---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.0 through 4.4.2
---END_METADATA---

Description Summary:
Netatalk contains a heap-based buffer overflow vulnerability within the cnid daemon's comm_rcv() function.

Executive Summary:
A heap buffer overflow in the Netatalk cnid daemon could allow a remote attacker to execute arbitrary code or crash the service.

Vulnerability Details

CVE-ID: CVE-2026-44050

Affected Software: Netatalk

Affected Versions: 2.0.0 through 4.4.2

Vulnerability: This is a heap buffer overflow in the cnid daemon. It occurs during the comm_rcv() process, which can be triggered by an attacker sending malformed data to the service.

Business Impact

A successful exploit may result in arbitrary code execution with the privileges of the Netatalk service, leading to full system compromise or a persistent denial-of-service condition. The 9.9 CVSS score highlights the extreme urgency of this vulnerability for any environment utilizing Netatalk for file sharing.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later immediately.

Proactive Monitoring: Monitor system logs for service crashes or unusual memory usage associated with the cnid daemon.

Compensating Controls: Restrict access to the Netatalk service to authorized client IP addresses via firewall rules to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize updating all Netatalk instances to version 4.4.3. This will eliminate the buffer overflow condition and secure the communication interface.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical out-of-bounds write vulnerability exists in the Netatalk convert_charset() function due to improper null termination, leading to potential system compromise.

Executive Summary:
An out-of-bounds write vulnerability in the Netatalk convert_charset() function allows authenticated attackers to potentially execute arbitrary code or cause system crashes.

Vulnerability Details

CVE-ID: CVE-2026-44049

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This memory corruption vulnerability (CWE-787) is triggered by improper null termination in the convert_charset() function, allowing an authenticated attacker to manipulate memory.

Business Impact

Successful exploitation can lead to arbitrary code execution, resulting in full system compromise, data loss, or significant service disruption. With a CVSS score of 7.5, this vulnerability poses a severe threat to the availability and integrity of the affected systems.

Remediation Plan

Immediate Action: Apply the vendor-provided security update by upgrading to Netatalk version 4.4.3 or later.

Proactive Monitoring: Monitor system logs for crashes or unusual memory usage patterns that may indicate attempts to trigger a buffer overflow.

Compensating Controls: Ensure the application is running with the principle of least privilege to minimize the potential impact should an attacker successfully execute code.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector (requiring authentication) provides a partial barrier to immediate exploitation.

Analyst Recommendation

Given the potential for remote code execution, patching this vulnerability is of high urgency. System administrators should prioritize the update to version 4.4.3 to prevent memory-related exploitation and maintain system security.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 2 is vulnerable to a stack-based buffer overflow that could allow an authenticated attacker to execute arbitrary code or cause a denial of service.

Executive Summary:
A stack-based buffer overflow in Netatalk 2 allows authenticated attackers to potentially execute arbitrary code, representing a critical security risk.

Vulnerability Details

CVE-ID: CVE-2026-44048

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in Netatalk 2. An authenticated attacker can trigger this condition through specially crafted network requests, leading to memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of remote code execution. Successful exploitation could lead to full system compromise, data theft, or complete service disruption, severely impacting business operations.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to resolve the buffer overflow vulnerability.

Proactive Monitoring: Monitor for service crashes or unusual CPU spikes that may indicate attempts to exploit the memory corruption vulnerability.

Compensating Controls: Use network segmentation and intrusion detection systems (IDS) to identify and block malformed packets directed toward the Netatalk service.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the nature of buffer overflows, this vulnerability is inherently dangerous and represents a high risk for code execution if discovered by malicious actors.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability demands immediate attention. All systems running Netatalk 2 should be updated to version 4.4.3 or later as soon as possible to mitigate the risk of compromise.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is vulnerable to SQL injection via the cnid backend, allowing authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A SQL injection vulnerability in Netatalk versions 3.1.0 through 4.4.2 allows authenticated attackers to compromise the underlying database, posing a high risk to data integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-44047

Affected Software: Netatalk

Affected Versions: 3.1.0 through 4.4.2

Vulnerability: This is a SQL injection vulnerability (CWE-89) within the cnid backend. The vulnerability requires the attacker to have low-level authenticated access to the system to successfully inject malicious SQL commands.

Business Impact

Successful exploitation of this flaw could allow an attacker to bypass security controls, leading to unauthorized data access, modification, or total system compromise. With a CVSS score of 8.8, this represents a significant threat to business continuity and data confidentiality, as the backend database often contains sensitive configuration or user information.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to remediate the vulnerability.

Proactive Monitoring: Review database access logs for unusual queries or patterns indicative of SQL injection attempts, particularly those originating from authenticated user sessions.

Compensating Controls: Ensure that the database user account utilized by the Netatalk cnid backend operates under the principle of least privilege to limit the scope of a potential injection attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is high, the requirement for authenticated access slightly lowers the immediate threat compared to unauthenticated remote code execution.

Analyst Recommendation

Given the severity of potential SQL injection, administrators should prioritize updating to the latest version of Netatalk. Apply the patch as part of the next scheduled maintenance cycle or sooner if the environment is exposed to untrusted users.

---METADATA---
VENDOR: Harbor
PRODUCT: Harbor (GoHarbor)
AFFECTED_VERSIONS: 2.15.0 and below
---END_METADATA---

Description Summary:
GoHarbor Harbor version 2.15.0 and below uses hard-coded credentials, allowing unauthenticated attackers to gain administrative access to the web user interface.

Executive Summary:
Harbor container registries are at critical risk of unauthorized access due to the use of hard-coded default credentials, potentially leading to the compromise of private container images.

Vulnerability Details

CVE-ID: CVE-2026-4404

Affected Software: Harbor (GoHarbor)

Affected Versions: 2.15.0 and below

Vulnerability: This vulnerability involves the use of hard-coded credentials in the Harbor software. This allows an attacker who knows the default password to log into the web UI with administrative privileges without needing to bypass any other security layers.

Business Impact

The impact is severe, as an attacker with administrative access to a container registry can steal proprietary source code, inject malicious code into container images (supply chain attack), or delete critical infrastructure components. The CVSS score of 9.4 reflects the high impact on confidentiality and integrity resulting from this authentication failure.

Remediation Plan

Immediate Action: Update Harbor to the latest version and immediately change all default administrative passwords.

Proactive Monitoring: Review Harbor access logs for logins using the default "admin" account, especially from unknown or external IP addresses.

Compensating Controls: Ensure the Harbor UI is not exposed to the public internet and implement Multi-Factor Authentication (MFA) if supported by your identity provider integration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, hard-coded credentials are among the easiest vulnerabilities for attackers to exploit once the default values are identified.

Analyst Recommendation

Immediate password rotation is the most critical step. Following that, upgrading to a version that enforces password changes or removes hard-coded defaults is essential to maintain a secure container supply chain.

---METADATA---
VENDOR: Fluent
PRODUCT: Fluentd
AFFECTED_VERSIONS: < 1.19.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fluentd allows path traversal via the ${tag} placeholder in file configurations, enabling attackers to write or overwrite arbitrary files and potentially achieve remote code execution.

Executive Summary:
A critical path traversal vulnerability in Fluentd versions prior to 1.19.3 allows attackers to perform arbitrary file writes, creating a significant risk for remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44024

Affected Software: Fluent Fluentd

Affected Versions: < 1.19.3

Vulnerability: This is a path traversal vulnerability caused by insufficient validation of the ${tag} placeholder in the out_file plugin. By sending crafted tags containing traversal characters, an unauthenticated attacker can manipulate file paths to write to unintended locations on the host filesystem.

Business Impact

Successful exploitation of this vulnerability allows attackers to overwrite critical system configuration files or binary files, which can lead to full system compromise via remote code execution. Given the CVSS score of 9.8, this vulnerability is critical. It poses a severe threat to the integrity and confidentiality of the entire host system running the Fluentd service.

Remediation Plan

Immediate Action: Update the Fluentd installation to version 1.19.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review Fluentd configuration files to identify if they utilize the ${tag} placeholder in path definitions and monitor filesystem activity for unauthorized file write attempts.

Compensating Controls: Run the Fluentd process with the minimum necessary filesystem permissions (least privilege) to limit the impact of a potential path traversal exploit.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and presents a direct path to system compromise. All users of Fluentd must prioritize upgrading to version 1.19.3 immediately. Organizations should also audit their logging configurations to ensure that input tags are not being used in a way that could facilitate path traversal.

---METADATA---
VENDOR: docling-project
PRODUCT: docling-core
AFFECTED_VERSIONS: >= 1.5.0, < 2.74.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Docling Core is vulnerable to path traversal and server-side request forgery, potentially allowing unauthenticated attackers to access restricted files or perform unauthorized network requests.

Executive Summary:
Docling Core versions 1.5.0 through 2.74.0 contain path traversal and server-side request forgery vulnerabilities that permit unauthorized file access and network interaction.

Vulnerability Details

CVE-ID: CVE-2026-44023

Affected Software: docling-core

Affected Versions: >= 1.5.0, < 2.74.1

Vulnerability: This vulnerability involves improper limitation of pathnames to restricted directories and server-side request forgery. These flaws allow unauthenticated remote attackers to interact with local files or perform requests to internal resources.

Business Impact

The combination of path traversal and SSRF allows an attacker to read sensitive files from the server or probe internal network services that are otherwise protected from the public internet. This can lead to the exposure of configuration files, credentials, or internal data, resulting in a significant security breach. The CVSS score of 8.6 confirms the high severity of these combined issues.

Remediation Plan

Immediate Action: Upgrade to docling-core version 2.74.1 or later to resolve the path traversal and SSRF flaws.

Proactive Monitoring: Audit network logs for unusual outbound connections from the server, which may indicate attempted SSRF exploitation.

Compensating Controls: Ensure the application runs with the minimum necessary filesystem permissions to limit the impact of potential path traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the underlying server environment.

Analyst Recommendation

Given the potential for both information disclosure and internal network reconnaissance, users of docling-core must upgrade to version 2.74.1 immediately. Failure to patch leaves the application exposed to unauthorized file access and potential lateral movement within the network.

---METADATA---
VENDOR: docling-project
PRODUCT: docling-core
AFFECTED_VERSIONS: >= 2.5.0, < 2.74.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Docling Core is vulnerable to path traversal and resource exhaustion due to improper handling of external file names and uncontrolled resource consumption.

Executive Summary:
A high-severity vulnerability in docling-core allows unauthenticated attackers to trigger unauthorized file access and resource exhaustion, posing a significant risk to system stability and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44019

Affected Software: docling-project docling-core

Affected Versions: >= 2.5.0, < 2.74.1

Vulnerability: This vulnerability involves improper input validation leading to external control of file paths (CWE-73) and uncontrolled resource consumption (CWE-400). The attack vector is network-based and does not require authentication, though it does require user interaction.

Business Impact

The exploitation of these flaws could lead to unauthorized information disclosure or a denial of service condition. Given the CVSS score of 8.1, the risk is classified as high, as an attacker could potentially crash the document processing service or read sensitive files from the underlying server.

Remediation Plan

Immediate Action: Update docling-core to version 2.74.1 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory spikes, and review application access logs for unusual file path patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests that attempt to traverse directories or flood the application with excessive processing tasks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of sufficient input sanitization in file handling routines.

Analyst Recommendation

The severity of this issue necessitates an immediate upgrade to the patched version. Organizations should prioritize patching to prevent potential service degradation and unauthorized data access.

---METADATA---
VENDOR: Docling-project
PRODUCT: Docling
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Docling, a tool for document processing and AI integration, contains a high-severity vulnerability that could be leveraged to compromise document parsing workflows.

Executive Summary:
A high-severity vulnerability in the Docling document processing library threatens the integrity of AI-integrated data pipelines and document parsing workflows.

Vulnerability Details

CVE-ID: CVE-2026-44016

Affected Software: Docling-project Docling

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the document parsing functionality of Docling. Attackers could potentially trigger this flaw by submitting malicious documents, leading to unauthorized code execution or system instability within the processing environment.

Business Impact

A successful exploit could result in the compromise of data processed by AI pipelines, potentially leading to data leakage or the corruption of training datasets. Given the CVSS score of 8.2, this vulnerability represents a critical risk to organizations relying on Docling for automated document ingestion and generative AI integrations.

Remediation Plan

Immediate Action: Update the Docling library to the latest secure version once released by the vendor.

Proactive Monitoring: Monitor document processing logs for errors, crashes, or unexpected execution patterns that may indicate a malformed input attack.

Compensating Controls: Implement strict file validation and sandboxing for all documents processed by Docling to prevent unauthorized payloads from interacting with the host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Docling in production workflows should prioritize identifying all instances where this library is implemented. Apply the vendor-provided patches as soon as they become available to mitigate the risk of document-based attacks against your AI ecosystem.

---METADATA---
VENDOR: 0xJacky
PRODUCT: Nginx-UI
AFFECTED_VERSIONS: <= 2.3.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Nginx-UI is susceptible to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied requests, potentially allowing unauthorized access to internal resources.

Executive Summary:
A Server-Side Request Forgery vulnerability in Nginx-UI allows authenticated attackers to perform unauthorized requests, compromising internal network security.

Vulnerability Details

CVE-ID: CVE-2026-44015

Affected Software: 0xJacky Nginx-UI

Affected Versions: <= 2.3.4

Vulnerability: The vulnerability (CWE-918) allows an authenticated attacker to perform SSRF attacks by manipulating requests handled by the user interface. This enables the attacker to interact with internal services that are not typically exposed to the public network.

Business Impact

Exploitation of this SSRF vulnerability could allow an attacker to bypass firewalls and access internal infrastructure, leading to unauthorized data access or reconnaissance. With a CVSS score of 8.5, the risk is high, particularly in environments where Nginx-UI is deployed with elevated privileges or access to internal network segments.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a patched version; currently, no direct patch is available for version 2.3.4.

Proactive Monitoring: Review web server and application logs for unusual outbound requests originating from the Nginx-UI server to internal IP addresses or restricted ports.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious outbound requests and restrict access to the Nginx-UI management interface to trusted IP ranges only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of a confirmed patch necessitates strict network-level access controls.

Analyst Recommendation

Because no official patch is available, administrators must implement compensating network controls and limit access to the Nginx-UI interface immediately. Monitor for vendor updates daily and apply the fix as soon as it becomes available.

---METADATA---
VENDOR: Node.js (OpenJS Foundation)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox library for Node.js is vulnerable to sandbox escape, potentially allowing arbitrary command execution on the host system.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library for Node.js poses a significant risk of arbitrary code execution on host systems.

Vulnerability Details

CVE-ID: CVE-2026-44009

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: This is a sandbox breakout vulnerability that allows an attacker to bypass the isolation mechanisms of the vm2 environment, leading to full system compromise. The vulnerability can be triggered by an unauthenticated attacker providing malicious input to the sandbox.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and data integrity. Successful exploitation allows an attacker to break out of the intended sandbox environment and execute arbitrary commands on the underlying host, potentially leading to unauthorized access to sensitive data, system takeover, or the deployment of ransomware.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for unusual process execution or attempts to access restricted file paths originating from Node.js applications.

Compensating Controls: Implement strict containerization and principle-of-least-privilege policies for all Node.js environments to limit the blast radius if the sandbox is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of sandbox escapes, organizations utilizing vm2 must prioritize this update. Ensure that all dependencies are audited and that the patching process is completed across all production and development environments to prevent potential host-level exploitation.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to an array species batch neutralization flaw, allowing attackers to escape the sandbox and execute arbitrary commands.

Executive Summary:
A critical sandbox escape in the vm2 library allows attackers to access host functions and execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44008

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: The neutralizeArraySpeciesBatch method improperly handles objects across the sandbox boundary. Attackers can leverage this to retrieve host objects, including the host Function object, and escape the sandbox.

Business Impact

The CVSS score of 9.8 underscores the severe risk of host system compromise. Successful exploitation grants the attacker the ability to escape the sandbox and execute arbitrary commands on the underlying host, leading to full system takeover.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately.

Proactive Monitoring: Monitor for unexpected system-level processes or unusual file system activity originating from the Node.js application.

Compensating Controls: Enforce strict process-level security, such as using seccomp profiles to block unauthorized system calls if a sandbox escape occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the persistent issues with vm2 sandbox escapes, users should ensure they are on the latest version (3.11.2+) and consider if the use of a sandbox is sufficient for their security requirements or if additional defense-in-depth measures are needed.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype access, allowing attackers to reach arbitrary prototypes and escape the sandbox.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access arbitrary prototypes and gain control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-44006

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to restrict access to BaseHandler.getPrototypeOf. By reaching this handler, an attacker can retrieve arbitrary prototypes, enabling a sandbox escape and subsequent host-level execution.

Business Impact

The CVSS score of 10.0 confirms this as a critical risk. Successful exploitation grants the attacker full control over the host system, potentially leading to unauthorized data access, service disruption, and compromise of the entire Node.js application environment.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to patch the prototype access handler.

Proactive Monitoring: Monitor for unusual JavaScript execution patterns or attempts to reflect on object prototypes within the application.

Compensating Controls: Implement strict resource limits and process isolation for any Node.js application that processes untrusted code.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a severe threat to any system relying on vm2 for isolation. Upgrading to the latest version is the only effective mitigation and must be performed immediately.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: 3.9.6 to 3.10.5
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype pollution, allowing sandboxed code to mutate host-realm objects and escape the environment.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to mutate host-realm objects and execute code outside the intended environment.

Vulnerability Details

CVE-ID: CVE-2026-44005

Affected Software: Node.js vm2

Affected Versions: 3.9.6 to 3.10.5

Vulnerability: The library incorrectly exposes mutable proxies for host-realm intrinsic prototypes. This allows sandboxed JavaScript to modify critical objects such as Object.prototype, facilitating a sandbox escape.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Exploitation allows an attacker to break out of the Node.js sandbox, leading to arbitrary code execution on the underlying host system, full server compromise, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to address the proxy exposure issue.

Proactive Monitoring: Monitor for anomalous process behavior or unexpected file system modifications originating from Node.js applications utilizing the vm2 library.

Compensating Controls: Ensure that Node.js applications are running with the principle of least privilege, utilizing containerization or restricted service accounts to limit the blast radius of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this sandbox escape, users must upgrade to version 3.11.0 immediately. Organizations should conduct a thorough audit of all Node.js applications relying on vm2 for isolation to ensure they are updated and secure.

---METADATA---
VENDOR: patriksimek
PRODUCT: vm2
AFFECTED_VERSIONS: < 3.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The vm2 sandbox environment is vulnerable to an uncaught exception flaw, which can be leveraged to cause a denial-of-service or potentially escape the sandbox.

Executive Summary:
An uncaught exception vulnerability in the vm2 sandbox environment allows unauthenticated attackers to cause service instability and potential security bypasses.

Vulnerability Details

CVE-ID: CVE-2026-44001

Affected Software: patriksimek vm2

Affected Versions: < 3.11.0

Vulnerability: The vulnerability (CWE-248) involves an uncaught exception that can be triggered by an attacker. This flaw allows for escape from the sandbox environment or can lead to a denial-of-service condition affecting the Node.js runtime.

Business Impact

A successful exploit could crash the application or allow an attacker to execute code outside of the restricted sandbox, leading to a complete compromise of the host environment. Given the CVSS score of 8.6, this vulnerability poses a severe risk to any application relying on vm2 for secure code execution.

Remediation Plan

Immediate Action: Upgrade the vm2 package to version 3.11.0 or higher.

Proactive Monitoring: Monitor application stability and error logs for recurring uncaught exceptions or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: If upgrading is not immediately possible, consider moving away from vm2 to more modern, actively maintained isolation alternatives, as the sandbox model itself may be fragile.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of sandbox escapes.

Analyst Recommendation

Upgrade to version 3.11.0 immediately to resolve the sandbox escape risk. Given the potential for complete host compromise, this update should be treated with the highest urgency in your security maintenance schedule.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js contains a bypass in its builtin allowlist, enabling unauthorized access to restricted modules and arbitrary code execution.

Executive Summary:
A critical sandbox bypass in the vm2 library allows attackers to load forbidden modules and execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-43999

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox's builtin allowlist can be bypassed by abusing the module builtin. This allows sandboxed code to access Node.js Module._load() to load restricted modules like child_process, resulting in host-level code execution.

Business Impact

The CVSS score of 9.9 highlights the extreme severity of this flaw. By achieving remote code execution outside the sandbox, an attacker can gain full control over the host, leading to data loss, system destruction, or persistent unauthorized access.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later to ensure the builtin allowlist is properly enforced.

Proactive Monitoring: Audit Node.js application logs for attempts to load sensitive modules such as child_process, fs, or net from within sandboxed environments.

Compensating Controls: Use strict environment variable configurations to restrict the capabilities of the Node.js process and prevent the spawning of child processes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that effectively nullifies the isolation provided by vm2. It is imperative to update the library immediately and review all code that relies on this sandbox for security purposes.

---METADATA---
VENDOR: Patriksimek
PRODUCT: vm2
AFFECTED_VERSIONS: 3.10.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The vm2 Node.js sandbox environment is vulnerable to improper link resolution, allowing attackers to bypass sandbox restrictions via link following.

Executive Summary:
A high-severity sandbox escape vulnerability in the vm2 library allows authenticated attackers to execute arbitrary code with host-level permissions.

Vulnerability Details

CVE-ID: CVE-2026-43998

Affected Software: Patriksimek vm2

Affected Versions: 3.10.5

Vulnerability: This vulnerability is caused by improper link resolution before file access (CWE-59), which permits an attacker with low-level privileges to bypass the sandbox environment and interact with the host filesystem.

Business Impact

The ability to escape a sandboxed environment represents a critical security failure, as it allows unauthorized access to the underlying host system. Given the CVSS score of 8.5, this flaw poses a significant risk of full system compromise, data exfiltration, or lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 package to version 3.11.0 or later as specified by the OSV advisory.

Proactive Monitoring: Monitor application logs for unusual file system access patterns or attempts to traverse directories outside of the designated sandbox.

Compensating Controls: If immediate patching is not possible, implement strict filesystem permissions for the Node.js process to limit the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of the sandbox escape makes it a targeted vector for sophisticated actors.

Analyst Recommendation

Organizations utilizing the vm2 library must prioritize updating to version 3.11.0 immediately. The presence of a proof-of-concept combined with the potential for total system impact necessitates rapid remediation to prevent host-level exploitation.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to a host object escape, allowing attackers to access the host environment by leveraging native symbols.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access host objects and bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-43997

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to properly restrict access to the host Object. Attackers can use HostObject.getOwnPropertySymbols to obtain sensitive references, enabling a full escape from the sandbox.

Business Impact

A CVSS score of 10.0 signifies an extremely high risk of compromise. Successful exploitation grants the attacker the ability to interact with the host environment, leading to full system control, sensitive data exposure, and potential compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately.

Proactive Monitoring: Monitor system logs for unusual Node.js activity that deviates from standard application behavior, specifically looking for attempts to access non-sandboxed modules or system functions.

Compensating Controls: Employ robust system-level isolation, such as running Node.js processes within hardened containers or gVisor, to minimize the impact if the sandbox is breached.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe security failure in the isolation mechanism. All systems utilizing versions of vm2 prior to 3.11.0 must be patched immediately to prevent complete host system compromise.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is susceptible to Server-Side Request Forgery (SSRF), allowing unauthenticated attackers to force the server to make unintended requests to internal or external resources.

Executive Summary:
An unauthenticated SSRF vulnerability in the JunoClaw AI platform enables unauthorized interactions with internal network resources, posing a significant risk to infrastructure security.

Vulnerability Details

CVE-ID: CVE-2026-43993

Affected Software: Dragonmonk111 JunoClaw

Affected Versions: < v0.x.y-security-1

Vulnerability: The platform fails to properly validate inputs, leading to a Server-Side Request Forgery (CWE-918) vulnerability. This can be exploited by an unauthenticated attacker to probe internal services or perform requests on behalf of the server.

Business Impact

With a CVSS score of 8.2, this vulnerability allows attackers to bypass network perimeters, potentially accessing sensitive internal APIs or cloud metadata services. Such access can lead to unauthorized information disclosure and serve as a pivot point for deeper network intrusion.

Remediation Plan

Immediate Action: Update to version v0.x.y-security-1 or apply the fix provided in the referenced commit (a168608).

Proactive Monitoring: Review web application firewall (WAF) logs for suspicious outbound requests originating from the JunoClaw server.

Compensating Controls: Configure the server's network egress rules to block traffic to internal-only IP ranges and metadata services (e.g., 169.254.169.254).

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to expose internal network topology.

Analyst Recommendation

The JunoClaw platform should be updated immediately to the secured version. Until updates are applied, network-level egress filtering is strongly recommended to mitigate the impact of potential SSRF exploitation.

---METADATA---
VENDOR: Juno Network
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < 0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw exposes sensitive BIP-39 mnemonic seeds in LLM tool-call JSON data, risking credential theft via telemetry or logging surfaces.

Executive Summary:
JunoClaw versions prior to 0.x.y-security-1 are vulnerable to credential exposure, allowing unauthorized access to BIP-39 seed phrases through system logs and telemetry.

Vulnerability Details

CVE-ID: CVE-2026-43992

Affected Software: Juno Network JunoClaw

Affected Versions: < 0.x.y-security-1

Vulnerability: The platform included the BIP-39 mnemonic seed as an explicit parameter in MCP tool-call JSON strings. This practice exposes the recovery seed to any intermediate system, including logging, telemetry, and external LLM providers.

Business Impact

The exposure of BIP-39 seed phrases essentially grants an attacker full control over the associated wallets or contract assets. With a CVSS score of 9.8, the potential for total financial loss and unauthorized contract manipulation is extreme, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the JunoClaw platform to version 0.x.y-security-1 or higher to remove the inclusion of sensitive mnemonic data in tool calls.

Proactive Monitoring: Review logs, telemetry data, and LLM interaction history for any instances where mnemonic seeds may have been inadvertently recorded or stored.

Compensating Controls: If immediate patching is not possible, rotate all keys or wallets that may have been handled by the platform and isolate the platform from logging systems that store sensitive JSON payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the exposure of cryptographic keys is a high-severity incident that requires immediate attention.

Analyst Recommendation

The exposure of root-level credentials like BIP-39 seeds is a catastrophic failure. Organizations must treat this as a high-priority incident, update the software immediately, and assume that any credentials processed by previous versions are compromised.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is vulnerable to OS Command Injection, allowing attackers to execute arbitrary commands on the underlying host system.

Executive Summary:
A critical OS command injection vulnerability in JunoClaw allows unauthenticated attackers to achieve full system compromise via malicious input injection.

Vulnerability Details

CVE-ID: CVE-2026-43991

Affected Software: Dragonmonk111 JunoClaw

Affected Versions: < v0.x.y-security-1

Vulnerability: The application improperly neutralizes special elements used in OS commands (CWE-78), allowing an attacker to inject and execute arbitrary system commands. This is a high-impact flaw that does not require user interaction.

Business Impact

The CVSS score of 8.4 reflects the severity of this issue, as it grants an attacker complete control over the application environment. Successful exploitation can lead to total system takeover, data destruction, and the installation of persistent backdoors within the corporate infrastructure.

Remediation Plan

Immediate Action: Update JunoClaw to version v0.x.y-security-1 or apply the patch found in commit 2bc54f6.

Proactive Monitoring: Monitor system process logs for anomalous command execution or unexpected shell activity spawned by the application service user.

Compensating Controls: Run the application with the least privilege necessary and use a WAF to filter input containing shell metacharacters (e.g., ;, &, |).

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection remains one of the most critical classes of vulnerabilities due to the ease of achieving remote code execution.

Analyst Recommendation

This vulnerability represents an immediate and critical threat to the integrity of the JunoClaw platform. Administrators must prioritize the application of the vendor-supplied security update to prevent unauthorized code execution and host compromise.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: junoclaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is vulnerable to OS Command Injection, allowing an unauthenticated attacker to execute arbitrary commands on the underlying host system.

Executive Summary:
A critical OS command injection vulnerability in the Dragonmonk111 junoclaw platform poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-43990

Affected Software: Dragonmonk111 junoclaw

Affected Versions: < v0.x.y-security-1

Vulnerability: This vulnerability is an OS Command Injection (CWE-77/CWE-78) flaw. It allows an unauthenticated attacker to inject and execute arbitrary OS commands, as indicated by the CVSS vector AV:L (Local) but PR:N (No privilege required).

Business Impact

Successful exploitation results in full system compromise, as the attacker can execute commands with the privileges of the application process. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk that could lead to data exfiltration, service disruption, or the establishment of persistent backdoors within the infrastructure.

Remediation Plan

Immediate Action: Update the junoclaw platform to version v0.x.y-security-1 or later immediately.

Proactive Monitoring: Monitor system logs for unauthorized process execution, unusual child processes spawned by the application, or suspicious command-line activity.

Compensating Controls: Implement strict input validation at the network edge and ensure the application runs with the least privilege necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bypass input sanitization and execute shell commands directly.

Analyst Recommendation

Due to the critical nature of command injection vulnerabilities, organizations running junoclaw must prioritize patching. Failure to update to v0.x.y-security-1 leaves the host system exposed to complete takeover; immediate deployment of the vendor-provided patch is required to mitigate this risk.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: junoclaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw suffers from path traversal and link following vulnerabilities, allowing attackers to manipulate file access and potentially access sensitive files outside the intended directory.

Executive Summary:
An improper input validation flaw in the Dragonmonk111 junoclaw platform allows for path traversal and unauthorized file access, threatening data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-43989

Affected Software: Dragonmonk111 junoclaw

Affected Versions: < v0.x.y-security-1

Vulnerability: This vulnerability involves Improper Input Validation (CWE-20), Path Traversal (CWE-22), and Link Following (CWE-59). An unauthenticated attacker can leverage these flaws to access arbitrary files on the system or manipulate file resolution, despite the CVSS UI:R (User Interaction Required) requirement.

Business Impact

The ability to traverse directories and follow symbolic links allows an attacker to read sensitive configuration files, system data, or application secrets. With a CVSS score of 8.5, this vulnerability presents a significant risk to the confidentiality and integrity of the application, potentially leading to unauthorized data disclosure or escalation of privilege.

Remediation Plan

Immediate Action: Update the junoclaw platform to version v0.x.y-security-1 or later to resolve the input validation and path resolution flaws.

Proactive Monitoring: Review file access logs for attempts to access directories outside of the designated application paths or suspicious file system operations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns (e.g., ../) in incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction slightly reduces the immediate exploitability compared to fully automated vectors.

Analyst Recommendation

The combination of path traversal and link resolution vulnerabilities is a serious security oversight that must be addressed. Administrators should apply the patch to v0.x.y-security-1 without delay to prevent unauthorized file system access and potential data leakage.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: Prior to 2.17.1
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Tautulli allows unauthenticated attackers to force the server to fetch arbitrary URLs.

Executive Summary:
Tautulli is affected by a critical SSRF vulnerability that allows unauthenticated attackers to perform arbitrary server-side requests.

Vulnerability Details

CVE-ID: CVE-2026-43986

Affected Software: Tautulli

Affected Versions: Prior to 2.17.1

Vulnerability: The application exposes a public endpoint that resolves attacker-controlled image hashes, transforming an authenticated SSRF primitive into an unauthenticated SSRF gadget.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe risk. Attackers can leverage the server's internal network access to interact with internal services that are otherwise unreachable from the public internet, potentially leading to sensitive information disclosure or internal service exploitation.

Remediation Plan

Immediate Action: Upgrade Tautulli to version 2.17.1 or later immediately.

Proactive Monitoring: Inspect server logs for outbound requests to suspicious external URLs or internal network segments originating from the Tautulli host.

Compensating Controls: Ensure the Tautulli host is isolated from sensitive internal network zones and implement egress filtering to restrict unauthorized outbound connections.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the ease of unauthenticated exploitation. Organizations running Tautulli must upgrade to version 2.17.1 immediately to close the SSRF vector and prevent potential internal network probing.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability that could be exploited by an attacker.

Executive Summary:
An additional high-severity security vulnerability in Tautulli requires immediate remediation to maintain the security of the monitoring environment.

Vulnerability Details

CVE-ID: CVE-2026-43985

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Tautulli, a Python-based monitoring tool. It represents a significant security weakness that could be used by an attacker to facilitate unauthorized actions within the scope of the application.

Business Impact

The CVSS score of 8.8 justifies a high-severity rating, indicating that the vulnerability is easily exploitable or carries significant impact. Successful exploitation could lead to unauthorized system access or information leakage regarding the Plex media environment.

Remediation Plan

Immediate Action: Apply the latest security update released by the Tautulli project.

Proactive Monitoring: Check application access logs for unusual patterns and ensure that monitoring accounts have the minimum necessary privileges.

Compensating Controls: Place the Tautulli dashboard behind a secure VPN or an authenticated reverse proxy to reduce the risk of direct exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Tautulli must maintain a proactive patching schedule, especially given the high-severity nature of this entry. Immediate updates, combined with network-level access restrictions, are essential for mitigating the risk posed by this vulnerability.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability requiring immediate attention to prevent unauthorized access.

Executive Summary:
A high-severity vulnerability in Tautulli, a Plex monitoring tool, exposes the underlying system to significant risk of unauthorized access or exploitation.

Vulnerability Details

CVE-ID: CVE-2026-43984

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a security flaw within the Tautulli monitoring and tracking tool for Plex Media Server. While specific technical details are pending, the severity indicates a critical weakness in the application's security posture.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a substantial risk to any organization or home user relying on Tautulli. Exploitation could allow an attacker to compromise the host system, potentially leading to unauthorized access to the Plex Media Server environment.

Remediation Plan

Immediate Action: Update Tautulli to the latest version immediately.

Proactive Monitoring: Review application logs for suspicious activity and monitor the system for unauthorized configuration changes.

Compensating Controls: Ensure the Tautulli interface is not exposed to the public internet and use a reverse proxy with authentication to provide an additional layer of security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Tautulli users should prioritize updating their software to the latest release to address this high-severity flaw. Limiting exposure by restricting network access to the application is highly recommended as a baseline defense.

---METADATA---
VENDOR: Pocket
PRODUCT: pocket-id
AFFECTED_VERSIONS: < 2.6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pocket ID contains authorization and session management flaws, permitting authenticated users to bypass security controls or maintain invalid sessions.

Executive Summary:
A critical authorization and session management vulnerability in Pocket ID could allow attackers to bypass security controls and maintain unauthorized access to services.

Vulnerability Details

CVE-ID: CVE-2026-43983

Affected Software: Pocket pocket-id

Affected Versions: < 2.6.0

Vulnerability: This vulnerability involves Improper Authorization (CWE-285) and Insufficient Session Expiration (CWE-613). It allows an authenticated user to perform actions they are not authorized to access or maintain sessions longer than intended.

Business Impact

These flaws undermine the OIDC provider's security model, potentially allowing attackers to maintain persistence or perform actions on behalf of other users. Given the CVSS score of 8.1, the impact on identity management systems is severe, as it threatens the trust and authentication integrity of all services relying on Pocket ID.

Remediation Plan

Immediate Action: Update Pocket ID to version 2.6.0 or later to ensure proper authorization checks and session expiration logic are enforced.

Proactive Monitoring: Monitor authentication and session logs for anomalous login durations or users attempting to access restricted administrative functions.

Compensating Controls: Implement additional session validation at the service provider level and enforce short-lived session tokens as a temporary defense-in-depth measure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable in environments that rely solely on default OIDC session configurations.

Analyst Recommendation

The security of an OIDC provider is paramount to the entire ecosystem it protects. Given the existence of a proof-of-concept and the nature of the authorization bypass, immediate migration to version 2.6.0 is essential to protect user sessions and prevent unauthorized access to integrated services.

---METADATA---
VENDOR: wger
PRODUCT: wger
AFFECTED_VERSIONS: < 2.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The wger fitness manager application suffers from an improper privilege management vulnerability that allows low-privileged users to perform unauthorized administrative actions.

Executive Summary:
An improper privilege management vulnerability in wger allows authenticated users to escalate privileges, potentially leading to a total compromise of the application.

Vulnerability Details

CVE-ID: CVE-2026-43978

Affected Software: wger wger

Affected Versions: < 2.6

Vulnerability: This is an improper privilege management vulnerability (CWE-269) where the application fails to correctly validate the roles or permissions of an authenticated user. This allows a standard, authenticated user to perform actions reserved for higher-privileged accounts.

Business Impact

Successful exploitation results in unauthorized access to administrative functions, which could allow an attacker to modify user data, delete records, or alter application configuration. Given the CVSS score of 8.1, this represents a high risk to the confidentiality and integrity of the fitness data managed within the application.

Remediation Plan

Immediate Action: Update to the latest version of wger (version 2.6 or later) as soon as it becomes available to remediate the privilege management flaw.

Proactive Monitoring: Review administrative audit logs for any actions performed by standard user accounts that would typically require elevated privileges.

Compensating Controls: Restrict access to the wger instance via VPN or IP whitelisting until the patch is applied, and verify that all user accounts are limited to the minimum necessary permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Privilege management flaws are highly attractive to attackers as they provide a direct path to administrative control.

Analyst Recommendation

This vulnerability highlights a critical failure in the application access control model. Administrators must monitor the vendor repository for the release of version 2.6 and apply the update immediately to prevent unauthorized privilege escalation and protect sensitive user information.

---METADATA---
VENDOR: wger-project
PRODUCT: wger
AFFECTED_VERSIONS: < 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error in wger's gym-scope authorization check allows unprivileged users to perform full account takeovers of other users via password resets.

Executive Summary:
wger versions prior to 2.6 contain an authorization bypass vulnerability that allows an attacker to perform a full account takeover of other users.

Vulnerability Details

CVE-ID: CVE-2026-43948

Affected Software: wger-project wger

Affected Versions: < 2.6

Vulnerability: The application incorrectly performs a Python object comparison that evaluates None != None as False. This allows an attacker with gym.manage_gym permissions and no gym assignment to bypass authorization checks and reset the passwords of other users without a gym assignment.

Business Impact

This flaw permits one-shot full account takeover, granting attackers unauthorized access to sensitive user data and effectively locking out legitimate users. Given the near-perfect CVSS score of 9.9, the risk of data compromise and loss of system integrity is critical.

Remediation Plan

Immediate Action: Update the wger application to version 2.6 or later to correct the faulty authorization logic.

Proactive Monitoring: Monitor application logs for unusual password reset activity or unauthorized access attempts to user accounts.

Compensating Controls: Deploy a WAF to monitor for suspicious POST requests targeting password reset or user management endpoints.

Exploitation Status

Public Exploit Available: Not explicitly stated (PoC exists per SSVC)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the existence of a PoC and the simplicity of the logic error make this a high-risk target for automated attacks.

Analyst Recommendation

This vulnerability is highly critical due to the ease of account takeover. Organizations must update wger to version 2.6 immediately. Failure to patch will leave user accounts exposed to complete compromise by any user meeting the minor prerequisite conditions.

---METADATA---
VENDOR: frangoteam
PRODUCT: FUXA
AFFECTED_VERSIONS: 1.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FUXA contains an incorrect authorization vulnerability that allows unauthenticated attackers to bypass security restrictions.

Executive Summary:
An incorrect authorization flaw in FUXA allows unauthenticated attackers to bypass security controls and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-43947

Affected Software: frangoteam FUXA

Affected Versions: 1.3.0

Vulnerability: The software fails to properly enforce authorization checks, permitting unauthenticated attackers to perform actions that should be restricted to authorized users.

Business Impact

Unauthorized access to a SCADA or HMI dashboard can result in the loss of confidentiality and integrity regarding industrial processes. With a CVSS score of 8.9, this vulnerability presents a critical risk to the security posture of any environment utilizing the affected software.

Remediation Plan

Immediate Action: Update the fuxa-server component to version 1.3.1 or later.

Proactive Monitoring: Review application-level access logs for unexpected administrative actions performed by unauthenticated or low-privilege sessions.

Compensating Controls: Implement strict network segmentation to restrict access to the FUXA interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability stems from improper authorization logic, which is inherently dangerous in an industrial control context.

Analyst Recommendation

Given the potential for unauthorized access to sensitive control systems, administrators should treat this update as urgent. Applying the patch to version 1.3.1 is the only reliable method to remediate the authorization deficiency.

---METADATA---
VENDOR: frangoteam
PRODUCT: FUXA
AFFECTED_VERSIONS: >= 1.2.11, < 1.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FUXA contains multiple vulnerabilities including code injection and authentication bypass, allowing unauthenticated attackers to compromise the system.

Executive Summary:
Unauthenticated attackers can achieve full system compromise in FUXA via code injection and authentication bypass vulnerabilities.

Vulnerability Details

CVE-ID: CVE-2026-43945

Affected Software: frangoteam FUXA

Affected Versions: >= 1.2.11, < 1.3.1

Vulnerability: This issue encompasses improper control of code generation and authentication bypass mechanisms, which allow unauthenticated remote attackers to execute arbitrary code or bypass security controls.

Business Impact

Successful exploitation allows an attacker to gain full control over the FUXA process visualization environment, potentially leading to unauthorized manipulation of industrial controls or data exfiltration. Given the high CVSS score of 8.9, this vulnerability poses a severe risk to operational integrity and system availability.

Remediation Plan

Immediate Action: Update the FUXA software to version 1.3.1 or later.

Proactive Monitoring: Monitor network traffic and server access logs for unusual patterns, specifically looking for attempts to interact with administrative endpoints or unauthorized code execution signatures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads associated with code injection attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of code injection and authentication bypass flaws makes this a high priority for patching.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent potential remote code execution. System administrators must prioritize upgrading to version 1.3.1 to eliminate the underlying flaws.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: 3.0.6 to 3.8.14
---END_METADATA---

Description Summary:
The electerm client is vulnerable to local code execution via maliciously crafted deep links or command-line options.

Executive Summary:
A critical local code execution vulnerability in electerm allows attackers to execute arbitrary commands by tricking users into opening malicious links.

Vulnerability Details

CVE-ID: CVE-2026-43944

Affected Software: electerm

Affected Versions: 3.0.6 to 3.8.14

Vulnerability: The application fails to sanitize inputs provided via deep links or CLI arguments, allowing an attacker to inject and execute arbitrary OS commands when the application is launched.

Business Impact

With a CVSS score of 9.6, this vulnerability allows for local system compromise. An attacker gaining code execution on a user's machine can steal local credentials, access SSH keys, or pivot into internal network segments, causing significant security breaches.

Remediation Plan

Immediate Action: Update electerm to version 3.8.15 or later immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution spawned by the electerm application.

Compensating Controls: Implement endpoint protection (EDR) to detect and block abnormal command-line execution patterns originating from terminal/SSH clients.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires urgent attention, especially for users who frequently interact with external links or handle remote systems. Patching is the only effective way to mitigate the risk of command injection.

---METADATA---
VENDOR: Electerm
PRODUCT: Electerm
AFFECTED_VERSIONS: 3.8.15 and prior
---END_METADATA---

Description Summary:
A vulnerability in Electerm's terminal hyperlink handler allows arbitrary code execution or local file access when a user clicks a malicious link.

Executive Summary:
A critical vulnerability in Electerm allows attackers to achieve arbitrary code execution via a malicious terminal hyperlink, requiring immediate user caution.

Vulnerability Details

CVE-ID: CVE-2026-43941

Affected Software: Electerm

Affected Versions: 3.8.15 and prior

Vulnerability: The application passes terminal output links directly to shell.openExternal without protocol validation, allowing attackers to trigger arbitrary execution or file access.

Business Impact

With a CVSS score of 9.6, this flaw poses a severe risk to end-user workstations. Successful exploitation allows an attacker to gain control over the user's local machine, potentially leading to the theft of SSH keys, configuration files, or other sensitive local information.

Remediation Plan

Immediate Action: Users should exercise extreme caution and avoid clicking untrusted links in terminal outputs until a patch is released.

Proactive Monitoring: Monitor for unusual file access or process execution linked to the terminal application.

Compensating Controls: Use a different terminal client if possible or disable terminal hyperlink features if the application configuration permits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there are no public patches available. This significantly elevates the risk, as the vulnerability is currently unmitigated.

Analyst Recommendation

Maintain heightened vigilance when interacting with terminal sessions. If the software is used in a high-security environment, consider migrating to an alternative terminal client until the vendor releases a security update.

---METADATA---
VENDOR: YAFNET
PRODUCT: YAFNET.Core
AFFECTED_VERSIONS: >= 4.0.0-beta.1, < 4.0.5; < 3.2.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
YAFNET.Core is affected by multiple Cross-site Scripting (XSS) vulnerabilities due to improper neutralization of user-supplied input and output encoding during web page generation.

Executive Summary:
YAFNET.Core is vulnerable to Cross-site Scripting (XSS), which may allow an unauthenticated attacker to execute arbitrary scripts in the context of a user's browser session.

Vulnerability Details

CVE-ID: CVE-2026-43938

Affected Software: YAFNET YAFNET.Core

Affected Versions: >= 4.0.0-beta.1, < 4.0.5; < 3.2.12

Vulnerability: The application fails to properly sanitize or encode user input, leading to Stored or Reflected XSS. The vulnerability is exploitable by an unauthenticated remote attacker via crafted input that is subsequently rendered in a victim's browser.

Business Impact

Successful exploitation allows an attacker to hijack user sessions, steal sensitive cookies, or perform unauthorized actions on behalf of authenticated users. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full account compromise and potential exfiltration of sensitive forum data.

Remediation Plan

Immediate Action: Update the YAFNET.Core NuGet package to version 4.0.5 or 3.2.12 immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application logs for suspicious patterns, such as encoded script tags or abnormal characters within user-submitted content.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect incoming requests and block malicious payloads targeting the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from fundamental issues in how the application handles data output, making it highly susceptible to manipulation.

Analyst Recommendation

The presence of a proof-of-concept, combined with the high CVSS score, necessitates immediate attention. Administrators must prioritize updating to the patched versions to eliminate the underlying XSS vectors and prevent unauthorized access to user sessions.

---METADATA---
VENDOR: YAFNET
PRODUCT: YAFNET.Core
AFFECTED_VERSIONS: < 4.0.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
YAFNET.Core is susceptible to SQL Injection and improper workflow enforcement, allowing authenticated attackers to manipulate database queries and bypass intended system behaviors.

Executive Summary:
An SQL Injection vulnerability in YAFNET.Core allows an authenticated attacker to execute arbitrary database commands, posing a severe risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-43937

Affected Software: YAFNET YAFNET.Core

Affected Versions: < 4.0.5

Vulnerability: This vulnerability involves improper neutralization of special elements in SQL commands and flaws in behavioral workflow enforcement. It requires an authenticated user to trigger the injection, which can lead to unauthorized database interactions.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a critical risk to the confidentiality and integrity of the application database. An attacker could potentially extract sensitive user information, modify forum content, or escalate privileges, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update YAFNET.Core to version 4.0.5 to address the SQL injection flaw and restore secure workflow enforcement.

Proactive Monitoring: Monitor database query logs for unusual syntax, unexpected record access, or high volumes of failed query attempts that suggest injection testing.

Compensating Controls: Utilize a WAF to identify and block common SQL injection patterns, and ensure the database user account has only the minimum necessary privileges to restrict the impact of a potential breach.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for authentication limits the initial attack surface, but the potential for total impact (as noted by CISA) makes this a high-priority remediation.

Analyst Recommendation

SQL Injection remains one of the most dangerous vulnerability types due to the potential for total database compromise. Organizations using YAFNET.Core must apply the 4.0.5 update immediately to secure their backend data and prevent unauthorized administrative access.

---METADATA---
VENDOR: felippe-regazio
PRODUCT: ssrfcheck
AFFECTED_VERSIONS: <= 1.3.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The ssrfcheck library contains an incomplete blacklist for disallowed inputs, leading to a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to bypass security checks.

Executive Summary:
The ssrfcheck library is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete input validation list, enabling potential unauthorized requests to internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-43929

Affected Software: felippe-regazio ssrfcheck

Affected Versions: <= 1.3.0

Vulnerability: The library fails to adequately sanitize input strings, allowing attackers to bypass SSRF protection mechanisms. This vulnerability is remotely exploitable without authentication, potentially leading to unauthorized interaction with internal services.

Business Impact

An SSRF vulnerability allows an attacker to pivot into an internal network, potentially accessing private APIs, metadata services, or sensitive internal documentation. Given the CVSS score of 8.2, this represents a significant security risk, especially in cloud-hosted environments where internal metadata services (e.g., AWS IMDS) could be exposed.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, users should consider replacing the library with a more robust alternative or implementing additional input validation/whitelisting logic at the application layer.

Proactive Monitoring: Review outbound network traffic from the application server for unexpected connections to internal IP addresses or sensitive local ports.

Compensating Controls: Restrict the application server's network access via egress filtering/security groups to ensure it can only communicate with required external endpoints and cannot reach sensitive internal infrastructure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The reliance on a blacklist (CWE-184) makes this library inherently fragile against bypass techniques.

Analyst Recommendation

Because there is no immediate patch available, developers must exercise caution when using this library. Implementing strict egress filtering and alternative input validation logic is essential to mitigate the risk of internal network exposure until a permanent fix is released.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: >= 0.6.10, < 0.8.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
FOSSBilling is susceptible to a code injection vulnerability, allowing an authenticated administrator to execute arbitrary code within the application environment.

Executive Summary:
An authenticated code injection vulnerability in FOSSBilling poses a severe risk of full system compromise for affected installations.

Vulnerability Details

CVE-ID: CVE-2026-43921

Affected Software: FOSSBilling FOSSBilling

Affected Versions: >= 0.6.10, < 0.8.0

Vulnerability: This vulnerability is a Code Injection (CWE-94) flaw that occurs due to improper control of code generation. It requires the attacker to have high-level administrative (PR:H) privileges to successfully trigger the injection.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server, leading to a complete compromise of the billing system and sensitive client data. With a CVSS score of 8.9, this is a high-severity issue that could result in unauthorized data exfiltration, service disruption, and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade to version 0.8.0 or the latest available release as specified by the vendor to remediate this code injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual execution patterns or unauthorized administrative activity that may indicate an attempt to leverage these high-level privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common code injection payloads, limiting the potential for exploitation until an update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the administrative privileges required, this vulnerability represents a significant risk of internal system takeover. Administrators should prioritize upgrading their FOSSBilling instances to the patched version immediately to ensure the integrity and security of the billing environment.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: < 0.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FOSSBilling suffers from an insufficient session expiration vulnerability, which may allow attackers to maintain unauthorized access to user sessions.

Executive Summary:
A critical session management vulnerability in FOSSBilling permits the persistence of unauthorized access due to insufficient session expiration controls.

Vulnerability Details

CVE-ID: CVE-2026-43918

Affected Software: FOSSBilling FOSSBilling

Affected Versions: < 0.8.0

Vulnerability: The application fails to properly expire sessions (CWE-613), allowing an authenticated attacker or a malicious actor who has hijacked a session to maintain access longer than intended. This flaw effectively bypasses standard security logout procedures.

Business Impact

With a CVSS score of 8.7, this vulnerability presents a high risk for unauthorized account takeover and long-term persistence in the system. The inability to reliably terminate sessions means that compromised accounts remain vulnerable until manually invalidated or purged by administrators, increasing the likelihood of unauthorized data access and fraudulent billing transactions.

Remediation Plan

Immediate Action: Update the FOSSBilling installation to version 0.8.0 or later to ensure robust session lifecycle management.

Proactive Monitoring: Monitor for active sessions that persist beyond expected timeframes and inspect logs for concurrent or anomalous login activity from suspicious IP addresses.

Compensating Controls: Enforce short session timeouts and require re-authentication for sensitive operations to mitigate the window of opportunity for session-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining secure session management is fundamental to platform security. Administrators must treat this as a high-priority update to prevent session hijacking and unauthorized persistence. Applying the 0.8.0 patch is the only definitive way to resolve the underlying session expiration defect.

---METADATA---
VENDOR: Vaultwarden
PRODUCT: Vaultwarden
AFFECTED_VERSIONS: < 1.35.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Vaultwarden is vulnerable to improper restriction of excessive authentication attempts, which may allow attackers to conduct brute-force attacks against user accounts.

Executive Summary:
Vaultwarden contains a vulnerability that fails to restrict excessive authentication attempts, increasing the risk of successful brute-force attacks.

Vulnerability Details

CVE-ID: CVE-2026-43914

Affected Software: Vaultwarden Vaultwarden

Affected Versions: < 1.35.4

Vulnerability: This vulnerability (CWE-307) involves the failure to properly restrict excessive authentication attempts. The vulnerability is network-accessible and does not require authentication to initiate, making it a target for remote brute-force operations.

Business Impact

The CVSS score of 7.3 highlights the risk of unauthorized account access. If successfully exploited, an attacker could potentially gain control of user accounts, leading to the theft of stored credentials or sensitive vault data, which carries significant reputational and security consequences for organizations relying on Vaultwarden.

Remediation Plan

Immediate Action: Update Vaultwarden to version 1.35.4 or later to ensure proper rate limiting on authentication attempts.

Proactive Monitoring: Monitor authentication logs for repeated failed login attempts from single IP addresses or abnormal surges in login traffic.

Compensating Controls: Implement multi-factor authentication (MFA) for all users and use rate-limiting features at the network edge or WAF level to block excessive authentication attempts.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Given the potential for automated exploitation, it is essential to patch to version 1.35.4 immediately. In addition to patching, organizations should enforce strong password policies and multi-factor authentication to provide defense-in-depth against credential-based attacks.

---METADATA---
VENDOR: dani-garcia
PRODUCT: vaultwarden
AFFECTED_VERSIONS: < 1.35.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Vaultwarden is affected by an incorrect authorization vulnerability that could allow authenticated users to perform unauthorized operations, leading to potential data corruption or service disruption.

Executive Summary:
An incorrect authorization vulnerability in Vaultwarden versions prior to 1.35.5 allows authenticated attackers to perform unauthorized actions, threatening system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-43913

Affected Software: dani-garcia Vaultwarden

Affected Versions: < 1.35.5

Vulnerability: The software is susceptible to CWE-863 (Incorrect Authorization), where an authenticated user can bypass security checks to perform operations that should be restricted. This vulnerability stems from improper validation of authorization tokens or permissions during authenticated sessions.

Business Impact

With a CVSS score of 8.1 (High), this vulnerability presents a substantial risk to the integrity and availability of the password management server. Unauthorized modification or disruption of service can lead to significant operational downtime and compromise the security of stored credentials managed by the platform.

Remediation Plan

Immediate Action: Update Vaultwarden to version 1.35.5 or later to apply the necessary authorization fixes.

Proactive Monitoring: Monitor server logs for unauthorized API calls or unexpected errors associated with user session tokens.

Compensating Controls: Ensure that the server is hosted within a secure, segmented network and limit administrative access to authorized personnel only.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit exists in curated sources).

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily internal, as the vulnerability requires an authenticated session to exploit.

Analyst Recommendation

Although there is no current evidence of active exploitation, the nature of the vulnerability in a password management component necessitates immediate attention. Update to version 1.35.5 promptly to close the authorization gap and protect the sensitive data handled by the Vaultwarden instance.

---METADATA---
VENDOR: dani-garcia
PRODUCT: vaultwarden
AFFECTED_VERSIONS: < 1.35.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Vaultwarden is affected by an improper authorization vulnerability that allows highly privileged users to bypass security constraints, potentially compromising the entire server environment.

Executive Summary:
An improper authorization flaw in Vaultwarden versions prior to 1.35.5 permits high-privilege users to bypass security boundaries, creating a critical risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-43912

Affected Software: dani-garcia Vaultwarden

Affected Versions: < 1.35.5

Vulnerability: This vulnerability is classified as CWE-285 (Improper Authorization). It allows a user with high privileges to execute actions or access resources outside their intended scope by exploiting flaws in the authorization enforcement mechanism.

Business Impact

With a CVSS score of 8.7 (High), this vulnerability is severe because it allows for cross-security-boundary operations. Successful exploitation could lead to complete administrative compromise of the password server, resulting in the total loss of confidentiality and integrity for all stored secrets.

Remediation Plan

Immediate Action: Update Vaultwarden to version 1.35.5 or later immediately to resolve the authorization bypass.

Proactive Monitoring: Conduct a thorough audit of administrative logs and user activity to ensure that no unauthorized configuration changes or data exports have occurred.

Compensating Controls: Restrict access to the management interface to internal, trusted networks and implement multi-factor authentication (MFA) to prevent unauthorized credential usage.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit exists in curated sources).

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The high severity reflects the potential for a privileged user to escalate their impact significantly.

Analyst Recommendation

The severity of this vulnerability, combined with the existence of a proof-of-concept, makes rapid remediation essential. Organizations must update their Vaultwarden instances to version 1.35.5 immediately to prevent potential exploitation and maintain the security of their stored secrets.

---METADATA---
VENDOR: Appium
PRODUCT: java-client
AFFECTED_VERSIONS: >= 8.2.1, < 10.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Appium Java Client is vulnerable to Server-Side Request Forgery and confused deputy attacks due to improper handling of the W3C WebDriver protocol.

Executive Summary:
A high-severity SSRF and confused deputy vulnerability in the Appium Java Client (versions 8.2.1 through 10.1.0) could allow unauthenticated attackers to perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-43910

Affected Software: Appium java-client

Affected Versions: >= 8.2.1, < 10.1.1

Vulnerability: The vulnerability involves CWE-441 (Confused Deputy) and CWE-918 (SSRF). An unauthenticated attacker can leverage the client to force the server to perform unintended requests, effectively using the application as a proxy to interact with internal or external resources.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to internal network security. By exploiting this flaw, an attacker could potentially scan internal infrastructure, access local services, or interact with sensitive APIs that are otherwise protected by network perimeters, leading to widespread system compromise.

Remediation Plan

Immediate Action: Update the Appium Java Client library to version 10.1.1 or later via your dependency management system (e.g., Maven).

Proactive Monitoring: Inspect network traffic originating from build servers or testing environments for unauthorized outbound connections to internal or sensitive external IP addresses.

Compensating Controls: Ensure that testing environments are isolated from production networks and that egress traffic is restricted via firewall rules to prevent unauthorized requests.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit)

Analyst Notes: As of July 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of the flaw makes it highly suitable for automated scanning and internal network reconnaissance.

Analyst Recommendation

The availability of a proof-of-concept increases the risk of exploitation for this vulnerability. Development and QA teams should prioritize updating the Appium Java Client dependency in all projects to version 10.1.1 to eliminate the SSRF and confused deputy vectors.

---METADATA---
VENDOR: Academy Software Foundation
PRODUCT: OpenImageIO
AFFECTED_VERSIONS: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenImageIO contains memory safety vulnerabilities including out-of-bounds read/write and integer overflows, which can be triggered when processing maliciously crafted image files.

Executive Summary:
OpenImageIO is affected by multiple memory corruption vulnerabilities that could allow an unauthenticated attacker to achieve arbitrary code execution or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-43909

Affected Software: Academy Software Foundation OpenImageIO

Affected Versions: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0

Vulnerability: The application is susceptible to CWE-125 (Out-of-bounds Read), CWE-190 (Integer Overflow), and CWE-787 (Out-of-bounds Write) when parsing image files. These flaws allow an unauthenticated attacker to trigger memory corruption via a specially crafted image file, typically requiring user interaction to open the file.

Business Impact

With a CVSS score of 8.8 (High), these vulnerabilities pose a significant risk to the confidentiality, integrity, and availability of systems utilizing OpenImageIO. Successful exploitation could lead to full system compromise or service disruption, particularly in production pipelines where VFX and animation assets are frequently processed.

Remediation Plan

Immediate Action: Update OpenImageIO to version 3.0.18.0 or 3.1.13.0, or apply the relevant upstream fix commits provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected application crashes or abnormal memory usage patterns during image processing tasks.

Compensating Controls: Implement strict input validation or sandboxing for image processing workflows to prevent the loading of untrusted or malformed files.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of May 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of these memory corruption flaws makes them highly attractive for weaponization.

Analyst Recommendation

Given the potential for arbitrary code execution, organizations should prioritize patching OpenImageIO in all environments that handle external or untrusted image data. Apply the identified version updates immediately to mitigate the risk of memory-based exploitation.

---METADATA---
VENDOR: Academy Software Foundation
PRODUCT: OpenImageIO
AFFECTED_VERSIONS: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenImageIO is vulnerable to integer overflow and out-of-bounds write conditions that can lead to memory corruption when parsing malformed image files.

Executive Summary:
Academy Software Foundation OpenImageIO is affected by critical memory corruption vulnerabilities that could lead to unauthorized system access or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-43908

Affected Software: Academy Software Foundation OpenImageIO

Affected Versions: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0

Vulnerability: The software suffers from CWE-190 (Integer Overflow) and CWE-787 (Out-of-bounds Write) vulnerabilities. An unauthenticated attacker can exploit these issues by tricking a user into processing a malicious image file, resulting in memory corruption.

Business Impact

The CVSS score of 8.8 highlights the severity of this vulnerability. Successful exploitation can result in the execution of arbitrary code with the privileges of the application, leading to potential data breaches and total loss of system integrity in VFX and animation environments.

Remediation Plan

Immediate Action: Upgrade to OpenImageIO version 3.0.18.0, 3.1.13.0, or newer to resolve the underlying memory management flaws.

Proactive Monitoring: Review application error logs for segmentation faults or abnormal exit codes associated with image parsing modules.

Compensating Controls: Utilize sandboxed processing environments or restricted service accounts for image manipulation tasks to limit the impact of a potential exploit.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of May 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. These flaws are inherent to the parsing logic and may be reachable via various file formats.

Analyst Recommendation

Due to the severity of the potential impact, all affected installations of OpenImageIO should be updated to the patched versions as a matter of urgency. Ensure that all downstream dependencies are also updated to maintain consistency and security across the infrastructure.

---METADATA---
VENDOR: Academy Software Foundation
PRODUCT: OpenImageIO
AFFECTED_VERSIONS: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenImageIO contains integer overflow and out-of-bounds write vulnerabilities that can be triggered through the processing of maliciously crafted image file formats.

Executive Summary:
Academy Software Foundation OpenImageIO is vulnerable to critical memory corruption flaws that may allow an unauthenticated attacker to compromise the integrity and availability of the host system.

Vulnerability Details

CVE-ID: CVE-2026-43907

Affected Software: Academy Software Foundation OpenImageIO

Affected Versions: < 3.0.18.0, >= 3.1.4.0-beta, < 3.1.13.0

Vulnerability: The library is vulnerable to CWE-190 (Integer Overflow) and CWE-787 (Out-of-bounds Write) due to improper validation of input data. An unauthenticated attacker can trigger these conditions via malicious image files, which may lead to memory corruption or arbitrary code execution.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant threat to production environments. Exploitation could lead to unauthorized access or the complete disruption of rendering and animation pipelines, causing significant operational downtime and potential data loss.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading OpenImageIO to version 3.0.18.0 or 3.1.13.0.

Proactive Monitoring: Monitor memory consumption and application stability when processing high volumes of image data from external sources.

Compensating Controls: Deploy Web Application Firewalls (WAF) or file integrity monitoring tools to detect or block the transfer of malformed or suspicious image files.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of May 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of these memory flaws requires careful handling of input files to trigger successfully.

Analyst Recommendation

The risk posed by these memory-related vulnerabilities requires immediate administrative attention. Administrators must update the OpenImageIO library to the latest patched version to ensure full protection against potential exploitation attempts.

---METADATA---
VENDOR: Academy Software Foundation
PRODUCT: OpenImageIO
AFFECTED_VERSIONS: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
OpenImageIO contains a heap-based buffer overflow vulnerability that can be triggered by processing specially crafted image files, potentially leading to arbitrary code execution.

Executive Summary:
A critical heap-based buffer overflow in OpenImageIO could allow an attacker to execute arbitrary code by supplying a malicious image file to the application.

Vulnerability Details

CVE-ID: CVE-2026-43906

Affected Software: Academy Software Foundation OpenImageIO

Affected Versions: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0

Vulnerability: This is a CWE-122 (Heap-based Buffer Overflow) vulnerability. It is triggered when the software fails to properly validate the size of image data during processing, allowing an attacker to overwrite heap memory.

Business Impact

The potential for arbitrary code execution poses a severe threat to any system processing untrusted imagery. This could lead to total system compromise, data theft, or malware installation. The CVSS score of 7.8 indicates a high severity, as it allows for significant technical impact on the host system.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to remediate the buffer overflow.

Proactive Monitoring: Implement robust input validation and sandboxing for any image processing pipelines that utilize the OpenImageIO library.

Compensating Controls: Use memory-safe wrappers or process isolation (containers) to limit the impact if a heap overflow occurs during file processing.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via malformed image files, which are common attack vectors in VFX and animation workflows.

Analyst Recommendation

Given the existence of a proof-of-concept and the potential for code execution, it is imperative that all software relying on OpenImageIO is updated immediately. Organizations should treat this as a high-priority vulnerability, especially in environments where files from external sources are frequently processed.