---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 146.0.7680.153
---END_METADATA---

Description Summary:
Google Chrome contains an inappropriate implementation in the V8 JavaScript engine that allows remote code execution via a crafted HTML page.

Executive Summary:
A critical vulnerability in the V8 engine of Google Chrome allows remote attackers to execute arbitrary code within a sandboxed environment.

Vulnerability Details

CVE-ID: CVE-2026-4447

Affected Software: Google Chrome

Affected Versions: prior to 146.0.7680.153

Vulnerability: This is an inappropriate implementation vulnerability in the V8 JavaScript engine. A remote attacker can trigger this flaw by enticing a user to visit a specially crafted HTML page, leading to arbitrary code execution within the browser's sandbox.

Business Impact

With a CVSS score of 8.8, this is a high-severity risk. While the code execution is constrained within the sandbox, such vulnerabilities are frequently leveraged as part of larger attack chains to escape the sandbox, potentially leading to full system compromise or sensitive data theft from the user's local environment.

Remediation Plan

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later to ensure the V8 engine is patched against this implementation flaw.

Proactive Monitoring: Use endpoint security tools to monitor for suspicious browser process behavior or unexpected network connections originating from Chrome instances.

Compensating Controls: Enable browser-based security features such as site isolation and ensure that users are trained to avoid interacting with untrusted or suspicious web content.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, browser-based vulnerabilities are high-value targets for attackers.

Analyst Recommendation

Given the ubiquity of Google Chrome, this update should be deployed across all workstations immediately. Proactive patching is the most effective defense against the potential for remote code execution and subsequent sandbox escape attempts.

---METADATA---
VENDOR: Zed Industries
PRODUCT: Zed
AFFECTED_VERSIONS: < 0.229.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zed is vulnerable to OS Command Injection due to improper neutralization of special elements, potentially allowing arbitrary code execution.

Executive Summary:
An OS Command Injection vulnerability in the Zed code editor could allow an attacker to execute arbitrary commands, posing a significant risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44466

Affected Software: Zed Industries Zed

Affected Versions: < 0.229.0

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an attacker to inject and execute unauthorized commands. The attack requires user interaction (UI:R) and is performed locally (AV:L), though it may result in a complete compromise of the system.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized system access, data exfiltration, or the installation of malicious software. Given the CVSS score of 8.6, this is a High-severity issue that could result in significant operational disruption and compromise of sensitive development environments.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.229.0 or later to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for suspicious process execution, particularly those initiated by the Zed application.

Compensating Controls: Ensure the principle of least privilege is applied to the user account running the Zed editor to limit the potential impact of command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for arbitrary command execution.

Analyst Recommendation

Organizations using the Zed code editor should treat this vulnerability with high priority. We recommend an immediate upgrade to version 0.229.0 across all developer workstations to neutralize the risk of OS command injection.

---METADATA---
VENDOR: Zed Industries
PRODUCT: Zed
AFFECTED_VERSIONS: < 0.227.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zed is susceptible to OS Command Injection, which may allow an attacker to execute arbitrary system commands through specially crafted input.

Executive Summary:
A critical OS Command Injection vulnerability in the Zed code editor potentially enables attackers to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44465

Affected Software: Zed Industries Zed

Affected Versions: < 0.227.1

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) flaw triggered by the improper neutralization of special elements. It requires user interaction and local access, but the potential impact involves full system compromise.

Business Impact

The potential for arbitrary command execution represents a severe risk to the confidentiality, integrity, and availability of host systems. With a CVSS score of 8.6, this vulnerability requires prompt remediation to prevent unauthorized access or malicious activity within the development environment.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.227.1 or later to remediate the vulnerability.

Proactive Monitoring: Review security logs for anomalous command-line arguments or unexpected child processes spawned by the Zed application.

Compensating Controls: Implement endpoint security solutions that can detect and block unauthorized or suspicious OS command executions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this vulnerability makes it an attractive target for attackers aiming to gain local persistence.

Analyst Recommendation

Due to the severity of OS command injection flaws, security teams should expedite the deployment of version 0.227.1. Users should ensure their development environments are updated immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: Zed Industries
PRODUCT: Zed
AFFECTED_VERSIONS: < 0.229.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zed is vulnerable to OS Command Injection caused by an incomplete list of disallowed inputs, allowing for the potential execution of unauthorized commands.

Executive Summary:
An OS Command Injection flaw in the Zed code editor allows for unauthorized command execution, presenting a significant security risk to host systems.

Vulnerability Details

CVE-ID: CVE-2026-44463

Affected Software: Zed Industries Zed

Affected Versions: < 0.229.0

Vulnerability: This vulnerability involves both an Incomplete List of Disallowed Inputs (CWE-184) and OS Command Injection (CWE-78). By bypassing existing filters, an attacker can inject malicious commands that the application executes with the privileges of the user.

Business Impact

The ability to execute arbitrary commands on a user's machine creates a high risk of data theft and system compromise. A CVSS score of 8.6 underscores the urgency of patching this vulnerability, as it could lead to full system control if successfully exploited.

Remediation Plan

Immediate Action: Upgrade to Zed version 0.229.0 or later to address the underlying input validation flaws.

Proactive Monitoring: Monitor for unusual shell commands or unexpected network activity originating from the Zed application process.

Compensating Controls: Utilize host-based intrusion detection systems (HIDS) to monitor for suspicious command execution patterns on developer machines.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of input validation and command injection flaws makes this a high-priority risk.

Analyst Recommendation

Organizations should prioritize updating the Zed editor to version 0.229.0 immediately. This patch addresses the critical input validation failures that facilitate command injection, effectively closing the primary attack vector.

---METADATA---
VENDOR: Zed Industries
PRODUCT: Zed
AFFECTED_VERSIONS: < 0.227.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zed is vulnerable to OS Command Injection, allowing an attacker to execute arbitrary commands on the host system.

Executive Summary:
The Zed code editor is affected by a critical OS Command Injection vulnerability that could allow for full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44461

Affected Software: Zed Industries Zed

Affected Versions: < 0.227.1

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an attacker to execute arbitrary operating system commands. The attack vector is local (AV:L), implying an attacker must have some level of local access or user interaction to trigger the injection.

Business Impact

Successful exploitation of this vulnerability can lead to complete system compromise, including unauthorized access to sensitive source code, environment variables, and local data. Given the CVSS score of 8.6, this represents a high-severity risk to the integrity and confidentiality of developer workstations.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.227.1 or later immediately.

Proactive Monitoring: Review system logs for unauthorized process execution or suspicious shell activity originating from the Zed editor process.

Compensating Controls: Ensure that the editor is run with the least privilege necessary, avoiding administrative or root execution contexts to limit the impact of a potential injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the potential for arbitrary code execution.

Analyst Recommendation

The severity of this command injection flaw necessitates an immediate upgrade to version 0.227.1. Organizations should prioritize patching developer environments to prevent potential lateral movement or data theft.

---METADATA---
VENDOR: Coder
PRODUCT: Coder
AFFECTED_VERSIONS: < 2.29.7, >= 2.30.0, < 2.30.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coder is vulnerable to OS command injection, which can be triggered by unauthenticated users through specially crafted requests.

Executive Summary:
An OS command injection vulnerability in Coder could allow an unauthenticated attacker to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44454

Affected Software: Coder Coder

Affected Versions: < 2.29.7; >= 2.30.0, < 2.30.2

Vulnerability: This is an OS command injection vulnerability (CWE-78) where improper neutralization of special elements allows attackers to inject and execute commands. The vulnerability is exploitable by unauthenticated remote users.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a high risk to the host environment. An attacker can leverage this flaw to gain unauthorized control over the server, potentially stealing credentials, exfiltrating data, or establishing persistence, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Coder installation to version 2.29.7 or 2.30.2 to remediate the command injection flaw.

Proactive Monitoring: Inspect system processes and network traffic for suspicious command execution patterns or unauthorized outbound connections.

Compensating Controls: Utilize a WAF to inspect incoming HTTP requests for malicious command sequences or shell metacharacters that target this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Command injection is a critical vulnerability that requires immediate attention. Organizations must verify their current version of Coder and apply the necessary patches immediately to prevent potential remote code execution by unauthenticated adversaries.

---METADATA---
VENDOR: Lumiverse
PRODUCT: AI chat application
AFFECTED_VERSIONS: Prior to 0.9.7
---END_METADATA---

Description Summary:
A vulnerability in the Lumiverse AI chat application allows authenticated users to achieve arbitrary OS-level code execution via the MCP server creation endpoint.

Executive Summary:
A critical command injection vulnerability in Lumiverse allows authenticated users to execute arbitrary commands on the underlying host server.

Vulnerability Details

CVE-ID: CVE-2026-44450

Affected Software: Lumiverse AI chat application

Affected Versions: Prior to 0.9.7

Vulnerability: The MCP server creation endpoint fails to validate the args array passed to child processes, allowing an attacker to inject inline-code execution flags. While the exploit requires the attacker to be logged in, it bypasses intended restrictions to grant OS-level code execution.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a maximum risk to the server infrastructure. An attacker with standard user access can escalate privileges to the OS level, resulting in full control over the Lumiverse server and potential access to sensitive data or internal network resources.

Remediation Plan

Immediate Action: Update the Lumiverse AI chat application to version 0.9.7 or later.

Proactive Monitoring: Monitor server process logs for unexpected child processes or unusual commands being executed by the application user.

Compensating Controls: Implement strict containerization or sandboxing for the application to limit the impact if code execution is achieved.

Exploitation Status

Public Exploit Available: Null

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of Lumiverse must upgrade to version 0.9.7 immediately. Given the ease of achieving OS-level code execution, this update is essential for maintaining the security and integrity of the hosting environment.

---METADATA---
VENDOR: Frappe
PRODUCT: ERPNext
AFFECTED_VERSIONS: frappe erpnext: < 16.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SQL injection vulnerability in ERPNext allows authenticated attackers to execute arbitrary SQL commands via improper neutralization of special elements.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44447) poses a critical risk of full database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44447

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: < 16.9.0

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) because it fails to properly sanitize user-supplied input before using it in database queries. This vulnerability requires the attacker to have low-level authenticated access to the application.

Business Impact

Successful exploitation allows an attacker to bypass security controls, potentially leading to unauthorized access to sensitive business data, modification of records, or complete system takeover. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and confidentiality, which could result in severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade to ERPNext version 16.9.0 or later to ensure the vulnerability is patched.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected syntax errors or suspicious SQL keywords that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious input directed at the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable once authenticated, the requirement for credentials limits the initial attack surface.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize patching this vulnerability immediately. Administrators must ensure that all instances of ERPNext are updated to the fixed version to prevent potential database-level compromise.

---METADATA---
VENDOR: Frappe
PRODUCT: ERPNext
AFFECTED_VERSIONS: frappe erpnext: >= 16.0.0-beta.1, < 16.14.0, < 15.104.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ERPNext contains a SQL injection vulnerability that allows authenticated users to execute arbitrary SQL commands due to improper input sanitization.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44446) presents a critical risk, enabling attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44446

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: >= 16.0.0-beta.1, < 16.14.0, < 15.104.3

Vulnerability: This is a CWE-89 (SQL Injection) vulnerability occurring in the application's query handling layer. Exploitation requires the attacker to be authenticated, though the impact is severe, potentially allowing for full administrative control over the underlying database.

Business Impact

The ability to inject arbitrary SQL queries allows an attacker to exfiltrate sensitive corporate data, alter financial or operational records, or gain unauthorized administrative access. The CVSS score of 8.8 underscores the severity of this risk, posing a threat to the core reliability and security of the ERP system.

Remediation Plan

Immediate Action: Update ERPNext to version 16.14.0 or 15.104.3, depending on the current branch in use.

Proactive Monitoring: Review application access logs and database audit trails for unauthorized query attempts or signs of anomalous database activity.

Compensating Controls: Implement strict input validation at the application level and utilize a WAF to block common SQL injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total database impact, though it is currently not known to be exploited in the wild.

Analyst Recommendation

Immediate remediation is required to secure the database layer. IT teams should verify their current version against the affected ranges and apply the vendor-provided patches as soon as possible to mitigate the risk of data breach.

---METADATA---
VENDOR: Frappe
PRODUCT: ERPNext
AFFECTED_VERSIONS: < 16.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in ERPNext allows authenticated users to modify data outside their permitted roles.

Executive Summary:
A critical authorization flaw in ERPNext allows authenticated users to escalate their privileges, enabling unauthorized data modification and potential system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-44442

Affected Software: Frappe ERPNext

Affected Versions: < 16.9.1

Vulnerability: The issue is a missing authorization check (CWE-862) on specific endpoints. While the vulnerability requires the attacker to be an authenticated user, the flaw allows them to bypass role-based access controls to perform unauthorized actions.

Business Impact

This vulnerability undermines the core security model of the ERPNext platform. An attacker with low-level access can perform administrative tasks or modify sensitive business data, leading to severe operational disruption or financial data compromise. Despite requiring authentication, the CVSS score of 9.9 highlights the extreme impact this has on organizational data integrity.

Remediation Plan

Immediate Action: Upgrade the ERPNext installation to version 16.9.1 or later.

Proactive Monitoring: Audit recent database modification logs for changes made by users that fall outside their assigned roles or standard business workflows.

Compensating Controls: Enforce the principle of least privilege for all user accounts and ensure the ERP instance is not accessible to unauthorized external personnel.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While it requires authentication, the impact is severe, and the vulnerability is inherently exploitable for any user with valid system credentials.

Analyst Recommendation

Organizations using ERPNext must prioritize the update to version 16.9.1. By addressing this authorization bypass, administrators can restore the integrity of their role-based access controls and prevent internal privilege escalation that could lead to widespread system abuse.

---METADATA---
VENDOR: FreeRDP
PRODUCT: FreeRDP
AFFECTED_VERSIONS: < 3.26.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeRDP is affected by a heap-based buffer overflow vulnerability in the Remote Desktop Protocol implementation, which could allow for remote code execution.

Executive Summary:
A heap-based buffer overflow in FreeRDP versions prior to 3.26.0 poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44421

Affected Software: FreeRDP FreeRDP

Affected Versions: < 3.26.0

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122). Based on the CVSS vector (AV:N/AC:L/PR:N/UI:R), the attacker can trigger this flaw remotely without authentication, though it requires user interaction.

Business Impact

The vulnerability allows for total technical impact, including potential remote code execution, which could lead to unauthorized system access, data theft, or complete compromise of the host environment. With a CVSS score of 8.8, this is a high-severity issue that should be prioritized to prevent system-wide security breaches.

Remediation Plan

Immediate Action: Update FreeRDP to version 3.26.0 or later immediately to apply the necessary memory safety patches.

Proactive Monitoring: Monitor network traffic for anomalous RDP sessions and review system logs for crashes or unexpected process behavior associated with the FreeRDP client/server.

Compensating Controls: Use network-level authentication (NLA) and restrict RDP access to trusted network segments to limit exposure to potentially malicious input.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for memory corruption in a widely used protocol implementation.

Analyst Recommendation

Given the potential for remote code execution and the existence of proof-of-concept material, organizations should treat this vulnerability with high urgency. Patching to version 3.26.0 is the only reliable method to mitigate the risk of heap-based memory corruption in FreeRDP.

---METADATA---
VENDOR: FreeRDP
PRODUCT: FreeRDP
AFFECTED_VERSIONS: < 3.26.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeRDP is affected by a heap-based buffer overflow vulnerability, which could allow an authenticated user to perform remote code execution.

Executive Summary:
A heap-based buffer overflow in FreeRDP versions prior to 3.26.0 allows authenticated attackers to potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44420

Affected Software: FreeRDP FreeRDP

Affected Versions: < 3.26.0

Vulnerability: This is a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker with low-level privileges (authenticated) can trigger this vulnerability remotely without requiring user interaction.

Business Impact

The ability for an authenticated attacker to execute arbitrary code poses a severe risk to internal system integrity and lateral movement potential. Given the CVSS score of 8.8, this vulnerability represents a critical security gap that could be weaponized to escalate privileges or exfiltrate sensitive data from the host.

Remediation Plan

Immediate Action: Upgrade to FreeRDP version 3.26.0 or higher as soon as possible.

Proactive Monitoring: Review authentication logs and session activity for signs of unauthorized privilege escalation or unusual command execution patterns.

Compensating Controls: Implement strict role-based access control (RBAC) to minimize the number of users capable of interacting with the vulnerable RDP components.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for authentication slightly reduces the attack surface compared to unauthenticated vectors, but it remains a high-priority risk.

Analyst Recommendation

The vulnerability requires immediate attention for all systems running FreeRDP. Administrators must prioritize the update to version 3.26.0 to ensure that memory safety improvements are active and the heap overflow condition is remediated.

---METADATA---
VENDOR: JetBrains
PRODUCT: TeamCity
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1, 2025.11.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JetBrains TeamCity contains a vulnerability related to missing authentication, potentially allowing unauthorized access to system functions.

Executive Summary:
A critical authentication-related vulnerability in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 exposes the platform to potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-44413

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1; 2025.11.5

Vulnerability: The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). An unauthenticated attacker can exploit this flaw to interact with sensitive endpoints, leading to unauthorized information disclosure or potential configuration changes.

Business Impact

Successful exploitation allows unauthorized parties to gain access to sensitive build artifacts, source code, or internal configuration details, which could facilitate further attacks against the development pipeline. With a CVSS score of 8.2, this vulnerability is a high-priority risk that threatens the security of the entire software supply chain managed by TeamCity.

Remediation Plan

Immediate Action: Update TeamCity installations to version 2026.1 or the relevant patched release (2025.11.5) immediately.

Proactive Monitoring: Review TeamCity audit logs for anomalous access patterns or unauthorized API requests originating from untrusted network segments.

Compensating Controls: Restrict access to the TeamCity interface via VPN or IP-allowlisting at the network level until the update is applied.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit available).

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication for critical functions represents a significant security design flaw that must be addressed via the vendor-supplied patch.

Analyst Recommendation

This vulnerability represents a significant security gap in the CI/CD pipeline. Organizations should apply the recommended updates immediately to prevent unauthorized access to build environments and sensitive project data.

---METADATA---
VENDOR: Hydro-Québec
PRODUCT: Le Circuit Electrique charging station backend
AFFECTED_VERSIONS: Hydro-Québec Le Circuit Electrique charging station backend: 0 up to (excluding) June_2026
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A session management vulnerability in the Le Circuit Electrique backend allows multiple connections with the same ID, potentially leading to a denial-of-service via resource exhaustion.

Executive Summary:
A vulnerability in the Hydro-Québec charging station backend allows unauthenticated attackers to overwhelm the system by reusing charging station identifiers.

Vulnerability Details

CVE-ID: CVE-2026-44383

Affected Software: Hydro-Québec Le Circuit Electrique charging station backend

Affected Versions: Hydro-Québec Le Circuit Electrique charging station backend: 0 up to (excluding) June_2026

Vulnerability: The system suffers from a session handling flaw (CWE-613) where it fails to properly invalidate or restrict multiple concurrent connections using the same charging station ID. This allows an unauthenticated attacker to inject malicious OCPP clients, leading to backend resource exhaustion.

Business Impact

This vulnerability poses a significant risk to the availability of the charging station network. Successful exploitation could result in service disruption for legitimate users, causing reputational damage to the service provider and potential operational downtime. The CVSS score of 7.5 (High) reflects the high impact on system availability, even though confidentiality and integrity remain unaffected.

Remediation Plan

Immediate Action: Upgrade the affected backend systems to the version released in June 2026 or later as specified by Hydro-Québec.

Proactive Monitoring: Monitor backend logs for anomalous connection patterns, specifically multiple concurrent sessions originating from the same charging station ID.

Compensating Controls: Implement rate limiting and stricter session validation at the network edge or via a Web Application Firewall (WAF) to prevent unauthorized concurrent connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor capable of sending network traffic to the OCPP interface.

Analyst Recommendation

The high severity of this vulnerability, combined with its impact on critical infrastructure, necessitates immediate attention. Administrators must verify their deployment status against the June 2026 update and apply the vendor-provided fixes to ensure the continued availability and integrity of the charging station network.

---METADATA---
VENDOR: Meshtastic
PRODUCT: firmware
AFFECTED_VERSIONS: < 2.7.21.1370b23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in the Meshtastic firmware GitHub workflow allows unauthorized execution of attacker-controlled code, leading to potential supply chain compromise.

Executive Summary:
A critical code injection vulnerability in the Meshtastic firmware repository allows unauthenticated attackers to execute malicious code via manipulated pull requests.

Vulnerability Details

CVE-ID: CVE-2026-44359

Affected Software: Meshtastic firmware

Affected Versions: < 2.7.21.1370b23

Vulnerability: The vulnerability stems from improper control of code generation (CWE-94) and inclusion of functionality from untrusted sources (CWE-829), where GitHub workflows automatically execute attacker-supplied files from forks without approval.

Business Impact

This flaw carries a CVSS score of 10.0, indicating the highest level of risk. An attacker could achieve full repository takeover, compromise self-hosted runners, or inject malicious code into the firmware supply chain, resulting in widespread downstream impact for users of the mesh networking solution.

Remediation Plan

Immediate Action: Update the Meshtastic firmware repository and associated build workflows to version 2.7.21.1370b23 or later.

Proactive Monitoring: Review repository CI/CD logs for any unrecognized workflow execution patterns or unauthorized attempts to access repository secrets.

Compensating Controls: Disable automatic workflow triggers for pull requests from external contributors until the environment is fully patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it bypasses standard security gates in the CI/CD pipeline.

Analyst Recommendation

Due to the critical severity and the potential for supply chain poisoning, immediate remediation is required. Developers and maintainers must ensure all workflows are updated to the patched version to prevent unauthorized code execution.

---METADATA---
VENDOR: BentoML
PRODUCT: BentoML
AFFECTED_VERSIONS: < 1.4.39
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BentoML is susceptible to OS command and code injection, which could allow an unauthenticated attacker to execute arbitrary commands if they can induce a user to interact with a malicious payload.

Executive Summary:
A critical OS command and code injection vulnerability in BentoML allows unauthenticated attackers to execute arbitrary code, posing a severe risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44346

Affected Software: BentoML BentoML

Affected Versions: < 1.4.39

Vulnerability: This vulnerability involves both CWE-78 (OS Command Injection) and CWE-94 (Code Injection). The CVSS vector (PR:N) indicates that the attack does not require prior authentication, though it does require user interaction (UI:R).

Business Impact

Exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the host system, which could lead to a total system compromise, unauthorized data exfiltration, or the installation of persistent backdoors. With a CVSS score of 8.8, the potential for significant organizational impact is high.

Remediation Plan

Immediate Action: Upgrade the BentoML Python library to version 1.4.39 or later to patch the injection vulnerabilities.

Proactive Monitoring: Review system logs for suspicious process execution, unusual outbound network connections, or unexpected file modifications occurring within the BentoML environment.

Compensating Controls: Implement strict input validation and sanitization for all data passed to BentoML processes and utilize a secure, isolated environment (e.g., containers with restricted privileges) to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for user interaction slightly reduces the immediate attack surface for automated exploitation.

Analyst Recommendation

Given the potential for remote code execution, organizations using BentoML must prioritize upgrading to version 1.4.39. This update is critical to preventing unauthorized access and ensuring the security of the AI model serving environment.

---METADATA---
VENDOR: BentoML
PRODUCT: BentoML
AFFECTED_VERSIONS: < 1.4.39
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BentoML contains an OS command injection vulnerability, allowing an unauthenticated attacker to execute arbitrary commands via malicious user interaction.

Executive Summary:
A critical OS command injection vulnerability in BentoML enables unauthenticated remote attackers to execute arbitrary commands, creating a significant risk of system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-44345

Affected Software: BentoML BentoML

Affected Versions: < 1.4.39

Vulnerability: The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS vector (PR:N) specifies that no authentication is required, while the UI:R flag indicates that successful exploitation requires interaction from an authorized user.

Business Impact

A successful exploit could allow an attacker to gain full control over the server running BentoML, leading to data theft, lateral movement, or full system takeover. The CVSS score of 8.8 reflects the high severity and the potential for a complete technical impact on the affected infrastructure.

Remediation Plan

Immediate Action: Immediately update the BentoML library to version 1.4.39 or higher to eliminate the injection vulnerability.

Proactive Monitoring: Monitor for unexpected shell commands or child processes spawned by the BentoML application and review access logs for suspicious user interactions.

Compensating Controls: Utilize WAF rules to detect and block common OS command injection payloads and apply the principle of least privilege to the service account running the BentoML environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable if an attacker can successfully trick an authenticated user into interacting with a malicious payload.

Analyst Recommendation

This vulnerability poses a severe threat to the operational environment. All deployments of BentoML must be updated to version 1.4.39 immediately to mitigate the risk of remote command execution and ensure the long-term security of the platform.

---METADATA---
VENDOR: PraisonAI
PRODUCT: Multi-agent teams system
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
PraisonAI multi-agent teams system contains an unspecified security vulnerability requiring immediate investigation.

Executive Summary:
A security vulnerability in the PraisonAI multi-agent platform could potentially expose critical business logic to unauthorized manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44340

Affected Software: PraisonAI Multi-agent teams system

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The exact nature of this vulnerability is currently under investigation; however, it affects the core multi-agent framework of the PraisonAI system. The authentication requirements remain indeterminate pending further vendor disclosure.

Business Impact

Given the CVSS score of 7.5, this vulnerability represents a high-risk scenario that could lead to unauthorized access or degradation of AI-driven workflows. Successful exploitation may result in the compromise of proprietary automated processes and the leakage of sensitive data handled by the agentic architecture.

Remediation Plan

Immediate Action: Review the official PraisonAI security advisories and apply available patches or configuration changes immediately.

Proactive Monitoring: Monitor system logs for unusual agent behavior or unauthorized API calls directed at the core framework.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact of a potential agent-based compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of AI agent systems in business workflows, the potential for exploitation is considered high.

Analyst Recommendation

Security teams should prioritize the identification of PraisonAI instances within their environment. Applying the vendor-supplied updates is the only definitive way to mitigate this risk; monitor vendor communication channels closely for technical bulletins.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 4.6.34
---END_METADATA---

Description Summary:
PraisonAI's MCP server fails to sanitize file paths in tool arguments, allowing unauthenticated attackers to perform arbitrary file writes and achieve code execution.

Executive Summary:
An unauthenticated directory traversal vulnerability in PraisonAI permits attackers to overwrite critical system files, leading to full system compromise via arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-44336

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 4.6.34

Vulnerability: The MCP server fails to validate input paths, allowing an attacker to use directory traversal sequences (e.g., ../../) to write files outside the intended directory. This permits the dropping of malicious Python .pth files into site-packages, resulting in arbitrary code execution in subsequent Python processes.

Business Impact

Successful exploitation allows an attacker to gain persistent, unauthorized access to the host server. This poses a significant risk of data theft, configuration tampering, and full system takeover. The 9.6 CVSS score underscores the severity of this vulnerability, necessitating urgent intervention to prevent exploitation.

Remediation Plan

Immediate Action: Update the PraisonAI installation to version 4.6.34 immediately to enforce strict path validation and containment checks.

Proactive Monitoring: Review file integrity logs for unauthorized modifications in Python site-packages or unexpected file creation within the application's base directory.

Compensating Controls: Restrict the service account running the PraisonAI process to the minimum necessary filesystem permissions to limit the scope of potential file overwrites.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe risk of persistence and code execution. Security teams must treat this as a high-priority update. Ensure all instances are patched to version 4.6.34 and verify that the service is running with the least privilege required to perform its functions.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 1.6.32
---END_METADATA---

Description Summary:
PraisonAI contains a logical flaw in its URL checking mechanism that allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks.

Executive Summary:
A logical flaw in PraisonAI's URL validation logic exposes the application to Server-Side Request Forgery (SSRF), potentially allowing unauthorized internal network access.

Vulnerability Details

CVE-ID: CVE-2026-44335

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 1.6.32

Vulnerability: The application's URL checking logic is insufficient, allowing an unauthenticated attacker to bypass security filters. This enables the application to be used as a proxy to send requests to internal resources that are otherwise inaccessible from the public internet.

Business Impact

SSRF vulnerabilities can lead to the exposure of internal-only services, metadata endpoints, and sensitive configuration interfaces. By leveraging the internal trust of the server, an attacker can bypass traditional network defenses. The 9.8 CVSS score reflects the high potential for lateral movement and internal reconnaissance within the organization's infrastructure.

Remediation Plan

Immediate Action: Upgrade to PraisonAI version 1.6.32 or later to rectify the URL validation logic flaws.

Proactive Monitoring: Monitor egress traffic from the server for requests directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application server from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for internal network exposure, this vulnerability requires immediate attention. Administrators must apply the patch version 1.6.32 to prevent SSRF-based attacks that could lead to broader infrastructure compromise.

---METADATA---
VENDOR: free5GC
PRODUCT: free5GC
AFFECTED_VERSIONS: Prior to 4.2.2
---END_METADATA---

Description Summary:
The free5GC NEF component suffers from an authentication bypass on the PFD management route group, allowing unauthenticated attackers to manipulate application data and subscriptions.

Executive Summary:
A critical authentication bypass in the free5GC NEF component allows unauthenticated attackers to read sensitive PFD data and manipulate notification subscriptions.

Vulnerability Details

CVE-ID: CVE-2026-44330

Affected Software: free5GC free5GC

Affected Versions: Prior to 4.2.2

Vulnerability: The nnef-pfdmanagement route group is mounted without inbound OAuth2/bearer-token authorization, permitting unauthenticated access to PFD data retrieval and subscription management.

Business Impact

A CVSS score of 10 reflects the severe impact of this vulnerability, which enables an attacker to influence PFD application data and subscription notifications. This could lead to service disruption, unauthorized data exfiltration, or the poisoning of network policy configurations within the 5G core.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or higher to enforce proper OAuth2 authentication for PFD management operations.

Proactive Monitoring: Monitor for anomalous GET/POST/DELETE requests targeting the NEF PFD management API endpoints.

Compensating Controls: Utilize a Service Mesh with strict authorization policies to intercept and block unauthorized requests to the NEF SBI interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of core network policy components, immediate patching is required. Failure to secure these endpoints could allow attackers to manipulate critical network traffic and subscriber policies.

---METADATA---
VENDOR: free5GC
PRODUCT: SMF (Session Management Function)
AFFECTED_VERSIONS: Prior to 4.2.2
---END_METADATA---

Description Summary:
The free5GC SMF component improperly manages UPI route groups, allowing unauthenticated attackers to perform unauthorized read, write, and delete operations.

Executive Summary:
A critical authentication bypass in the free5GC SMF component allows an unauthenticated network attacker to perform unauthorized management operations on the 5G core network.

Vulnerability Details

CVE-ID: CVE-2026-44329

Affected Software: free5GC SMF

Affected Versions: Prior to 4.2.2

Vulnerability: The vulnerability stems from the SMF component mounting UPI management route groups without required OAuth2/bearer-token authorization middleware. This allows an unauthenticated attacker with network access to the Service-Based Architecture (SBI) to interact directly with UPI endpoints.

Business Impact

The CVSS score of 10.0 signifies the highest level of risk, as it allows for unauthorized control over critical 5G network management functions. Exploitation could lead to severe network disruption, interception of communication, or total manipulation of user plane nodes, causing catastrophic service outages.

Remediation Plan

Immediate Action: Update free5GC SMF to version 4.2.2 or later to implement required authorization middleware.

Proactive Monitoring: Audit network logs for unauthorized access attempts or suspicious traffic patterns directed at SBI endpoints and UPI management routes.

Compensating Controls: Implement strict network micro-segmentation to ensure only authorized components can communicate with the SMF service, effectively isolating it from untrusted network segments.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is exceptionally severe due to the lack of any authentication requirements. Organizations utilizing free5GC must prioritize the update to version 4.2.2 to close this critical security gap and prevent unauthorized manipulation of core network infrastructure.

---METADATA---
VENDOR: free5GC
PRODUCT: free5GC
AFFECTED_VERSIONS: < 4.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The free5GC core network implementation is vulnerable to missing authentication and authorization, leading to potential service disruption or unauthorized state manipulation.

Executive Summary:
The free5GC core network software contains critical authentication and authorization flaws that could allow unauthenticated attackers to impact network availability.

Vulnerability Details

CVE-ID: CVE-2026-44328

Affected Software: free5GC free5GC

Affected Versions: < 4.2.2

Vulnerability: This vulnerability involves missing authentication (CWE-306) and authorization (CWE-862) for critical functions, alongside a NULL pointer dereference (CWE-476). The vulnerability is remotely exploitable (AV:N) by an unauthenticated attacker, potentially leading to denial-of-service or improper network control.

Business Impact

Exploitation of these flaws poses a significant risk to 5G network core integrity. An attacker could potentially crash critical network services or bypass security controls, resulting in system downtime and potential unauthorized access to network management functions. The CVSS score of 8.2 reflects the high impact on availability and the lack of required authentication.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or later and ensure the Go package github.com/free5gc/smf is updated to version 1.4.3.

Proactive Monitoring: Monitor network core logs for abnormal request patterns or service crashes that might indicate exploitation attempts.

Compensating Controls: Implement strict network ingress filtering and segmentation to restrict access to the 5G core control plane to authorized management subnets only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of authentication requirements.

Analyst Recommendation

Due to the critical nature of core network infrastructure, administrators must apply these updates immediately. Given the remote exploitability, failure to patch leaves the 5G core exposed to significant operational and security risks.

---METADATA---
VENDOR: free5GC
PRODUCT: free5GC
AFFECTED_VERSIONS: Prior to 4.2.2
---END_METADATA---

Description Summary:
The free5GC NEF component fails to enforce authentication on the OAM route group, allowing unauthenticated network attackers to access OAM-related functions.

Executive Summary:
A critical authentication bypass in the free5GC NEF component allows unauthenticated network attackers to access the OAM interface.

Vulnerability Details

CVE-ID: CVE-2026-44327

Affected Software: free5GC free5GC

Affected Versions: Prior to 4.2.2

Vulnerability: The OAM route group is mounted without any inbound OAuth2 or bearer-token middleware, exposing the interface to any attacker capable of reaching the Service-Based Architecture (SBI) network.

Business Impact

With a CVSS score of 10, this vulnerability allows for unauthenticated interaction with core network management functions. While currently a stub, the lack of an authentication boundary creates a structural defect that exposes the core network to unauthorized management operations, leading to potential denial of service or future exploitation of added OAM features.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or higher to implement mandatory authentication middleware across all OAM route groups.

Proactive Monitoring: Monitor network traffic directed at the NEF SBI interface for unauthorized connection attempts or unexpected OAM requests.

Compensating Controls: Implement strict network segmentation and mTLS (mutual TLS) at the transport layer to ensure only authorized network functions can communicate with the NEF.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security defect in a 5G core component. It is imperative that operators apply the 4.2.2 update immediately to establish a hardened authentication boundary for the OAM interface.

---METADATA---
VENDOR: Linkwarden
PRODUCT: Linkwarden
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Linkwarden allows authenticated users to make unauthorized requests to internal services via insufficient URL validation.

Executive Summary:
An SSRF vulnerability in Linkwarden allows authenticated users to probe internal network services, potentially leading to unauthorized data access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44313

Affected Software: Linkwarden Linkwarden

Affected Versions: Prior to 2.13.0

Vulnerability: The fetchTitleAndHeaders function contains an SSRF flaw due to inadequate URL validation. Authenticated users can bypass checks that only verify the "http://" or "https://" prefix to query internal, non-public services.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a significant risk to the internal network infrastructure. An attacker can leverage this SSRF to scan internal ports, interact with internal APIs, or access metadata services, potentially leading to further compromise of the internal environment.

Remediation Plan

Immediate Action: Update Linkwarden to version 2.13.0 or later to implement strict URL validation.

Proactive Monitoring: Monitor network logs for outbound requests originating from the Linkwarden server directed at internal IP ranges or sensitive internal services.

Compensating Controls: Implement network segmentation to isolate the Linkwarden instance and restrict its ability to communicate with internal, non-public resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SSRF vulnerabilities are often used as a stepping stone for deeper network penetration. Organizations should prioritize updating Linkwarden and ensuring that the host server follows the principle of least privilege regarding network access.

---METADATA---
VENDOR: Netflix
PRODUCT: Lemur
AFFECTED_VERSIONS: < 1.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netflix Lemur is vulnerable to LDAP injection, which may allow an authenticated attacker to manipulate backend queries.

Executive Summary:
Netflix Lemur versions prior to 1.9.0 contain an LDAP injection vulnerability that allows authenticated users to compromise backend data integrity.

Vulnerability Details

CVE-ID: CVE-2026-44304

Affected Software: Netflix Lemur

Affected Versions: < 1.9.0

Vulnerability: This is an LDAP Injection vulnerability (CWE-90) where the application fails to properly neutralize special elements in inputs used for LDAP queries, allowing authenticated attackers to execute unauthorized queries.

Business Impact

An attacker capable of exploiting this LDAP injection could potentially bypass access controls, extract sensitive directory information, or gain unauthorized administrative privileges within the Lemur environment. Given the 8.1 CVSS score, this vulnerability poses a severe risk to the confidentiality and integrity of certificate management operations.

Remediation Plan

Immediate Action: Update to Lemur version 1.9.0 or later to resolve the underlying input sanitization flaw.

Proactive Monitoring: Monitor LDAP query logs for unusual query patterns or syntax errors that suggest injection attempts.

Compensating Controls: Implement strict input validation and query parameterization at the application level if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit available).

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by an authenticated user with access to the affected search functions.

Analyst Recommendation

The risk of directory manipulation via LDAP injection is substantial. Users should update to version 1.9.0 immediately to ensure that LDAP queries are correctly neutralized and that the integrity of the certificate management system is maintained.

---METADATA---
VENDOR: Protobuf
PRODUCT: protobufjs-cli
AFFECTED_VERSIONS: protobufjs protobuf.js: >= 2.0.0, < 2.0.2, < 1.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in protobufjs-cli allows authenticated attackers to execute arbitrary code during the generation process.

Executive Summary:
A code injection vulnerability in protobufjs-cli (CVE-2026-44295) poses a critical risk by allowing authenticated attackers to execute arbitrary code within the host environment.

Vulnerability Details

CVE-ID: CVE-2026-44295

Affected Software: Protobuf protobufjs-cli

Affected Versions: protobufjs protobuf.js: >= 2.0.0, < 2.0.2, < 1.2.1

Vulnerability: This vulnerability is a CWE-94 (Code Injection) flaw where the command-line tool fails to properly control the generation of code. An authenticated user can influence the output, leading to the execution of unintended code, often requiring user interaction to trigger the malicious payload.

Business Impact

Successful exploitation can lead to remote code execution (RCE) on the developer or build system, potentially resulting in full system compromise, malicious code insertion into software builds, or unauthorized access to internal development environments. The CVSS score of 8.7 highlights the extreme risk to development pipelines and organizational security.

Remediation Plan

Immediate Action: Update the protobufjs-cli package to version 1.2.1 or 2.0.2 via your package manager.

Proactive Monitoring: Monitor build servers and development machines for unexpected execution processes or unauthorized changes to source code files.

Compensating Controls: Limit access to the protobufjs-cli utility to authorized users only and ensure build processes are isolated within restricted environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it directly impacts code generation, which is a critical trust point in software development.

Analyst Recommendation

Organizations utilizing protobufjs-cli must treat this as a high-priority update. Developers and build engineers should verify their dependencies and upgrade to the patched versions immediately to prevent potential supply chain attacks.

---METADATA---
VENDOR: protobufjs
PRODUCT: protobuf.js
AFFECTED_VERSIONS: < 7.5.6, >= 8.0.0, < 8.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The protobuf.js library is vulnerable to code injection when compiling protobuf definitions into JavaScript functions, potentially allowing unauthorized code execution.

Executive Summary:
A code injection vulnerability in protobuf.js allows authenticated attackers to execute arbitrary JavaScript, posing a significant risk to application integrity.

Vulnerability Details

CVE-ID: CVE-2026-44293

Affected Software: protobufjs protobuf.js

Affected Versions: < 7.5.6, >= 8.0.0, < 8.0.2

Vulnerability: The vulnerability (CWE-94) involves improper control of code generation. An attacker with low privileges can leverage this flaw to inject malicious code during the compilation of protobuf definitions.

Business Impact

Successful exploitation permits an attacker to execute arbitrary code within the context of the application, leading to potential data exfiltration or full system compromise. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could severely impact business operations and the confidentiality of sensitive data managed by the affected application.

Remediation Plan

Immediate Action: Update the protobufjs package to version 7.5.6 or 8.0.2 via your package manager (e.g., npm install protobufjs@latest).

Proactive Monitoring: Monitor application logs for unusual JavaScript execution patterns or unexpected calls to sensitive system functions originating from protobuf processing modules.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation to limit the scope of potential code injection attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a low-privilege authenticated user to trigger, but the resulting impact is severe.

Analyst Recommendation

Organizations utilizing protobuf.js must prioritize upgrading to the patched versions immediately. Given the nature of code injection, leaving this vulnerability unpatched creates a direct pathway for unauthorized system access and should be addressed in the current sprint cycle.

---METADATA---
VENDOR: protobufjs
PRODUCT: protobuf.js
AFFECTED_VERSIONS: < 7.5.6, >= 8.0.0, < 8.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The protobuf.js library contains a code injection vulnerability when compiling protobuf definitions, potentially allowing attackers to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in protobuf.js allows attackers to execute arbitrary code, presenting a significant security risk to any application utilizing this library for serialization.

Vulnerability Details

CVE-ID: CVE-2026-44291

Affected Software: protobufjs protobuf.js

Affected Versions: < 7.5.6, >= 8.0.0, < 8.0.2

Vulnerability: This vulnerability is identified as CWE-94 (Code Injection). An unauthenticated attacker can exploit the way the library compiles protobuf definitions into JavaScript functions to achieve arbitrary code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a serious threat to application security. Successful exploitation could lead to full application compromise, allowing an attacker to manipulate data, bypass security controls, or extract sensitive information processed by the library.

Remediation Plan

Immediate Action: Update the npm package protobufjs to version 7.5.6 or 8.0.2, depending on the current branch in use.

Proactive Monitoring: Monitor applications using this library for unexpected behavior or unauthorized execution of JavaScript functions during the serialization/deserialization process.

Compensating Controls: If immediate patching is not feasible, restrict the library's ability to process untrusted or externally sourced protobuf definitions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The library's core function of compiling definitions makes it a high-value target for injection attacks.

Analyst Recommendation

Security teams must prioritize updating the protobufjs dependency to the identified secure versions. Failure to patch this vulnerability leaves applications vulnerable to remote code execution, which could be leveraged to compromise the entire host environment.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiAuthenticator
AFFECTED_VERSIONS: 8.0.2, 8.0.0, 6.6.0 through 6.6.8, 6.5.0 through 6.5.6, 6.4.0 through 6.4.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper access control vulnerability in FortiAuthenticator allows unauthenticated attackers to execute unauthorized code or commands.

Executive Summary:
A critical access control flaw in Fortinet FortiAuthenticator allows unauthenticated remote code execution, posing a severe threat to internal network security.

Vulnerability Details

CVE-ID: CVE-2026-44277

Affected Software: Fortinet FortiAuthenticator

Affected Versions: 8.0.2, 8.0.0, 6.6.0 through 6.6.8, 6.5.0 through 6.5.6, 6.4.0 through 6.4.10

Vulnerability: The vulnerability involves improper access control (CWE-284) that allows an unauthenticated remote attacker (per CVSS vector PR:N) to execute arbitrary code or commands on the underlying system.

Business Impact

The potential for unauthenticated remote code execution makes this a critical risk, as it allows attackers to gain full control over the appliance. Given the CVSS score of 9.8, this could lead to total compromise of identity and authentication services, enabling lateral movement throughout the organization and severe data theft.

Remediation Plan

Immediate Action: Upgrade to FortiAuthenticator version 8.0.3, 8.0.1, 6.6.9, 6.5.7, 6.4.11, or 6.3.5 immediately.

Proactive Monitoring: Monitor system logs for unauthorized administrative logins or unexpected process execution patterns originating from the FortiAuthenticator appliance.

Compensating Controls: Restrict management interface access to trusted IP addresses using firewall rules to limit the exposure of the vulnerable service to untrusted networks.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists on GitHub, and the vulnerability is highly automatable, making the risk of near-term exploitation significant.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability and the availability of public proof-of-concept code, this issue represents a high-priority risk. Administrators must prioritize patching these appliances immediately to prevent potential remote system compromise.

---METADATA---
VENDOR: Dell
PRODUCT: Wyse Management Suite (WMS)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Dell Wyse Management Suite (WMS) is susceptible to an improper link resolution vulnerability, potentially leading to unauthorized file access.

Executive Summary:
An improper link resolution vulnerability in Dell Wyse Management Suite (WMS) could allow attackers to gain unauthorized access to sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44274

Affected Software: Dell Wyse Management Suite (WMS)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application suffers from an improper link resolution (Time-of-Check Time-of-Use) vulnerability before file access, which can be leveraged to read or manipulate files outside the intended scope. This flaw typically requires access to the application environment to exploit.

Business Impact

Successful exploitation could result in the disclosure of sensitive configuration files, credentials, or system data, significantly compromising the security posture of the management server. The CVSS score of 7.8 underscores the high risk of this vulnerability, as it allows attackers to bypass file system permissions and gain deeper insights into the underlying infrastructure.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Dell, specifically ensuring the system is updated to at least version 2605.

Proactive Monitoring: Monitor system logs for unauthorized file access attempts or anomalous process activity associated with the WMS service account.

Compensating Controls: Restrict access to the WMS server to only necessary administrative personnel and ensure the application runs with the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

File access vulnerabilities in management suites are frequently targeted for lateral movement and privilege escalation. Security teams should prioritize patching this vulnerability to mitigate the risk of unauthorized file disclosure and maintain the integrity of their Dell WMS deployments.

---METADATA---
VENDOR: Dell
PRODUCT: Wyse Management Suite (WMS)
AFFECTED_VERSIONS: Versions prior to WMS 2605
---END_METADATA---

Description Summary:
Dell Wyse Management Suite (WMS) is vulnerable to SQL injection, potentially allowing unauthenticated or authenticated attackers to execute arbitrary database commands.

Executive Summary:
A critical SQL injection vulnerability in Dell Wyse Management Suite (WMS) allows for potential remote code execution or unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-44272

Affected Software: Dell Wyse Management Suite (WMS)

Affected Versions: Versions prior to WMS 2605

Vulnerability: This is an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability. This flaw allows attackers to inject malicious SQL queries into the database, which could lead to full database compromise.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as High/Critical. An attacker successfully exploiting this flaw could gain full control over the WMS database, leading to the compromise of managed thin clients, exposure of sensitive configuration data, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to Dell Wyse Management Suite version 2605 or later immediately.

Proactive Monitoring: Enable database query logging and monitor for anomalous or highly complex SQL queries that deviate from standard application behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the WMS web interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The 8.8 CVSS score necessitates immediate attention. Organizations running Dell Wyse Management Suite should verify their current version and upgrade to 2605 or higher without delay. This vulnerability represents a significant entry point for attackers to gain persistence within the environment.

---METADATA---
VENDOR: Dell
PRODUCT: Wyse Management Suite (WMS)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Dell Wyse Management Suite (WMS) contains an SQL injection vulnerability allowing unauthorized database interaction.

Executive Summary:
A high-severity SQL injection vulnerability in Dell Wyse Management Suite (WMS) poses a significant risk of unauthorized database manipulation and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-44271

Affected Software: Dell Wyse Management Suite (WMS)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves improper neutralization of special elements in SQL commands, which may allow an attacker to execute arbitrary SQL queries. While the authentication requirement is not explicitly detailed, SQL injection flaws in management suites often permit unauthenticated or low-privileged attackers to bypass security controls.

Business Impact

The exploitation of this flaw could lead to unauthorized access to sensitive management data, potential modification of device configurations, or full compromise of the backend database. With a CVSS score of 8.1, this represents a high risk to organizational confidentiality and integrity, potentially resulting in widespread disruption to managed endpoint environments.

Remediation Plan

Immediate Action: Upgrade to WMS version 2605 or the latest available security release provided by Dell.

Proactive Monitoring: Review database query logs for unusual patterns, such as unexpected syntax or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious traffic directed at the WMS interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of centralized management software, this vulnerability must be treated with urgency. Administrators should prioritize patching the Wyse Management Suite immediately to prevent potential unauthorized database access and ensure the continued security of the managed endpoint ecosystem.

---METADATA---
VENDOR: Scramble
PRODUCT: Scramble
AFFECTED_VERSIONS: 0.13.2 to 0.13.22 (exclusive)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Scramble API documentation generator for Laravel is vulnerable to remote code execution when validation rules process user-supplied data during documentation generation.

Executive Summary:
A critical remote code execution vulnerability in the Scramble package for Laravel allows unauthenticated attackers to execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-44262

Affected Software: Scramble (Laravel package)

Affected Versions: 0.13.2 through 0.13.21

Vulnerability: This is an arbitrary code execution vulnerability occurring during the automated generation of API documentation. An unauthenticated attacker can trigger this by providing malicious input to validation rules that the documentation generator then evaluates within the application context.

Business Impact

Successful exploitation results in full server compromise, as the attacker gains the ability to execute arbitrary PHP code with the privileges of the web application. Given the CVSS score of 9.4, this poses an extreme risk of data exfiltration, service disruption, and complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade the Scramble package to version 0.13.22 or higher immediately.

Proactive Monitoring: Review web application logs for suspicious input patterns or unexpected execution errors originating from documentation routes.

Compensating Controls: Restrict access to API documentation endpoints to authorized internal IP addresses using firewall rules or web server access controls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical threat to the confidentiality and integrity of the hosting environment. Organizations utilizing Scramble within Laravel projects must prioritize patching to version 0.13.22 to eliminate the risk of remote code execution.