---METADATA---
VENDOR: UXGROUP LLC
PRODUCT: Cast to TV Screen Mirroring
AFFECTED_VERSIONS: v2.2.77
---END_METADATA---

Description Summary:
UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 is vulnerable to an arbitrary file overwrite during the import process, leading to code execution or data exposure.

Executive Summary:
An arbitrary file overwrite vulnerability in the Cast to TV Screen Mirroring application allows attackers to replace critical system files, potentially leading to full remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30282

Affected Software: UXGROUP LLC Cast to TV Screen Mirroring

Affected Versions: v2.2.77

Vulnerability: This vulnerability occurs during the file import process of the application. An attacker can craft a malicious file that, when processed, overwrites critical internal application or system files, allowing for arbitrary code execution (ACE) or sensitive information exposure.

Business Impact

The ability to overwrite arbitrary files is a high-impact flaw that typically leads to complete system compromise. With a CVSS score of 9.0, a successful exploit could allow an attacker to gain a persistent foothold on the device, steal user data, or pivot to other systems on the network. This represents a significant risk to both individual user privacy and corporate network security.

Remediation Plan

Immediate Action: Users should immediately update the Cast to TV Screen Mirroring application to the latest available version provided by UXGROUP LLC.

Proactive Monitoring: Monitor device file systems for unauthorized changes to application directories and review system logs for unusual process executions following file imports.

Compensating Controls: Restrict application permissions to the minimum necessary for operation and avoid importing files from untrusted or unknown sources until the software is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, file overwrite vulnerabilities are a well-known vector for achieving code execution, making this a high-priority target for attackers.

Analyst Recommendation

The potential for arbitrary code execution necessitates an immediate response. We strongly recommend that all users of the Cast to TV Screen Mirroring application update to a secure version immediately. Organizations should also consider mobile device management (MDM) policies to ensure third-party applications are kept current.

---METADATA---
VENDOR: Doorman
PRODUCT: Doorman
AFFECTED_VERSIONS: 0.1.0, 1.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper access control vulnerability in Doorman allows authenticated users to escalate their account role to high-privileged levels via the account update endpoint.

Executive Summary:
A critical privilege escalation vulnerability in Doorman allows authenticated users to perform unauthorized role changes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-30269

Affected Software: Doorman Doorman

Affected Versions: 0.1.0, 1.0.2

Vulnerability: This vulnerability involves a missing authorization check within the /platform/user/{username} endpoint. An authenticated user can manipulate the role parameter during a profile update to grant themselves administrative or other high-privileged roles.

Business Impact

The ability for a standard user to escalate privileges poses a severe threat to data integrity, confidentiality, and operational control. With a CVSS score of 9.9, this vulnerability represents an imminent risk of unauthorized administrative access, which could lead to complete system takeover, unauthorized data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Restrict user access to the profile update functionality until an official patch is applied or verify if the vendor has provided a specific update for these versions.

Proactive Monitoring: Review application access logs for anomalous POST or PUT requests to the /platform/user/ endpoint, specifically looking for role changes associated with non-administrative accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the profile update endpoint that contain unauthorized role assignments.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators should prioritize identifying all instances of Doorman within their environment. Immediately restrict user profile modification capabilities and prepare to apply the vendor-supplied patch as soon as it is released to prevent potential privilege escalation.

---METADATA---
VENDOR: Plane
PRODUCT: Plane
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Plane open-source project management tool allows for potential unauthorized actions, threatening the confidentiality of sensitive project data and organizational workflows.

Executive Summary:
The Plane project management platform is affected by a high-severity vulnerability that could lead to unauthorized data access or system manipulation, endangering proprietary project information.

Vulnerability Details

CVE-ID: CVE-2026-30242

Affected Software: Plane

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Plane project management tool's core logic. Given its high CVSS score, it likely involves an authentication bypass or an insecure direct object reference (IDOR) that allows an attacker to access or modify data without proper authorization.

Business Impact

Exploitation of this flaw could result in the theft of intellectual property, exposure of strategic roadmaps, and unauthorized modification of project tasks. The CVSS score of 8.5 indicates a High severity, suggesting that a successful attack could significantly disrupt business operations and lead to a loss of stakeholder trust in the platform's security.

Remediation Plan

Immediate Action: Deploy the latest security patches or container image updates for the Plane platform immediately to secure the environment.

Proactive Monitoring: Audit application access logs for unusual patterns of data export or administrative actions performed by standard user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter for common injection or unauthorized access patterns and implement strict role-based access controls (RBAC).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, because Plane is an open-source tool, the source code is available for researchers and threat actors to identify exploitation vectors quickly.

Analyst Recommendation

The severity of this vulnerability (CVSS 8.5) requires immediate remediation to protect sensitive organizational data. We recommend that IT teams treat this as a high-priority update and verify the integrity of project data following the application of the patch.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase (PWA Component)
AFFECTED_VERSIONS: 3.31.5 and earlier
---END_METADATA---

Description Summary:
A path traversal vulnerability in Budibase's PWA ZIP processing allows authenticated builders to exfiltrate sensitive server files, including environment variables and encryption keys.

Executive Summary:
Authenticated users with builder privileges can completely compromise the Budibase platform by using a path traversal flaw to steal cryptographic secrets and service credentials.

Vulnerability Details

CVE-ID: CVE-2026-30240

Affected Software: Budibase

Affected Versions: 3.31.5 and earlier

Vulnerability: A path traversal flaw exists in the POST /api/pwa/process-zip endpoint. By crafting a malicious icons.json file inside a ZIP upload, an authenticated builder can force the server to read arbitrary files like /proc/1/environ and upload them to public-facing object storage.

Business Impact

This vulnerability leads to a total platform compromise. By exfiltrating environment variables, an attacker gains access to JWT secrets, database credentials, and API tokens. The CVSS score of 9.6 is justified because the flaw allows a user with limited "builder" permissions to elevate their access to a full system administrator and compromise the underlying infrastructure.

Remediation Plan

Immediate Action: Update Budibase to the latest version (post-3.31.5) which includes sanitized path joining and input validation for the PWA processing endpoint.

Proactive Monitoring: Monitor MinIO or S3 object stores for unexpected file uploads, and review builder activity logs for suspicious ZIP processing requests.

Compensating Controls: Implement the principle of least privilege by restricting builder access to trusted personnel and rotate all secrets (JWT, DB, API keys) if exploitation is suspected.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation. The severity is exceptionally high because it facilitates the mass exfiltration of all service credentials in a single request.

Analyst Recommendation

The ability to exfiltrate the server's environment variables is a "game-over" scenario for any application. Organizations using Budibase must update their installations immediately and consider rotating all platform secrets as a precautionary measure.

---METADATA---
VENDOR: OliveTin
PRODUCT: OliveTin Web Interface
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
OliveTin, a web interface for shell commands, contains a high-severity vulnerability that could lead to unauthorized command execution.

Executive Summary:
OliveTin is affected by a high-severity vulnerability that could allow unauthorized individuals to execute predefined or arbitrary shell commands via the web interface.

Vulnerability Details

CVE-ID: CVE-2026-30223

Affected Software: OliveTin

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability impacts the way OliveTin manages access to shell commands. Given its function as a command execution wrapper, a flaw in this area typically involves improper access control or command injection.

Business Impact

Unauthorized access to OliveTin could allow an attacker to execute system-level commands, leading to server compromise, data loss, or service disruption. The CVSS score of 8.8 reflects the high risk associated with a tool designed specifically to execute shell operations.

Remediation Plan

Immediate Action: Apply vendor security updates immediately and ensure that all access to the OliveTin interface requires strong authentication.

Proactive Monitoring: Review OliveTin execution logs for any commands triggered by unauthorized users or at unusual times.

Compensating Controls: Place the OliveTin interface behind a VPN or an identity-aware proxy (IAP) to restrict access to trusted personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. However, tools that bridge web interfaces to shell commands are naturally high-risk targets.

Analyst Recommendation

Immediate patching is required. Furthermore, administrators should strictly audit which commands are available via OliveTin and ensure the service is not exposed to the public internet.

---METADATA---
VENDOR: bitbank2
PRODUCT: AnimatedGIF
AFFECTED_VERSIONS: v2.2.0
---END_METADATA---

Description Summary:
The bitbank2 AnimatedGIF library contains a buffer overflow in the DecodeLZW function that can lead to remote code execution or denial of service via a crafted GIF file.

Executive Summary:
A critical buffer overflow in the bitbank2 AnimatedGIF library allows remote attackers to cause a crash or execute arbitrary code via malicious GIF files.

Vulnerability Details

CVE-ID: CVE-2026-30141

Affected Software: bitbank2 AnimatedGIF

Affected Versions: v2.2.0

Vulnerability: The vulnerability exists in the DecodeLZW function, which fails to properly handle bounds checking during GIF decompression. An attacker can supply a specially crafted GIF file that causes a buffer overflow, leading to application crashes or the execution of arbitrary code.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical for any application utilizing this library to process image uploads or user-provided files. Successful exploitation could lead to full application compromise or service disruption, causing significant reputational and operational harm to businesses relying on the library for image processing.

Remediation Plan

Immediate Action: Update the bitbank2 AnimatedGIF library to the latest patched version.

Proactive Monitoring: Implement strict file type validation and scanning for all user-uploaded images before they reach the processing layer.

Compensating Controls: Run image processing tasks within a sandboxed, low-privilege container environment to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and security teams must audit their software supply chain to identify applications that depend on the bitbank2 AnimatedGIF library. Updating to the latest version is essential to mitigate the risk of remote code execution via malicious image files.

---METADATA---
VENDOR: Samba
PRODUCT: Samba
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists in Samba's certificate auto-enrollment Group Policy handling mechanism.

Executive Summary:
An authentication-related vulnerability in Samba’s Group Policy handling could allow attackers to compromise certificate auto-enrollment processes.

Vulnerability Details

CVE-ID: CVE-2026-3012

Affected Software: Samba

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the certificate auto-enrollment Group Policy handling component. It requires the attacker to have a level of authenticated network access to manipulate policy objects, potentially leading to unauthorized certificate management.

Business Impact

Successful exploitation of this flaw could allow unauthorized entities to manipulate certificate enrollment, potentially leading to a total compromise of trust within the domain environment. With a CVSS score of 8.0, this represents a high-severity risk that could facilitate man-in-the-middle attacks or unauthorized access to encrypted data streams.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Samba project or your Linux distribution vendor immediately.

Proactive Monitoring: Monitor domain controller logs for unusual modifications to Group Policy Objects (GPOs) and abnormal certificate enrollment requests.

Compensating Controls: Restrict administrative access to Group Policy management to only verified and essential personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of identity and certificate services, the potential for exploitation is high.

Analyst Recommendation

Given the central role of Samba in enterprise identity management, this vulnerability poses a significant risk to organizational integrity. Administrators are urged to prioritize the deployment of vendor-supplied patches and audit current certificate auto-enrollment configurations to ensure no unauthorized changes have occurred.

---METADATA---
VENDOR: Changing
PRODUCT: IDExpert Windows Logon Agent
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
IDExpert Windows Logon Agent is vulnerable to unauthenticated remote code execution via unauthorized remote DLL downloads and execution.

Executive Summary:
The IDExpert Windows Logon Agent is susceptible to a critical remote code execution flaw that allows unauthenticated attackers to execute malicious DLLs on target systems.

Vulnerability Details

CVE-ID: CVE-2026-3000

Affected Software: Changing IDExpert Windows Logon Agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software contains a Remote Code Execution (RCE) vulnerability. An unauthenticated attacker can remotely force the system to download arbitrary DLL files from a malicious source and execute them, bypassing standard security boundaries.

Business Impact

The impact of this vulnerability is critical, as it allows for unauthorized code execution at the system level without requiring user interaction or credentials. This could lead to the total compromise of sensitive authentication infrastructure and the theft of user credentials. The CVSS score of 9.8 underscores the extreme risk to organizational security and business continuity.

Remediation Plan

Immediate Action: Apply the latest security updates for IDExpert Windows Logon Agent as provided by the vendor to mitigate this RCE risk.

Proactive Monitoring: Inspect system logs for the loading of unsigned or suspicious DLLs and monitor for unusual network activity originating from the logon agent service.

Compensating Controls: Implement strict firewall rules to prevent the logon agent from initiating connections to untrusted external domains and employ application whitelisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical ease of exploiting unauthenticated RCE flaws makes this a high-priority target for attackers.

Analyst Recommendation

Given the Critical severity and the potential for complete system takeover, IT administrators should treat this as a top-priority patching task. Immediate remediation is necessary to protect Windows logon environments from remote compromise.

---METADATA---
VENDOR: Changing
PRODUCT: IDExpert Windows Logon Agent
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A remote code execution vulnerability in IDExpert Windows Logon Agent allows unauthenticated attackers to force arbitrary file downloads and execution from remote sources.

Executive Summary:
Unauthenticated remote attackers can achieve full system compromise on hosts running IDExpert Windows Logon Agent by forcing the execution of malicious remote files.

Vulnerability Details

CVE-ID: CVE-2026-2999

Affected Software: Changing IDExpert Windows Logon Agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Remote Code Execution (RCE) vulnerability. It allows an unauthenticated remote attacker to manipulate the agent into downloading arbitrary executable files from an attacker-controlled remote source and executing them with system-level privileges.

Business Impact

A successful exploit grants an attacker the ability to execute arbitrary code, leading to complete takeover of the affected Windows workstation or server. This presents a severe risk of data exfiltration, ransomware deployment, and lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and high impact on system integrity.

Remediation Plan

Immediate Action: Update the IDExpert Windows Logon Agent to the latest available version provided by Changing immediately to close the execution vector.

Proactive Monitoring: Monitor network traffic for unauthorized outbound connections to unknown external IP addresses from logon agents and review Windows event logs for unexpected process creations.

Compensating Controls: Restrict outbound internet access for internal agents to only known-good update servers and utilize Endpoint Detection and Response (EDR) tools to block unauthorized file executions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical 9.8 CVSS score, the potential for rapid exploitation by threat actors is extremely high.

Analyst Recommendation

This vulnerability is categorized as Critical and requires immediate attention from security teams. Organizations using Changing's IDExpert solution must prioritize the deployment of the vendor's patch to prevent unauthenticated remote code execution.

---METADATA---
VENDOR: eAI Technologies
PRODUCT: ERP
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A DLL Hijacking vulnerability in eAI Technologies ERP allows authenticated local attackers to execute arbitrary code by placing a malicious DLL in the application directory.

Executive Summary:
Authenticated local attackers can achieve arbitrary code execution on systems running eAI Technologies ERP by exploiting a DLL hijacking flaw.

Vulnerability Details

CVE-ID: CVE-2026-2998

Affected Software: eAI Technologies ERP

Affected Versions: See vendor advisory for affected versions

Vulnerability: The application fails to securely validate or specify the full path of required DLL files. This allows an authenticated local attacker to place a malicious DLL in the program's directory, which the application then loads and executes with the program's privileges.

Business Impact

Successful exploitation allows an attacker to escalate privileges or maintain persistence on a local workstation or server. This could lead to the theft of corporate data or further lateral movement within the corporate network. The CVSS score of 7.8 indicates a High severity, primarily limited by the requirement for local access and authentication.

Remediation Plan

Immediate Action: Apply the official security updates from eAI Technologies immediately to ensure the application uses secure library loading mechanisms.

Proactive Monitoring: Monitor for the creation of unexpected DLL files in application directories and review system logs for unauthorized administrative-level process executions.

Compensating Controls: Implement strict folder permissions to prevent non-administrative users from writing files to the ERP application directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, DLL hijacking is a well-understood attack vector that is frequently used in multi-stage compromises.

Analyst Recommendation

While this vulnerability requires local access, the potential for arbitrary code execution makes it a significant risk for environments where multiple users share systems. IT administrators should verify directory permissions and deploy the vendor's patch as soon as possible to mitigate the risk of privilege escalation.

---METADATA---
VENDOR: HSC
PRODUCT: MailInspector
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
HSC MailInspector 5 is affected by an unspecified security vulnerability requiring immediate administrative review.

Executive Summary:
A high-severity vulnerability identified in HSC MailInspector 5 requires immediate investigation and remediation to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-29963

Affected Software: HSC MailInspector

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an unspecified vulnerability affecting HSC MailInspector 5. The technical details regarding the authentication level and attack vector are currently limited, necessitating a cautious approach to security posture.

Business Impact

A CVSS score of 7.5 indicates a high-severity risk that could lead to unauthorized access or potential compromise of mail processing systems. Successful exploitation could disrupt critical communication channels or lead to the exposure of sensitive email traffic, causing significant operational and security impacts.

Remediation Plan

Immediate Action: Contact the vendor or consult their security portal to identify specific remediation steps or available patches for version 5.

Proactive Monitoring: Monitor mail gateway logs and system performance metrics for anomalous activity or unauthorized access attempts.

Compensating Controls: Utilize perimeter security controls, such as WAFs or hardened gateway configurations, to restrict access to the application while a permanent fix is pending.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the lack of specific technical details, administrators should prioritize vendor outreach to obtain actionable patch information. Ensure all systems are isolated from untrusted networks until a formal remediation path is validated.

---METADATA---
VENDOR: HSC
PRODUCT: MailInspector
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
HSC MailInspector v5 contains an unspecified vulnerability that may impact system security and user process integrity.

Executive Summary:
A high-severity vulnerability in HSC MailInspector v5 presents a risk to system integrity and necessitates urgent security review.

Vulnerability Details

CVE-ID: CVE-2026-29962

Affected Software: HSC MailInspector

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an unspecified vulnerability affecting user processes in HSC MailInspector v5. The exact nature of the flaw remains unclear, but it is classified as high-severity, warranting immediate attention.

Business Impact

The CVSS score of 7.5 highlights a significant risk, potentially allowing for unauthorized process manipulation or system-level impact. Failure to address this could result in service disruption or unauthorized system control, compromising the confidentiality and integrity of the organization's email infrastructure.

Remediation Plan

Immediate Action: Verify current installation versions against the vendor’s security advisory and apply the recommended patches immediately upon release.

Proactive Monitoring: Maintain strict oversight of user process logs and system integrity monitoring tools to detect any deviations from expected behavior.

Compensating Controls: Apply network-level restrictions to minimize exposure of the MailInspector interface to unauthorized users until a vendor-supplied patch is deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately assess their exposure and engage with the vendor for specific technical guidance regarding this vulnerability. Given the high severity, proactive patching and layered defense strategies are critical to preventing potential exploitation.

---METADATA---
VENDOR: KiviCare
PRODUCT: Clinic & Patient Management System (EHR) plugin for WordPress
AFFECTED_VERSIONS: All versions up to, and including, 4.1.2
---END_METADATA---

Description Summary:
The KiviCare EHR plugin for WordPress suffers from an authentication bypass in its social login function, allowing unauthenticated attackers to log in as any patient or capture administrator cookies.

Executive Summary:
A critical authentication bypass in the KiviCare WordPress plugin allows unauthenticated attackers to gain full access to sensitive medical records and potentially hijack administrator sessions.

Vulnerability Details

CVE-ID: CVE-2026-2991

Affected Software: KiviCare Clinic & Patient Management System (EHR) plugin for WordPress

Affected Versions: All versions up to, and including, 4.1.2

Vulnerability: The patientSocialLogin() function fails to verify social provider access tokens. Attackers can bypass credential checks by providing a target email and an arbitrary token value. Crucially, authentication cookies are set in the response headers before role checks, potentially exposing administrator cookies even if a 403 error is returned.

Business Impact

This vulnerability represents a catastrophic risk to patient privacy and regulatory compliance (e.g., HIPAA). With a CVSS score of 9.8, attackers can access Protected Health Information (PHI), prescriptions, and billing data. Furthermore, the potential for administrator session hijacking could lead to a total site takeover, causing massive reputational and legal damage.

Remediation Plan

Immediate Action: Update the KiviCare plugin to the latest patched version immediately. If a patch is unavailable, disable the social login feature or the plugin entirely until a fix is applied.

Proactive Monitoring: Review WordPress user logs for suspicious login activity and check for unusual HTTP 403 responses that may have successfully set authentication cookies in the headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter requests to the patientSocialLogin endpoint and enforce Multi-Factor Authentication (MFA) for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. However, the simplicity of this bypass makes it a prime candidate for automated exploit scripts.

Analyst Recommendation

Due to the sensitivity of medical data and the high CVSS score, this is a top-priority remediation. Organizations must update the KiviCare plugin immediately to prevent unauthenticated access to sensitive EHR data and administrative functions.

---METADATA---
VENDOR: OCPP Infrastructure
PRODUCT: WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical authentication flaw in OCPP WebSocket endpoints allows unauthenticated attackers to impersonate charging stations and manipulate backend commands and data.

Executive Summary:
The absence of authentication on OCPP WebSocket endpoints enables unauthenticated attackers to hijack charging station identities and compromise the integrity of the charging network.

Vulnerability Details

CVE-ID: CVE-2026-29796

Affected Software: OCPP Infrastructure WebSocket Endpoint

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from a lack of proper authentication on WebSocket endpoints utilized by the Open Charge Point Protocol (OCPP). An unauthenticated attacker can establish a connection using a known station identifier, allowing them to impersonate a legitimate charger and interact with the backend system.

Business Impact

Successful exploitation could result in unauthorized control of the charging infrastructure, potential service outages, and the corruption of billing or usage data. With a CVSS score of 9.4, the risk to the business includes significant operational disruption and a loss of customer trust in the security of the charging platform.

Remediation Plan

Immediate Action: Update the affected software to the latest version immediately to enable required authentication for all WebSocket communications.

Proactive Monitoring: Review backend logs for anomalous command patterns or station identifiers connecting from unauthorized geographic locations.

Compensating Controls: Deploy a Web Application Firewall (WAF) capable of inspecting WebSocket traffic and enforcing connection limits or IP-based filtering.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high due to the unauthenticated nature of the access required for exploitation.

Analyst Recommendation

Securing the communication channel between charging stations and the backend is critical for operational safety. Administrators should verify that all endpoints require strong authentication and consider implementing certificate-based authentication to prevent station impersonation. Apply the recommended vendor patches without delay.

---METADATA---
VENDOR: Vito
PRODUCT: Vito
AFFECTED_VERSIONS: Prior to version 3.20.3
---END_METADATA---

Description Summary:
Vito versions prior to 3.20.3 contain a missing authorization check in workflow site-creation actions, allowing authenticated attackers to manage sites on unauthorized servers.

Executive Summary:
A critical authorization bypass in Vito allows authenticated users to create and manage websites on servers belonging to other projects, leading to unauthorized infrastructure access.

Vulnerability Details

CVE-ID: CVE-2026-29789

Affected Software: Vito Server Management Application

Affected Versions: Prior to version 3.20.3

Vulnerability: The application fails to validate if an authenticated user with workflow write access has permission to use a specific server_id. By supplying a foreign server_id during site-creation actions, an attacker can gain unauthorized control over servers linked to different projects within the same Vito instance.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a near-total breakdown of multi-tenant or multi-project isolation. An attacker could deploy malicious applications, modify existing site configurations, or gain shell access to servers they do not own, resulting in massive data breaches and service disruption.

Remediation Plan

Immediate Action: Update the Vito application to version 3.20.3 or later immediately to enforce proper server-level authorization checks.

Proactive Monitoring: Review workflow logs and site creation history for any instances where sites were created on servers by users not officially assigned to those projects.

Compensating Controls: Restrict the ability to create workflows or sites to a very small number of highly trusted users until the patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. However, the high CVSS score and the nature of server management software make this an extremely attractive target for attackers.

Analyst Recommendation

The severity of this flaw demands immediate remediation. Vito administrators must apply the 3.20.3 update without delay to restore project isolation and prevent unauthorized server manipulation across their deployment environment.