---METADATA---
VENDOR: efwGrp
PRODUCT: efw4
AFFECTED_VERSIONS: < 4.08.010
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The efw4 application contains an incorrect authorization vulnerability that allows authenticated users to access or modify data they are not authorized to view.

Executive Summary:
An incorrect authorization flaw in efwGrp efw4 allows authenticated attackers to bypass security controls, posing a significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-44260

Affected Software: efwGrp efw4

Affected Versions: < 4.08.010

Vulnerability: This vulnerability is an instance of CWE-863 (Incorrect Authorization). It permits an authenticated user with low-level privileges to perform unauthorized actions, as the application fails to properly validate the user's permissions during specific request processing.

Business Impact

The vulnerability carries a CVSS score of 8.1 (High), reflecting the potential for unauthorized access to sensitive information or unauthorized modification of system data. Successful exploitation could lead to significant data breaches or integrity compromises within the affected environment, potentially resulting in regulatory non-compliance and loss of stakeholder trust.

Remediation Plan

Immediate Action: Update the efw4 installation to version 4.08.010 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review application access logs for unusual patterns of administrative actions or unauthorized requests originating from standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) policies and utilize a Web Application Firewall (WAF) to filter suspicious requests that attempt to access unauthorized endpoints.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit exists in curated sources).

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its direct impact on authorization logic, which is often a target for privilege escalation.

Analyst Recommendation

Given the High severity rating and the existence of a proof-of-concept, organizations should prioritize patching this vulnerability. Apply the version 4.08.010 update as soon as possible to neutralize the risk of unauthorized data access and ensure robust authorization enforcement.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Netty network application framework, potentially leading to unauthorized access or service disruption.

Executive Summary:
A high-severity vulnerability in the Netty network application framework necessitates immediate patching to prevent potential unauthorized access or service degradation.

Vulnerability Details

CVE-ID: CVE-2026-44250

Affected Software: Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a framework-level vulnerability in Netty, commonly used for high-performance protocol servers and clients. The flaw could be leveraged by an attacker to manipulate network traffic or compromise server-side operations depending on the specific implementation.

Business Impact

Given the CVSS score of 7.5, this vulnerability poses a significant risk to applications built on the Netty framework. Compromise of the network layer can lead to unauthorized access to sensitive data, session hijacking, or service-wide outages, significantly impacting business continuity and data security.

Remediation Plan

Immediate Action: Update all instances of the Netty framework to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor application logs for unusual connection requests or unexpected protocol errors that may indicate exploitation attempts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter malicious traffic patterns and provide a layer of virtual patching against common protocol-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Netty is a foundational component for many critical applications. It is imperative that security and development teams collaborate to identify all dependencies, upgrade to the secure version, and perform regression testing to ensure that security measures do not break existing functionality.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been reported in the Netty network application framework, which is used for developing protocol servers and clients.

Executive Summary:
The Netty network application framework is affected by a high-severity vulnerability that could compromise the security of protocol servers and clients.

Vulnerability Details

CVE-ID: CVE-2026-44249

Affected Software: Netty

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability affects the Netty framework, which is widely used for high-performance network communication. Users should refer to the official vendor security advisory for technical specifics regarding the exploit vector and authentication requirements.

Business Impact

Given the CVSS score of 8.1, successful exploitation could lead to severe security breaches, including unauthorized data access or remote code execution within applications leveraging the Netty framework. This poses a critical risk to the availability and confidentiality of networked services.

Remediation Plan

Immediate Action: Verify the version of Netty currently in use across all applications and update to the latest secure release provided by the vendor.

Proactive Monitoring: Monitor network traffic for anomalous patterns or unexpected protocol behaviors that might indicate an attempt to exploit the framework.

Compensating Controls: Utilize a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter malicious traffic targeting known protocol vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the widespread use of Netty, the potential for exploitation is high.

Analyst Recommendation

Security teams must immediately audit their software supply chain to identify applications utilizing the vulnerable Netty framework. Applying the vendor's patch is the only reliable method to mitigate this high-severity risk and prevent potential exploitation.

---METADATA---
VENDOR: Sangoma
PRODUCT: FreePBX
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in FreePBX, an open-source IP PBX platform, regarding file-based operations.

Executive Summary:
A high-severity vulnerability in the FreePBX platform may allow attackers to compromise system security, necessitating immediate attention from administrators.

Vulnerability Details

CVE-ID: CVE-2026-44239

Affected Software: Sangoma FreePBX

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability concerns file-based operations within the FreePBX environment. Further technical details regarding the authentication level required are pending, but the high CVSS score suggests a significant flaw in how the system handles file interactions.

Business Impact

The CVSS score of 8.8 indicates a high-risk scenario. Successful exploitation could lead to unauthorized file manipulation or system-level access, potentially disrupting telecommunications services and exposing sensitive configuration data.

Remediation Plan

Immediate Action: Update the FreePBX system to the latest stable release provided by Sangoma.

Proactive Monitoring: Monitor file integrity and access logs for unauthorized changes to system configuration files or unexpected administrative actions.

Compensating Controls: Ensure that the PBX interface is not exposed to the public internet and restrict access to authorized management networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with urgency. Review the Sangoma security portal for specific version requirements and apply patches immediately to prevent unauthorized access to your PBX infrastructure.

---METADATA---
VENDOR: Sangoma
PRODUCT: FreePBX
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the FreePBX open-source IP PBX system.

Executive Summary:
The FreePBX system is affected by a high-severity vulnerability that could threaten the integrity of communication infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-44238

Affected Software: FreePBX

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the FreePBX system, potentially allowing unauthorized actions within the PBX management or telephony interfaces.

Business Impact

The CVSS score of 8.8 indicates a high risk to business communications. Successful exploitation could lead to unauthorized call routing, eavesdropping, or disruption of communication services, which could severely impact organizational operations.

Remediation Plan

Immediate Action: Check the FreePBX official security advisories and apply any available updates or patches to the PBX software.

Proactive Monitoring: Monitor PBX logs for unusual administrative access, unauthorized configuration changes, or suspicious call traffic.

Compensating Controls: Restrict administrative access to the FreePBX web interface to trusted IP addresses only and ensure the system is behind a robust firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of IP PBX systems, it is vital to keep FreePBX software updated. Security teams should prioritize this update to ensure the continued security and availability of voice communication services.

---METADATA---
VENDOR: enesgkky
PRODUCT: Pulpy
AFFECTED_VERSIONS: < 0.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Pulpy desktop application packager contains an incomplete path blocklist in its filesystem API, allowing packaged web applications to access sensitive files in the user's home directory.

Executive Summary:
A critical path traversal vulnerability in Pulpy allows packaged web applications to read and write sensitive user files, including SSH keys and cloud credentials.

Vulnerability Details

CVE-ID: CVE-2026-44225

Affected Software: enesgkky Pulpy

Affected Versions: < 0.1.1

Vulnerability: This is an improper access control and path traversal vulnerability where the validateFsPath() function fails to properly sandbox the pulpy.fs JavaScript API. An attacker-controlled web application can bypass the blocklist to access restricted files such as ~/.ssh/id_rsa or ~/.aws/credentials.

Business Impact

Exploitation allows for the theft of credentials, cryptographic keys, and sensitive local data, leading to a total compromise of the user's local workstation and potential lateral movement into cloud environments. The high CVSS score of 9.3 reflects the severity of this unauthorized access to highly sensitive system files.

Remediation Plan

Immediate Action: Update all applications packaged with Pulpy to version 0.1.1 or later and rebuild the application bundles.

Proactive Monitoring: Scan for unauthorized file access attempts or anomalous read/write activity on sensitive system configuration files.

Compensating Controls: Implement endpoint protection solutions to monitor and block unauthorized processes from accessing sensitive directories like ~/.ssh or ~/.aws.

Exploitation Status

Public Exploit Available: Yes (Proof of Concept)

Analyst Notes: As of May 12, 2026, while there is no public information indicating widespread active exploitation, a proof-of-concept exists. The potential for exploitation is high.

Analyst Recommendation

The risk of credential theft via this vulnerability is significant for developers and users of applications packaged with Pulpy. It is imperative to update the packager and redistribute affected software immediately to prevent local data compromise.

---METADATA---
VENDOR: ArcadeDB
PRODUCT: ArcadeDB
AFFECTED_VERSIONS: Prior to 2.6.4
---END_METADATA---

Description Summary:
Authorization bypass flaws in ArcadeDB allow authenticated users to access, modify, or corrupt data and schemas across different databases on the same server.

Executive Summary:
An authorization bypass vulnerability in ArcadeDB allows authenticated users to perform unauthorized actions across multiple databases, compromising data isolation.

Vulnerability Details

CVE-ID: CVE-2026-44221

Affected Software: ArcadeDB ArcadeDB

Affected Versions: Prior to 2.6.4

Vulnerability: This vulnerability consists of two defects: failure to initialize file access maps and improper security configuration during database creation. These issues allow an authenticated principal to bypass both record-level and database-level authorization.

Business Impact

Successful exploitation allows an authenticated user to perform unauthorized read, write, and schema mutations on any database residing on the affected server. Given the 9.0 CVSS score, this represents a major risk to data integrity and multi-tenant isolation, potentially resulting in cross-database data leakage or catastrophic system-wide database corruption.

Remediation Plan

Immediate Action: Upgrade all instances of ArcadeDB to version 2.6.4 or later immediately.

Proactive Monitoring: Audit database access logs for unusual cross-database queries or unauthorized attempts to modify database schemas.

Compensating Controls: Enforce strict database-level access controls and review API token permissions to ensure the principle of least privilege is maintained.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability fundamentally breaks the security model of the database server. Administrators must ensure all instances are updated to version 2.6.4 to restore proper authorization enforcement and prevent potential unauthorized data manipulation by authenticated entities.

---METADATA---
VENDOR: PrestaShop
PRODUCT: PrestaShop
AFFECTED_VERSIONS: Prior to 8.2.6 and 9.1.1
---END_METADATA---

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in PrestaShop allows unauthenticated attackers to trigger a back-office takeover via the Contact Us form.

Executive Summary:
A critical stored XSS vulnerability in the PrestaShop back-office allows unauthenticated attackers to hijack administrative sessions and gain full control over the application.

Vulnerability Details

CVE-ID: CVE-2026-44212

Affected Software: PrestaShop

Affected Versions: Prior to 8.2.6 and 9.1.1

Vulnerability: The vulnerability exists in the Customer Service view of the back-office. An unauthenticated attacker can submit a malicious payload via the public Contact Us form, which is then stored and executed when an administrator views the ticket.

Business Impact

This flaw facilitates a full back-office takeover, granting the attacker total control over the e-commerce environment. Given the CVSS score of 9.3, this represents a severe threat to the integrity of the store, allowing for unauthorized modifications to product listings, customer data theft, and potential malware distribution.

Remediation Plan

Immediate Action: Apply the security update to PrestaShop version 8.2.6 or 9.1.1 immediately.

Proactive Monitoring: Audit back-office customer service threads for suspicious email addresses or script tags.

Compensating Controls: Utilize a WAF to inspect incoming form submissions for malicious JavaScript payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrative takeover vulnerabilities are high-priority targets. It is essential to update the PrestaShop environment to the latest patched version to prevent unauthorized access and maintain the security of your e-commerce operations.

---METADATA---
VENDOR: smp46
PRODUCT: Pingvin Share X
AFFECTED_VERSIONS: >= 1.14.1, < 1.16.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pingvin Share X contains an authentication bypass flaw that allows users who possess a valid password to skip the TOTP second-factor authentication requirement.

Executive Summary:
A critical authentication bypass vulnerability in Pingvin Share X allows an attacker with a valid password to circumvent secondary multi-factor authentication requirements.

Vulnerability Details

CVE-ID: CVE-2026-44196

Affected Software: smp46 Pingvin Share X

Affected Versions: 1.14.1 through 1.16.2

Vulnerability: This is an improper authentication flaw caused by an incorrect comparison in the TOTP verification process. An attacker who has already obtained a legitimate user's password can bypass the second-factor authentication layer, effectively nullifying the security benefits of MFA.

Business Impact

By bypassing MFA, an attacker with compromised credentials gains full access to the file-sharing platform, leading to unauthorized data access and potential data leakage. With a CVSS score of 9.1, this vulnerability significantly undermines the security posture of the platform by rendering multi-factor authentication ineffective.

Remediation Plan

Immediate Action: Update the Pingvin Share X installation to version 1.16.3 or later.

Proactive Monitoring: Review authentication logs for suspicious logins, particularly those that occur without the expected MFA challenges.

Compensating Controls: If immediate patching is not feasible, restrict access to the application via a VPN or IP allow-listing to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Securing the authentication flow is vital for maintaining the confidentiality of shared files. Administrators must upgrade to version 1.16.3 immediately to restore the integrity of the multi-factor authentication process.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform 2
AFFECTED_VERSIONS: Visual Studio Code Ansible Lightspeed extension
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Visual Studio Code Ansible Lightspeed extension is vulnerable to OS command injection via improper neutralization of special elements in configuration settings.

Executive Summary:
A command injection vulnerability in the VS Code Ansible Lightspeed extension allows arbitrary command execution with the privileges of the local user.

Vulnerability Details

CVE-ID: CVE-2026-44191

Affected Software: Red Hat Ansible Automation Platform 2 (Visual Studio Code Ansible Lightspeed extension)

Affected Versions: Visual Studio Code Ansible Lightspeed extension.

Vulnerability: This is an OS command injection flaw (CWE-78) occurring in the handling of extension configuration settings. Attackers can inject shell commands via specific extension parameters, which may execute automatically during initialization or when running playbooks.

Business Impact

The vulnerability carries a CVSS 3.1 score of 7.8, representing a high-severity risk. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running Visual Studio Code. This can lead to local system compromise, data theft, or the execution of malicious automation routines within the development environment.

Remediation Plan

Immediate Action: Immediately uninstall or disable the Visual Studio Code Ansible Lightspeed extension. Exercise extreme caution by avoiding the opening of untrusted workspaces or executing playbooks from unverified sources.

Proactive Monitoring: Review workstation logs for unexpected shell executions or child processes spawned by the Visual Studio Code application.

Compensating Controls: Audit and sanitize configuration values for ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts if the extension must be utilized in a restricted capacity.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit available in current data).

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for automated execution during the initialization of the Language Server.

Analyst Recommendation

Users should prioritize the removal or disabling of the vulnerable extension until a verified fix is provided by the vendor. Maintain strict operational security regarding the source of all Ansible playbooks and workspace configurations to prevent potential injection attempts.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Ansible Lightspeed Visual Studio Code extension allows for OS command injection.

Executive Summary:
A vulnerability in the Red Hat Ansible Lightspeed extension for Visual Studio Code could enable an attacker to execute arbitrary OS commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44190

Affected Software: Red Hat Ansible Automation Platform

Affected Versions: See vendor advisory

Vulnerability: This is an OS command injection vulnerability (CWE-78) found in the Ansible Lightspeed extension. The vulnerability requires user interaction to exploit and executes with the privileges of the local user.

Business Impact

The ability to inject OS commands presents a high risk to organizational security, as it facilitates unauthorized code execution on developer machines. With a CVSS score of 7.8, this vulnerability poses a severe threat to the integrity and confidentiality of the development environment, potentially allowing attackers to escalate their presence within the network or exfiltrate proprietary data.

Remediation Plan

Immediate Action: Promptly apply all security updates provided by Red Hat for the Ansible Lightspeed extension.

Proactive Monitoring: Audit logs for suspicious or unauthorized process creation and unexpected command-line arguments originating from the Visual Studio Code host process.

Compensating Controls: Implement endpoint protection solutions that can detect and block unauthorized shell commands or suspicious script execution on developer endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is mitigated by the necessity for user interaction to trigger the injection.

Analyst Recommendation

Security teams must ensure that all developer environments are updated to the latest version of the Ansible Lightspeed extension to address this command injection flaw. Given the high-severity classification, this update should be treated as a priority to prevent potential compromise of developer infrastructure.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Visual Studio Code Ansible Lightspeed extension allows for argument injection via the AnsiblePlaybookRunProvider.

Executive Summary:
A vulnerability in the Red Hat Ansible Automation Platform extension for Visual Studio Code may allow an attacker to perform argument injection, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44189

Affected Software: Red Hat Ansible Automation Platform

Affected Versions: See vendor advisory

Vulnerability: This is an argument injection vulnerability (CWE-88) occurring within the AnsiblePlaybookRunProvider. The vulnerability requires user interaction to trigger, and the attacker operates with the privileges of the local user running the extension.

Business Impact

Successful exploitation of this vulnerability could lead to arbitrary command execution on the developer's workstation. Given the CVSS score of 7.8, this represents a high-risk scenario where an attacker could gain unauthorized access to sensitive development environments, credentials, or source code, potentially resulting in significant data loss or lateral movement within the corporate network.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory and apply all provided updates for the Ansible Lightspeed extension immediately.

Proactive Monitoring: Monitor developer workstations for anomalous process execution patterns or unexpected shell commands initiated by the Visual Studio Code environment.

Compensating Controls: Ensure that developers follow the principle of least privilege by running development tools with the minimum necessary permissions to limit the impact of potential command injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is constrained by the requirement for user interaction.

Analyst Recommendation

Organizations utilizing the Ansible Lightspeed extension should prioritize the identification of affected instances and apply vendor patches as soon as they become available. Given the potential for total impact on the affected system, immediate attention is required to mitigate this high-severity risk.

---METADATA---
VENDOR: Cleanuparr
PRODUCT: Cleanuparr
AFFECTED_VERSIONS: < 2.9.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Cleanuparr allows unauthenticated remote attackers to gain administrative access via X-Forwarded-For header spoofing.

Executive Summary:
Cleanuparr versions prior to 2.9.10 are vulnerable to an authentication bypass flaw that allows unauthenticated attackers to gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-44183

Affected Software: Cleanuparr Cleanuparr

Affected Versions: < 2.9.10

Vulnerability: The application incorrectly trusts the leftmost entry of the X-Forwarded-For HTTP header to determine the client IP address. An unauthenticated attacker can spoof a trusted local network IP to bypass authentication checks and assume administrator privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker full administrative access to the Cleanuparr instance. Given the CVSS score of 9.8, this poses a critical risk, enabling unauthorized configuration changes, file manipulation, and potential compromise of the underlying host environment.

Remediation Plan

Immediate Action: Upgrade to Cleanuparr version 2.9.10 or later immediately to apply the fix for the authentication logic.

Proactive Monitoring: Review web server and application access logs for suspicious X-Forwarded-For header values or anomalous administrative login patterns from unexpected IP ranges.

Compensating Controls: Implement a Web Application Firewall (WAF) to sanitize or strip X-Forwarded-For headers if the application is exposed to untrusted networks.

Exploitation Status

Public Exploit Available: Not explicitly stated (PoC exists per SSVC)

Analyst Notes: As of May 12, 2026, while there is no information regarding widespread active exploitation in the wild, a Proof-of-Concept is available. The ease of exploitation and the critical nature of the impact necessitate immediate patching.

Analyst Recommendation

This vulnerability represents a critical security failure in access control. Administrators must prioritize updating to version 2.9.10 to prevent unauthorized administrative access. Organizations should also audit their network architecture to ensure that only trusted proxies are permitted to set the X-Forwarded-For header.

---METADATA---
VENDOR: jupyter-server
PRODUCT: Enterprise Gateway
AFFECTED_VERSIONS: < 3.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A YAML injection vulnerability in Jupyter Enterprise Gateway allows attackers to inject malicious fields into Kubernetes manifests, potentially leading to unauthorized privilege escalation.

Executive Summary:
A critical YAML injection vulnerability in Jupyter Enterprise Gateway allows attackers to manipulate Kubernetes manifests, potentially enabling the creation of unauthorized or privileged container resources.

Vulnerability Details

CVE-ID: CVE-2026-44182

Affected Software: jupyter-server Enterprise Gateway

Affected Versions: < 3.3.0

Vulnerability: The software fails to properly sanitize environment variables before interpolating them into Kubernetes YAML manifests. This allows an attacker to inject arbitrary YAML structures, including document boundaries or privileged security contexts, which the Kubernetes cluster may then process.

Business Impact

Successful exploitation can lead to a total compromise of the Kubernetes cluster by allowing the deployment of malicious or overly privileged pods. Given the CVSS score of 10.0, this represents the highest level of risk, capable of impacting the entire containerized environment.

Remediation Plan

Immediate Action: Update Jupyter Enterprise Gateway to version 3.3.0 or later to implement proper YAML-aware escaping for all template variables.

Proactive Monitoring: Review Kubernetes audit logs for the creation of unexpected resources or pods with elevated security contexts. Monitor for anomalous environment variable definitions.

Compensating Controls: Utilize Kubernetes Admission Controllers to enforce security policies that prevent the deployment of pods with privileged escalation or unauthorized configurations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly concerning due to the potential for automated resource manipulation within a distributed cluster environment.

Analyst Recommendation

Given the perfect CVSS score, this vulnerability must be treated as an emergency. Immediate patching of the Enterprise Gateway is required to prevent potential cluster-wide compromise.

---METADATA---
VENDOR: jupyter-server
PRODUCT: enterprise_gateway
AFFECTED_VERSIONS: >= 2.0.0rc2, < 3.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Jupyter Enterprise Gateway is vulnerable to Server Side Template Injection (SSTI), allowing unauthenticated attackers to execute arbitrary code and gain control over the Kubernetes cluster.

Executive Summary:
A critical Server Side Template Injection vulnerability in Jupyter Enterprise Gateway permits unauthenticated remote code execution and potential full compromise of the underlying Kubernetes cluster.

Vulnerability Details

CVE-ID: CVE-2026-44181

Affected Software: jupyter-server enterprise_gateway

Affected Versions: >= 2.0.0rc2, < 3.3.0

Vulnerability: The application is vulnerable to SSTI through environment variables used during the rendering of Kubernetes manifests. By injecting Jinja2 template expressions, an attacker can execute arbitrary Python code and OS commands, potentially stealing Kubernetes service account tokens to escalate privileges further.

Business Impact

This vulnerability allows an attacker to achieve full remote code execution within the Enterprise Gateway service. By stealing Kubernetes secrets and service account tokens, an attacker can move laterally to compromise the entire Kubernetes cluster, including the deployment of privileged pods or hostPath volume mounts. With a CVSS score of 10.0, this represents the highest level of security risk.

Remediation Plan

Immediate Action: Upgrade Jupyter Enterprise Gateway to version 3.3.0 or higher. Verify that all containerized instances are running the updated image.

Proactive Monitoring: Inspect Kubernetes audit logs for suspicious pod creation or modification activities. Monitor for anomalous processes executing within the Enterprise Gateway service containers.

Compensating Controls: Implement strict Kubernetes RBAC policies to limit the permissions of the service account used by the Enterprise Gateway. Use network policies to isolate the gateway from sensitive internal cluster services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of SSTI in a containerized environment makes this a highly dangerous vector for cluster-wide compromise.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full cluster takeover, immediate patching is required. Organizations should treat this as a top-tier security emergency and verify that all affected Jupyter Enterprise Gateway instances are updated to version 3.3.0 without delay.

---METADATA---
VENDOR: jupyter-server
PRODUCT: enterprise_gateway
AFFECTED_VERSIONS: >= 2.0.0rc1, < 3.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Jupyter Enterprise Gateway is vulnerable to an input validation bypass that allows kernels to run as root, potentially leading to container escapes and full cluster compromise.

Executive Summary:
A critical input validation vulnerability in Jupyter Enterprise Gateway allows attackers to bypass root restrictions, enabling container escapes and unauthorized access to underlying worker nodes.

Vulnerability Details

CVE-ID: CVE-2026-44180

Affected Software: jupyter-server enterprise_gateway

Affected Versions: >= 2.0.0rc1, < 3.3.0

Vulnerability: The application fails to properly enforce UID and GID restrictions for remote kernels. An unauthenticated attacker can submit a crafted KERNEL_UID or KERNEL_GID value to bypass security checks, executing kernels with root permissions within the host environment.

Business Impact

Successful exploitation allows an attacker to break out of the containerized environment, gaining code execution on the underlying worker node. This can lead to the compromise of the entire Kubernetes cluster and all workloads running within it. With a CVSS score of 9.8, this flaw represents an extreme risk to cloud infrastructure security and sensitive data access.

Remediation Plan

Immediate Action: Upgrade Jupyter Enterprise Gateway to version 3.3.0 or later to ensure root restriction logic is correctly enforced.

Proactive Monitoring: Monitor cluster logs for unusual kernel execution patterns or unexpected root-level processes originating from Jupyter containers.

Compensating Controls: Implement strict Pod Security Policies or Admission Controllers to prevent containers from running as root, even if the application logic is bypassed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack is low, and the potential for lateral movement within a cluster makes this a high-priority security concern.

Analyst Recommendation

Infrastructure teams must treat this vulnerability with the highest priority. Upgrading to version 3.3.0 is essential to prevent container breakout scenarios that could jeopardize the entire cluster environment.

---METADATA---
VENDOR: neutrinolabs
PRODUCT: xrdp
AFFECTED_VERSIONS: < 0.10.6.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability in the neutrinolabs xrdp RDP server allows authenticated attackers to potentially execute arbitrary code or cause a crash.

Executive Summary:
A high-severity heap-based buffer overflow in the xrdp RDP server allows authenticated attackers to execute arbitrary code or cause service instability.

Vulnerability Details

CVE-ID: CVE-2026-44178

Affected Software: neutrinolabs xrdp

Affected Versions: < 0.10.6.1

Vulnerability: This is a heap-based buffer overflow (CWE-122) within the xrdp server component. An authenticated attacker can exploit this flaw to corrupt memory, potentially leading to remote code execution or a denial of service condition.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to remote access infrastructure. Successful exploitation could grant an attacker full control over the RDP server, facilitating lateral movement within the network or the exfiltration of sensitive data from the host system.

Remediation Plan

Immediate Action: Update the xrdp server to version 0.10.6.1 or later immediately to patch the memory safety issue.

Proactive Monitoring: Monitor RDP server logs for abnormal connection patterns, repeated crashes, or unauthorized attempts to interact with the service.

Compensating Controls: Restrict access to RDP services to trusted networks or VPNs only, and utilize multi-factor authentication to reduce the likelihood of an attacker gaining the required authenticated access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The fix is available via commit 80c52879fead585d6347df5b3c587718adf8f5a5.

Analyst Recommendation

Given that RDP is a common target for attackers, patching this heap-based overflow is critical. Administrators should verify their current version and upgrade to 0.10.6.1 without delay to protect against potential exploitation of the RDP service.

---METADATA---
VENDOR: getkirby
PRODUCT: kirby
AFFECTED_VERSIONS: >= 5.3.0, < 5.4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Kirby CMS is vulnerable to path traversal and remote file inclusion, allowing unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Executive Summary:
A critical path traversal and remote file inclusion vulnerability in Kirby CMS allows unauthenticated attackers to potentially compromise the application.

Vulnerability Details

CVE-ID: CVE-2026-44177

Affected Software: getkirby kirby

Affected Versions: >= 5.3.0, < 5.4.1

Vulnerability: The application is susceptible to both path traversal (CWE-22) and improper control of filenames for include statements (CWE-98). This allows an unauthenticated attacker to manipulate file paths, potentially leading to the inclusion of arbitrary files or remote code execution.

Business Impact

This vulnerability poses a severe risk to the business, as it allows unauthenticated attackers to bypass security boundaries. Successful exploitation could result in the disclosure of sensitive source code, configuration data, or total system compromise via remote file inclusion. The High CVSS score of 8.8 reflects the ease of exploitation and the potential for a total loss of application integrity.

Remediation Plan

Immediate Action: Immediately update to Kirby version 5.4.1 or later to mitigate these vulnerabilities.

Proactive Monitoring: Monitor web server logs for suspicious requests involving file inclusion attempts or directory traversal markers.

Compensating Controls: Implement WAF rules to filter out malicious path traversal sequences and restrict the web user's ability to execute files outside of designated, secure directories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability and the high risk of remote code execution, patching to version 5.4.1 is mandatory. Administrators should perform this update immediately to prevent potential exploitation of the CMS.

---METADATA---
VENDOR: getkirby
PRODUCT: kirby
AFFECTED_VERSIONS: < 4.9.1, >= 5.0.0, < 5.4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-site Scripting vulnerability in the Kirby CMS allows authenticated attackers with low privileges to execute malicious scripts.

Executive Summary:
Kirby CMS contains a Cross-site Scripting vulnerability that permits authenticated attackers to compromise user sessions or sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-44175

Affected Software: getkirby kirby

Affected Versions: < 4.9.1, >= 5.0.0, < 5.4.1

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability where improper input neutralization allows for the injection of scripts. The attack requires an authenticated user with low privileges and relies on user interaction to execute the payload.

Business Impact

Successful exploitation can result in the theft of administrative session cookies, unauthorized modification of web content, or the redirection of users to malicious sites. With a CVSS score of 8.5, this vulnerability represents a high risk to user data confidentiality and the overall integrity of the content management platform.

Remediation Plan

Immediate Action: Update the Kirby CMS installation to version 4.9.1 or 5.4.1, depending on the currently deployed major release branch.

Proactive Monitoring: Monitor site traffic for unusual redirect patterns or the presence of unexpected script tags within user-generated content or administrative dashboards.

Compensating Controls: Deploy a Web Application Firewall with robust XSS filtering rules to inspect and sanitize incoming requests for malicious script injection attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full session compromise of administrative accounts.

Analyst Recommendation

Administrators should verify their current version of Kirby and apply the relevant security update immediately. Given the high impact of XSS on CMS platforms, patching is the only reliable method to eliminate the injection vector.

---METADATA---
VENDOR: GetKirby
PRODUCT: Kirby
AFFECTED_VERSIONS: < 4.9.1, >= 5.0.0, < 5.4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Kirby content management system is vulnerable to unsafe reflection, allowing authenticated users to trigger unintended code execution or select arbitrary classes.

Executive Summary:
An unsafe reflection vulnerability in the Kirby content management system allows authenticated users to potentially execute arbitrary code, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-44174

Affected Software: GetKirby Kirby

Affected Versions: < 4.9.1 and 5.0.0 through 5.4.0

Vulnerability: This vulnerability involves the use of externally controlled input to select classes or code, known as unsafe reflection (CWE-470). It requires the attacker to be authenticated to the Kirby administration interface to trigger the flaw.

Business Impact

The CVSS score of 8.7 highlights the severity of this issue. An attacker with administrative or user-level access could leverage this flaw to gain unauthorized code execution on the server, leading to complete site takeover, data exfiltration, or defacement, which directly threatens business continuity and brand reputation.

Remediation Plan

Immediate Action: Upgrade to Kirby version 4.9.1 or 5.4.1 immediately to resolve the unsafe reflection vulnerability.

Proactive Monitoring: Monitor site activity logs for anomalous requests to administrative endpoints or unexpected server-side errors that may indicate exploitation attempts.

Compensating Controls: Restrict access to the Kirby administration panel to known, trusted IP addresses and implement a WAF to inspect incoming traffic for malicious input patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently critical because it allows for code execution, which is a common vector for persistent site compromise.

Analyst Recommendation

Administrators must treat this as a high-priority update. Upgrading to the patched versions is the only reliable way to prevent potential remote code execution via the reflection flaw, and this should be performed during the next maintenance window or immediately for high-exposure environments.

---METADATA---
VENDOR: MariaDB
PRODUCT: Server
AFFECTED_VERSIONS: MariaDB server versions 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, and 12.3.1
---END_METADATA---

Description Summary:
Unsafe parameter handling during State Snapshot Transfer (SST) in MariaDB server allows malicious joiner nodes to execute arbitrary shell commands on the donor node.

Executive Summary:
A high-severity command injection vulnerability in MariaDB's SST process allows unauthorized shell command execution, requiring an immediate update to patched versions.

Vulnerability Details

CVE-ID: CVE-2026-44168

Affected Software: MariaDB Server

Affected Versions: MariaDB server versions 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, and 12.3.1

Vulnerability: This vulnerability resides in the State Snapshot Transfer (SST) process, where donor nodes perform unsafe interpolation of joiner-sent parameters. An attacker acting as a joiner can inject shell commands via the mariabackup method to execute code on the donor side.

Business Impact

Successful exploitation results in remote code execution on the database server, granting an attacker full control over the database environment. With a CVSS score of 8.0, this vulnerability presents a critical threat to data confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade to MariaDB versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2, or 10.6.27.

Proactive Monitoring: Monitor database server logs for unexpected process execution or unauthorized shell activity originating from the SST process.

Compensating Controls: Restrict network access to the database cluster and ensure only trusted nodes can initiate SST operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for full command execution on database servers, which is a critical security failure. Administrators must apply the provided patches immediately to secure their database infrastructure.

---METADATA---
VENDOR: Tyler Technologies
PRODUCT: Tyler Identity Local (TID-L)
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Tyler Identity Local (TID-L) utilizes default administrative credentials that are not required to be changed upon deployment, posing a significant risk of unauthorized administrative access.

Executive Summary:
The Tyler Identity Local (TID-L) platform is vulnerable to unauthorized administrative access due to the use of hardcoded, default credentials, posing a critical risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44159

Affected Software: Tyler Technologies Tyler Identity Local (TID-L)

Affected Versions: All versions

Vulnerability: This vulnerability involves the use of default administrative credentials (CWE-1392) that remain active because the system does not enforce credential changes during initialization. An unauthenticated attacker with network access to the management interface can leverage these known credentials to gain full administrative control over the application.

Business Impact

Successful exploitation allows an attacker to gain full administrative access to the Tyler Identity Local system. Given the CVSS score of 9.8, this represents a critical risk, potentially leading to unauthorized data exfiltration, system reconfiguration, or lateral movement within the enterprise network. Organizations are advised that because the product is end-of-life and unsupported, the risk profile is significantly elevated.

Remediation Plan

Immediate Action: Since Tyler Identity Local is end-of-life and unsupported, the only effective remediation is the immediate decommissioning and removal of the software from the environment.

Proactive Monitoring: Review all access logs for the TID-L interface to identify any unauthorized logins or suspicious administrative activity performed using default accounts.

Compensating Controls: If immediate decommissioning is not possible, place the affected system behind a strict network-level firewall that limits access to the management interface to authorized IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, the use of default credentials in an unsupported, legacy application makes this a high-priority target for automated scanning and exploitation.

Analyst Recommendation

The reliance on default credentials in an unsupported product creates an unacceptable security posture. Organizations must prioritize the migration away from Tyler Identity Local immediately, as no security patches will be provided by the vendor.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Sandbox Browser
AFFECTED_VERSIONS: Before 2026.4.15
---END_METADATA---

Description Summary:
OpenClaw contains an authentication bypass in webhook validation that allows unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical authentication bypass in OpenClaw's webhook validation allows unauthenticated attackers to execute arbitrary commands on the system.

Vulnerability Details

CVE-ID: CVE-2026-44109

Affected Software: OpenClaw Sandbox Browser

Affected Versions: Before 2026.4.15

Vulnerability: The application fails to validate webhook signatures when configuration keys are missing, effectively failing open. This allows an unauthenticated attacker to replay requests or bypass signature verification entirely to execute arbitrary commands.

Business Impact

The ability to execute arbitrary commands on the host system represents the highest level of security risk. Given the 9.8 CVSS score, this vulnerability could be leveraged to gain full system control, install malware, or exfiltrate sensitive data.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.4.15 or later immediately.

Proactive Monitoring: Review system logs for unauthorized command execution and audit webhook callback patterns.

Compensating Controls: Ensure that all webhook endpoints are protected by robust authentication and signature verification, and use network segmentation to limit the exposure of these endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that must be addressed immediately. Ensure all instances are patched and that cryptographic keys are properly configured to prevent unauthorized command execution.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A script execution order flaw during system shutdown causes the firewall to terminate prematurely, exposing internal services to unauthenticated remote attackers.

Executive Summary:
A critical race condition in Phoenix Contact charging controllers exposes internal services to remote attackers during the system shutdown process.

Vulnerability Details

CVE-ID: CVE-2026-44108

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an incorrect behavior order (CWE-696) vulnerability. The firewall is shut down before other services, creating a temporary, exploitable window where internal network services are reachable by unauthenticated remote actors.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a high risk of unauthorized access to sensitive internal services. An attacker could leverage this window to gain a foothold in the controller, potentially leading to full system compromise or lateral movement within the operational network.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later to correct the service shutdown sequence.

Proactive Monitoring: Monitor network traffic for unusual connection attempts during periods of system maintenance or expected reboots.

Compensating Controls: Isolate the controllers within a restricted VLAN and utilize firewall rules to block unsolicited incoming traffic, even if the device internal firewall is temporarily disabled.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation requires precise timing, but the potential for remote compromise remains high.

Analyst Recommendation

The vulnerability highlights a critical flaw in the system shutdown sequence that exposes internal services. Organizations must apply the vendor-provided firmware update to version 1.9.1 as soon as possible to ensure the firewall remains active until all services are safely terminated.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The firmware update process for Phoenix Contact charging controllers lacks cryptographic signature verification, allowing unauthenticated remote attackers to install malicious firmware.

Executive Summary:
A critical vulnerability in Phoenix Contact charging controllers allows unauthenticated attackers to achieve full system compromise by installing unauthorized firmware.

Vulnerability Details

CVE-ID: CVE-2026-44104

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an improper verification of cryptographic signature (CWE-347) flaw. Because the system only checks the CRC32 checksum of firmware updates, an unauthenticated attacker can bypass integrity checks to execute arbitrary code with system-level privileges.

Business Impact

The CVSS score of 9.8 reflects the high potential for total system compromise, which poses a severe risk to operational technology environments. Successful exploitation could lead to full control over charging infrastructure, resulting in significant safety hazards, equipment damage, and prolonged service downtime.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later immediately.

Proactive Monitoring: Review device logs for unauthorized firmware update requests or unexpected system reboots that may indicate an attempted update.

Compensating Controls: Restrict network access to the management interfaces of these controllers to trusted internal management segments only, effectively preventing remote unauthenticated access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of secure boot or code signing mechanisms.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required to prevent unauthorized firmware modification. Administrators must prioritize updating all affected charging controllers to version 1.9.1 to ensure the integrity of the boot and update process.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1 (also affects SEC-3100, SEC-3050, SEC-3000)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The CHARX OCPP Agent service on Phoenix Contact devices lacks authentication, allowing remote attackers to reconfigure backend connections and cause denial of service.

Executive Summary:
A critical missing authentication vulnerability in the CHARX OCPP Agent allows unauthenticated attackers to reconfigure backend connections, leading to denial of service and potential data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-44101

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The OCPP Agent service fails to verify the identity of remote entities, granting an unauthenticated attacker the ability to alter backend connection settings.

Business Impact

Exploitation of this vulnerability enables attackers to disrupt charging station operations through denial of service or divert sensitive data by reconfiguring backend connections. Given the CVSS score of 9.8, the potential for service outages and information leakage is substantial. This risk is particularly high for operators of charging infrastructure who rely on secure connectivity to the backend management platform.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to enforce authentication for the OCPP Agent service.

Proactive Monitoring: Monitor the status of backend connections and review logs for unauthorized reconfiguration attempts or unexpected connection drops in the charging management system.

Compensating Controls: Restrict network access to the OCPP Agent service by implementing strict firewall rules and network segmentation, ensuring only verified management servers can communicate with the device.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ability to remotely reconfigure backend connections is a critical flaw that could facilitate large-scale service disruption.

Analyst Recommendation

Operators must treat this vulnerability with high urgency to prevent potential operational downtime and data exposure. It is essential to apply the manufacturer-provided firmware updates and verify network security controls to protect the integrity of the backend management communications.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to 1.9.1 (excluding 1.9.1)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The CHARX JupiCore service in various Phoenix Contact CHARX SEC controllers contains a missing authentication vulnerability, allowing unauthenticated remote attackers to reconfigure charging points.

Executive Summary:
A critical authentication bypass in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to manipulate charging point configurations, potentially causing service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44100

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 through 1.9.0

Vulnerability: The CHARX JupiCore service fails to enforce proper authentication for critical functions. This allows an unauthenticated remote attacker to perform unauthorized reconfigurations, leading to the disclosure of sensitive UIDs, denial-of-service conditions, and file tampering.

Business Impact

The ability to manipulate industrial charging infrastructure remotely carries significant operational risk. With a CVSS score of 9.4, the vulnerability enables attackers to disrupt service availability or potentially cause physical damage to connected assets through unauthorized configuration changes, leading to severe reputational and financial impacts.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or later as specified by the vendor advisory.

Proactive Monitoring: Review system logs for unauthorized configuration change events and monitor for abnormal communication patterns targeting the JupiCore service.

Compensating Controls: Deploy network segmentation to isolate industrial control systems from public-facing networks and utilize industrial firewalls to restrict access to the affected service.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving critical function access, suggests high exploitability if the interface is reachable via the network.

Analyst Recommendation

Organizations utilizing affected Phoenix Contact hardware must prioritize the firmware update to version 1.9.1. Given the potential for operational disruption and unauthorized access, ensuring all controllers are updated is essential to maintaining the integrity of the charging infrastructure.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3000, 3050, 3100, 3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend.

Executive Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44098

Affected Software: Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an OS command injection flaw (CWE-78) triggered when an unauthenticated remote attacker bypasses firewall restrictions to interact with the OCPP backend. Successful exploitation allows the execution of arbitrary commands with the privileges of the charx-oa user.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over charging infrastructure, potentially causing operational disruption or unauthorized access to the underlying network. Given the CVSS score of 8.6, the risk is high: it enables attackers to manipulate controller functions without requiring valid user credentials.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or higher immediately.

Proactive Monitoring: Monitor network traffic for anomalous OCPP communication patterns and audit system logs for unexpected command execution attempts.

Compensating Controls: Ensure that the OCPP backend is strictly isolated from public networks and implement firewall rules to prevent unauthorized access to the management interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on a firewall bypass suggests that robust network perimeter security is a critical factor in preventing exploitation.

Analyst Recommendation

The severity of this remote, unauthenticated vulnerability necessitates immediate patching. Organizations should prioritize updating their Phoenix Contact CHARX controllers to the latest firmware to eliminate the command injection vector and secure their industrial control environment.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Phoenix Contact CHARX series is vulnerable to a fail-open condition, allowing attackers to force a fallback to a firmware partition containing default credentials.

Executive Summary:
A failure to secure the firmware partition fallback process in Phoenix Contact CHARX devices allows unauthenticated attackers to gain unauthorized access via default credentials.

Vulnerability Details

CVE-ID: CVE-2026-44094

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: The devices exhibit a fail-open behavior (CWE-636) where an unauthenticated remote attacker can force a transition to a legacy or secondary firmware partition. This partition contains insecure configurations, specifically the use of default credentials, which can be exploited for unauthorized access.

Business Impact

The CVSS score of 8.6 indicates a high risk of unauthorized access and potential loss of availability. By forcing the system to a less secure state, attackers can bypass current authentication mechanisms, leading to complete device control, data exfiltration, or the disabling of charging operations.

Remediation Plan

Immediate Action: Update the affected CHARX devices to firmware version 1.9.1 or later.

Proactive Monitoring: Monitor device logs for unexpected partition changes or attempts to authenticate with default credentials.

Compensating Controls: Ensure that management interfaces are isolated from public networks and that all default passwords are changed on all accessible partitions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent design weakness in how the system handles partition fallback, making it a target for attackers seeking to bypass modern security hardening.

Analyst Recommendation

The reliance on default credentials in legacy firmware partitions presents a significant security gap. Administrators must prioritize the upgrade to version 1.9.1 to ensure that the device does not fall back to an insecure state, thereby mitigating the risk of unauthorized administrative access.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1 (also affects SEC-3100, SEC-3050, SEC-3000)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the Phoenix Contact CHARX SEC series allows unauthenticated remote attackers to access and potentially compromise the MQTT broker.

Executive Summary:
A critical missing authentication flaw in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by accessing the MQTT broker.

Vulnerability Details

CVE-ID: CVE-2026-44090

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The MQTT broker on the affected hardware lacks proper authentication, allowing an unauthenticated remote attacker to interact with the service if network access is permitted.

Business Impact

The ability to access the MQTT broker allows an attacker to manipulate industrial control communications, leading to potential operational disruption or full device compromise. With a CVSS score of 9.8, this vulnerability poses a severe threat to operational technology environments. Unauthorized access may result in unauthorized control of physical processes, leading to safety risks and significant financial impact.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to implement mandatory authentication for the MQTT broker.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the MQTT port and review device logs for suspicious configuration changes or unexpected message publishing.

Compensating Controls: Ensure that all industrial control devices are isolated from the public internet via robust firewall rules and VPNs to restrict access to the MQTT broker to authorized internal sources only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication on critical industrial protocols is a high-risk configuration that should be remediated immediately.

Analyst Recommendation

This vulnerability represents a significant risk to industrial systems and must be addressed as a high priority. Administrators should ensure that firmware updates are applied to all impacted hardware and verify that network-level controls are in place to prevent unauthorized exposure of the MQTT broker.

---METADATA---
VENDOR: Totolink
PRODUCT: EX1200L
AFFECTED_VERSIONS: 9.3.5u.6146_B20201023 (likely others)
---END_METADATA---

Description Summary:
The Totolink EX1200L router contains a buffer overflow in the login functionality, allowing unauthenticated remote attackers to execute arbitrary code as root.

Executive Summary:
A critical buffer overflow in the Totolink EX1200L login interface allows unauthenticated attackers to execute code as root and gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-44089

Affected Software: Totolink EX1200L

Affected Versions: 9.3.5u.6146_B20201023 (and potentially others)

Vulnerability: A buffer overflow exists in the cgi-bin/cstecgi.cgi endpoint, which handles login requests. An unauthenticated attacker can send a crafted request to trigger this overflow and execute arbitrary commands with root-level privileges.

Business Impact

With a CVSS score of 9.4, this vulnerability allows for total compromise of the router. An attacker gaining root access can intercept network traffic, modify DNS settings, or use the device as an entry point to attack other internal systems, posing a significant risk to the entire network environment.

Remediation Plan

Immediate Action: Update the EX1200L firmware to the latest available version provided by Totolink.

Proactive Monitoring: Monitor network traffic for unusual activity originating from the router, such as unexpected outbound connections or system configuration changes.

Compensating Controls: Disable remote management of the router and restrict access to the web interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for root-level remote code execution, this vulnerability poses a severe threat to network integrity. Organizations should immediately apply firmware updates and restrict management access to the device to mitigate the risk of unauthorized remote exploitation.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 2 is susceptible to a path traversal vulnerability that allows authenticated attackers to access restricted directories via improper pathname validation.

Executive Summary:
A path traversal vulnerability in Netatalk 2 allows authenticated attackers to access unauthorized files, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44068

Affected Software: Netatalk Netatalk

Affected Versions: 2.1.0 through 4.4.2

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) residing in the file handling mechanisms of Netatalk 2. It requires an attacker to have authenticated access to the system to successfully traverse outside of restricted directories.

Business Impact

Successful exploitation allows an attacker to bypass file system restrictions, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.6, this represents a high severity risk that could lead to full system compromise if sensitive configuration or data files are accessed.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to apply the necessary security patches.

Proactive Monitoring: Monitor system access logs for unusual path patterns or attempts to access directories outside of expected user shares.

Compensating Controls: Ensure strict file system permissions are enforced for the service account running Netatalk to limit the impact of potential traversals.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is limited to authenticated users, which necessitates robust identity and access management as a baseline defense.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized file access, organizations running Netatalk 2 should prioritize updating to version 4.4.3. Patching is the only definitive way to resolve this path traversal flaw and protect sensitive file system resources.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple heap out-of-bounds reads exist in the Spotlight RPC unmarshalling code in Netatalk 3, potentially allowing information disclosure.

Executive Summary:
A heap out-of-bounds read vulnerability in Netatalk 3 allows authenticated attackers to potentially access sensitive memory.

Vulnerability Details

CVE-ID: CVE-2026-44066

Affected Software: Netatalk Netatalk

Affected Versions: 3.1.0 through 4.4.2

Vulnerability: The vulnerability is an out-of-bounds read (CWE-125) within the Spotlight RPC unmarshalling code. Based on the CVSS vector (PR:L), this requires a low-privilege authenticated user to successfully trigger the flaw.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive information residing in memory. While the CVSS score of 7.1 (High) reflects the potential for information disclosure and service impact, the requirement for authenticated access reduces the immediate risk to external-facing environments.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later, where this vulnerability has been addressed.

Proactive Monitoring: Review system and application logs for unusual RPC traffic or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to Netatalk services to trusted users only and ensure network segmentation is in place to limit the reach of potential attackers.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires specific interaction with the Spotlight RPC interface.

Analyst Recommendation

Given the severity of this memory-handling flaw, administrators should prioritize updating to the patched version, 4.4.3. Ensuring that all Netatalk instances are running the latest software version is the most effective way to mitigate this risk.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.3 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability exists in the ASP session ID handling logic of Netatalk 1, potentially leading to service disruption or information disclosure.

Executive Summary:
An out-of-bounds read vulnerability in Netatalk 1 session handling poses a risk of service interruption and information disclosure to adjacent network attackers.

Vulnerability Details

CVE-ID: CVE-2026-44064

Affected Software: Netatalk Netatalk

Affected Versions: 1.3 through 4.4.2

Vulnerability: This is an out-of-bounds read (CWE-125) triggered during the handling of ASP session IDs. The CVSS vector (AV:A) indicates that the attacker must be positioned on the adjacent network to exploit this flaw.

Business Impact

The vulnerability carries a CVSS score of 7.1 (High), primarily due to its potential to cause a denial-of-service condition (impacting availability) or unauthorized information exposure. Organizations relying on Netatalk for file sharing services may face operational downtime if the service is crashed via this vector.

Remediation Plan

Immediate Action: Update the Netatalk installation to version 4.4.3 or later to resolve the session handling flaw.

Proactive Monitoring: Monitor network-level traffic for anomalous packets directed at the Netatalk service, specifically targeting session ID parameters.

Compensating Controls: Implement network access controls to ensure only authorized devices can communicate with the Netatalk service, mitigating the adjacent network attack vector.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access limits the attack surface significantly.

Analyst Recommendation

The vulnerability necessitates a patch to the latest version (4.4.3) to ensure service stability and security. Administrators should schedule these updates during the next maintenance window to minimize potential exposure.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing output length bounds check in the pull_charset_flags() function of Netatalk 2 allows for a potential out-of-bounds write.

Executive Summary:
A critical out-of-bounds write vulnerability in Netatalk 2 could allow remote, authenticated attackers to achieve arbitrary code execution or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44062

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This is an out-of-bounds write (CWE-787) caused by a missing length check in the pull_charset_flags() function. The CVSS vector indicates that while it requires authenticated access (PR:L), it carries a high impact on Confidentiality, Integrity, and Availability.

Business Impact

With a CVSS score of 7.5 (High), this vulnerability is highly dangerous as it can lead to full system compromise. Successful exploitation could allow an attacker to gain elevated control, potentially leading to unauthorized data modification, theft, or complete service takeover.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or higher immediately to apply the necessary bounds checking logic.

Proactive Monitoring: Audit access logs for unusual user activity and monitor system integrity for unauthorized changes or unexpected process behavior.

Compensating Controls: Employ a Web Application Firewall or intrusion detection system configured to inspect traffic for malformed character set flag parameters.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory corruption flaws of this nature are often highly sought after by threat actors for weaponization.

Analyst Recommendation

Given the potential for total system compromise, this CVE should be treated with high urgency. Organizations must prioritize the update to version 4.4.3 to ensure that the memory-safety defect in character set flag processing is remediated.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.5.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer underflow vulnerability in the dsi_writeinit() function of Netatalk allows for potential service disruption.

Executive Summary:
A critical integer underflow vulnerability in Netatalk versions 1.5.0 through 4.4.2 poses a significant risk of denial-of-service to affected network file systems.

Vulnerability Details

CVE-ID: CVE-2026-44060

Affected Software: Netatalk

Affected Versions: 1.5.0 through 4.4.2

Vulnerability: This vulnerability is an integer underflow (CWE-191) occurring within the dsi_writeinit() function. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/PR:N.

Business Impact

The primary impact of this vulnerability is a high risk of system availability loss. Because the flaw allows for an integer underflow, an attacker can trigger a crash, leading to service downtime for file-sharing infrastructure. While the CVSS score is 7.5 (High), the ability for unauthenticated remote attackers to disrupt business-critical file services necessitates prompt remediation to maintain operational continuity.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to apply the necessary fix for the dsi_writeinit() integer underflow.

Proactive Monitoring: Monitor system logs for abnormal service crashes or repeated connection attempts targeting the DSI (Data Stream Interface) protocol.

Compensating Controls: Implement network segmentation to restrict access to Netatalk services to only trusted internal IP ranges, reducing the exposure to external attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of required authentication, but currently, no known weaponized exploit exists.

Analyst Recommendation

Given the ease of exploitation (low complexity, no authentication), organizations should prioritize patching their Netatalk instances. Upgrading to version 4.4.3 is the only definitive way to eliminate the risk of service disruption associated with this vulnerability.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.2.2 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Netatalk versions 2.2.2 through 4.4.2 allows attackers with high privileges to compromise system integrity and availability.

Executive Summary:
An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 could allow an attacker with high privileges to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44058

Affected Software: Netatalk

Affected Versions: 2.2.2 through 4.4.2

Vulnerability: This is an improper authentication vulnerability (CWE-287) that requires high privileges (PR:H) to exploit. An attacker who has already gained high-level access may leverage this flaw to bypass further authentication controls, leading to total impact on confidentiality, integrity, and availability.

Business Impact

Successful exploitation of this flaw could result in complete administrative control over the affected Netatalk server. Given the CVSS score of 7.2, the risk of unauthorized data access and system manipulation is severe. Organizations relying on Netatalk for sensitive file storage face significant reputational and operational risks if this vulnerability is leveraged by an existing malicious actor within the environment.

Remediation Plan

Immediate Action: Update Netatalk to version 4.5.0 or later to resolve the authentication bypass mechanism.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or anomalous access patterns from existing high-privilege service accounts.

Compensating Controls: Apply the principle of least privilege to administrative accounts and ensure that management interfaces for Netatalk are not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the impact is high, the requirement for high privileges mitigates the immediate risk from external, unauthenticated threats.

Analyst Recommendation

While the requirement for high privileges reduces the attack surface compared to unauthenticated flaws, the potential for total system compromise makes this a high-priority item for maintenance cycles. Administrators should move to version 4.5.0 as soon as possible.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 can lead to OS command injection if successfully exploited.

Executive Summary:
A logic error in Netatalk 3.1.4 through 4.4.2 enables potential OS command injection, posing a severe threat to server security.

Vulnerability Details

CVE-ID: CVE-2026-44055

Affected Software: Netatalk

Affected Versions: 3.1.4 through 4.4.2

Vulnerability: This is an OS command injection vulnerability (CWE-78) triggered by a logic error involving bitwise OR operations. The attack vector requires low privileges (PR:L) and high attack complexity (AC:H), but successful execution allows for full system compromise.

Business Impact

Command injection vulnerabilities are among the most dangerous, as they allow an attacker to execute arbitrary code on the underlying host operating system. With a CVSS score of 7.5, the potential for total system takeover is high. If exploited, an attacker could exfiltrate sensitive files, install persistent backdoors, or pivot to other systems within the internal network.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to patch the logic error that enables command injection.

Proactive Monitoring: Monitor for suspicious child processes being spawned by the Netatalk daemon and inspect system logs for unusual command-line arguments.

Compensating Controls: Use a Web Application Firewall (WAF) or host-based Intrusion Detection System (IDS) to detect and block common command injection signatures in network traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high attack complexity required for successful execution serves as a temporary barrier, but it should not be relied upon as a primary defense.

Analyst Recommendation

Due to the critical nature of OS command injection, this vulnerability should be remediated with high urgency. Administrators must update to version 4.4.3 to ensure that the logic error is neutralized and the command injection vector is closed.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.5.0 through 4.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is vulnerable to an improper cryptographic algorithm usage, potentially allowing unauthorized access to sensitive communications.

Executive Summary:
A vulnerability in Netatalk versions 1.5.0 through 4.2.2 involving the use of broken or risky cryptographic algorithms poses a significant risk of unauthorized data interception.

Vulnerability Details

CVE-ID: CVE-2026-44053

Affected Software: Netatalk Netatalk

Affected Versions: 1.5.0 through 4.2.2

Vulnerability: This vulnerability (CWE-327) involves the use of weak or broken cryptographic algorithms, which can be exploited by an unauthenticated remote attacker to compromise data confidentiality and integrity.

Business Impact

The reliance on insecure cryptography can lead to the exposure of sensitive data transmitted over the network, potentially resulting in unauthorized access or data breaches. With a CVSS score of 7.4, this vulnerability represents a high risk to business operations, particularly in environments where network traffic contains confidential information.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.5.0 or later to ensure the implementation of secure cryptographic standards.

Proactive Monitoring: Review network traffic logs for anomalous patterns and monitor authentication logs for signs of unauthorized access attempts.

Compensating Controls: Implement robust network-level encryption (e.g., VPNs or TLS-based tunneling) to encapsulate traffic if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the cryptographic implementation, making it susceptible to passive interception attacks.

Analyst Recommendation

Given the potential for complete compromise of data confidentiality and integrity, organizations should prioritize upgrading to the patched version of Netatalk. Immediate remediation is necessary to eliminate the risk of cryptographic exploitation.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is susceptible to sensitive information exposure due to the improper insertion of restricted data into application log files.

Executive Summary:
An information disclosure vulnerability in Netatalk versions 2.1.0 through 4.4.2 allows unauthorized access to sensitive data via insecure logging practices.

Vulnerability Details

CVE-ID: CVE-2026-44052

Affected Software: Netatalk Netatalk

Affected Versions: 2.1.0 through 4.4.2

Vulnerability: This vulnerability (CWE-532) occurs when an application inadvertently writes sensitive information, such as credentials or session tokens, into log files that may be accessible to unauthorized users.

Business Impact

The leakage of sensitive information into logs can lead to unauthorized access to systems or accounts, resulting in broader security compromises. With a CVSS score of 7.5, this issue presents a high risk, as it allows unauthenticated attackers to potentially gather intelligence required for further exploitation.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to remediate the insecure logging behavior.

Proactive Monitoring: Audit existing application logs for the presence of sensitive data and restrict access to log directories to authorized personnel only.

Compensating Controls: Use a Web Application Firewall (WAF) or system-level monitoring to detect and block access attempts targeting sensitive files or log storage paths.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, increasing the risk of discovery by automated scanning tools.

Analyst Recommendation

Organizations should ensure that logging configurations are audited and that the software is updated to the latest version immediately. Securing log files is a critical step in preventing secondary attacks and maintaining overall system integrity.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.0.2 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 3 contains an improper link resolution vulnerability that allows authenticated attackers to perform unauthorized file access via symbolic link following.

Executive Summary:
An improper link resolution vulnerability in Netatalk 3 allows authenticated attackers to manipulate file access, resulting in a high risk of sensitive data exposure.

Vulnerability Details

CVE-ID: CVE-2026-44051

Affected Software: Netatalk Netatalk

Affected Versions: 3.0.2 through 4.4.2

Vulnerability: This vulnerability (CWE-59) occurs when the application fails to properly resolve links before performing file operations. It allows an authenticated attacker to bypass intended file access restrictions.

Business Impact

The ability to exploit link resolution can lead to unauthorized access to sensitive files on the server, resulting in potential data breaches. With a CVSS score of 8.1, the vulnerability is classified as high, reflecting the potential for significant impact on data confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to remediate the vulnerability.

Proactive Monitoring: Audit file system activity logs for suspicious access patterns involving symbolic or hard links.

Compensating Controls: Configure the environment to prevent the creation of symbolic links in directories accessible to the Netatalk service where possible.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, emphasizing the importance of securing user credentials and access levels.

Analyst Recommendation

Organizations should treat this high-severity vulnerability with urgency. Immediate application of the 4.4.3 update is required to close the link resolution flaw and maintain the security posture of the affected Netatalk environments.