---METADATA---
VENDOR: RAGFlow
PRODUCT: RAGFlow
AFFECTED_VERSIONS: 0.24.0 and earlier
---END_METADATA---

Description Summary:
A Jinja2 template injection vulnerability in RAGFlow's prompt generator allows authenticated users to execute arbitrary OS commands on the server.

Executive Summary:
An SSTI vulnerability in RAGFlow allows authenticated users to achieve remote code execution via malicious prompt generation workflows.

Vulnerability Details

CVE-ID: CVE-2026-45312

Affected Software: RAGFlow

Affected Versions: 0.24.0 and earlier

Vulnerability: The prompt generator (rag/prompts/generator.py) contains a Jinja2 template injection flaw. Authenticated users can create a specially crafted workflow, such as a Canvas workflow with a DuckDuckGo + LLM component chain, to trigger the injection and execute arbitrary OS commands.

Business Impact

With a CVSS score of 9.9, this vulnerability is critical. While it requires authentication, the ability for any standard user to gain remote code execution on the server poses a significant threat to the platform's security, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Update to the latest version of RAGFlow.

Proactive Monitoring: Monitor server-side logs for unusual process creation or shell command activity originating from the RAGFlow service.

Compensating Controls: Enforce strict controls on user permissions and limit the ability of regular users to create complex workflows or access sensitive prompt generation features.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their RAGFlow installation to the latest available version immediately. Additionally, audit all user-created workflows for suspicious patterns that might indicate an attempt to leverage this injection point.

---METADATA---
VENDOR: ronf
PRODUCT: asyncssh
AFFECTED_VERSIONS: < 2.23.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The AsyncSSH Python package is susceptible to a path traversal vulnerability that could allow unauthorized access to files outside of the intended directory.

Executive Summary:
A high-severity path traversal vulnerability in AsyncSSH could allow unauthenticated attackers to access restricted files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-45309

Affected Software: ronf asyncssh

Affected Versions: < 2.23.0

Vulnerability: The vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory (CWE-22). It allows an attacker to bypass directory restrictions during SSH operations, potentially leading to unauthorized file system access.

Business Impact

Successful exploitation of this path traversal vulnerability could result in the unauthorized disclosure of sensitive configuration files, source code, or system data. With a CVSS score of 8.2, this vulnerability represents a significant risk to the security of the host environment. Unauthorized access to the file system can provide attackers with the necessary information to escalate privileges or move laterally within the network.

Remediation Plan

Immediate Action: Update the asyncssh package to version 2.23.0 or later to resolve the directory traversal flaw.

Proactive Monitoring: Monitor file access logs for attempts to traverse outside of the expected directories, specifically looking for dot-dot-slash patterns.

Compensating Controls: Run the application with the principle of least privilege, ensuring the process owner has minimal access to the underlying file system.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Path traversal vulnerabilities in SSH implementations are frequently targeted due to the high level of access provided to the underlying system.

Analyst Recommendation

Given the potential for unauthorized file access, it is critical to apply the update to version 2.23.0 immediately. Organizations should verify their dependency trees to ensure that all instances of AsyncSSH are patched to the secure version.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony / Yaml
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Symfony YAML component is susceptible to inefficient regular expression complexity, which can be exploited by an unauthenticated attacker to cause a denial of service.

Executive Summary:
The Symfony framework is vulnerable to high-severity denial of service attacks resulting from regular expression complexity issues in its YAML parsing logic.

Vulnerability Details

CVE-ID: CVE-2026-45305

Affected Software: Symfony (including the Yaml component)

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This is a CWE-1333 Inefficient Regular Expression Complexity vulnerability, where specially crafted input can cause catastrophic backtracking, leading to high CPU usage by an unauthenticated attacker.

Business Impact

This vulnerability poses a serious threat to application availability. A CVSS score of 8.7 indicates that the vulnerability is easy to exploit remotely without authentication, potentially allowing an attacker to render a web application unresponsive or cause significant performance degradation.

Remediation Plan

Immediate Action: Update the Symfony YAML component to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to address the regex performance issues.

Proactive Monitoring: Review application performance monitoring logs for unexpected latency or CPU spikes occurring during the processing of user-provided YAML data.

Compensating Controls: Use a Web Application Firewall to filter or rate-limit requests that contain complex or unusually large YAML content.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, however, makes it a prime candidate for automated denial of service attacks.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Patching the affected software versions is the most effective method to prevent potential service disruptions caused by malicious input.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony / Yaml
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Symfony YAML component allows for XML entity expansion, which can lead to denial of service via resource exhaustion.

Executive Summary:
The Symfony framework contains a high-severity vulnerability that allows unauthenticated attackers to trigger resource exhaustion through improper restriction of recursive entity references.

Vulnerability Details

CVE-ID: CVE-2026-45304

Affected Software: Symfony (including the Yaml component)

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This is a CWE-776 XML Entity Expansion vulnerability where the application fails to properly restrict recursive entity references, allowing an unauthenticated remote attacker to consume system resources.

Business Impact

Successful exploitation of this flaw can result in significant system downtime or service unavailability, as the recursive entity expansion can lead to excessive memory or CPU consumption. With a CVSS score of 8.7, this is classified as a high-severity risk that could disrupt critical business operations relying on Symfony-based infrastructure.

Remediation Plan

Immediate Action: Upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to incorporate the necessary security patches.

Proactive Monitoring: Monitor server logs and system resource metrics for sudden spikes in CPU or memory usage that correlate with incoming web requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malformed or recursive XML-like payloads if an immediate patch cannot be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to crash services via simple, unauthenticated requests.

Analyst Recommendation

Given the high CVSS score and the ease of exploitation, teams should prioritize patching their Symfony dependencies. Upgrading to the latest versions is the only definitive way to prevent potential denial of service attacks against your application infrastructure.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: < 0.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-site Scripting (XSS) vulnerability in the Open WebUI platform allows attackers to execute arbitrary scripts in the context of an authenticated user's browser session.

Executive Summary:
A critical XSS vulnerability in Open WebUI could allow an attacker to hijack user sessions or perform unauthorized actions within the AI interface.

Vulnerability Details

CVE-ID: CVE-2026-45303

Affected Software: Open WebUI

Affected Versions: < 0.6.5

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability occurring during web page generation. An attacker with low-level privileges can inject malicious scripts that execute in the browser of a victim, potentially leading to total technical impact.

Business Impact

Successful exploitation allows for the theft of session tokens, unauthorized access to sensitive AI chat history, or the performance of actions on behalf of the user. With a CVSS score of 7.7, the risk of data compromise and unauthorized platform activity is high, particularly in collaborative or multi-user environments.

Remediation Plan

Immediate Action: Update the Open WebUI package to version 0.6.5 or later immediately.

Proactive Monitoring: Audit logs for suspicious script injections or unusual user behavior originating from within the platform's interface.

Compensating Controls: Utilize a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and employ a WAF to filter malicious inputs.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of 2026-07-11, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Security teams must prioritize the update to version 0.6.5. This vulnerability poses a significant risk to user data privacy and session integrity; failure to patch leaves the platform exposed to potential account takeover and information disclosure.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: < 0.3.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Open WebUI contains an improper access control vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An improper access control vulnerability in Open WebUI versions prior to 0.3.16 permits authenticated attackers to bypass security restrictions and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-45301

Affected Software: Open WebUI

Affected Versions: < 0.3.16

Vulnerability: This vulnerability, classified under CWE-284, stems from improper access control. The CVSS vector (PR:L) confirms that an attacker must possess authenticated, low-privileged access to the platform to exploit this flaw.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation allows an authenticated attacker to manipulate data or gain unauthorized access to functions they should not be able to access, potentially leading to a total loss of confidentiality and integrity within the platform. Given the nature of AI platforms, this could result in unauthorized access to sensitive model interactions or administrative configurations.

Remediation Plan

Immediate Action: Update the Open WebUI platform to version 0.3.16 or later immediately.

Proactive Monitoring: Review application access logs for unusual patterns of API calls or unauthorized attempts to access administrative endpoints.

Compensating Controls: Ensure the deployment is restricted to trusted internal networks and utilize a Web Application Firewall (WAF) to filter malicious requests targeting the application's authentication logic.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for low-level authentication slightly mitigates the attack surface but does not remove the risk of insider threats or compromised user accounts.

Analyst Recommendation

Organizations utilizing Open WebUI must prioritize upgrading to version 0.3.16 to remediate this access control flaw. Given the existence of a proof-of-concept, the window for potential exploitation is narrowing; immediate patching is the only effective method to ensure the security of the AI platform environment.

---METADATA---
VENDOR: amir20
PRODUCT: Dozzle
AFFECTED_VERSIONS: < 10.5.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dozzle contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated remote attackers to perform unauthorized requests.

Executive Summary:
A critical SSRF vulnerability in Dozzle exposes containerized environments to unauthorized internal network access by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-45298

Affected Software: amir20 Dozzle

Affected Versions: < 10.5.2

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the Dozzle log viewer. The flaw permits unauthenticated attackers to send arbitrary requests from the server hosting the container, potentially bypassing network segmentation.

Business Impact

Successful exploitation allows an attacker to interact with internal services that are otherwise protected by a firewall or network perimeter. With a CVSS score of 8.6, this represents a high risk of data exfiltration or internal reconnaissance, potentially leading to a broader compromise of the internal infrastructure.

Remediation Plan

Immediate Action: Upgrade Dozzle to version 10.5.2 or later to address the underlying flaw. If an immediate update is not feasible, restrict network access to the Dozzle interface using strict IP allowlisting.

Proactive Monitoring: Inspect server logs for unusual outbound traffic patterns originating from the Dozzle container instance.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious outbound requests or unauthorized API calls directed at the service.

Exploitation Status

Public Exploit Available: No (Nuclei detection template exists).

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning.

Analyst Recommendation

Given the high CVSS score and the ease of exploitability, organizations must prioritize patching this vulnerability immediately. While no weaponized exploit is currently observed, the existence of detection templates suggests that threat actors are actively creating tools to identify and leverage this flaw.

---METADATA---
VENDOR: WordPress
PRODUCT: WordPress-Coding-Standards
AFFECTED_VERSIONS: >= 0.14.1, < 3.4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WordPress Coding Standards package is vulnerable to eval injection via improper neutralization of directives in dynamically evaluated code.

Executive Summary:
An eval injection vulnerability in WordPress Coding Standards could allow attackers to execute arbitrary code if malicious configuration files are processed.

Vulnerability Details

CVE-ID: CVE-2026-45293

Affected Software: WordPress WordPress-Coding-Standards

Affected Versions: >= 0.14.1, < 3.4.1

Vulnerability: The software fails to properly neutralize directives within dynamically evaluated code, leading to a CWE-95 eval injection vulnerability. This allows an attacker to manipulate the execution flow of the coding standards tool.

Business Impact

While the attack requires user interaction, the potential impact includes full system compromise or code execution within the environment where the coding standards are applied. With a CVSS score of 8.6, this vulnerability represents a significant risk for development environments that rely on these standards for automated builds and testing.

Remediation Plan

Immediate Action: Update the WordPress-Coding-Standards package to version 3.4.1 or later via the appropriate package manager.

Proactive Monitoring: Monitor build pipelines and development server logs for any unexpected execution errors or unauthorized process spawns during code linting tasks.

Compensating Controls: Ensure that the coding standards tool is only executed in isolated, sandboxed environments with limited permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires specific conditions to trigger, but its impact remains severe.

Analyst Recommendation

Organizations utilizing these coding standards in their CI/CD pipelines should prioritize updating the package to version 3.4.1. This will eliminate the underlying eval injection flaw and secure the development infrastructure against potential compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DHP-1320
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the D-Link DHP-1320 router. This flaw may allow for remote exploitation and unauthorized device control.

Executive Summary:
A high-severity vulnerability in the D-Link DHP-1320 powerline router could allow attackers to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2026-4529

Affected Software: D-Link DHP-1320

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists within the D-Link DHP-1320 hardware/firmware stack. Given the CVSS score of 8.8, this flaw likely involves a remote, unauthenticated attack vector targeting the device's management interface or network services.

Business Impact

Compromise of a network gateway like the DHP-1320 allows an attacker to perform man-in-the-middle (MitM) attacks, pivot to other devices on the internal network, and disrupt internet connectivity. The CVSS score of 8.8 justifies a high-priority response, as the vulnerability poses a direct threat to the confidentiality and integrity of all data passing through the affected hardware.

Remediation Plan

Immediate Action: Update the D-Link DHP-1320 firmware to the latest available version immediately; if the device is end-of-life (EoL), replace it with a supported model.

Proactive Monitoring: Review network traffic for anomalous outbound connections originating from the router and monitor for unauthorized changes to DNS settings.

Compensating Controls: Ensure the router’s management interface is not accessible from the Wide Area Network (WAN) and use strong, unique administrative passwords.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, D-Link devices are frequent targets for automated botnets, making the potential for exploitation very high.

Analyst Recommendation

This vulnerability carries a high severity rating and affects critical networking infrastructure. It is imperative that administrators verify the firmware status of all DHP-1320 units and apply updates or decommission vulnerable hardware to prevent network-wide compromise.

---METADATA---
VENDOR: JasperFx
PRODUCT: Marten
AFFECTED_VERSIONS: < 8.36.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Marten, a .NET transactional document database, is vulnerable to SQL injection because it fails to properly parameterize the regConfig parameter in full-text search APIs.

Executive Summary:
A critical SQL injection vulnerability in the Marten .NET library allows attackers to execute arbitrary database commands via unsanitized full-text search inputs.

Vulnerability Details

CVE-ID: CVE-2026-45288

Affected Software: JasperFx Marten

Affected Versions: < 8.36.1

Vulnerability: The vulnerability stems from improper neutralization of special elements in the regConfig parameter of full-text search APIs. This allows for SQL injection when untrusted user input is passed into these functions without adequate validation.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and confidentiality. Exploitation could allow an attacker to bypass application logic, exfiltrate sensitive data from the underlying PostgreSQL database, or cause significant system disruption.

Remediation Plan

Immediate Action: Upgrade the JasperFx Marten library to version 8.36.1 or later to ensure the regConfig parameter is properly parameterized.

Proactive Monitoring: Inspect application logs for anomalous database queries or unexpected syntax errors originating from search functionality. Monitor PostgreSQL server logs for unusual query patterns.

Compensating Controls: Utilize input validation and sanitization routines at the application layer to block malicious payloads from reaching the database driver.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of exploitation in SQL injection flaws necessitates immediate patching.

Analyst Recommendation

This vulnerability represents a significant risk to any application utilizing the affected versions of Marten. Development teams must prioritize the transition to version 8.36.1 to eliminate the SQL injection vector and protect the underlying database infrastructure.

---METADATA---
VENDOR: PoxenStudio
PRODUCT: Talebook
AFFECTED_VERSIONS: < 3.42.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Talebook (MyBooks) is susceptible to a missing authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
A missing authorization flaw in Talebook allows authenticated attackers to perform unauthorized operations, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-45273

Affected Software: PoxenStudio Talebook

Affected Versions: < 3.42.0

Vulnerability: This vulnerability is a missing authorization flaw (CWE-862) within the Talebook web server. It permits an authenticated user to bypass intended access controls and execute functions they are not authorized to access.

Business Impact

Successful exploitation of this vulnerability allows an attacker with low-level privileges to gain unauthorized control over core application functions. Given the CVSS score of 8.7, this is a high-severity issue that could result in total compromise of the application data and integrity. Organizations relying on Talebook for sensitive document management face significant risks of unauthorized data access or modification.

Remediation Plan

Immediate Action: Update Talebook to version 3.42.0 or later immediately to resolve the missing authorization check.

Proactive Monitoring: Review application access logs for unusual patterns of administrative function calls originating from standard user accounts.

Compensating Controls: Implement strict network access controls to limit the exposure of the Talebook interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally exploitable due to the lack of server-side capability checks for sensitive operations.

Analyst Recommendation

The high CVSS score and the presence of a known proof-of-concept necessitate immediate action. Administrators must prioritize updating to version 3.42.0 to eliminate the risk of privilege escalation and unauthorized system control.

---METADATA---
VENDOR: ci4-cms-erp
PRODUCT: ci4ms
AFFECTED_VERSIONS: < 0.31.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability in the ci4ms content management system allows authenticated users to inject malicious scripts, potentially leading to unauthorized actions or data theft.

Executive Summary:
A high-severity cross-site scripting vulnerability in ci4ms, a CodeIgniter 4-based CMS, could allow authenticated attackers to execute malicious scripts within the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-45270

Affected Software: ci4-cms-erp ci4ms

Affected Versions: < 0.31.9.0

Vulnerability: The application is susceptible to a Cross-site Scripting (XSS) vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw requires the attacker to have low-level privileges (authenticated access) to successfully inject the script.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the browser of a victim, which can result in session hijacking, unauthorized data access, or defacement of the application. Given the CVSS score of 8.7, this represents a significant risk to the integrity and confidentiality of the platform, potentially compromising administrative accounts if they interact with the injected malicious content.

Remediation Plan

Immediate Action: Upgrade the ci4ms installation to version 0.31.9.0 or later as provided in the official GitHub repository.

Proactive Monitoring: Monitor web application logs for suspicious input patterns, particularly those containing script tags or encoded payloads, directed at user-accessible fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common XSS payloads, which can provide temporary protection while the update is being tested or deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally an issue of unsanitized user input rendering in the browser.

Analyst Recommendation

This vulnerability presents a substantial risk to organizational security due to the potential for session compromise. Administrators should prioritize applying the patch to version 0.31.9.0 immediately to eliminate this attack vector.

---METADATA---
VENDOR: Pimcore
PRODUCT: Pimcore
AFFECTED_VERSIONS: < 11.5.17, >= 12.0.0, < 12.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in Pimcore allows authenticated users to perform unauthorized actions, potentially leading to data integrity issues or service disruption.

Executive Summary:
A high-severity missing authorization flaw in Pimcore allows authenticated users to bypass security controls, resulting in unauthorized data modification or system disruption.

Vulnerability Details

CVE-ID: CVE-2026-45260

Affected Software: Pimcore Pimcore

Affected Versions: < 11.5.17, >= 12.0.0, < 12.3.7

Vulnerability: The software fails to perform adequate authorization checks for certain functions, allowing an authenticated user to perform actions outside their designated permission level.

Business Impact

This vulnerability can facilitate unauthorized administrative actions or modifications, undermining the integrity of the Data and Experience Management platform. With a CVSS score of 8.1, the risk of significant operational impact or unauthorized changes to managed data is substantial.

Remediation Plan

Immediate Action: Update the Pimcore installation to version 11.5.17, 12.3.7, or 2026.1.3 to remediate the authorization logic flaw.

Proactive Monitoring: Monitor audit logs for unusual administrative activity or actions performed by low-privileged users that should be restricted.

Compensating Controls: Implement strict role-based access control (RBAC) reviews and ensure that administrative interfaces are not exposed to untrusted network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from insufficient server-side authorization enforcement.

Analyst Recommendation

The missing authorization flaw presents a clear threat to system integrity. Administrators are strongly advised to apply the vendor-provided patches immediately to ensure that security permissions are correctly enforced across all system functions.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The FreeBSD KTLS receive path improperly decrypts records in place, leading to potential memory corruption due to unsafe mbuf modification.

Executive Summary:
A critical vulnerability in the FreeBSD Kernel TLS (KTLS) subsystem allows for potential memory corruption, posing a significant risk to system stability and security.

Vulnerability Details

CVE-ID: CVE-2026-45257

Affected Software: FreeBSD FreeBSD

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists in the KTLS receive path, which incorrectly assumes that mbufs holding received data are anonymous and safe to modify during in-place decryption. This flaw can be triggered by an attacker to cause memory corruption, potentially leading to a kernel panic or unauthorized information disclosure.

Business Impact

With a CVSS score of 7.8, this high-severity vulnerability represents a significant risk to the availability and integrity of FreeBSD systems. Successful exploitation could lead to system crashes (Denial of Service) or potential privilege escalation, directly impacting business operations and the confidentiality of processed network data.

Remediation Plan

Immediate Action: Monitor official FreeBSD security advisories and apply the provided kernel patches or system updates as soon as they become available.

Proactive Monitoring: Review system logs for kernel-related errors or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the affected services where possible and ensure that intrusion detection systems are configured to flag anomalous traffic patterns targeting the kernel network stack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects the core kernel network stack, the risk of system-wide compromise is elevated. Administrators should prioritize the deployment of vendor-supplied patches as soon as they are released to ensure the continued integrity and stability of their FreeBSD environments.

---METADATA---
VENDOR: FreeBSD
PRODUCT: bsdinstall / bsdconfig
AFFECTED_VERSIONS: 15.0-RELEASE (up to p9), 14.4-RELEASE (up to p5), 14.3-RELEASE (up to p14)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
FreeBSD's bsdinstall and bsdconfig utilities are vulnerable to command injection when processing Wi-Fi network names during network scanning, which could lead to arbitrary code execution.

Executive Summary:
A command injection vulnerability in FreeBSD's bsdinstall and bsdconfig utilities allows an attacker within wireless range to execute arbitrary commands with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-45255

Affected Software: FreeBSD bsdinstall and bsdconfig

Affected Versions: FreeBSD 15.0-RELEASE (up to p9), 14.4-RELEASE (up to p5), 14.3-RELEASE (up to p14)

Vulnerability: The vulnerability (CWE-78) occurs when these utilities process Wi-Fi network names (SSIDs) containing malicious characters, which are then passed improperly to bsddialog(1). This is a network-adjacent, unauthenticated vulnerability.

Business Impact

Successful exploitation allows an attacker to gain full control over the system during the installation or configuration process. This is particularly dangerous as these tools often run with elevated (root) privileges, potentially leading to a complete system takeover. The CVSS score of 7.5 reflects the high impact of this vulnerability on system integrity and availability.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the affected FreeBSD releases as specified in the FreeBSD-SA-26:23.bsdinstall advisory.

Proactive Monitoring: Monitor system logs for unauthorized execution of commands within the bsdinstall or bsdconfig contexts.

Compensating Controls: If patching is delayed, avoid performing Wi-Fi network scans in untrusted environments or when the security of the local wireless broadcast is not guaranteed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for the attacker to be in wireless range and the specific timing of the scan makes this a complex but highly impactful exploit.

Analyst Recommendation

System administrators managing FreeBSD environments must ensure that the latest security patches are applied to mitigate this command injection risk. Given the potential for root-level code execution, this should be treated as a high-priority maintenance task for all affected FreeBSD releases.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: 15.0-RELEASE up to p9, 14.4-RELEASE up to p5, 14.3-RELEASE up to p14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A parameter validation error in the ptrace(PT_SC_REMOTE) system call in FreeBSD allows for an out-of-bounds write vulnerability.

Executive Summary:
A high-severity out-of-bounds write vulnerability in the FreeBSD kernel allows local attackers to achieve potential code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-45253

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is an out-of-bounds write (CWE-787) occurring within the ptrace(PT_SC_REMOTE) syscall interface. The vulnerability arises from improper validation of parameters for syscall(2) and __syscall(2), and can be triggered by an unauthenticated local attacker.

Business Impact

The CVSS score of 8.4 reflects a high-severity risk as the vulnerability allows for privilege escalation, data compromise, or complete system denial-of-service. Because this involves kernel-level memory corruption, a successful exploit could result in the total compromise of the host system, rendering standard user-level defenses ineffective.

Remediation Plan

Immediate Action: Update FreeBSD systems to the latest patch release (15.0-RELEASE-p9, 14.4-RELEASE-p5, or 14.3-RELEASE-p14) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual kernel panics, segmentation faults, or unauthorized attempts to utilize the ptrace system call by non-privileged users.

Compensating Controls: Restrict access to the ptrace system call using kernel security modules or hardened configuration settings if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is significant due to its location in the kernel, making it a prime target for local privilege escalation.

Analyst Recommendation

Given the critical nature of kernel-level vulnerabilities, administrators must prioritize patching affected FreeBSD instances. Apply the provided vendor updates immediately to prevent local attackers from exploiting this memory corruption flaw to gain elevated system access.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: 15.0-RELEASE up to p9, 14.4-RELEASE up to p5, 14.3-RELEASE up to p14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the FreeBSD kernel occurs when a file descriptor is closed while a thread is blocked in a poll(2) or select(2) system call.

Executive Summary:
A use-after-free vulnerability in the FreeBSD kernel could allow an authenticated local attacker to cause system crashes or potentially achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-45251

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is a use-after-free (CWE-416) vulnerability where improper synchronization allows a file descriptor to be closed while a thread is actively waiting on it via poll(2) or select(2). The attacker must have low-level local privileges to trigger the race condition.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to system integrity and availability. Successful exploitation typically leads to kernel panics (Denial of Service), but in complex scenarios, it may allow for elevation of privilege, compromising all data residing on the affected system.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch immediately to address the race condition in the file descriptor handling logic.

Proactive Monitoring: Review system audit logs for frequent, unexplained kernel panics or repeated crashes involving system-level processes.

Compensating Controls: Minimize the number of local users with shell access to reduce the attack surface for this local privilege escalation vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in the kernel are notoriously difficult to weaponize but highly dangerous once a reliable trigger is discovered.

Analyst Recommendation

Kernel-level use-after-free flaws are high-priority security issues. Organizations should perform an emergency maintenance window to apply the FreeBSD security patches to all production servers to mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: 15.0-RELEASE up to p9, 14.4-RELEASE up to p5, 14.3-RELEASE up to p14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the FreeBSD setcred(2) system call allows local users to potentially exceed intended privileges.

Executive Summary:
A stack-based buffer overflow in the FreeBSD setcred(2) system call presents a critical risk of local privilege escalation for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-45250

Affected Software: FreeBSD

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: This is a stack-based buffer overflow (CWE-121) within the setcred(2) system call. While the call is intended for privileged users, the flaw allows for memory corruption that can be triggered by an attacker with low-level local privileges.

Business Impact

The CVSS score of 7.8 underscores the danger of this vulnerability, which allows local users to bypass security boundaries. By corrupting the stack, an attacker can potentially execute arbitrary code with kernel-level privileges, resulting in full system compromise and loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all affected FreeBSD installations to the latest patch release (15.0-RELEASE-p9, 14.4-RELEASE-p5, or 14.3-RELEASE-p14).

Proactive Monitoring: Monitor for suspicious processes executing system calls or attempting to manipulate credentials beyond their assigned capabilities.

Compensating Controls: Limit access to the system to authorized users only and implement strict principle-of-least-privilege configurations to mitigate the impact of a local account compromise.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept repository exists on GitHub.

Analyst Notes: As of May 22, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists on GitHub, so exploitation risk should be treated as credible. The existence of a PoC increases the likelihood of threat actors attempting to weaponize this stack overflow.

Analyst Recommendation

The presence of a public proof-of-concept makes this vulnerability an immediate threat to any environment where local access is provided to users. Patching is required urgently to prevent attackers from leveraging the available PoC to gain administrative control over the underlying operating system.

---METADATA---
VENDOR: Mirasvit
PRODUCT: Full Page Cache Warmer for Magento 2
AFFECTED_VERSIONS: Before 1.11.12
---END_METADATA---

Description Summary:
Mirasvit Full Page Cache Warmer for Magento 2 contains a PHP object injection vulnerability allowing unauthenticated RCE via the CacheWarmer cookie.

Executive Summary:
An unauthenticated PHP object injection vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 enables remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-45247

Affected Software: Mirasvit, Full Page Cache Warmer for Magento 2

Affected Versions: Before 1.11.12

Vulnerability: The vulnerability stems from an insecure call to PHP's unserialize() function using user-controlled input from the CacheWarmer cookie. This allows an unauthenticated attacker to inject malicious serialized objects, triggering gadget chains that result in remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to Magento-based e-commerce environments. Exploitation leads to total server compromise, potentially exposing customer PII, payment information, and administrative credentials. This could result in significant financial loss and severe regulatory compliance violations.

Remediation Plan

Immediate Action: Update the Mirasvit Full Page Cache Warmer plugin to version 1.11.12 or higher immediately.

Proactive Monitoring: Inspect web server access logs for suspicious cookie values containing serialized PHP objects or anomalous requests directed at the cache warming mechanism.

Compensating Controls: Deploy WAF rules to detect and block serialized PHP objects in incoming HTTP headers and cookies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of required authentication. Organizations utilizing Magento 2 with the Mirasvit Full Page Cache Warmer must apply the vendor-provided patch immediately to prevent unauthorized code execution and potential data exfiltration.

---METADATA---
VENDOR: steipete
PRODUCT: summarize
AFFECTED_VERSIONS: 0 up to (excluding) 0.15.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the summarize package allows unauthenticated attackers to perform unauthorized daemon requests via untrusted events.

Executive Summary:
A Server-Side Request Forgery vulnerability in the steipete summarize package could allow unauthenticated attackers to induce unauthorized internal requests.

Vulnerability Details

CVE-ID: CVE-2026-45245

Affected Software: steipete summarize

Affected Versions: 0 up to (excluding) 0.15.1

Vulnerability: This vulnerability consists of a Server-Side Request Forgery (CWE-918) and Improper Verification of Source (CWE-940). It allows an unauthenticated, network-adjacent attacker to influence the application to perform requests to internal services.

Business Impact

Successful exploitation could allow an attacker to probe internal network infrastructure or interact with internal APIs that are not exposed to the public internet. While the CVSS score is 7.4 (High), the potential to bypass perimeter defenses and access sensitive internal services poses a significant risk to organizational data integrity and service confidentiality.

Remediation Plan

Immediate Action: Update the npm/@steipete/summarize package to version 0.15.1 or later.

Proactive Monitoring: Monitor server-side logs for unusual outbound network connections initiated by the application service.

Compensating Controls: Implement strict egress filtering on the host machine to block the application from reaching unauthorized internal resources or sensitive endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of adequate validation on incoming event sources.

Analyst Recommendation

Given the potential for internal network discovery and the availability of proof-of-concept material, organizations using the summarize package should prioritize upgrading to version 0.15.1 immediately. Ensure that all downstream dependencies are also updated to maintain a secure software supply chain.

---METADATA---
VENDOR: steipete
PRODUCT: summarize
AFFECTED_VERSIONS: 0 up to (excluding) 0.15.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the summarize package allows authenticated users to perform path traversal via the slidesdir parameter.

Executive Summary:
A missing authorization vulnerability in the steipete summarize package enables authenticated users to perform path traversal, potentially leading to unauthorized file system access.

Vulnerability Details

CVE-ID: CVE-2026-45242

Affected Software: steipete summarize

Affected Versions: 0 up to (excluding) 0.15.1

Vulnerability: This is a Missing Authorization (CWE-862) vulnerability that allows a low-privileged authenticated user to manipulate the slidesdir parameter. This can lead to path traversal, allowing the user to access or manipulate files outside of the intended directory.

Business Impact

The ability to perform path traversal can result in unauthorized reading or manipulation of application files, which may lead to privilege escalation or the exposure of sensitive configuration data. With a CVSS score of 7.1, this vulnerability represents a significant risk to the confidentiality and integrity of the hosting environment.

Remediation Plan

Immediate Action: Update the npm/@steipete/summarize package to version 0.15.0 or later to ensure proper authorization checks are applied.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences (e.g., ../) within the slidesdir parameter.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the filesystem access of the service account to only the directories absolutely necessary for operation.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any user with a valid account on the system.

Analyst Recommendation

Administrators should treat this vulnerability with high priority, as it allows authenticated users to break out of their intended storage sandbox. Apply the security update immediately and audit existing user permissions to ensure they follow the principle of least privilege.

---METADATA---
VENDOR: HTMLy
PRODUCT: CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in HTMLy CMS through version 3, which may allow for unauthorized system access or information disclosure.

Executive Summary:
An identified vulnerability in HTMLy CMS through version 3 poses a high risk to the security and integrity of web-hosted content.

Vulnerability Details

CVE-ID: CVE-2026-45233

Affected Software: HTMLy CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the HTMLy CMS platform, potentially exposing the system to unauthorized interactions. The flaw may allow attackers to bypass security controls and interact with the CMS in an unauthorized manner.

Business Impact

An exploit of this CMS vulnerability could lead to unauthorized content modification, administrative account takeover, or the exposure of sensitive site data. With a CVSS score of 8.1, this high-severity vulnerability could result in severe reputational damage and the compromise of web-based assets.

Remediation Plan

Immediate Action: Update the HTMLy CMS installation to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor site traffic for unusual administrative access attempts or modifications to site configuration files.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and restrict access to the CMS administrative dashboard to known, trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Web administrators should treat this vulnerability with high priority to prevent unauthorized access to their CMS-managed sites. Updating the software to a patched version is the most effective way to eliminate this risk and ensure the continued security of web content.

---METADATA---
VENDOR: DumbAssets
PRODUCT: DumbAssets
AFFECTED_VERSIONS: Through 1.0.11
---END_METADATA---

Description Summary:
DumbAssets contains a path traversal vulnerability in the file deletion API that allows unauthenticated attackers to delete arbitrary files, resulting in denial of service.

Executive Summary:
A critical path traversal vulnerability in DumbAssets allows unauthenticated attackers to delete essential system files, leading to a complete denial of service.

Vulnerability Details

CVE-ID: CVE-2026-45230

Affected Software: DumbAssets

Affected Versions: Through 1.0.11

Vulnerability: The POST /api/delete-file endpoint fails to validate the filesToDelete array, allowing an attacker to use ../ sequences to traverse outside the intended directory and delete critical files like server.js.

Business Impact

The CVSS score of 9.1 highlights the severity of this vulnerability. While it primarily results in a denial of service, the ability to delete arbitrary files can be used to disrupt critical business operations or potentially clear evidence of other malicious activities.

Remediation Plan

Immediate Action: Update to the latest version of DumbAssets and check the vendor advisory for specific patch details.

Proactive Monitoring: Monitor API access logs for suspicious input patterns, specifically repeated use of directory traversal sequences.

Compensating Controls: Implement strict path validation and ensure the application runs with the minimum file system permissions required.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: Cp0204
PRODUCT: quark-auto-save
AFFECTED_VERSIONS: 0 up to (excluding) 0.8.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The quark-auto-save package is vulnerable to mass assignment, allowing attackers to modify internal object attributes.

Executive Summary:
A critical mass assignment vulnerability in the quark-auto-save package allows authenticated attackers to modify restricted object attributes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-45229

Affected Software: Cp0204 quark-auto-save

Affected Versions: 0 up to (excluding) 0.8.5

Vulnerability: The software is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915). This vulnerability requires the attacker to have low-level authenticated access (PR:L) to perform the exploitation.

Business Impact

The ability to modify internal object attributes can lead to privilege escalation or unauthorized data manipulation, resulting in a total technical impact on the affected system. While the CVSS score of 8.8 reflects the high risk of total impact, the requirement for authentication reduces the immediate risk compared to unauthenticated exploits.

Remediation Plan

Immediate Action: Update the quark-auto-save package to version 0.8.5 or later.

Proactive Monitoring: Review application logs for unexpected changes to user attributes or system configurations that deviate from expected operational behavior.

Compensating Controls: Implement strict input validation at the application layer to ensure that only expected fields are processed during object updates, effectively mitigating mass assignment risks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is significant; however, it is limited by the requirement for authenticated access.

Analyst Recommendation

Organizations utilizing the quark-auto-save package must prioritize the update to version 0.8.5 to prevent unauthorized attribute modification. Immediate patching is recommended to maintain the integrity of the application environment.

---METADATA---
VENDOR: heymrun
PRODUCT: heym
AFFECTED_VERSIONS: 0 up to (excluding) 0.0.21
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The heym package contains a sandbox escape vulnerability that allows authenticated attackers to bypass security restrictions via Python introspection.

Executive Summary:
A critical sandbox escape vulnerability in the heym package allows authenticated attackers to bypass security protections, potentially leading to full system control.

Vulnerability Details

CVE-ID: CVE-2026-45227

Affected Software: heymrun heym

Affected Versions: 0 up to (excluding) 0.0.21

Vulnerability: The software suffers from a Protection Mechanism Failure (CWE-693) that permits sandbox escaping through Python introspection. This vulnerability requires the attacker to have low-level authenticated access (PR:L).

Business Impact

A successful sandbox escape allows an attacker to break out of the intended execution environment, leading to potential unauthorized access to the underlying host system. With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the host environment.

Remediation Plan

Immediate Action: Update the heym package to version 0.0.21 or later to resolve the sandbox escape vulnerability.

Proactive Monitoring: Monitor for unexpected execution of system-level commands or unauthorized file system access originating from the application process.

Compensating Controls: Ensure the application is running with the least privilege necessary, and consider containerization or additional OS-level sandboxing to limit the scope of a potential breakout.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to its potential to bypass security boundaries.

Analyst Recommendation

Given the existence of a proof-of-concept and the high severity of a sandbox escape, users of the heym package should update to version 0.0.21 immediately. Proactive patching is essential to prevent potential host system compromise.

---METADATA---
VENDOR: Crabbox
PRODUCT: Crabbox
AFFECTED_VERSIONS: 0 up to (excluding) 0.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Crabbox is vulnerable to a path traversal flaw allowing unauthorized file system access.

Executive Summary:
A path traversal vulnerability in Crabbox allows local attackers to potentially access restricted files, posing a risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-45224

Affected Software: Crabbox

Affected Versions: 0 up to (excluding) 0.9.0

Vulnerability: This is a path traversal vulnerability (CWE-22) residing in the workspace resolution logic, which fails to properly validate pathnames. The vulnerability is exploitable by a local user with user-level interaction.

Business Impact

Successful exploitation of this flaw could allow an attacker to read or manipulate sensitive files outside of the intended directory structure. This compromises the confidentiality and integrity of the local environment. While the CVSS score of 7.1 indicates a high severity, the requirement for local access and user interaction slightly mitigates the immediate remote risk.

Remediation Plan

Immediate Action: Update the Crabbox package to version 0.9.0 or later to resolve the path resolution flaw.

Proactive Monitoring: Monitor file system access logs for unexpected access attempts to sensitive configuration files or directories outside of the designated workspace.

Compensating Controls: Ensure that the application process is running with the least privilege necessary to limit the potential impact of file system traversal.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data).

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by local users who can influence path resolution parameters.

Analyst Recommendation

Given the potential for unauthorized file access, administrators should prioritize updating to version 0.9.0. Applying this update is the most effective way to secure the environment against potential path traversal attacks.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Crabbox
AFFECTED_VERSIONS: 0 up to (excluding) 0.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability exists in Crabbox due to improper handling of administrative claims, allowing attackers to escalate privileges.

Executive Summary:
An authentication bypass flaw in OpenClaw Crabbox allows authenticated users to spoof administrative privileges and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-45223

Affected Software: OpenClaw Crabbox

Affected Versions: 0 up to (excluding) 0.9.0

Vulnerability: This is an Authentication Bypass by Spoofing (CWE-290) vulnerability. It allows a low-privileged authenticated user to manipulate administrative claims, effectively bypassing intended access controls.

Business Impact

The ability to bypass authentication and gain administrative rights poses a severe risk to the confidentiality and integrity of the application. With a CVSS score of 8.8, this vulnerability allows for total technical impact, potentially enabling an attacker to modify configurations, access sensitive data, or disrupt operations.

Remediation Plan

Immediate Action: Update OpenClaw Crabbox to version 0.9.0 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor user activity logs for unusual privilege escalation events or unauthorized administrative actions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious manipulation of session tokens or administrative claims.

Exploitation Status

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB).

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an initial foothold is established.

Analyst Recommendation

Given the potential for complete control over the Crabbox instance, organizations should treat this update as a high priority. Ensure the patch to version 0.9.0 is applied promptly to prevent unauthorized administrative access.

---METADATA---
VENDOR: StoreApps
PRODUCT: Smart Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in StoreApps Smart Manager allows for unauthorized privilege escalation.

Executive Summary:
A privilege escalation flaw in StoreApps Smart Manager may allow authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-45216

Affected Software: StoreApps Smart Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is categorized as an Incorrect Privilege Assignment, where the application fails to properly enforce access control boundaries. This allows an authenticated user to escalate their permissions beyond their intended role.

Business Impact

Successful exploitation allows attackers to bypass intended security constraints, potentially gaining administrative control over the application. This risks the confidentiality and integrity of sensitive store data. The CVSS score of 8.8 highlights the severity of the privilege escalation risk.

Remediation Plan

Immediate Action: Update the Smart Manager plugin to the latest version provided by the vendor.

Proactive Monitoring: Review application access logs for accounts performing actions outside their assigned privilege levels.

Compensating Controls: Utilize Web Application Firewall (WAF) rules to filter suspicious requests that may be attempting to trigger privilege escalation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize updating the Smart Manager plugin to mitigate this escalation risk. Regular audits of user roles and permissions are recommended to ensure that no unauthorized privilege changes have already occurred.

---METADATA---
VENDOR: Xpro
PRODUCT: Xpro Addons — 140+ Widgets for Elementor
AFFECTED_VERSIONS: 0 through 1.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability in the Xpro Addons plugin for WordPress allows authenticated attackers to manipulate database queries.

Executive Summary:
A Blind SQL Injection vulnerability in Xpro Addons for Elementor allows authenticated attackers to potentially extract sensitive information from the underlying WordPress database.

Vulnerability Details

CVE-ID: CVE-2026-45214

Affected Software: Xpro Xpro Addons — 140+ Widgets for Elementor

Affected Versions: 0 through 1.5.1

Vulnerability: This vulnerability is a SQL Injection (CWE-89) flaw originating from improper input sanitization. Per the CVSS vector (PR:L), this attack requires an authenticated user with at least low-level privileges to successfully trigger the injection.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive data stored within the WordPress database, including user credentials or configuration details. While the base CVSS score is 8.5, the requirement for authenticated access slightly lowers the immediate risk to unauthenticated external threats. However, if an attacker compromises a low-privileged account, they could leverage this flaw to escalate their impact significantly.

Remediation Plan

Immediate Action: Update the Xpro Addons plugin to version 1.5.2 or later immediately to incorporate the vendor's security patch.

Proactive Monitoring: Monitor database query logs for anomalous, high-frequency, or suspicious SQL syntax patterns that may indicate automated injection attempts.

Compensating Controls: Ensure a Web Application Firewall (WAF) is configured with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a high-severity risk due to the potential for full database compromise if the underlying application uses an overly privileged database user.

Analyst Recommendation

Given the potential for data exfiltration, organizations utilizing this plugin must prioritize the update to version 1.5.2. Failure to patch may allow authenticated users to perform unauthorized database operations, placing the confidentiality and integrity of the application environment at risk.

---METADATA---
VENDOR: Saad Iqbal APIExperts
PRODUCT: WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
AFFECTED_VERSIONS: 0 through 4.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability in the WC Shop Sync plugin for WooCommerce allows authenticated attackers to execute unauthorized database queries.

Executive Summary:
A Blind SQL Injection vulnerability in the WC Shop Sync plugin for WooCommerce allows authenticated attackers to potentially compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-45211

Affected Software: Saad Iqbal APIExperts WC Shop Sync (woosquare)

Affected Versions: 0 through 4.7.1

Vulnerability: This is a SQL Injection vulnerability (CWE-89) that permits an attacker to interfere with the queries made to the database. The CVSS vector indicates that this attack requires an authenticated user (PR:L) to interact with the vulnerable plugin function.

Business Impact

The exploitation of this flaw could result in the exfiltration of sensitive e-commerce data, such as product details or customer information, depending on the database permissions. Although the CVSS score is 8.5, the necessity of an authenticated session limits the attack surface; nevertheless, the risk to business data integrity remains critical.

Remediation Plan

Immediate Action: Update the WC Shop Sync plugin to version 4.7.2 or later as soon as possible.

Proactive Monitoring: Review database access logs for unusual query patterns and unexpected errors that may signify an ongoing injection attempt.

Compensating Controls: Deploy or update WAF rules to filter malicious SQL syntax and restrict access to the administrative/plugin settings that interact with the database.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows attackers to bypass standard application logic to interact directly with the database engine.

Analyst Recommendation

Security teams should treat this vulnerability with high urgency. Patching the plugin is the only definitive way to eliminate the underlying code flaw. Ensure all WordPress plugin updates are managed through a centralized process to maintain a consistent security posture.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A TOCTOU race condition in the TrendAI Apex One agent allows a local attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in the TrendAI Apex One agent poses a significant security risk by allowing attackers to gain elevated system permissions.

Vulnerability Details

CVE-ID: CVE-2026-45208

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: This vulnerability is a time-of-check time-of-use (TOCTOU) race condition in the agent's processing. It requires the attacker to have local access and low privileges on the host system to successfully trigger the escalation.

Business Impact

Successful exploitation of this flaw allows a local user to escalate privileges to a higher level, potentially gaining administrative control over the host. Given the CVSS score of 7.8, this represents a High severity risk, as it could lead to full system compromise, data theft, or the disabling of security software on the endpoint.

Remediation Plan

Immediate Action: Update on-premises installations of TrendAI Apex One to version 14.0.0.17079 or later; SaaS users should ensure their agents are updated to 14.0.20731.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution patterns or unexpected changes to local system configuration files.

Compensating Controls: Restrict local user access and ensure that standard user accounts do not have unnecessary permissions that could facilitate the exploitation of local race conditions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TOCTOU vulnerabilities typically require precise timing, making them moderately difficult to weaponize reliably.

Analyst Recommendation

This vulnerability is a significant threat to endpoint integrity. Organizations should prioritize patching TrendAI Apex One agents across their environment to eliminate the potential for local privilege escalation.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An origin validation error in the TrendAI Apex One agent allows a local attacker to escalate privileges.

Executive Summary:
A critical origin validation flaw in the TrendAI Apex One agent enables local attackers to escalate privileges on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-45207

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: The vulnerability stems from an origin validation error within the agent, which can be exploited by a local attacker with low privileges to perform unauthorized actions and escalate their system privileges.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a high risk to organizational security. An attacker who has already gained a foothold on a system with limited access could use this flaw to gain full control, potentially leading to unauthorized data access or widespread system disruption.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates: upgrade on-premises agents to 14.0.0.17079 and SaaS agents to 14.0.20731.

Proactive Monitoring: Review system audit logs for unauthorized attempts to interface with the Apex One agent or unexpected privilege escalation events.

Compensating Controls: Implement strict endpoint hardening and limit local user permissions to reduce the attack surface available to a local actor.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access inherently limits the scope of the threat to already compromised endpoints.

Analyst Recommendation

The severity of this issue necessitates prompt remediation. IT administrators should verify that all managed endpoints running TrendAI Apex One are updated to the specified versions to prevent privilege escalation.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An origin validation vulnerability in the TrendAI Apex One agent allows for local privilege escalation.

Executive Summary:
A privilege escalation vulnerability in the TrendAI Apex One agent, caused by improper origin validation, requires immediate patching to prevent unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-45206

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: This vulnerability involves an origin validation error that allows an authenticated local user to perform actions outside of their intended privilege level, resulting in successful privilege escalation.

Business Impact

The CVSS score of 7.8 underscores the high business impact of this vulnerability. If left unpatched, an attacker with local access can bypass security controls to gain elevated privileges, significantly increasing the risk of data breaches and persistent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Update all affected TrendAI Apex One agents to version 14.0.0.17079 for on-premises or 14.0.20731 for SaaS deployments.

Proactive Monitoring: Monitor for unusual activity involving agent-related processes or indicators of local privilege escalation attempts.

Compensating Controls: Ensure that systems are configured with the principle of least privilege to minimize the potential impact should an attacker attempt to exploit local vulnerabilities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the potential for privilege escalation makes this a high-priority patch.

Analyst Recommendation

Administrators must prioritize the deployment of the identified updates. Given the nature of the flaw, failing to patch leaves endpoints vulnerable to local attackers seeking to gain administrative control.

---METADATA---
VENDOR: Imagination
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical memory vulnerability in the Imagination Graphics DDK allows improper GPU commands to trigger out-of-bounds memory access.

Executive Summary:
A high-severity vulnerability in the Imagination Graphics DDK enables a guest VM to perform unauthorized memory reads or writes on the host kernel.

Vulnerability Details

CVE-ID: CVE-2026-45195

Affected Software: Imagination Graphics DDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the interface between the virtual machine and GPU firmware, where improper command validation allows a malicious actor to perform out-of-bounds memory operations. This represents a significant security boundary violation between the guest VM and the host kernel.

Business Impact

The CVSS score of 7.8 underscores the severity of this vulnerability, as it allows for potential guest-to-host breakout. Successful exploitation could lead to full system compromise, data exfiltration, or complete loss of control over the affected virtualization host, posing a severe threat to multi-tenant environments.

Remediation Plan

Immediate Action: Identify all systems utilizing Imagination Graphics DDK and apply the latest vendor-provided security patches to the GPU firmware and driver stack.

Proactive Monitoring: Monitor virtual machine hypervisor logs for unexpected GPU firmware interactions or unauthorized attempts to access restricted memory regions.

Compensating Controls: Where patching is delayed, limit the exposure of sensitive virtualized workloads by isolating systems that rely on affected GPU drivers until the remediation is complete.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the nature of this vulnerability involving kernel-level memory access, immediate patching is essential to prevent VM escape scenarios. System administrators should prioritize this update in all virtualized environments utilizing Imagination graphics hardware.

---METADATA---
VENDOR: Exim
PRODUCT: Exim
AFFECTED_VERSIONS: 4.97 up to (excluding) 4.99.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Exim versions before 4.99.3 contain a use-after-free vulnerability in the BDAT body parsing path, allowing unauthenticated remote code execution via specifically crafted TLS close_notify sequences.

Executive Summary:
A critical use-after-free vulnerability in Exim allows unauthenticated remote attackers to achieve arbitrary code execution, posing a severe risk to mail infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-45185

Affected Software: Exim

Affected Versions: 4.97 up to (excluding) 4.99.3

Vulnerability: This vulnerability is a use-after-free flaw triggered during BDAT body parsing when a client sends a TLS close_notify mid-transfer. An unauthenticated attacker can exploit this memory corruption to execute arbitrary code on the affected server.

Business Impact

The exploitation of this vulnerability results in full system compromise, allowing attackers to gain complete control over the mail transfer agent. Given the CVSS score of 9.8, this poses an extreme risk of data exfiltration, service disruption, and potential lateral movement into the internal network.

Remediation Plan

Immediate Action: Upgrade Exim to version 4.99.3 or later immediately to resolve the memory corruption vulnerability.

Proactive Monitoring: Monitor server logs for unusual BDAT traffic patterns and unexpected segmentation faults or crashes in the Exim process.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection system configured to drop malformed TLS chunks or suspicious SMTP traffic patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which allows for unauthenticated remote code execution, the potential for exploitation is high.

Analyst Recommendation

Organizations running Exim must prioritize patching to version 4.99.3 or above. Given the critical severity and the ease of exploitation, failure to update will leave the infrastructure vulnerable to complete compromise by remote, unauthenticated actors.

---METADATA---
VENDOR: Pimcore
PRODUCT: Pimcore
AFFECTED_VERSIONS: < 11.5.17, >= 12.0.0, < 12.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pimcore is vulnerable to insecure deserialization of untrusted data, which can be leveraged by an authenticated user with high privileges to achieve remote code execution.

Executive Summary:
An insecure deserialization vulnerability in Pimcore allows a high-privileged attacker to compromise the entire system, necessitating urgent patching.

Vulnerability Details

CVE-ID: CVE-2026-45162

Affected Software: Pimcore Pimcore

Affected Versions: < 11.5.17, >= 12.0.0, < 12.3.7

Vulnerability: The application improperly deserializes untrusted data, which an authenticated attacker with high privileges can exploit to execute arbitrary code.

Business Impact

Successful exploitation allows for complete control over the application server, potentially leading to full system compromise and total loss of confidentiality, integrity, and availability. Given the CVSS score of 8.0, the potential for catastrophic business impact is high.

Remediation Plan

Immediate Action: Update the Pimcore installation to version 11.5.17, 12.3.7, or 2026.1.3 to mitigate the deserialization risk.

Proactive Monitoring: Inspect server logs for anomalous execution patterns or unexpected system calls that may indicate an attempt to exploit deserialization routines.

Compensating Controls: Ensure the application runs with the least privilege necessary to limit the potential reach of a successful code execution exploit.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Insecure deserialization is a critical security flaw that often leads to remote code execution.

Analyst Recommendation

Due to the severity of insecure deserialization, immediate patching is required. Organizations must treat this as a high-priority update to prevent potential full-system compromise by malicious actors.

---METADATA---
VENDOR: Solana Foundation
PRODUCT: Anchor
AFFECTED_VERSIONS: >= 1.0.0, < 1.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Anchor framework for Solana contains an improper input validation vulnerability that can lead to unauthorized state changes.

Executive Summary:
A critical input validation flaw in the Anchor framework could allow unauthenticated remote attackers to perform unauthorized operations on Solana programs.

Vulnerability Details

CVE-ID: CVE-2026-45137

Affected Software: Solana Foundation Anchor

Affected Versions: >= 1.0.0, < 1.0.2

Vulnerability: This vulnerability involves improper input validation (CWE-20) within the Anchor framework. It allows unauthenticated attackers to provide malicious input that may lead to unintended program execution or state manipulation.

Business Impact

Exploitation of this vulnerability poses a severe risk to the integrity of Solana-based programs. An attacker could potentially bypass security checks, leading to unauthorized asset transfers or data corruption. The CVSS score of 8.2 reflects the high impact on system integrity.

Remediation Plan

Immediate Action: Update the anchor-lang crate to version 1.0.2 immediately. Developers should audit existing programs to identify any suspicious state changes or transactions.

Proactive Monitoring: Monitor blockchain transaction logs for anomalous patterns or unauthorized calls to sensitive program instructions.

Compensating Controls: Implement rigorous input sanitization and schema validation at the application level to ensure all incoming data conforms to expected formats.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, making rapid remediation essential.

Analyst Recommendation

The integrity of decentralized applications depends on the security of the underlying framework. Developers must prioritize the update to version 1.0.2 to prevent potential exploitation of the input validation flaw, as the risk of unauthorized state manipulation is significant.

---METADATA---
VENDOR: Caddy
PRODUCT: Caddy Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Caddy server platform. The specific technical details regarding the nature of the flaw remain under investigation.

Executive Summary:
The Caddy server platform is affected by a high-severity vulnerability that could potentially expose the system to unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-45135

Affected Software: Caddy Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Caddy server platform. Due to limited disclosure at this time, the exact vector and authentication requirements remain pending further vendor clarification.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a significant risk to the availability and integrity of web services. Successful exploitation could lead to unauthorized system access or the compromise of sensitive data handled by the Caddy server, potentially resulting in severe operational downtime and reputational damage.

Remediation Plan

Immediate Action: Administrators should monitor the official Caddy security advisory page and apply the latest security patches as soon as they are released.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unauthorized administrative attempts that deviate from established traffic baselines.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict ingress filtering to mitigate potential exploitation attempts while awaiting official vendor patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation remains a critical concern for organizations relying on this software.

Analyst Recommendation

Given the high severity rating, it is imperative that security teams prioritize this issue within their vulnerability management lifecycle. Immediately review the vendor's security bulletins and prepare for an emergency patching cycle to ensure the integrity of your network perimeter.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts exposes Personal Access Tokens and SSH signing keys to untrusted code.

Executive Summary:
Unsafe credential handling in CloudPirates Helm Charts exposes sensitive signing and access keys, creating an immediate risk of repository compromise.

Vulnerability Details

CVE-ID: CVE-2026-45132

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The generate-schema.yaml workflow uses unsafe checkout practices that allow fork-controlled code to access and exfiltrate Personal Access Tokens and SSH signing keys.

Business Impact

The theft of signing keys and access tokens allows an attacker to impersonate the project maintainers and push malicious code or sign fraudulent commits. With a CVSS score of 10.0, this represents a critical threat to the integrity of the entire software lifecycle.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to correct the workflow checkout and credential management practices.

Proactive Monitoring: Review repository logs for unauthorized commit activity or unusual use of the compromised SSH signing keys.

Compensating Controls: Immediately revoke and rotate all Personal Access Tokens and SSH keys that were configured for use within this workflow.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of secret exposure, users must treat this as a high-urgency remediation. Beyond updating the workflow, a full rotation of all exposed secrets is required to ensure the security of the repository and its associated assets.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts executes attacker-controlled code from forks, exposing repository secrets.

Executive Summary:
A critical configuration flaw in CloudPirates Helm Charts exposes sensitive repository credentials to unauthorized actors via GitHub Actions.

Vulnerability Details

CVE-ID: CVE-2026-45131

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The pull-request.yaml GitHub Actions workflow runs code from untrusted forks in a privileged context, exposing Docker Hub credentials and other repository secrets without requiring approval.

Business Impact

Exposure of credentials allows attackers to access private container registries and potentially inject malicious code into the software supply chain. With a CVSS score of 10.0, this vulnerability presents a catastrophic risk to the security of the build pipeline and downstream software users.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to secure the GitHub Actions workflow and isolate untrusted code execution.

Proactive Monitoring: Audit repository secret usage logs and verify if any credentials have been accessed or used by unauthorized parties.

Compensating Controls: Rotate all secrets (Docker Hub credentials, tokens) that were exposed or potentially accessible during the vulnerable period.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant supply chain risk. Organizations using these Helm charts must update to the patched version and treat all previously stored secrets as compromised, necessitating a mandatory rotation of all affected credentials.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Entra / Himmelblau
AFFECTED_VERSIONS: >= 2.0.0, < 2.3.11, >= 3.0.0-alpha, < 3.1.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Himmelblau interoperability suite for Microsoft Azure Entra ID contains an incorrect authorization vulnerability.

Executive Summary:
An authorization vulnerability in the Himmelblau suite for Azure Entra ID could allow authenticated users to escalate privileges and access unauthorized resources.

Vulnerability Details

CVE-ID: CVE-2026-45108

Affected Software: Himmelblau-idm Himmelblau

Affected Versions: >= 2.0.0, < 2.3.11, >= 3.0.0-alpha, < 3.1.5

Vulnerability: This vulnerability is caused by incorrect authorization (CWE-863). It requires low-privileged authenticated access to exploit, allowing an attacker to bypass intended access controls and perform actions they are not authorized to execute.

Business Impact

Successful exploitation can lead to full compromise of the integrated identity management systems. With a CVSS score of 8.4, the ability for an attacker to escalate privileges within Azure Entra ID or Intune represents a severe risk to organizational security, potentially resulting in unauthorized administrative access.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to the Himmelblau suite. Review the security advisory for specific upgrade paths based on the current deployment version.

Proactive Monitoring: Audit logs for unauthorized access attempts or unusual administrative actions performed by low-privileged service accounts.

Compensating Controls: Enforce strict Conditional Access policies in Azure Entra ID to limit the impact of potential unauthorized access.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the potential for privilege escalation makes this a high-priority item for identity management security.

Analyst Recommendation

Identity management suites are high-value targets for attackers. Given the potential for privilege escalation, security teams should prioritize the deployment of the necessary patches to ensure that authorization controls are correctly enforced within the Azure Entra environment.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to 10.0.98
---END_METADATA---

Description Summary:
OneUptime is vulnerable to a sandbox escape in its Node.js environment due to the improper use of the vm module.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows for remote code execution by bypassing the Node.js vm module isolation.

Vulnerability Details

CVE-ID: CVE-2026-45102

Affected Software: OneUptime OneUptime

Affected Versions: Prior to 10.0.98

Vulnerability: The application utilizes the Node.js vm module for code isolation, which is not designed for security; attackers can escape this sandbox via error objects and recursion.

Business Impact

With a CVSS score of 9.9, this vulnerability permits an attacker to escape the intended execution environment and perform arbitrary code execution on the host. This poses a critical threat to the security and stability of the OneUptime platform.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.98 or later to remediate the sandbox escape vulnerability.

Proactive Monitoring: Monitor for abnormal system calls or unauthorized filesystem access originating from the OneUptime application process.

Compensating Controls: Run the application with restricted OS-level permissions (e.g., using containers or sandboxing technologies) to mitigate the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The use of the vm module for security isolation is inherently flawed. Administrators must update to the latest version immediately to ensure that more robust security primitives are in place.

---METADATA---
VENDOR: sealed-env
PRODUCT: sealed-env
AFFECTED_VERSIONS: 0.1.0-alpha.1 through 0.1.0-alpha.3
---END_METADATA---

Description Summary:
The sealed-env library incorrectly embeds literal TOTP secrets in unencrypted JWS payloads, allowing unauthorized parties to extract sensitive credentials.

Executive Summary:
A critical security flaw in the sealed-env library exposes TOTP secrets in plaintext, allowing unauthorized access to sensitive authentication tokens.

Vulnerability Details

CVE-ID: CVE-2026-45091

Affected Software: sealed-env

Affected Versions: 0.1.0-alpha.1 through 0.1.0-alpha.3

Vulnerability: The library embeds the operator's TOTP secret within a base64-encoded JWS payload that is not encrypted. Any entity with access to the minted tokens, such as log aggregators or CI/CD systems, can extract the secret in plaintext.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk of credential compromise. Exposure of TOTP secrets effectively invalidates the multi-factor authentication mechanism for the affected environment, potentially granting attackers persistent access to critical systems and data.

Remediation Plan

Immediate Action: Update the sealed-env library to version 0.1.0-alpha.4 or later immediately.

Proactive Monitoring: Review CI/CD logs, container logs, and monitoring tools for the presence of leaked TOTP secrets and rotate all affected secrets immediately.

Compensating Controls: Implement secret scanning and log sanitization procedures to prevent sensitive tokens from being stored in cleartext in logs or environment variables.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant failure in secure secret management. It is imperative that affected organizations upgrade to the latest version of the library and immediately rotate any TOTP secrets that may have been exposed through logs or build environments.

---METADATA---
VENDOR: hahwul
PRODUCT: dalfox
AFFECTED_VERSIONS: < 2.13.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dalfox contains vulnerabilities including improper file path control, missing authentication for critical functions, and unrestricted file uploads.

Executive Summary:
The Dalfox XSS scanner is vulnerable to multiple security flaws, including unauthenticated file upload and path traversal, posing a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45089

Affected Software: hahwul dalfox

Affected Versions: < 2.13.0

Vulnerability: This vulnerability involves a combination of CWE-73, CWE-306, and CWE-434. An unauthenticated attacker can leverage these flaws to perform unauthorized file uploads and path manipulation, bypassing standard security controls.

Business Impact

The CVSS score of 8.2 (High) reflects the potential for severe impact, including the compromise of system integrity and availability. An attacker could upload malicious files to the server, potentially leading to full system compromise, unauthorized data access, or the deployment of persistent backdoors.

Remediation Plan

Immediate Action: Update the hahwul dalfox package to version 2.13.0 or later immediately.

Proactive Monitoring: Monitor server logs for unusual file upload activity or unexpected access to sensitive system paths.

Compensating Controls: Ensure the application is deployed within a restricted, non-privileged container environment to limit the impact of a potential file system breakout.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of missing authentication and unrestricted file upload makes this a high-value target for automated exploitation.

Analyst Recommendation

Given the severity of the identified flaws and the presence of a proof-of-concept, users must prioritize upgrading to version 2.13.0. The ability for unauthenticated actors to interact with critical file functions necessitates immediate patching to prevent potential remote code execution.

---METADATA---
VENDOR: Dalfox
PRODUCT: Dalfox
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
Dalfox contains an unauthenticated remote code execution vulnerability in its REST API server mode due to insecure deserialization of scan options.

Executive Summary:
An unauthenticated remote code execution vulnerability in Dalfox allows attackers to execute arbitrary shell commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-45087

Affected Software: Dalfox Dalfox

Affected Versions: Prior to 2.13.0

Vulnerability: The server mode deserializes attacker-supplied JSON directly into scan options, allowing an unauthenticated user to inject arbitrary shell commands that the Dalfox process will execute.

Business Impact

With a CVSS score of 10, this is a critical vulnerability that allows an unauthenticated attacker to gain full control over the host running the Dalfox server. This could lead to complete system compromise, data exfiltration, or the use of the host as a pivot point for further attacks.

Remediation Plan

Immediate Action: Update Dalfox to version 2.13.0 or later to ensure proper validation and stripping of scan options.

Proactive Monitoring: Monitor for unauthorized requests to the Dalfox API and check for unexpected child processes spawned by the Dalfox service.

Compensating Controls: If the Dalfox server must be exposed, implement strong authentication via an API key and restrict access to the service port (6664) using network-level controls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and trivial to exploit if the service is exposed to a network. Immediate updates are required, and the service should not be exposed without authentication.

---METADATA---
VENDOR: OpenSIPS
PRODUCT: opensips
AFFECTED_VERSIONS: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A NULL pointer dereference vulnerability in OpenSIPS allows unauthenticated remote attackers to trigger a denial of service by sending specifically crafted SIP requests.

Executive Summary:
A critical NULL pointer dereference vulnerability in OpenSIPS permits unauthenticated remote attackers to crash the service, resulting in a denial of service for critical communications.

Vulnerability Details

CVE-ID: CVE-2026-45084

Affected Software: OpenSIPS opensips

Affected Versions: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1

Vulnerability: This vulnerability is a NULL pointer dereference (CWE-476) occurring during the parsing or handling of SIP messages. It is accessible to unauthenticated remote attackers, as confirmed by the CVSS vector AV:N/AC:L/AT:N/PR:N.

Business Impact

The ability for a remote attacker to crash a core SIP server with a single crafted request poses a severe threat to organizations relying on OpenSIPS for telephony or messaging. The CVSS score of 8.7 reflects the high impact on availability, which could lead to significant operational downtime and loss of communication capabilities across the enterprise.

Remediation Plan

Immediate Action: Upgrade to OpenSIPS versions 3.6.6 or 4.0.0-rc1 to resolve the underlying pointer handling flaw.

Proactive Monitoring: Monitor server uptime and process health, specifically tracking restarts of the OpenSIPS daemon which may indicate successful exploitation of this vulnerability.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System capable of identifying and blocking malformed SIP traffic patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. NULL pointer dereferences in networking code are frequently discovered and exploited to force service outages.

Analyst Recommendation

Organizations should treat this vulnerability with high priority. Given the ease of exploitation, applying the vendor-recommended update is the only effective way to prevent potential service instability caused by malicious remote actors.