---METADATA---
VENDOR: Isaacs
PRODUCT: minimatch
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The minimatch library, a JavaScript utility for glob matching, is vulnerable to a flaw that could result in application instability or unauthorized processing of malicious expressions.

Executive Summary:
The minimatch JavaScript library contains a high-severity vulnerability that could allow attackers to trigger a denial-of-service or compromise application logic through malformed glob expressions.

Vulnerability Details

CVE-ID: CVE-2026-27903

Affected Software: minimatch

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the way the minimatch utility converts glob expressions into JavaScript Regular Expressions. An attacker providing a specially crafted input string could potentially trigger a Regular Expression Denial of Service (ReDoS) or bypass intended matching logic.

Business Impact

Because minimatch is a foundational dependency in many Node.js applications and build tools, a vulnerability here has a wide-reaching impact. Exploitation could result in significant application downtime, increased CPU consumption on servers, or the bypassing of security filters that rely on glob matching for file or path authorization. The CVSS score of 7.5 reflects these substantial operational risks.

Remediation Plan

Immediate Action: Update the minimatch package to the latest version via npm or your preferred package manager and redeploy affected applications.

Proactive Monitoring: Monitor application performance for sudden spikes in CPU usage, which may indicate an attempt to exploit a ReDoS vulnerability.

Compensating Controls: Implement input validation to sanitize and limit the length and complexity of user-provided strings that are passed to glob-matching functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in widely used utility libraries are often targeted quickly once details are released to the developer community.

Analyst Recommendation

It is critical to identify all internal applications and CI/CD pipelines that utilize the minimatch library. Immediate updates are required to ensure that these applications remain resilient against denial-of-service attacks and to maintain the integrity of path-matching security controls.

---METADATA---
VENDOR: Vociferous
PRODUCT: Vociferous
AFFECTED_VERSIONS: Prior to 4.4.2
---END_METADATA---

Description Summary:
Vociferous prior to 4.4.2 contains an unauthenticated directory traversal vulnerability in the export_file route, enabling arbitrary file writes to any location accessible by the application.

Executive Summary:
Vociferous versions prior to 4.4.2 are vulnerable to a critical unauthenticated directory traversal attack that allows remote actors to overwrite system files or deploy malicious payloads.

Vulnerability Details

CVE-ID: CVE-2026-27897

Affected Software: Vociferous

Affected Versions: Prior to 4.4.2

Vulnerability: The vulnerability exists in src/api/system.py within the export_file route. Because the API is unauthenticated and lacks filename validation, an attacker can use directory traversal sequences (e.g., ../) to bypass the intended UI and write arbitrary data to any path reachable by the user running the application.

Business Impact

With a CVSS score of 10.0, this is a maximum-severity vulnerability. Attackers can achieve full system compromise by overwriting critical configuration files or placing executable scripts in startup directories. The overly permissive CORS configuration further increases the risk of exploitation via cross-site requests.

Remediation Plan

Immediate Action: Update Vociferous to version 4.4.2 or later immediately to resolve the lack of input validation in the filesystem logic.

Proactive Monitoring: Review filesystem integrity for unauthorized changes in sensitive directories and monitor API logs for requests containing directory traversal patterns in the JSON payload.

Compensating Controls: Restrict network access to the Vociferous API using a firewall and modify the CORS configuration to disallow wildcard origins, limiting the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, the combination of unauthenticated access and arbitrary file write makes this an extremely attractive target for attackers.

Analyst Recommendation

The ability to write arbitrary files as an unauthenticated user is a critical failure in the application's security architecture. The urgency to apply the 4.4.2 patch cannot be overstated; failure to do so leaves the host system entirely exposed to remote compromise.

---METADATA---
VENDOR: FacturaScripts
PRODUCT: FacturaScripts
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
FacturaScripts accounting and invoicing software contains an unspecified vulnerability requiring immediate attention.

Executive Summary:
FacturaScripts is affected by a security vulnerability that may expose accounting systems to unauthorized access or compromise.

Vulnerability Details

CVE-ID: CVE-2026-27891

Affected Software: FacturaScripts

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided data lacks specific technical details regarding the vulnerability type or the authentication requirements necessary for exploitation.

Business Impact

The vulnerability carries a CVSS score of 7.2, placing it in the High severity category. Successful exploitation could lead to unauthorized access to sensitive financial data, invoicing manipulation, or potential disruption of core business accounting operations.

Remediation Plan

Immediate Action: Monitor official FacturaScripts security channels for patch availability and apply updates as soon as they are released.

Proactive Monitoring: Review application access logs for unauthorized administrative activity or unusual API requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block suspicious traffic patterns directed at the accounting interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the software, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the monitoring of the FacturaScripts vendor advisory portal. Apply all security patches immediately upon release to mitigate the risk of data exposure.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Piwigo photo gallery application, potentially impacting web-based image hosting security.

Executive Summary:
An additional high-severity security vulnerability in Piwigo requires immediate administrative review to ensure the integrity of web-hosted content.

Vulnerability Details

CVE-ID: CVE-2026-27885

Affected Software: Piwigo Photo Gallery

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An unspecified security vulnerability exists within the Piwigo application. Further technical details remain pending; however, the severity necessitates proactive patching.

Business Impact

With a CVSS score of 7.2, this vulnerability poses a high risk to organizational web assets. Successful exploitation could facilitate unauthorized access to private content or administrative functions, potentially leading to data loss or service disruption.

Remediation Plan

Immediate Action: Update all Piwigo instances to the latest available version provided by the vendor.

Proactive Monitoring: Review application logs for any irregular activity or unauthorized configuration changes to the photo gallery.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rulesets to protect against potential web-based attack vectors targeting Piwigo.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency. Ensure that all instances of Piwigo are patched and that security configurations are reviewed to defend against potential exploitation.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana
AFFECTED_VERSIONS: See vendor advisory; affects OSS and Enterprise versions
---END_METADATA---

Description Summary:
A chained attack involving SQL Expressions and a Grafana Enterprise plugin enables remote arbitrary code execution (RCE) when the sqlExpressions feature toggle is active.

Executive Summary:
Grafana instances with the sqlExpressions feature enabled are at critical risk of Remote Code Execution (RCE) through a chained vulnerability in Enterprise plugins.

Vulnerability Details

CVE-ID: CVE-2026-27876

Affected Software: Grafana (OSS and Enterprise)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a chained vulnerability where the "sqlExpressions" feature toggle in Grafana OSS interacts with a Grafana Enterprise plugin to allow Remote Code Execution. An attacker can exploit this chain to execute arbitrary code on the host system.

Business Impact

The CVSS score of 9.1 indicates a critical risk to the organization. Successful exploitation allows an attacker to gain full control over the Grafana server, potentially leading to lateral movement within the network, data exfiltration, and complete compromise of the monitoring infrastructure. This could result in prolonged service outages and significant security remediation costs.

Remediation Plan

Immediate Action: Update Grafana and all Enterprise plugins to the latest versions immediately. If patching is not possible, disable the sqlExpressions feature toggle in the Grafana configuration.

Proactive Monitoring: Monitor system logs for unauthorized shell execution or unexpected network connections originating from the Grafana server.

Compensating Controls: Restrict access to the Grafana web interface to authorized internal users only and ensure the service is running with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of the chain may limit widespread exploitation, but the RCE impact makes it a high-priority target.

Analyst Recommendation

Due to the potential for Remote Code Execution, this vulnerability must be addressed with the highest urgency. Administrators should prioritize upgrading their Grafana environment and verifying that the sqlExpressions feature is only enabled if absolutely necessary and properly secured.

---METADATA---
VENDOR: Dovecot
PRODUCT: Doveadm
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Doveadm credentials are verified using direct comparison, creating a timing oracle vulnerability that allows attackers to potentially guess sensitive information.

Executive Summary:
A high-severity timing oracle vulnerability in Doveadm credential verification could allow attackers to perform unauthorized authentication by analyzing response times.

Vulnerability Details

CVE-ID: CVE-2026-27856

Affected Software: Dovecot (Doveadm)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The doveadm utility uses direct string comparison for credential verification instead of constant-time comparison. This unauthenticated remote flaw allows an attacker to measure the time taken for the server to respond, eventually deducing the correct credentials through a timing oracle attack.

Business Impact

A successful timing attack can lead to unauthorized access to the mail system, resulting in data breaches, unauthorized reading of emails, and potential administrative control over the mail server. The CVSS score of 7.4 reflects the high risk to confidentiality and access control.

Remediation Plan

Immediate Action: Apply the latest security updates from Dovecot immediately to ensure that credential comparisons are performed in constant time.

Proactive Monitoring: Review authentication logs for an abnormally high number of failed login attempts from single IP addresses, which may indicate a timing attack in progress.

Compensating Controls: Implement fail2ban or similar rate-limiting tools to block IP addresses that exceed a threshold of failed authentication attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation. Timing attacks require high precision and low network jitter but are a proven method for credential recovery.

Analyst Recommendation

While timing attacks are more complex to execute than buffer overflows, they are highly effective against poorly implemented authentication routines. Organizations should apply vendor patches immediately to move to constant-time verification.

---METADATA---
VENDOR: SenseLive
PRODUCT: X3050
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the SenseLive X3050 web management interface allows unauthorized modification of configuration parameters, leading to a persistent Denial-of-Service (DoS).

Executive Summary:
A critical vulnerability in the SenseLive X3050 web management interface allows unauthenticated attackers to trigger a persistent lockout, resulting in total denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-27843

Affected Software: SenseLive X3050

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The web management interface lacks sufficient authentication and validation for critical configuration parameters. Attackers can inject disruptive values, rendering the device unreachable without physical console intervention.

Business Impact

A CVSS score of 9.1 reflects the severe operational impact of this vulnerability. Because the device lacks a physical reset button, a successful exploit forces a costly, manual technical recovery, causing significant downtime for both the gateway and downstream RS-485 systems.

Remediation Plan

Immediate Action: Update the firmware to the latest version provided by SenseLive and restrict web management interface access to authorized internal networks.

Proactive Monitoring: Monitor for unauthorized attempts to access the device management page and audit configuration changes.

Compensating Controls: Use a dedicated management VLAN and firewall rules to strictly limit access to the X3050 web interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the difficulty of recovering from this DoS condition, it is imperative to secure the management interface immediately. We recommend applying the latest firmware and implementing strict network-level access controls to prevent unauthorized configuration changes.

---METADATA---
VENDOR: Unknown
PRODUCT: MR-GM5L-S1 and MR-GM5A-L1
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
The MR-GM5L-S1 and MR-GM5A-L1 devices contain an authentication bypass vulnerability that allows unauthorized users to modify device configurations.

Executive Summary:
An authentication bypass vulnerability in MR-GM5L-S1 and MR-GM5A-L1 devices creates a critical risk of unauthorized configuration changes and potential loss of device control.

Vulnerability Details

CVE-ID: CVE-2026-27842

Affected Software: Unknown, MR-GM5L-S1 and MR-GM5A-L1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The devices are susceptible to an authentication bypass, which permits unauthenticated attackers to gain administrative access and alter critical device settings.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for full control over affected hardware. This could lead to a complete compromise of the device, disruption of services, or the creation of persistent backdoors, posing a significant risk to operational continuity.

Remediation Plan

Immediate Action: Identify the vendor for the MR-GM5L-S1 and MR-GM5A-L1 models and apply the latest security firmware update provided by the manufacturer.

Proactive Monitoring: Monitor device configuration logs for unauthorized changes and observe network traffic for anomalous administrative activity.

Compensating Controls: Isolate affected devices from the public internet using firewalls or VPNs to restrict access until a patch is applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of an authentication bypass, immediate mitigation is required. Administrators should verify the affected hardware and apply manufacturer-supplied patches as soon as they become available.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
phpMyFAQ, an open-source FAQ web application, is affected by a high-severity vulnerability that could allow for unauthorized system interaction.

Executive Summary:
A high-severity flaw in the phpMyFAQ application poses a risk to the confidentiality and integrity of the knowledge base, potentially allowing for unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-27836

Affected Software: phpMyFAQ phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability impacts phpMyFAQ, an open-source FAQ management system. The CVSS score of 7.5 suggests a high-impact flaw, likely involving improper input validation or an authentication bypass that could be exploited by an attacker to gain unauthorized access to the application’s administrative or data functions.

Business Impact

Successful exploitation could result in the unauthorized modification of FAQ content or the exposure of sensitive internal documentation. Given the CVSS score of 7.5, this represents a significant risk to organizations that rely on phpMyFAQ for providing critical information to users or employees.

Remediation Plan

Immediate Action: Update phpMyFAQ to the latest stable version immediately to apply necessary security patches.

Proactive Monitoring: Review application access logs for suspicious activity, particularly around administrative functions and user management pages.

Compensating Controls: Use a Web Application Firewall (WAF) to block common web attack vectors and ensure the application is running on a secured, hardened web server environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. As an open-source application, the disclosure of this flaw may lead to the rapid development of exploits.

Analyst Recommendation

It is strongly recommended that administrators of phpMyFAQ installations apply the latest security updates immediately. Addressing this high-severity vulnerability is essential to maintaining the security and reliability of the knowledge base.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Piwigo, an open-source photo gallery application for the web.

Executive Summary:
A high-severity security vulnerability in the Piwigo photo gallery application could allow attackers to compromise web-hosted image repositories.

Vulnerability Details

CVE-ID: CVE-2026-27834

Affected Software: Piwigo Photo Gallery

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to an unspecified security flaw within the Piwigo application. Users should verify their version against vendor advisories to assess the risk of unauthorized access or data exposure.

Business Impact

With a CVSS score of 7.2, this vulnerability represents a significant risk to the security of web-based media hosting. Potential impacts include unauthorized access to private galleries, data exfiltration, or defacement of the web portal, which could damage organizational reputation.

Remediation Plan

Immediate Action: Update the Piwigo installation to the most recent version provided by the project maintainers.

Proactive Monitoring: Monitor web server logs for suspicious URL requests or unauthorized administrative access attempts within the Piwigo interface.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the Piwigo application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators of Piwigo instances must prioritize the application of security patches. Given the public-facing nature of these applications, prompt remediation is necessary to prevent exploitation by external actors.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Piwigo, an open-source photo gallery application, contains a security vulnerability that could allow for unauthorized access or site compromise.

Executive Summary:
A security flaw in Piwigo photo gallery software could allow attackers to gain unauthorized access to media or compromise the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-27833

Affected Software: Piwigo

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists in Piwigo, a web-based photo gallery. Although the specific flaw is not detailed, it likely involves vulnerabilities common to PHP-based gallery software, such as insecure file uploads, XSS, or SQL injection.

Business Impact

A successful exploit could lead to the theft of private images, unauthorized modification of the gallery, or full server compromise if the attacker can execute arbitrary code. This poses a significant risk to data privacy and system integrity. The CVSS score of 7.5 reflects the High severity of the risk.

Remediation Plan

Immediate Action: Update Piwigo to the latest available version immediately to apply the necessary security fixes.

Proactive Monitoring: Monitor the web server for the creation of unusual files, especially in upload directories, and review application logs for unauthorized administrative logins.

Compensating Controls: Restrict file upload permissions and use a Web Application Firewall (WAF) to block malicious web traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Web-based gallery applications are frequently targeted by automated exploit kits.

Analyst Recommendation

Maintaining the security of web-facing applications like Piwigo is essential. Administrators should prioritize the installation of the latest security patches and ensure the underlying server environment is hardened against common web attacks.

---METADATA---
VENDOR: Model Context Protocol (MCP)
PRODUCT: MCP Atlassian Server
AFFECTED_VERSIONS: Versions prior to 0.17.0
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the MCP Atlassian server allows attackers to write arbitrary files to the server, potentially leading to remote code execution.

Executive Summary:
A critical file-write vulnerability in the MCP Atlassian server allows attackers to achieve remote code execution by bypassing directory boundaries.

Vulnerability Details

CVE-ID: CVE-2026-27825

Affected Software: MCP Atlassian (Server for Confluence and Jira)

Affected Versions: Prior to version 0.17.0

Vulnerability: The confluence_download_attachment tool fails to enforce directory boundaries on the download_path parameter. An attacker who can invoke this tool can write malicious content (such as a cron job) to any path the server process can access, leading to unauthenticated remote code execution (RCE).

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the host system, leading to a total compromise of the MCP server and potentially the linked Confluence or Jira instances. With a CVSS score of 9.0, this vulnerability presents an immediate threat to corporate data and server stability, as it allows for persistent access via malicious system files.

Remediation Plan

Immediate Action: Update the MCP Atlassian server to version 0.17.0 or higher immediately to implement the necessary path validation fixes.

Proactive Monitoring: Scan the server for unauthorized files in sensitive directories like /etc/cron.d/, /tmp/, or web root folders.

Compensating Controls: Run the MCP server process with the least privilege possible to limit the scope of files an attacker can overwrite if the vulnerability is triggered.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. However, the ability to achieve RCE via a simple path traversal in a download function is a well-known and highly effective attack pattern.

Analyst Recommendation

This RCE vulnerability is highly critical and should be patched immediately. Organizations using the MCP Atlassian server must prioritize the update to version 0.17.0. Additionally, administrators should review the permissions of the service account running the MCP server to ensure it does not have unnecessary write access to system-critical directories.

---METADATA---
VENDOR: RustFS
PRODUCT: RustFS Console
AFFECTED_VERSIONS: Versions prior to 1.0.0-alpha.83
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the RustFS Console allows attackers to steal administrator credentials and achieve full system compromise.

Executive Summary:
Attackers can exploit a stored XSS flaw in the RustFS management console to hijack administrator sessions and gain complete control over the distributed storage system.

Vulnerability Details

CVE-ID: CVE-2026-27822

Affected Software: RustFS Console

Affected Versions: Versions prior to 1.0.0-alpha.83

Vulnerability: The vulnerability exists in the PDF preview logic of the management console. By bypassing this logic, an attacker can store a malicious payload that executes arbitrary JavaScript in the browser of any administrator who views it, enabling the theft of credentials from localStorage.

Business Impact

Compromise of the RustFS Console grants an attacker full access to the distributed object storage system. This could lead to massive data breaches, unauthorized data deletion, or the injection of malicious files into the storage network. The CVSS score of 9.0 reflects this high potential for system-wide impact.

Remediation Plan

Immediate Action: Update RustFS to version 1.0.0-alpha.83 to resolve the XSS vulnerability and secure the PDF preview component.

Proactive Monitoring: Monitor the RustFS Console for unusual administrative logins and audit the storage system for any unauthorized file uploads or configuration changes.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts the execution of inline scripts and prevents data from being sent to unauthorized external domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, active exploitation has not been observed. However, the ability to pivot from a stored payload to full administrative takeover makes this a critical priority.

Analyst Recommendation

Storage infrastructure is a primary target for ransomware and data exfiltration. We strongly urge administrators to apply the 1.0.0-alpha.83 update immediately and review console access logs for any signs of session hijacking.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Versions before 1.26.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Gitea versions before 1.26.0 fail to handle errors correctly during pre-receive hook processing, allowing attackers to bypass branch-protection checks using oversized input.

Executive Summary:
An authorization bypass vulnerability in Gitea versions prior to 1.26.0 allows attackers to circumvent critical branch-protection security controls.

Vulnerability Details

CVE-ID: CVE-2026-27780

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: Versions before 1.26.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) resulting from a failure to close connections or halt processes when a bufio.Scanner error occurs. By providing specifically crafted, oversized input during the pre-receive hook process, an attacker can cause the system to ignore security checks, effectively bypassing branch protections.

Business Impact

The ability to bypass branch protections with a CVSS score of 9.8 poses a catastrophic risk to the integrity of the software development lifecycle. Unauthorized code changes can be pushed to protected branches, potentially allowing the introduction of malicious backdoors or unauthorized modifications to production-critical source code.

Remediation Plan

Immediate Action: Upgrade to Gitea version 1.26.0 or higher to ensure proper input validation and error handling for pre-receive hooks.

Proactive Monitoring: Review repository push logs for abnormal activity or attempts to push to protected branches that should have been rejected.

Compensating Controls: Implement strict CI/CD pipeline checks that verify code integrity independently of the Git server's native branch protection mechanisms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the criticality of the bypass necessitates immediate attention.

Analyst Recommendation

This vulnerability is critical due to the potential for total compromise of repository integrity. Administrators must upgrade to version 1.26.0 or later immediately to restore the effectiveness of branch-protection policies and prevent unauthorized code modifications.

---METADATA---
VENDOR: OCPP-compliant Charging Infrastructure
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
WebSocket endpoints lack authentication, allowing unauthenticated attackers to impersonate charging stations and manipulate backend data via the Open Charge Point Protocol.

Executive Summary:
A critical vulnerability in OCPP WebSocket endpoints allows unauthenticated attackers to impersonate charging stations, potentially leading to unauthorized control of charging infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27772

Affected Software: OCPP-compliant Charging Infrastructure

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw involves a lack of authentication mechanisms on WebSocket endpoints. An unauthenticated attacker can connect to the OCPP endpoint using a discovered charging station identifier to issue or receive commands as a legitimate charger.

Business Impact

A successful exploit allows for complete unauthorized control over electric vehicle charging infrastructure. This could lead to privilege escalation, corruption of charging network data reported to the backend, and significant reputational damage. The CVSS score of 9.4 reflects the critical nature of this flaw and its potential to disrupt essential energy infrastructure.

Remediation Plan

Immediate Action: Update the affected software to the latest version provided by the vendor to implement mandatory authentication for all WebSocket connections.

Proactive Monitoring: Review access logs for the OCPP WebSocket endpoint for any connections originating from unknown IP addresses or using duplicated station identifiers.

Compensating Controls: Implement network-level access control lists (ACLs) or a VPN to restrict access to the WebSocket endpoints to known, authorized charging station IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the unauthenticated nature of the flaw and the sensitivity of charging infrastructure, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of charging networks. It is highly recommended that administrators apply the relevant security patches immediately. Failure to secure these endpoints could allow attackers to manipulate power delivery or compromise the entire backend management system.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea and Forgejo versions prior to 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated access vulnerability in the Gitea and Forgejo container registry allows remote attackers to pull private container images due to missing authentication checks.

Executive Summary:
A critical unauthenticated access vulnerability in the Gitea container registry allows remote attackers to exfiltrate private images, potentially exposing sensitive credentials and source code.

Vulnerability Details

CVE-ID: CVE-2026-27771

Affected Software: Gitea and Forgejo Open Source Git Server

Affected Versions: Gitea's built-in container (OCI) registry in all versions prior to 1.26.2; Forgejo versions prior to 1.26.2.

Vulnerability: This is an unauthenticated access vulnerability in the container registry component. Remote attackers can pull private container images because the software fails to perform mandatory authentication checks before serving registry data.

Business Impact

With a CVSS score of 8.2, this vulnerability is highly severe as it facilitates the unauthorized exposure of proprietary source code, API keys, and database credentials stored within container images. This exposure provides attackers with the necessary intelligence to escalate access, leading to broader infrastructure compromise and potential data breaches.

Remediation Plan

Immediate Action: Update Gitea or Forgejo to version 1.26.2 or later immediately to enforce proper authentication on the container registry.

Proactive Monitoring: Audit access logs for the container registry to identify unusual pull requests or unauthorized attempts to access sensitive container images.

Compensating Controls: If an immediate update is not feasible, restrict network access to the Gitea/Forgejo registry service to trusted internal IP ranges using a firewall or WAF.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 4, 2026, public proof-of-concept exploits are available for this vulnerability. Given the ease of access and the sensitivity of the data at risk, immediate patching is required.

Analyst Recommendation

This vulnerability is critical due to the availability of public exploits and the potential for massive data exposure. Administrators must treat this as a top-priority security event and apply the 1.26.2 update across all affected deployments to prevent unauthorized data exfiltration.

---METADATA---
VENDOR: OCPP Implementations
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Unauthenticated attackers can perform station impersonation and manipulate backend data due to a lack of authentication on OCPP WebSocket endpoints.

Executive Summary:
The absence of authentication on OCPP WebSocket endpoints allows unauthenticated attackers to hijack charging station identities and manipulate backend infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27767

Affected Software: OCPP WebSocket Implementations

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from the lack of authentication mechanisms on WebSocket endpoints. Attackers can connect using a known charger ID and interact with the backend as a legitimate station without providing credentials.

Business Impact

Attackers can gain unauthorized control over charging infrastructure and corrupt the data reported to the backend. This can lead to financial loss, privilege escalation, and significant reputational damage. The CVSS score of 9.4 underscores the critical risk to charging network operators.

Remediation Plan

Immediate Action: Apply security updates to the OCPP backend to require authentication for all incoming WebSocket connections.

Proactive Monitoring: Audit backend logs for station IDs that connect from multiple locations or show unusual data patterns.

Compensating Controls: Deploy a secure proxy or gateway that requires authentication before forwarding traffic to the OCPP WebSocket endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, the lack of authentication is a fundamental security gap that is likely to be exploited.

Analyst Recommendation

Immediate action is required to secure the OCPP communication channel. Enforcing strong, per-device authentication is the only way to mitigate the risk of station impersonation and data corruption.

---METADATA---
VENDOR: SODOLA
PRODUCT: SL902-SWTGW124AS Firmware
AFFECTED_VERSIONS: Versions through 200.1.20
---END_METADATA---

Description Summary:
SODOLA SL902-SWTGW124AS firmware generates predictable MD5-based session identifiers, allowing attackers to forge authenticated sessions and bypass the login flow.

Executive Summary:
Predictable session identifier generation in SODOLA switches allows attackers to forge administrative cookies and bypass authentication entirely to gain unauthorized device access.

Vulnerability Details

CVE-ID: CVE-2026-27755

Affected Software: SODOLA SL902-SWTGW124AS Firmware

Affected Versions: Versions through 200.1.20

Vulnerability: The firmware uses a weak algorithm to generate session cookies based on predictable MD5 hashes. An attacker who can calculate these values can forge a valid session identifier and gain authenticated access without knowing the actual user password.

Business Impact

This vulnerability allows for an authentication bypass that grants full control over the network switch. With a CVSS score of 9.8, the business risk includes unauthorized network reconfiguration, traffic monitoring, and potential denial-of-service attacks against critical infrastructure.

Remediation Plan

Immediate Action: Update the device firmware to the latest version which includes a cryptographically secure random session generation mechanism.

Proactive Monitoring: Review device access logs for successful logins that do not correspond to known administrative activity or originate from anomalous sources.

Compensating Controls: Isolate the management interface behind a VPN or a secure jump host to prevent external actors from attempting to forge session cookies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. The predictable nature of MD5-based tokens makes this vulnerability a prime candidate for custom exploit development.

Analyst Recommendation

The use of weak session identifiers is a critical flaw in device security. It is imperative to update the firmware immediately to transition to secure session management and protect the integrity of the network environment.

---METADATA---
VENDOR: SODOLA
PRODUCT: SL902-SWTGW124AS Firmware
AFFECTED_VERSIONS: Versions through 200.1.20
---END_METADATA---

Description Summary:
SODOLA SL902-SWTGW124AS firmware contains hardcoded default credentials, allowing remote attackers to gain full administrative control over the device management interface.

Executive Summary:
The use of hardcoded default credentials in SODOLA firmware allows unauthenticated remote attackers to seize total administrative control of affected network switches.

Vulnerability Details

CVE-ID: CVE-2026-27751

Affected Software: SODOLA SL902-SWTGW124AS Firmware

Affected Versions: Versions through 200.1.20

Vulnerability: This is a default credentials vulnerability where the management interface is accessible using factory-set logins. An unauthenticated remote attacker can bypass security controls because the system does not enforce a password change upon initial setup.

Business Impact

An attacker gaining administrative access to a network switch can intercept traffic, redirect data, or disable network segments entirely. With a CVSS score of 9.8, this vulnerability represents a critical risk to network infrastructure security and data privacy, potentially leading to a complete breach of the internal network.

Remediation Plan

Immediate Action: Update the firmware to the latest version and immediately change all default administrative passwords to unique, complex strings.

Proactive Monitoring: Audit management logs for successful logins from unexpected IP addresses and monitor for unauthorized configuration changes.

Compensating Controls: Disable the web management interface on public-facing ports and restrict management access to a dedicated, isolated Management VLAN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, default credential vulnerabilities are frequently targeted by automated botnets and are trivial to exploit.

Analyst Recommendation

The presence of default credentials on network infrastructure is a critical security failure. Administrators must update the firmware and rotate all passwords immediately to prevent unauthorized remote management of the hardware.

---METADATA---
VENDOR: Avira
PRODUCT: Internet Security
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component, potentially allowing for arbitrary code execution.

Executive Summary:
A high-severity deserialization vulnerability in Avira Internet Security's System Speedup component could allow attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-27749

Affected Software: Avira Internet Security (System Speedup component)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability occurs when the System Speedup component deserializes data from an untrusted source without sufficient validation. An attacker could provide a specially crafted serialized object that, when processed, triggers the execution of malicious code with the privileges of the Avira service.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a significant risk to endpoint security. Successful exploitation could lead to full system compromise, allowing an attacker to bypass security software, install persistent malware, or exfiltrate sensitive data from the local machine.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Avira immediately. Ensure that the automatic update feature for Avira Internet Security is enabled and functioning correctly.

Proactive Monitoring: Monitor systems for unusual process creation originating from Avira service executables and review system logs for errors related to the System Speedup component.

Compensating Controls: Use endpoint detection and response (EDR) tools to identify and block suspicious behavior resulting from successful deserialization attacks, such as unexpected shell launches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation. Deserialization vulnerabilities in security software are particularly dangerous as they often run with high system privileges.

Analyst Recommendation

It is critical to apply the vendor-provided security patches immediately. Security software is a high-value target for local privilege escalation, and maintaining up-to-date versions is essential to ensuring the overall security posture of the organization's endpoints.

---METADATA---
VENDOR: Avira
PRODUCT: Internet Security
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Avira Internet Security's Software Updater component contains an improper link resolution vulnerability that could allow for unauthorized file manipulation or privilege escalation.

Executive Summary:
Avira Internet Security is vulnerable to a high-severity improper link resolution flaw within its Software Updater component, potentially allowing an attacker to escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-27748

Affected Software: Avira Internet Security

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves improper link resolution (such as a symlink attack) within the Software Updater component. An attacker with local access could exploit this flaw to redirect file operations to sensitive system locations, typically requiring local authentication to execute.

Business Impact

A successful exploit could lead to local privilege escalation, allowing a standard user to gain administrative rights on the host system. Given the CVSS score of 7.8, this represents a significant risk to the integrity of the endpoint, potentially leading to the installation of persistent malware or the disabling of security software. System downtime and the need for extensive forensic cleanup are primary concerns for affected organizations.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Avira to ensure the Software Updater component is patched against link resolution flaws.

Proactive Monitoring: Monitor system logs for unusual file system activities or unauthorized modifications to system directories originating from the Avira update service.

Compensating Controls: Implement strict principle of least privilege (PoLP) across all endpoints to limit the ability of local users to create symbolic links in sensitive directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its location within a privileged security service, the potential for exploitation remains high once technical details emerge.

Analyst Recommendation

The high CVSS score of 7.8 necessitates immediate attention from IT security teams. Organizations should prioritize the deployment of Avira’s latest patches to all managed endpoints to mitigate the risk of local privilege escalation. Ensuring that security software itself is not used as a vector for compromise is critical for maintaining a robust defense posture.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to version 10.0.7
---END_METADATA---

Description Summary:
An OS command injection vulnerability in OneUptime allows authenticated users to execute arbitrary commands on the Probe server via the monitor destination field.

Executive Summary:
Authenticated users can achieve full remote code execution on OneUptime Probe servers by exploiting a command injection vulnerability in the traceroute functionality.

Vulnerability Details

CVE-ID: CVE-2026-27728

Affected Software: OneUptime OneUptime

Affected Versions: Prior to version 10.0.7

Vulnerability: The vulnerability exists in the NetworkPathMonitor.performTraceroute() function, which fails to properly sanitize shell metacharacters in the destination field. This allows an authenticated project user to inject and execute arbitrary operating system commands on the underlying Probe server.

Business Impact

A successful exploit allows an attacker to take complete control of the Probe server, potentially using it as a pivot point to attack other internal network resources. This leads to a total loss of confidentiality, integrity, and availability for the affected monitoring infrastructure. The CVSS score of 9.9 reflects the critical risk of authenticated remote code execution.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.7 or later immediately to patch the command injection flaw.

Proactive Monitoring: Inspect Probe server logs for suspicious shell commands or unusual outbound network connections originating from the monitoring service.

Compensating Controls: Use containerization to isolate the Probe service and implement strict AppArmor or SELinux profiles to limit the commands the service can execute.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly mitigates the risk, but any compromised user account could be used to trigger the exploit.

Analyst Recommendation

Remote code execution vulnerabilities in monitoring tools are particularly dangerous as these tools often have broad network access. Immediate patching is required to secure the Probe servers and prevent lateral movement within the corporate network.