments and restrict access to its management interface to known, trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of the vulnerability, organizations should treat this as an urgent remediation task. If the device is not critical, consider disconnecting it from the network until a secure firmware update can be verified and applied.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow OSS
AFFECTED_VERSIONS: 1.0.0 through 1.8.4
---END_METADATA---

Description Summary:
IBM Langflow OSS suffers from improper authorization enforcement in the Streamable MCP transport endpoint, enabling unauthenticated access to protected project resources and operations.

Executive Summary:
IBM Langflow OSS contains a critical authorization flaw that allows unauthenticated attackers to manipulate protected project resources and execute unauthorized operations.

Vulnerability Details

CVE-ID: CVE-2026-7664

Affected Software: IBM Langflow OSS

Affected Versions: 1.0.0 through 1.8.4

Vulnerability: The vulnerability exists within the Streamable MCP transport endpoint, which fails to properly enforce authorization checks. This allows an unauthenticated attacker to interact with protected MCP projects and perform unauthorized actions.

Business Impact

With a CVSS score of 9.8, this vulnerability carries a high risk of unauthorized data access and manipulation. Exploitation could lead to the exposure of sensitive proprietary project data or the malicious modification of operational workflows, resulting in significant business disruption and potential loss of intellectual property.

Remediation Plan

Immediate Action: Update IBM Langflow OSS to the latest version as recommended by the vendor to enforce proper authorization controls.

Proactive Monitoring: Review access logs for unusual patterns of interaction with the MCP transport endpoint or unauthorized attempts to access project-specific resources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at the MCP transport endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to project integrity and data security. Administrators must apply the vendor-provided patch immediately to ensure that authorization mechanisms are correctly enforced and that unauthorized access is blocked.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow OSS
AFFECTED_VERSIONS: 1.0.0 through 1.9.6
---END_METADATA---

Description Summary:
An improper authorization vulnerability in the IBM Langflow OSS Streamable MCP transport endpoint allows unauthenticated attackers to access and execute MCP operations.

Executive Summary:
IBM Langflow OSS is affected by a critical authorization bypass vulnerability that enables unauthenticated remote attackers to execute arbitrary MCP project operations.

Vulnerability Details

CVE-ID: CVE-2026-7663

Affected Software: IBM Langflow OSS

Affected Versions: 1.0.0 through 1.9.6

Vulnerability: The flaw resides in the Streamable MCP transport endpoint, which fails to enforce proper authorization checks. This allows unauthenticated users to interact with and execute operations on protected MCP project resources.

Business Impact

With a CVSS score of 9.1, this vulnerability presents an extreme risk to the integrity and confidentiality of projects managed within Langflow OSS. Unauthorized execution of MCP operations could lead to data manipulation, loss of intellectual property, or the potential for further system compromise via injected workflows.

Remediation Plan

Immediate Action: Update IBM Langflow OSS to the latest available version immediately to remediate the authorization enforcement flaw.

Proactive Monitoring: Monitor network traffic and application logs for unauthorized access attempts or suspicious calls to the Streamable MCP transport endpoint.

Compensating Controls: Restrict network access to the Langflow instance via IP whitelisting or VPN-only access to prevent reachability by unauthenticated external actors.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of required authentication for sensitive operations. Organizations utilizing Langflow OSS must treat this as a top-priority remediation task, ensuring that the software is patched to a version that correctly enforces authorization logic.

---METADATA---
VENDOR: Zephyr Project
PRODUCT: Zephyr RTOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The IPv6 Neighbor Discovery handlers in the Zephyr RTOS contain a vulnerability that may lead to memory corruption or instability.

Executive Summary:
A critical vulnerability in the Zephyr RTOS IPv6 stack could allow for remote memory corruption, potentially leading to unauthorized code execution or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-7656

Affected Software: Zephyr Project Zephyr

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the IPv6 Neighbor Discovery handlers within the networking subsystem. It involves improper handling of packet data, which can be exploited by an unauthenticated remote attacker via crafted IPv6 traffic.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a severe risk to embedded systems and IoT devices running Zephyr. Exploitation could allow attackers to bypass security boundaries, crash critical infrastructure, or achieve remote code execution, leading to full device compromise.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to the latest version incorporating the fix for the IPv6 Neighbor Discovery handler vulnerability.

Proactive Monitoring: Monitor network traffic for malformed IPv6 Neighbor Discovery packets or unusual protocol behavior within the network stack.

Compensating Controls: If patching is not immediately feasible, restrict inbound IPv6 traffic to only known, trusted sources and utilize internal network segmentation to isolate vulnerable devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Embedded systems are often difficult to patch, but the risk associated with this network-level vulnerability is significant. Organizations must prioritize updating their Zephyr-based firmware to prevent potential remote exploitation of their connected devices.

---METADATA---
VENDOR: WordPress
PRODUCT: Admin Columns Plugin
AFFECTED_VERSIONS: up to and including 7.0.18
---END_METADATA---

Description Summary:
The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection, which can lead to Remote Code Execution via unvalidated post meta values.

Executive Summary:
A critical PHP Object Injection vulnerability in the Admin Columns WordPress plugin allows unauthenticated attackers to achieve Remote Code Execution.

Vulnerability Details

CVE-ID: CVE-2026-7654

Affected Software: WordPress Admin Columns Plugin

Affected Versions: up to and including 7.0.18

Vulnerability: This vulnerability is a PHP Object Injection flaw within the IdsToCollection::get_ids_from_string() function. It occurs due to the use of unserialize() without an allowed_classes restriction, allowing an unauthenticated attacker to process malicious, attacker-controlled post meta values to execute arbitrary code.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for full system compromise. Successful exploitation could lead to total loss of site integrity, unauthorized access to sensitive database information, and the potential for the server to be leveraged for further attacks, resulting in significant reputational damage and operational downtime.

Remediation Plan

Immediate Action: Update the Admin Columns plugin to version 7.0.19 or later immediately to resolve the insecure deserialization flaw.

Proactive Monitoring: Review WordPress logs for unusual post-meta requests or unexpected PHP execution patterns that may indicate attempts to inject malicious objects.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block malicious serialized PHP objects in incoming requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for Remote Code Execution, this vulnerability poses a severe risk to any WordPress environment utilizing the Admin Columns plugin. Administrators should prioritize updating the plugin to version 7.0.19 or later immediately to mitigate the risk of unauthorized code execution.

---METADATA---
VENDOR: STYXKEY
PRODUCT: Boost
AFFECTED_VERSIONS: Up to and including 2.0.3
---END_METADATA---

Description Summary:
The Boost plugin for WordPress is vulnerable to PHP Object Injection via an untrusted cookie, which may lead to remote code execution if a POP chain exists.

Executive Summary:
A critical PHP Object Injection vulnerability in the Boost WordPress plugin allows unauthenticated attackers to manipulate application logic and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7637

Affected Software: Boost for WordPress

Affected Versions: Up to and including 2.0.3

Vulnerability: The plugin deserializes untrusted input from the STYXKEY-BOOST_USER_LOCATION cookie. An unauthenticated attacker can inject a malicious PHP object, though exploitation depends on the availability of a POP chain within the site's ecosystem.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. While it relies on the presence of a POP chain, the ubiquity of various plugins on WordPress sites makes it highly likely that such a chain exists, leading to potential data theft or code execution.

Remediation Plan

Immediate Action: Update the Boost plugin to the latest version immediately.

Proactive Monitoring: Monitor for unusual cookie values or attempts to inject serialized objects through HTTP headers.

Compensating Controls: Implement a WAF to inspect and block serialized PHP objects in incoming cookie data.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Deserialization vulnerabilities are complex and dangerous. Administrators should prioritize updating the Boost plugin and audit the entire plugin stack to identify and remove any components that provide potential POP chains.

---METADATA---
VENDOR: PixelYourSite
PRODUCT: Cost of Goods by PixelYourSite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'csvdata[0][cost_of_goods_value]' parameter.

Executive Summary:
The Cost of Goods by PixelYourSite plugin for WordPress is susceptible to Stored Cross-Site Scripting, allowing attackers to inject malicious scripts into the application.

Vulnerability Details

CVE-ID: CVE-2026-7613

Affected Software: PixelYourSite Cost of Goods plugin for WordPress

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability occurring via the 'csvdata[0][cost_of_goods_value]' parameter. Exploitation likely requires the attacker to have at least low-level authenticated access to the WordPress dashboard to input malicious data.

Business Impact

With a CVSS score of 7.2, this vulnerability represents a High risk. Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an administrator's browser, potentially leading to unauthorized plugin configuration changes or session hijacking.

Remediation Plan

Immediate Action: Update the Cost of Goods by PixelYourSite plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor WordPress administrative logs for unusual activity or suspicious modifications to plugin settings.

Compensating Controls: Implement a Web Application Firewall (WAF) with XSS protection rules enabled to filter malicious payloads targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Store-based XSS vulnerabilities are frequently targeted for session theft. We strongly recommend updating the plugin immediately and auditing user accounts with administrative capabilities to ensure no unauthorized persistence has been established.

---METADATA---
VENDOR: TRENDnet
PRODUCT: TEW-821DAP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the TRENDnet TEW-821DAP wireless access point, potentially allowing unauthorized access.

Executive Summary:
A high-severity vulnerability in the TRENDnet TEW-821DAP could allow an attacker to gain unauthorized control over the device.

Vulnerability Details

CVE-ID: CVE-2026-7607

Affected Software: TRENDnet TEW-821DAP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the device's firmware and management interface, potentially allowing an attacker to bypass authentication or execute arbitrary commands on the device.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the security of the network where the device is deployed. Compromising an access point can provide an attacker with a foothold into the internal network, leading to data exfiltration or further lateral movement.

Remediation Plan

Immediate Action: Update the firmware of the TRENDnet TEW-821DAP to the latest version provided by the manufacturer.

Proactive Monitoring: Review device management logs for unauthorized access attempts and monitor for anomalous traffic originating from the access point.

Compensating Controls: Place the device on an isolated management VLAN and disable remote management access if not strictly required.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators should prioritize firmware updates for all TRENDnet TEW-821DAP units. If a patch is not immediately available, restrict access to the device's management interface to prevent exploitation by remote attackers.

---METADATA---
VENDOR: libssh2
PRODUCT: libssh2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in libssh2, a library providing SSH support for various applications, affecting versions up to 1.

Executive Summary:
A high-severity flaw in the libssh2 library could lead to unauthorized access or communication interception in applications relying on the library.

Vulnerability Details

CVE-ID: CVE-2026-7598

Affected Software: libssh2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core functionality of libssh2, which handles SSH connections. Improper handling of data or connection states could potentially allow an attacker to compromise the secure communication tunnel.

Business Impact

A CVSS score of 7.3 indicates a significant risk for any application relying on libssh2 for secure data transit. Exploitation could result in the interception of sensitive data, authentication bypass, or unauthorized remote access to the systems utilizing the library.

Remediation Plan

Immediate Action: Update the libssh2 library in all applications to the latest patched version provided by the project or your OS maintainer.

Proactive Monitoring: Monitor network traffic for anomalous SSH connection patterns or unexpected failures in secure communication channels.

Compensating Controls: Ensure that all SSH traffic is encrypted with strong, modern ciphers and that key-based authentication is strictly enforced.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because libssh2 is a fundamental component in many software stacks, it is critical to identify all internal applications using this library and update them immediately. Failure to do so leaves your infrastructure vulnerable to man-in-the-middle or credential theft attacks.

---METADATA---
VENDOR: Anthropic
PRODUCT: Claude Desktop Cowork
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in Anthropic’s Claude Desktop Cowork handling of VM images may allow for unauthorized operations or system interference.

Executive Summary:
A high-severity vulnerability in Anthropic's Claude Desktop Cowork concerning VM image handling exposes users to potential security risks during virtual environment interactions.

Vulnerability Details

CVE-ID: CVE-2026-7574

Affected Software: Anthropic Claude Desktop Cowork

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the insecure handling of VM images within the Claude Desktop Cowork environment. The flaw potentially allows for improper processing of image data, which could be leveraged to affect the integrity or operation of the virtualized environment.

Business Impact

Successful exploitation could lead to unauthorized code execution or escape from the virtual environment, compromising the confidentiality and integrity of the local system. With a CVSS score of 8.7, this vulnerability poses a significant threat to users, particularly in environments where Claude Desktop Cowork is integrated into secure or sensitive workflows.

Remediation Plan

Immediate Action: Apply all available security updates provided by Anthropic for the Claude Desktop Cowork application to address the image handling flaw.

Proactive Monitoring: Monitor system logs for suspicious process spawning or unexpected file system modifications associated with the Claude Desktop application.

Compensating Controls: Restrict the application's ability to process external or untrusted VM image files until a verified patch has been applied to the host environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security flaws related to virtual image handling require immediate attention due to the potential for host-level impact. Users should prioritize updating their Claude Desktop Cowork installation and maintain vigilance regarding the source of any VM images processed by the platform until the remediation is confirmed.

---METADATA---
VENDOR: Infor
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A security flaw has been identified within the Keycloak identity and access management product.

Executive Summary:
A vulnerability has been identified in Infor's implementation of Keycloak, necessitating immediate review of security bulletins to determine the scope of impact.

Vulnerability Details

CVE-ID: CVE-2026-7571

Affected Software: Infor Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists within the Keycloak component as utilized by Infor products. Specific technical details regarding the authentication requirements or the nature of the flaw are currently limited.

Business Impact

As Keycloak is an identity and access management (IAM) solution, any vulnerability potentially impacts the security of all integrated applications. With a CVSS score of 7.1, this flaw should be treated as a High priority, as it may allow for unauthorized access to authentication tokens or administrative functions.

Remediation Plan

Immediate Action: Monitor official Infor security advisories for specific patch information and guidance on mitigating this vulnerability.

Proactive Monitoring: Review authentication logs and audit trails for anomalous access patterns or unauthorized administrative actions within the Keycloak environment.

Compensating Controls: Ensure that access to the Keycloak administration console is restricted to trusted internal networks and utilize multi-factor authentication (MFA) for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Keycloak is a centralized point of failure for identity services, security teams must prioritize checking for official updates. Until a patch is applied, ensure that all administrative interfaces are hardened and access is strictly controlled.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBUDashboard component poses a severe risk of remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7570

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the NVBUDashboard component, where improper neutralization of special elements used in an SQL command allows an attacker to execute arbitrary code. Based on the functional scope of dashboard utilities, this typically requires authenticated access, though the severity is elevated due to the potential for administrative account compromise.

Business Impact

The ability to execute remote code on a backup server carries catastrophic business risk, including the potential for unauthorized data exfiltration, the destruction of backup archives, and the total compromise of the backup infrastructure. With a CVSS score of 8.8, this flaw represents a high-severity threat that could lead to widespread service disruption and loss of data integrity.

Remediation Plan

Immediate Action: Identify and apply the latest security patches provided by Quest for NetVault Backup immediately.

Proactive Monitoring: Review system access logs for anomalous database queries or unexpected execution of administrative commands originating from the dashboard interface.

Compensating Controls: Restrict network access to the NetVault Dashboard interface to authorized management subnets only and employ a Web Application Firewall (WAF) to filter malicious SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical role of backup infrastructure, organizations must prioritize the mitigation of this vulnerability. Administrators are advised to verify their current version against the vendor's security bulletin and apply the necessary updates to prevent potential unauthorized system access and remote code execution.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is vulnerable to a cross-site scripting (XSS) flaw in the viewclient component that facilitates authentication bypass.

Executive Summary:
A high-severity authentication bypass vulnerability in Quest NetVault Backup allows unauthorized actors to compromise system integrity via cross-site scripting.

Vulnerability Details

CVE-ID: CVE-2026-7569

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the viewclient component, where an XSS flaw enables an attacker to bypass authentication mechanisms. The lack of proper input sanitization allows the execution of malicious scripts in the context of an administrative session.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of unauthorized access to backup infrastructure. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the deletion of critical backups, significantly impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Identify and apply the latest security patches provided by Quest to address the viewclient vulnerability.

Proactive Monitoring: Review web server logs for suspicious URL patterns or unexpected script execution attempts originating from the viewclient module.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious XSS payloads targeting the NetVault interface until a patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability poses a significant risk to the security posture of the backup environment. Administrators should prioritize the installation of vendor-supplied updates as soon as they become available to mitigate the risk of authentication bypass and potential lateral movement.

---METADATA---
VENDOR: WordPress
PRODUCT: Temporary Login plugin
AFFECTED_VERSIONS: up to and including 1.0.0
---END_METADATA---

Description Summary:
The Temporary Login plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to log in as any temporary user.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Temporary Login WordPress plugin allows attackers to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-7567

Affected Software: WordPress Temporary Login plugin

Affected Versions: up to and including 1.0.0

Vulnerability: The maybe_login_temporary_user() function improperly handles the temp-login-token parameter, allowing an array input to bypass security checks and return all users associated with the temporary login meta key.

Business Impact

With a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to gain unauthorized access to the WordPress environment. This could lead to full site takeover, data exfiltration, or the modification of site content.

Remediation Plan

Immediate Action: Update the Temporary Login plugin to the latest version available from the vendor.

Proactive Monitoring: Review WordPress user access logs for unusual login activity or spikes in authentication attempts using temporary login tokens.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing array-based inputs for the temp-login-token parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Site administrators should update the affected plugin immediately. Given the ease of exploitation, this vulnerability poses a significant risk to the security and integrity of the affected WordPress site.

---METADATA---
VENDOR: Totolink
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6279_B20210910
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Totolink NR1800X lighttpd component, allowing remote attackers to trigger a crash or execute code via the Host header.

Executive Summary:
A critical stack-based buffer overflow in the Totolink NR1800X router allows remote, unauthenticated attackers to compromise device integrity.

Vulnerability Details

CVE-ID: CVE-2026-7546

Affected Software: Totolink NR1800X

Affected Versions: 9.1.0u.6279_B20210910

Vulnerability: The vulnerability exists in the find_host_ip function of the lighttpd component. By sending a crafted Host header, an unauthenticated remote attacker can trigger a buffer overflow.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. Successful exploitation allows remote code execution, which could lead to unauthorized access to the local network, interception of traffic, or the use of the device as a pivot point for further lateral movement within the business environment.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to address the buffer overflow in the web server component.

Proactive Monitoring: Monitor device traffic for anomalous HTTP headers and inspect system logs for service crashes or unexpected restarts of the lighttpd process.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering to block requests containing abnormally large or malformed Host headers.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 1, 2026, there is public disclosure of an exploit for this vulnerability. Given the ease of remote exploitation, immediate patching is mandatory to prevent unauthorized device control.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploits, poses an imminent risk to network security. Organizations utilizing the affected Totolink hardware must prioritize firmware updates or restrict management interface access to trusted internal segments immediately.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
The Totolink A8000RU router is vulnerable to remote OS command injection via the proto parameter in the CGI handler, allowing unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU allows unauthenticated remote attackers to achieve full system-level code execution.

Vulnerability Details

CVE-ID: CVE-2026-7538

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw resides in the /cgi-bin/cstecgi.cgi script, specifically within the proto argument. An unauthenticated attacker can inject shell commands that are executed with the privileges of the web server.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a severe threat to business infrastructure. An attacker gaining command execution on a gateway device can bypass perimeter security, sniff internal traffic, or exfiltrate sensitive data, leading to significant operational disruption and data breach risks.

Remediation Plan

Immediate Action: Update the affected Totolink A8000RU device to the latest firmware version provided by the manufacturer.

Proactive Monitoring: Review web server access logs for suspicious patterns in CGI requests, particularly those containing shell metacharacters (e.g., ;, |, &).

Compensating Controls: Disable access to the web-based management interface from untrusted or external networks until the firmware can be patched.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 1, 2026, public exploit code for this vulnerability is available. The ability to execute arbitrary commands remotely makes this a high-priority target for threat actors.

Analyst Recommendation

Due to the critical nature of remote code execution on network infrastructure, immediate remediation is required. Affected devices should be isolated from the public internet until the patch is applied.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow OSS
AFFECTED_VERSIONS: 1.0.0 through 1.9.1
---END_METADATA---

Description Summary:
IBM Langflow OSS is vulnerable to remote code execution during archive extraction due to improper validation of symbolic links.

Executive Summary:
A critical remote code execution vulnerability in IBM Langflow OSS allows attackers to gain unauthorized code execution through malicious symbolic link manipulation.

Vulnerability Details

CVE-ID: CVE-2026-7524

Affected Software: IBM Langflow OSS

Affected Versions: 1.0.0 through 1.9.1

Vulnerability: Improper validation of symbolic links during the extraction process of archive files allows an attacker to overwrite arbitrary files on the host system, leading to code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Successful exploitation grants an attacker the ability to execute arbitrary code, potentially leading to full system compromise and loss of sensitive data.

Remediation Plan

Immediate Action: Update IBM Langflow OSS to the latest available version as specified by the vendor security advisory.

Proactive Monitoring: Monitor for unusual file write operations or unexpected processes spawned by the Langflow application.

Compensating Controls: Run the application in a hardened, restricted container environment with minimal filesystem permissions to limit the impact of potential file overwrites.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of IBM Langflow OSS must review the vendor's security advisory and apply the necessary patches immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Singularity (Advanced Database Cleaner)
PRODUCT: Advanced Database Cleaner – Premium
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion, potentially allowing unauthorized file access.

Executive Summary:
A Local File Inclusion vulnerability in the Advanced Database Cleaner – Premium plugin for WordPress poses a significant risk of unauthorized file system access.

Vulnerability Details

CVE-ID: CVE-2026-7522

Affected Software: Singularity Advanced Database Cleaner – Premium

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw that may allow an attacker to include arbitrary files on the server. The specific authentication requirements are not explicitly stated, but LFI vulnerabilities in WordPress plugins often bypass standard access controls.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, credentials, or source code, resulting in complete system compromise. With a CVSS score of 8.8, this flaw represents a high risk to business operations, potentially leading to data breaches and the loss of site integrity.

Remediation Plan

Immediate Action: Update the Advanced Database Cleaner – Premium plugin to the latest available version provided by the vendor. If an update is not currently available, consider disabling or removing the plugin until a secure version is released.

Proactive Monitoring: Monitor server logs for suspicious file inclusion patterns, such as directory traversal characters (e.g., ../) in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common Local File Inclusion attack vectors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, administrators should treat this vulnerability with high priority. Ensure that the plugin is patched immediately upon the release of a security update by the vendor to prevent potential unauthorized access to the underlying server.

---METADATA---
VENDOR: BetterDocs
PRODUCT: BetterDocs Pro
AFFECTED_VERSIONS: Up to and including 3.8.0
---END_METADATA---

Description Summary:
The BetterDocs Pro plugin for WordPress contains a Local File Inclusion vulnerability in the doc_style parameter, allowing unauthenticated attackers to execute arbitrary PHP code on the server.

Executive Summary:
A critical Local File Inclusion vulnerability in the BetterDocs Pro plugin for WordPress allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7515

Affected Software: BetterDocs BetterDocs Pro

Affected Versions: Up to and including 3.8.0

Vulnerability: This is a Local File Inclusion (LFI) vulnerability residing in the doc_style parameter. It allows unauthenticated attackers to include and execute arbitrary PHP files on the server, resulting in potential full system compromise.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code poses a catastrophic risk to business operations. This vulnerability could lead to total server compromise, unauthorized access to sensitive application data, and potential lateral movement within the network. With a CVSS score of 9.8, this flaw is categorized as critical and requires immediate attention to prevent data breaches or service degradation.

Remediation Plan

Immediate Action: Update the BetterDocs Pro plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal patterns or unexpected file inclusions targeting the doc_style parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts directed at the WordPress plugin directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the lack of required authentication, it is imperative that all organizations using the BetterDocs Pro plugin prioritize this update. Failure to remediate immediately leaves the host server vulnerable to complete compromise. Ensure all systems are patched and verify the integrity of the WordPress installation post-update.

---METADATA---
VENDOR: Red Hat (Keycloak)
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A session fixation vulnerability exists in Keycloak's login-actions endpoints, potentially allowing attackers to hijack user sessions.

Executive Summary:
A session fixation vulnerability within Keycloak's login-actions endpoints allows attackers to potentially compromise user session integrity.

Vulnerability Details

CVE-ID: CVE-2026-7507

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a session fixation vulnerability located in the login-actions endpoints of Keycloak. The flaw allows an attacker to manipulate or fix a session identifier, which may lead to unauthorized account access if the attacker can force a user to authenticate with a pre-determined session ID.

Business Impact

A successful exploit could allow an attacker to hijack active user sessions, leading to unauthorized access to sensitive application data and administrative functions. With a CVSS score of 7.5, this vulnerability poses a significant risk to the security and confidentiality of user accounts within the identity management environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Keycloak vendor immediately.

Proactive Monitoring: Review access logs for anomalous session activity and investigate any unusual login patterns or session token reuse.

Compensating Controls: Ensure that session management best practices are enforced, such as strict session timeout policies and the use of secure, HTTP-only session cookies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Identity management systems are high-value targets; therefore, this vulnerability should be remediated as a priority. Administrators must prioritize the application of vendor-supplied patches to ensure the integrity of the authentication flow and protect against session hijacking.

---METADATA---
VENDOR: Keycloak (Red Hat)
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A flaw in Keycloak’s URL validation logic during redirect operations could allow for open redirection or potential security bypasses.

Executive Summary:
An improper URL validation vulnerability in Keycloak during redirect operations presents a risk of unauthorized redirection or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-7504

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from flaws in the URL validation logic within Keycloak's redirect operations. The issue may allow an attacker to bypass intended security constraints during redirection, potentially facilitating phishing or other malicious activities by redirecting users to unauthorized locations.

Business Impact

Exploitation of this vulnerability can be used to facilitate social engineering attacks or bypass security controls that rely on trusted redirect paths. With a CVSS score of 8.1, the risk is elevated, as it can be leveraged to redirect authenticated users to malicious sites, potentially resulting in credential theft or further system compromise.

Remediation Plan

Immediate Action: Apply the latest security updates released by the vendor to address the URL validation flaw.

Proactive Monitoring: Monitor application logs for unexpected or suspicious redirect patterns that deviate from standard authentication flows.

Compensating Controls: Implement strict allow-lists for redirect URLs within the application configuration to mitigate the risk of unauthorized redirection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates prompt remediation. Administrators should ensure that all instances of Keycloak are updated to the latest version to correct the underlying URL validation logic and prevent the exploitation of redirect operations.

---METADATA---
VENDOR: Basamak Information Technology
PRODUCT: Basamak Information Technology Consulting and Organization Trade Ltd
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability exists in Basamak Information Technology software due to improper neutralization of user-supplied input.

Executive Summary:
A cross-site scripting vulnerability in Basamak Information Technology software poses a significant risk to user session security and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-7498

Affected Software: Basamak Information Technology Consulting and Organization Trade Ltd

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a cross-site scripting (XSS) vulnerability where improper input neutralization during web page generation allows an attacker to inject malicious scripts. This typically requires a user to interact with a crafted link or page, potentially leading to unauthorized actions performed on behalf of the user.

Business Impact

The CVSS score of 8.8 places this at a High to Critical severity level, indicating a substantial risk of session hijacking, credential theft, or the execution of malicious actions within the context of the user's browser. Organizations should treat this with high priority to prevent reputational damage and the compromise of sensitive user information.

Remediation Plan

Immediate Action: Apply all security patches provided by Basamak Information Technology to resolve the input validation flaws.

Proactive Monitoring: Monitor web traffic for anomalous script patterns and review logs for signs of reflected or stored XSS attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common cross-site scripting payloads and enforce strict Content Security Policies (CSP).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high impact of XSS vulnerabilities, remediation should be prioritized in all web-facing components. Ensure that developers follow secure coding practices regarding input sanitization and output encoding to prevent similar issues from reoccurring in future updates.