---METADATA---
VENDOR: ImageMagick Studio LLC
PRODUCT: ImageMagick
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
ImageMagick is susceptible to a vulnerability during image manipulation that could allow for unauthorized code execution or system instability when processing crafted files.

Executive Summary:
A high-severity vulnerability in ImageMagick poses a significant risk of remote exploitation through the processing of maliciously crafted image files by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-30929

Affected Software: ImageMagick Studio LLC ImageMagick

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves improper handling of image data during editing and manipulation processes. An unauthenticated attacker could provide a specially crafted image file that triggers a memory corruption or logic flaw within the software.

Business Impact

Exploitation could lead to arbitrary code execution on the server or workstation processing the image, or a denial-of-service (DoS) condition that halts automated workflows. Given the CVSS score of 7.7, this is a High-severity issue, particularly for web applications that automatically process user-uploaded content, potentially leading to full server takeover.

Remediation Plan

Immediate Action: Update ImageMagick to the latest stable version provided by the vendor or the relevant Linux distribution maintainer.

Proactive Monitoring: Monitor application logs for crashes in image processing modules and inspect incoming file uploads for unusual header signatures.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect uploaded files and utilize sandboxing (e.g., Bubblewrap or Docker) to isolate the ImageMagick process from the rest of the system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation of this vulnerability. ImageMagick vulnerabilities are frequently targeted by researchers and attackers due to the software's widespread use in automated web backends.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching, especially for any system that processes untrusted image content. Security teams should verify that all instances of ImageMagick, including those bundled within other software stacks, are updated to the latest secure version to prevent remote code execution.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime Synthetic Monitors
AFFECTED_VERSIONS: Prior to 10.0.20
---END_METADATA---

Description Summary:
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitrary executables.

Executive Summary:
OneUptime’s Synthetic Monitors allow authenticated users to bypass normal execution limits and spawn arbitrary executables on the probe host via exposed Playwright objects.

Vulnerability Details

CVE-ID: CVE-2026-30921

Affected Software: OneUptime

Affected Versions: Prior to 10.0.20

Vulnerability: In OneUptime versions prior to 10.0.20, untrusted Playwright code is executed inside a Node.js vm but is provided with live host Playwright objects. This allows a low-privileged authenticated user to bypass sandbox restrictions by directly calling browser.browserType().launch() to spawn an arbitrary executable on the probe host or container.

Business Impact

This vulnerability carries a CVSS score of 9.9, indicating a near-total threat to the system. An attacker can achieve full remote code execution, allowing them to compromise the probe container, access sensitive environment variables, and potentially move laterally into the wider infrastructure.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.20 or later to ensure that Playwright objects are not exposed to the user-controlled execution environment.

Proactive Monitoring: Review synthetic monitor scripts for calls to launch() or other sensitive browser management functions and audit container processes for unauthorized binaries.

Compensating Controls: Restrict the privileges of the container running the oneuptime-probe and implement strict outbound network filtering to prevent command-and-control communication.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous because it provides a direct path to RCE without requiring complex sandbox escape techniques.

Analyst Recommendation

The ability for low-privileged users to execute arbitrary code on the server is a critical security failure. Administrators must upgrade to version 10.0.20 immediately to mitigate the risk of a full container and potentially cluster-wide compromise.

---METADATA---
VENDOR: Zoom
PRODUCT: Zoom Workplace for Windows
AFFECTED_VERSIONS: Before 6.6.0
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Mail feature of Zoom Workplace for Windows allows unauthenticated users to conduct an escalation of privilege via network access.

Executive Summary:
A critical privilege escalation vulnerability in Zoom Workplace for Windows allows unauthenticated attackers to gain elevated system permissions by exploiting a file path control flaw.

Vulnerability Details

CVE-ID: CVE-2026-30903

Affected Software: Zoom Workplace for Windows

Affected Versions: Before 6.6.0

Vulnerability: The vulnerability involves "External Control of File Name or Path" within the Zoom Mail feature. An unauthenticated attacker with network access can exploit this flaw to manipulate file paths, potentially leading to the execution of malicious files or the overwriting of sensitive system components to escalate privileges.

Business Impact

A successful exploit could allow an attacker to gain administrative rights on a user's workstation, leading to data theft, malware installation, and persistent access to the corporate network. The CVSS score of 9.6 reflects the high risk of unauthorized privilege elevation on end-user devices.

Remediation Plan

Immediate Action: Update Zoom Workplace for Windows to version 6.6.0 or later immediately.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for suspicious file system activity or unusual process spawning originating from the Zoom application.

Compensating Controls: Ensure that users do not have local administrative rights, which can limit the impact of privilege escalation vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, Zoom's large install base makes it a primary target for sophisticated threat actors seeking to compromise corporate endpoints.

Analyst Recommendation

Privilege escalation in widely deployed communication software is a critical threat. IT administrators must ensure that all Windows endpoints are running the latest version of Zoom Workplace to mitigate this risk and protect the organization's fleet of devices.

---METADATA---
VENDOR: Wazuh
PRODUCT: Wazuh
AFFECTED_VERSIONS: 4.4.0 through 4.14.3
---END_METADATA---

Description Summary:
A path traversal vulnerability in Wazuh's cluster synchronization routine allows authenticated peers to write arbitrary files and potentially achieve remote code execution.

Executive Summary:
An authenticated path traversal vulnerability in Wazuh allows cluster peers to perform arbitrary file writes, potentially leading to full system-level compromise.

Vulnerability Details

CVE-ID: CVE-2026-30893

Affected Software: Wazuh

Affected Versions: 4.4.0 to 4.14.3

Vulnerability: The cluster synchronization process improperly validates paths, allowing an authenticated peer to escape the intended directory and overwrite critical Python modules or system files.

Business Impact

This vulnerability is rated at a 9.0 CVSS score because it allows an attacker who has compromised one node to escalate privileges and impact the entire cluster. This could result in a complete loss of security monitoring visibility and potential system-level control over the infrastructure.

Remediation Plan

Immediate Action: Upgrade all Wazuh nodes to version 4.14.4 or later immediately.

Proactive Monitoring: Monitor cluster communication logs for unexpected file write operations or synchronization anomalies.

Compensating Controls: Isolate the cluster communication network and ensure that only authorized, trusted nodes can participate in the synchronization process.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 29, 2026, a proof-of-concept exists for this vulnerability. The existence of a PoC significantly increases the risk of exploitation, necessitating an urgent response.

Analyst Recommendation

The availability of a proof-of-concept makes this a high-priority remediation task. Organizations must apply the provided patch to all Wazuh components to prevent cluster-wide compromise.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime Synthetic Monitors
AFFECTED_VERSIONS: Prior to 10.0.18
---END_METADATA---

Description Summary:
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code execution and full cluster compromise.

Executive Summary:
Authenticated users in OneUptime can escape the JavaScript sandbox to execute arbitrary system commands, leading to a complete compromise of the database and cluster credentials.

Vulnerability Details

CVE-ID: CVE-2026-30887

Affected Software: OneUptime

Affected Versions: Prior to 10.0.18

Vulnerability: The system executes custom Playwright/JavaScript code within an insecure Node.js vm module. An authenticated project member can leverage a standard prototype-chain escape to bypass this sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container.

Business Impact

The business impact is critical, as the affected container holds environment variables containing database and cluster credentials. Exploitation leads directly to a complete cluster compromise. With a CVSS score of 9.9, the risk involves total loss of data confidentiality, integrity, and availability across the entire monitoring infrastructure.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.18 or later to ensure untrusted code is executed in a secure, hardened environment.

Proactive Monitoring: Inspect synthetic monitor configurations for suspicious JavaScript or use of constructor escapes and review container logs for unauthorized shell activity.

Compensating Controls: Implement network segmentation to isolate the oneuptime-probe containers and restrict their access to sensitive internal databases and cluster APIs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the use of well-known sandbox escape techniques makes the likelihood of exploitation by a knowledgeable insider very high.

Analyst Recommendation

Given the potential for complete cluster takeover, this vulnerability must be addressed with extreme urgency. Organizations should upgrade to version 10.0.18 immediately. Until the patch is applied, restrict the ability of users to create or modify synthetic monitors.

---METADATA---
VENDOR: Moodle (Plugin by mdjnelson)
PRODUCT: Custom Certificate (mod_customcert)
AFFECTED_VERSIONS: Prior to versions 4.4.9 and 5.0.3
---END_METADATA---

Description Summary:
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.

Executive Summary:
The Moodle Custom Certificate plugin contains a critical security flaw that allows authorized teachers to access and modify certificate data across different courses, leading to unauthorized data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-30884

Affected Software: Custom Certificate Moodle Plugin (mod_customcert)

Affected Versions: Prior to versions 4.4.9 and 5.0.3

Vulnerability: The core_get_fragment and mod_customcert_save_element services fail to verify the context of a supplied elementid. This allows an authenticated teacher with management permissions in one course to manipulate certificates in any other course on the Moodle site.

Business Impact

This vulnerability enables cross-course data tampering and information disclosure, which can undermine the integrity of academic certifications. The CVSS score of 9.6 reflects the high impact on data integrity and confidentiality within the educational platform, potentially allowing for the unauthorized issuance of certificates.

Remediation Plan

Immediate Action: Update the Custom Certificate plugin to version 4.4.9 or 5.0.3 immediately through the Moodle plugin management interface.

Proactive Monitoring: Audit certificate modification logs for any changes made by users to courses they are not officially assigned to manage.

Compensating Controls: Review and restrict the mod/customcert:manage capability to only the most trusted administrative users until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of context validation makes this vulnerability highly reliable for an authenticated attacker.

Analyst Recommendation

Moodle administrators must update the mod_customcert plugin to the fixed versions immediately. This action is necessary to prevent unauthorized users from compromising the validity of certificates across the entire installation.

---METADATA---
VENDOR: baserCMS
PRODUCT: baserCMS
AFFECTED_VERSIONS: Versions prior to 5.2.3
---END_METADATA---

Description Summary:
baserCMS contains an OS command injection vulnerability within its update functionality. Authenticated administrators can exploit this flaw to execute arbitrary commands with server-level privileges.

Executive Summary:
A critical OS command injection vulnerability in baserCMS allows authenticated administrators to achieve full remote code execution on the underlying server host.

Vulnerability Details

CVE-ID: CVE-2026-30877

Affected Software: baserCMS (Website Development Framework)

Affected Versions: Versions prior to 5.2.3

Vulnerability: This issue is classified as an OS Command Injection vulnerability residing in the update functionality of the framework. An attacker must be authenticated with administrator-level privileges to trigger the flaw, allowing them to bypass application logic and execute system-level commands under the context of the web server user.

Business Impact

A successful exploit poses a severe threat to the confidentiality, integrity, and availability of the server environment. By executing arbitrary OS commands, an attacker can gain persistent access, exfiltrate sensitive database content, or pivot into the internal network. The CVSS score of 9.1 reflects the critical nature of potential total system compromise, despite the requirement for administrative authentication.

Remediation Plan

Immediate Action: Administrators must immediately upgrade baserCMS installations to version 5.2.3 or later to patch the vulnerable update component.

Proactive Monitoring: Security teams should review system audit logs for unusual shell activity or unexpected outbound connections originating from the web server process.

Compensating Controls: Implement strict egress filtering to prevent reverse shell connections and ensure the web server is running with the least privilege necessary to minimize the impact of command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the technical details regarding the update function flaw are now public, the risk of exploitation by malicious insiders or compromised admin accounts is significantly elevated.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to version 5.2.3. Organizations should prioritize this patch to prevent administrative account compromise from escalating into a full server takeover. Ensure that all administrative credentials follow strong rotation policies to mitigate the risk of unauthorized access to the vulnerable update function.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.5.10
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A path traversal vulnerability in the SiYuan /export endpoint allows unauthenticated attackers to read arbitrary files from the server filesystem.

Executive Summary:
A critical path traversal vulnerability in SiYuan allows attackers to steal sensitive configuration files, potentially leading to full system compromise or remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30869

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.5.10

Vulnerability: A path traversal flaw exists in the /export endpoint, where double-encoded sequences can be used to bypass security filters. This allows an unauthenticated attacker to retrieve sensitive files, including API tokens and authentication secrets.

Business Impact

The exposure of API tokens and session secrets poses an extreme risk, as it grants attackers administrative access to the SiYuan kernel API. With a CVSS score of 9.3, this vulnerability could be chained to achieve remote code execution, resulting in total server compromise and potential exfiltration of all stored knowledge management data.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.5.10 or later immediately to patch the affected /export endpoint.

Proactive Monitoring: Inspect server logs for suspicious URL patterns containing directory traversal sequences (e.g., ../, %2e%2e%2f).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal attempts and double-encoded input strings.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of the data exposure and the potential for remote code execution, immediate remediation is required. Ensure that all instances are updated to the latest version and verify that no unauthorized access to sensitive configuration files has occurred.

---METADATA---
VENDOR: Appsmith
PRODUCT: Appsmith Table Widget (TableWidgetV2)
AFFECTED_VERSIONS: Prior to 1.96
---END_METADATA---

Description Summary:
A stored XSS vulnerability in Appsmith's Table Widget allows authenticated users to execute malicious scripts via unsanitized HTML attributes, leading to full administrative account takeover.

Executive Summary:
Appsmith is vulnerable to a critical stored cross-site scripting flaw that allows a standard user to escalate privileges and achieve a full administrative account takeover.

Vulnerability Details

CVE-ID: CVE-2026-30862

Affected Software: Appsmith Table Widget (TableWidgetV2)

Affected Versions: Prior to 1.96

Vulnerability: This critical stored XSS vulnerability originates from a lack of HTML sanitization within the React rendering pipeline of the Table Widget. An authenticated attacker with a regular user account can inject malicious attributes that, when viewed by a System Administrator via the "Invite Users" feature, execute a high-privileged API call to capture environment variables and take over the administrative account.

Business Impact

A successful exploit results in the complete compromise of the Appsmith instance. By gaining access to the /api/v1/admin/env endpoint, an attacker can extract sensitive configuration data and credentials, leading to total administrative control. Given the CVSS score of 9.0, this represents a severe risk to organizational data integrity and the security of internal tools built on the platform.

Remediation Plan

Immediate Action: Update Appsmith to version 1.96 or later immediately to apply the necessary HTML sanitization patches.

Proactive Monitoring: Audit the "Invite Users" logs and review any suspicious activity originating from the Table Widget components or unexpected calls to administrative API endpoints.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the execution of inline scripts and unauthorized API requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows a standard user to compromise the entire system through a common administrative workflow, the potential for exploitation is high.

Analyst Recommendation

The severity of this privilege escalation vulnerability cannot be overstated. Organizations utilizing Appsmith for internal tooling must prioritize the update to version 1.96. Immediate remediation is required to prevent authenticated users from gaining unauthorized administrative access to the environment.

---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: 0.2.5 to before 0.2.10
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability in WeKnora allows attackers to bypass command validation using the -p flag in npx node, leading to complete system compromise.

Executive Summary:
WeKnora is susceptible to a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands with full application privileges.

Vulnerability Details

CVE-ID: CVE-2026-30861

Affected Software: WeKnora LLM Framework

Affected Versions: 0.2.5 to before 0.2.10

Vulnerability: The vulnerability is located in the MCP stdio configuration validation. An unauthenticated remote attacker can bypass existing blacklists and whitelists by using the -p flag with npx node to execute arbitrary commands on the underlying server.

Business Impact

This flaw poses an extreme risk to data confidentiality, integrity, and availability. Successful exploitation grants the attacker the same privileges as the application, enabling them to steal sensitive documents, modify data, or move laterally within the network. The CVSS score of 9.9 underscores the critical risk associated with unauthenticated RCE.

Remediation Plan

Immediate Action: Upgrade WeKnora to version 0.2.10 or later to apply the necessary validation fixes.

Proactive Monitoring: Audit application logs for suspicious npx or uvx command executions and monitor for unauthorized user registrations.

Compensating Controls: Implement strict network egress filtering to prevent the application from communicating with malicious external servers during a potential exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Mar 7, 2026, this vulnerability is known to be exploitable due to the bypass of command validation logic. Because WeKnora allows unrestricted registration, any user can potentially trigger this flaw.

Analyst Recommendation

Given the unauthenticated nature of this RCE and the high CVSS score, this vulnerability must be treated as a top priority. Organizations using WeKnora should update to version 0.2.10 immediately to mitigate the risk of total system takeover.

---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: Prior to version 0.2.12
---END_METADATA---

Description Summary:
A remote code execution vulnerability in WeKnora's database query functionality allows unauthenticated attackers to bypass SQL injection protections via PostgreSQL array expressions.

Executive Summary:
WeKnora faces a critical unauthenticated remote code execution vulnerability where attackers can bypass SQL injection filters to execute arbitrary code on the database server.

Vulnerability Details

CVE-ID: CVE-2026-30860

Affected Software: WeKnora LLM Framework

Affected Versions: Prior to version 0.2.12

Vulnerability: The application's validation system fails to recursively inspect child nodes within PostgreSQL array and row expressions. This allows an unauthenticated attacker to smuggle dangerous functions, such as large object operations, to achieve RCE with the privileges of the database user.

Business Impact

Exploitation of this vulnerability results in full compromise of the database server. Attackers can exfiltrate entire datasets, corrupt document stores, or gain a foothold for further network attacks. The CVSS score of 9.9 reflects the high impact of bypassing security controls to achieve unauthenticated code execution.

Remediation Plan

Immediate Action: Update the WeKnora framework to version 0.2.12 immediately to resolve the recursive validation flaw.

Proactive Monitoring: Review PostgreSQL logs for unusual function calls (e.g., lo_import, lo_export) and monitor for anomalous SQL syntax involving complex array expressions.

Compensating Controls: Apply the principle of least privilege to the database user account to limit the impact of a successful SQL injection or RCE.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Mar 7, 2026, the technical details for bypassing the validation system are public. The ability to chain SQL injection into RCE makes this a highly attractive target for threat actors.

Analyst Recommendation

This is a critical vulnerability that bypasses standard SQL injection protections. Immediate patching to version 0.2.12 is the only effective way to ensure the security of the database and the WeKnora application environment.

---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been found in the WeKnora LLM framework, potentially impacting document understanding and semantic retrieval security.

Executive Summary:
WeKnora is affected by a high-severity vulnerability that could compromise the confidentiality and integrity of processed documents and semantic data.

Vulnerability Details

CVE-ID: CVE-2026-30855

Affected Software: WeKnora LLM Framework

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists within the WeKnora framework's document processing or retrieval logic. With a CVSS score of 8.8, the flaw likely allows for unauthorized data access or manipulation of the document understanding pipeline.

Business Impact

An attacker could potentially access sensitive documents stored within the framework or manipulate the semantic retrieval results to provide false information. The CVSS score of 8.8 indicates a high risk to the core functionality of the platform.

Remediation Plan

Immediate Action: Update the WeKnora framework to the latest patched version as recommended by the vendor.

Proactive Monitoring: Monitor for anomalous document access patterns and review system logs for errors in the semantic retrieval engine.

Compensating Controls: Implement strict role-based access control (RBAC) to ensure that users can only access the documents and flows they are authorized to see.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. This is one of several vulnerabilities identified in the WeKnora framework recently, suggesting a need for a comprehensive security audit.

Analyst Recommendation

Apply the necessary updates immediately. Given the sensitive nature of document understanding frameworks, maintaining a fully patched environment is essential to prevent data breaches.

---METADATA---
VENDOR: GStreamer
PRODUCT: GStreamer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GStreamer's rtpqdm2depay component contains a heap-based buffer overflow that could lead to unauthenticated remote code execution.

Executive Summary:
A critical heap-based buffer overflow in GStreamer allows unauthenticated attackers to execute arbitrary code remotely by exploiting the rtpqdm2depay media processing module.

Vulnerability Details

CVE-ID: CVE-2026-3085

Affected Software: GStreamer GStreamer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a heap-based buffer overflow within the rtpqdm2depay depayloader. An unauthenticated attacker can trigger the overflow by providing a malicious RTP stream, leading to memory corruption and subsequent remote code execution.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to system availability and data confidentiality. Exploitation could result in a complete system takeover, allowing attackers to bypass security boundaries and access sensitive internal resources.

Remediation Plan

Immediate Action: Update GStreamer to the latest available version to patch the heap-based buffer overflow in the rtpqdm2depay component.

Proactive Monitoring: Implement memory-integrity monitoring and review system logs for segmentation faults or application crashes related to GStreamer processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or specialized protocol filter to inspect and validate RTP traffic before it reaches the GStreamer processing engine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. The technical complexity of heap overflows is high, but the potential impact on media-heavy environments is catastrophic.

Analyst Recommendation

The 8.8 CVSS score indicates a critical priority. Organizations must ensure all systems utilizing GStreamer for RTP stream processing are updated immediately to prevent potential remote exploitation.

---METADATA---
VENDOR: Smallstep
PRODUCT: Step CA
AFFECTED_VERSIONS: < 0.30.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Smallstep Step CA versions below 0.30.0 are vulnerable to an improper authentication flaw in the SCEP UpdateReq function, allowing unauthenticated attackers to issue certificates.

Executive Summary:
A critical authentication bypass in Smallstep Step CA allows unauthenticated attackers to issue unauthorized digital certificates, potentially undermining the entire PKI infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-30836

Affected Software: Smallstep Step CA

Affected Versions: < 0.30.0

Vulnerability: This vulnerability is caused by a failure to properly authenticate requests during the SCEP UpdateReq process. An unauthenticated attacker can exploit this to perform unauthorized certificate issuance, which violates the fundamental security assumptions of the certificate authority.

Business Impact

The ability for an unauthenticated actor to issue certificates poses a catastrophic risk to the organization's PKI infrastructure. With a CVSS score of 10.0, this vulnerability could allow attackers to perform man-in-the-middle attacks, impersonate legitimate services, or decrypt secure communications, leading to total loss of trust in the system.

Remediation Plan

Immediate Action: Update Smallstep Step CA to version 0.30.0 or later to ensure proper authentication is enforced for all certificate requests.

Proactive Monitoring: Audit existing certificate issuance logs for any unauthorized or unexpected certificate requests that occurred prior to the update.

Compensating Controls: Restrict access to the SCEP endpoint at the network level using firewalls or mutual TLS (mTLS) to ensure only authorized entities can interact with the service.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation. However, the criticality of this vulnerability (CVSS 10) indicates that it should be mitigated immediately to prevent potential large-scale security breaches.

Analyst Recommendation

This vulnerability represents the highest level of risk to security infrastructure. Organizations must upgrade to version 0.30.0 immediately and conduct a thorough audit of their certificate store to ensure no unauthorized certificates have been issued.

---METADATA---
VENDOR: PinchTab
PRODUCT: PinchTab HTTP Server
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
PinchTab, an HTTP server for AI agents, contains a vulnerability that could allow for unauthorized control over Chrome browser instances.

Executive Summary:
A security flaw in the PinchTab HTTP server could allow attackers to hijack AI-driven browser sessions, leading to unauthorized data access or malicious browser activity.

Vulnerability Details

CVE-ID: CVE-2026-30834

Affected Software: PinchTab HTTP Server

Affected Versions: See vendor advisory for affected versions

Vulnerability: PinchTab is a standalone HTTP server designed to give AI agents control over Chrome. The vulnerability likely involves an authentication bypass or insecure API endpoint that allows an attacker to intercept or issue commands to the browser instance controlled by the AI.

Business Impact

The CVSS score of 7.5 indicates a High severity. If exploited, an attacker could steal session cookies, access sensitive web accounts, or use the hijacked browser to perform actions on behalf of the user, resulting in a significant breach of privacy and potential financial loss.

Remediation Plan

Immediate Action: Update the PinchTab server software to the latest version and ensure that all AI agent communication is encrypted and authenticated.

Proactive Monitoring: Monitor the HTTP server logs for unexpected connections or commands that do not originate from authorized AI agent sources.

Compensating Controls: Restrict access to the PinchTab HTTP server to the local host or a dedicated, secure management network using firewall rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. As AI integration grows, these types of bridge applications will become increasingly high-value targets.

Analyst Recommendation

The intersection of AI and browser control presents a unique security risk. It is imperative to apply the primary remediation immediately to prevent attackers from gaining control over automated browser sessions and the sensitive data they handle.

---METADATA---
VENDOR: Soft Serve
PRODUCT: Soft Serve Git Server
AFFECTED_VERSIONS: 0.6.0 to before 0.11.4
---END_METADATA---

Description Summary:
An authenticated SSRF vulnerability in Soft Serve allows SSH users to force the server to make requests to internal IP addresses, potentially exposing private services.

Executive Summary:
Authenticated users of Soft Serve can exploit a Server-Side Request Forgery (SSRF) flaw to gain unauthorized access to internal network services and sensitive metadata.

Vulnerability Details

CVE-ID: CVE-2026-30832

Affected Software: Soft Serve

Affected Versions: 0.6.0 to before 0.11.4

Vulnerability: An authenticated SSH user can trigger the repo import command with a crafted --lfs-endpoint URL. This allows the attacker to force the server to perform blind HTTP requests to internal/private IP addresses, which can be further exploited to read internal service data.

Business Impact

While the attack requires authentication, it allows users to bypass network segmentation and interact with internal APIs, cloud metadata services, or other private resources. This could lead to sensitive data exposure or further exploitation of internal systems. The CVSS score of 9.1 indicates a critical risk to internal infrastructure.

Remediation Plan

Immediate Action: Update Soft Serve to version 0.11.4 or later to implement proper validation of LFS endpoints.

Proactive Monitoring: Inspect server logs for repo import commands targeting internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 169.254.169.254).

Compensating Controls: Use network-level firewalls or egress filtering to prevent the Git server from initiating connections to sensitive internal subnets.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Mar 7, 2026, this vulnerability is documented as a multi-stage SSRF. Although the initial request is blind, it can be chained into a full read vulnerability using a malicious LFS server.

Analyst Recommendation

Administrators should prioritize updating Soft Serve to version 0.11.4. Even though authentication is required, the ability for a user to probe and exploit the internal network represents a significant security failure that must be addressed promptly.

---METADATA---
VENDOR: GStreamer
PRODUCT: GStreamer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GStreamer's rtpqdm2depay component is vulnerable to an Out-Of-Bounds Write, which could allow an unauthenticated attacker to execute remote code.

Executive Summary:
A critical Out-Of-Bounds Write vulnerability in GStreamer's RTP processing module enables unauthenticated remote code execution, threatening the total compromise of affected multimedia systems.

Vulnerability Details

CVE-ID: CVE-2026-3083

Affected Software: GStreamer GStreamer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Out-Of-Bounds (OOB) Write located in the rtpqdm2depay element. An unauthenticated remote attacker can exploit this flaw by sending specially crafted RTP packets to a system using GStreamer to process media streams.

Business Impact

The potential for Remote Code Execution (RCE) carries a CVSS score of 8.8. A successful exploit allows an attacker to gain full control over the host system, leading to data theft, installation of malware, or use of the system as a pivot point for lateral movement within the corporate network.

Remediation Plan

Immediate Action: Apply the latest GStreamer security patches immediately, specifically targeting the plugins-good or relevant library packages containing the rtpqdm2depay element.

Proactive Monitoring: Use network intrusion detection systems (IDS) to monitor for malformed RTP traffic or unexpected crashes in media processing services.

Compensating Controls: Disable the rtpqdm2depay plugin if it is not required for business operations, or utilize sandboxing technologies to isolate GStreamer processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, RCE vulnerabilities in widely used media frameworks are highly prized by threat actors and often lead to rapid exploit development.

Analyst Recommendation

This vulnerability represents a significant risk to any infrastructure performing real-time media processing. Immediate patching is required to mitigate the risk of unauthenticated remote code execution.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Flowise LLM flow builder could allow attackers to compromise customized large language model flows.

Executive Summary:
Flowise contains a high-severity security vulnerability that could lead to the unauthorized manipulation or compromise of LLM-based application workflows.

Vulnerability Details

CVE-ID: CVE-2026-30823

Affected Software: Flowise

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability affects the Flowise drag-and-drop interface used for building LLM flows. Based on the CVSS score of 8.8, the flaw likely permits an attacker to intercept or modify the logic of AI applications.

Business Impact

Successful exploitation could lead to "prompt injection" at scale, data exfiltration from connected vector databases, or the hijacking of AI-driven business processes. The CVSS score of 8.8 highlights the significant risk to the integrity of AI infrastructure.

Remediation Plan

Immediate Action: Update Flowise to the latest version immediately to resolve the identified security flaw.

Proactive Monitoring: Audit LLM flow configurations for unauthorized changes and monitor API logs for unusual request patterns.

Compensating Controls: Ensure that Flowise is deployed within a secure network perimeter and that all users are authenticated via a centralized identity provider.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, no active exploitation has been reported. As LLM frameworks become more prevalent, they are increasingly targeted by researchers and threat actors alike.

Analyst Recommendation

Apply the vendor's security updates without delay. AI orchestration tools often have broad access to internal data sources, making their security paramount to the overall safety of the organization's data.

---METADATA---
VENDOR: Vivotek
PRODUCT: FD8136 Camera
AFFECTED_VERSIONS: Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a
---END_METADATA---

Description Summary:
A remote buffer overflow vulnerability in the Vivotek FD8136 camera firmware allows authenticated attackers to execute arbitrary code as root.

Executive Summary:
A high-severity remote buffer overflow in Vivotek FD8136 cameras enables authenticated attackers to gain full root control over the hardware.

Vulnerability Details

CVE-ID: CVE-2026-30652

Affected Software: Vivotek FD8136

Affected Versions: Firmware version FD8136-VVTK-0300a

Vulnerability: The vulnerability resides in the /cgi-bin/dido/setdo.cgi endpoint. An authenticated attacker can trigger this buffer overflow to execute arbitrary commands with elevated system privileges.

Business Impact

The CVSS score of 8.8 highlights the significant risk of device compromise. Successful exploitation grants the attacker full root access, which can be utilized to disable security monitoring, exfiltrate video feeds, or launch further attacks against the local network.

Remediation Plan

Immediate Action: Update the camera firmware to the latest secure version released by Vivotek.

Proactive Monitoring: Review system logs for signs of unauthorized requests to the /cgi-bin/dido/setdo.cgi endpoint and monitor for unexpected process execution on the device.

Compensating Controls: Implement network-level access controls to ensure that only trusted administrative workstations can communicate with the camera's management interface.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, public exploit information exists. The capability to achieve root execution via this endpoint necessitates immediate firmware remediation.

Analyst Recommendation

This vulnerability is highly dangerous due to the potential for complete device takeover. Organizations must prioritize firmware updates for all affected Vivotek cameras and ensure that camera management interfaces are isolated from broader network segments to minimize the attack surface.

---METADATA---
VENDOR: Vivotek
PRODUCT: FD8136 Camera
AFFECTED_VERSIONS: Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a
---END_METADATA---

Description Summary:
A post-authentication remote buffer overflow in the Vivotek FD8136 camera firmware allows authenticated attackers to execute arbitrary code as root.

Executive Summary:
A critical post-authentication remote buffer overflow in Vivotek FD8136 cameras allows an attacker to achieve full root-level control over the device.

Vulnerability Details

CVE-ID: CVE-2026-30650

Affected Software: Vivotek FD8136

Affected Versions: Firmware version FD8136-VVTK-0300a

Vulnerability: This buffer overflow exists in the /cgi-bin/admin/eventtask.cgi endpoint. It requires an authenticated user to trigger, subsequently allowing the execution of arbitrary code with root privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to network security. Compromised cameras can be used as a pivot point for lateral movement within the network, or to facilitate botnet recruitment, surveillance interception, and persistent unauthorized access to the facility's physical security infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Vivotek for the FD8136 model to patch the buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from camera devices and inspect access logs for repeated failed attempts to access administrative CGI endpoints.

Compensating Controls: Isolate camera management interfaces on a dedicated, non-routable VLAN and restrict access to these interfaces using strict firewall rules.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, public exploit information is available. The ability to achieve root-level execution makes this a critical risk for any environment relying on these devices.

Analyst Recommendation

Due to the availability of exploits and the severity of root-level command execution, immediate firmware patching is required. Administrators should ensure these devices are not exposed to the public internet and restrict management access to authorized personnel only.