---METADATA---
VENDOR: WordPress
PRODUCT: WP User Manager
AFFECTED_VERSIONS: <= 2.9.16
---END_METADATA---

Description Summary:
An arbitrary file deletion vulnerability in the WP User Manager plugin for WordPress allows authenticated users to delete sensitive system files.

Executive Summary:
A critical arbitrary file deletion vulnerability in the WP User Manager plugin for WordPress permits authenticated attackers to remove critical system files, leading to potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-49766

Affected Software: WordPress WP User Manager

Affected Versions: <= 2.9.16

Vulnerability: The plugin contains a flaw that allows authenticated subscribers to trigger arbitrary file deletion on the server filesystem. By manipulating specific parameters, an attacker can delete sensitive configuration files or core application files.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a Critical risk to business operations. Exploitation can lead to complete service denial, loss of administrative control, and potential site instability, resulting in significant operational downtime.

Remediation Plan

Immediate Action: Update the WP User Manager plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor server access logs for unusual requests targeting file-handling functions or deletion operations.

Compensating Controls: Restrict file system permissions for the web server user account to the minimum necessary level to prevent unauthorized deletion of sensitive paths.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate remediation via plugin update is required. Organizations should evaluate their reliance on the affected plugin and ensure that all user permissions are strictly enforced to minimize the attack surface.

---METADATA---
VENDOR: WordPress
PRODUCT: Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
AFFECTED_VERSIONS: <= 1.1.8
---END_METADATA---

Description Summary:
The Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress suffers from unauthenticated PHP Object Injection via deserialization of untrusted input.

Executive Summary:
A critical unauthenticated PHP Object Injection flaw in the Integration for Mailchimp and Contact Form 7 plugin exposes WordPress environments to potential remote compromise.

Vulnerability Details

CVE-ID: CVE-2026-49765

Affected Software: WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms

Affected Versions: <= 1.1.8

Vulnerability: The plugin fails to securely handle untrusted input during deserialization, allowing unauthenticated attackers to inject arbitrary PHP objects. This mechanism can be leveraged as a vector for remote code execution if a compatible POP chain is identified within the environment.

Business Impact

The CVSS score of 9.8 underscores the severity of this flaw. Exploitation could allow attackers to bypass standard authentication, leading to unauthorized data exfiltration, modification of application logic, or total administrative takeover of the WordPress instance.

Remediation Plan

Immediate Action: Update the affected plugin to the latest version provided by the vendor.

Proactive Monitoring: Review application and database logs for unusual activity or unauthorized administrative actions following plugin usage.

Compensating Controls: Utilize a WAF to inspect and filter incoming traffic for serialized object signatures that could indicate an injection attempt.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk of unauthorized access. It is imperative that security teams audit their WordPress installations and apply the necessary updates immediately to eliminate this attack surface.

---METADATA---
VENDOR: WordPress
PRODUCT: RegistrationMagic
AFFECTED_VERSIONS: <= 6.0.8.6
---END_METADATA---

Description Summary:
A broken authentication vulnerability in the RegistrationMagic plugin for WordPress allows unauthenticated attackers to bypass security controls.

Executive Summary:
A critical broken authentication vulnerability in the RegistrationMagic plugin for WordPress allows unauthenticated attackers to potentially gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-49764

Affected Software: WordPress RegistrationMagic

Affected Versions: <= 6.0.8.6

Vulnerability: This vulnerability involves a failure in the authentication mechanism, allowing unauthenticated parties to interact with restricted functions. This effectively bypasses standard login requirements, granting unauthorized access to the application.

Business Impact

The 9.8 CVSS score identifies this as a Critical vulnerability. Unauthorized access to registration and administrative functions can lead to total account takeover, data exfiltration of user records, and complete compromise of the WordPress environment.

Remediation Plan

Immediate Action: Update the RegistrationMagic plugin to the latest version immediately to resolve the authentication flaw.

Proactive Monitoring: Review authentication logs for anomalous login patterns or access from unauthorized IP addresses.

Compensating Controls: Implement multi-factor authentication (MFA) for administrative accounts to add an extra layer of defense against unauthorized access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Broken authentication is a high-risk vulnerability that requires immediate attention. Organizations should prioritize updating the RegistrationMagic plugin and conduct an audit of user accounts to detect any unauthorized modifications or privilege escalations that may have already occurred.

---METADATA---
VENDOR: WordPress
PRODUCT: Integration for Contact Form 7 HubSpot
AFFECTED_VERSIONS: <= 1.3.7
---END_METADATA---

Description Summary:
The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to unauthenticated PHP Object Injection, potentially allowing remote code execution via serialized input.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the Integration for Contact Form 7 HubSpot WordPress plugin poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-49763

Affected Software: WordPress Integration for Contact Form 7 HubSpot

Affected Versions: <= 1.3.7

Vulnerability: This vulnerability involves the insecure deserialization of untrusted input, enabling unauthenticated attackers to inject malicious PHP objects. While the plugin itself may lack a native POP chain, the presence of such chains in other installed themes or plugins could facilitate arbitrary file deletion, data theft, or system compromise.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation could lead to full site compromise, unauthorized access to sensitive customer data, and potential long-term persistence within the web environment, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Integration for Contact Form 7 HubSpot plugin to the latest available version immediately.

Proactive Monitoring: Monitor server access logs for anomalous deserialization patterns or unexpected requests targeting plugin-specific endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious serialized objects and suspicious input strings.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the ease of unauthenticated access, administrators must prioritize patching. If an immediate update is not feasible, consider disabling the plugin until a secure version is deployed to mitigate the risk of remote execution.

---METADATA---
VENDOR: Totolink
PRODUCT: LR350
AFFECTED_VERSIONS: 9.3.5u.6369_B20220309
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353863","name":"VDB-353863 | Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353863","name":"VDB-353863 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.778274","name":"Submit #778274 | TOTOLINK LR350 LR350 V9.3.5u.6369_B20220309 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWiFiGuestCfg-32153a41781f8048a918c1c78e95064e?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.207Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Totolink LR350 setWiFiGuestCfg function allows remote attackers to trigger memory corruption via the ssid argument.

Executive Summary:
A critical remote buffer overflow vulnerability in Totolink LR350 routers poses a severe risk of unauthorized system manipulation and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-4976

Affected Software: Totolink LR350

Affected Versions: 9.3.5u.6369_B20220309

Vulnerability: This vulnerability involves a buffer overflow in the setWiFiGuestCfg function within the /cgi-bin/cstecgi.cgi script. The flaw allows an authenticated attacker to trigger memory corruption by injecting a malicious ssid argument, which can be executed remotely.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity. Successful exploitation could lead to total system compromise, resulting in unauthorized access to sensitive network settings, potential service outages, or the ability for an attacker to persist within the local network environment.

Remediation Plan

Immediate Action: Since a specific patch is not currently identified, administrators should restrict management access to the device and disable guest Wi-Fi features until the vendor releases a firmware update.

Proactive Monitoring: Monitor device access logs for unusual traffic patterns targeting the /cgi-bin/cstecgi.cgi endpoint, specifically looking for abnormally long strings within the ssid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system to filter and block requests containing oversized payloads directed at the vulnerable cstecgi.cgi script.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at the referenced Notion link.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of the buffer overflow suggests that the device is susceptible to arbitrary code execution if the memory space is manipulated effectively.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for total system impact, this vulnerability requires immediate attention. Security teams should prioritize isolating affected Totolink devices from the public internet and applying forthcoming vendor firmware updates as soon as they are released to prevent potential exploitation.

---METADATA---
VENDOR: Erlang
PRODUCT: OTP erts
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Erlang OTP erts inet_drv component allows unauthenticated remote attackers to crash the BEAM VM via a crafted SCTP ERROR chunk.

Executive Summary:
A critical stack-based buffer overflow in Erlang OTP erts allows unauthenticated remote attackers to cause a denial-of-service condition by crashing the BEAM virtual machine.

Vulnerability Details

CVE-ID: CVE-2026-49759

Affected Software: Erlang OTP erts

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack-based buffer overflow located within the inet_drv component. It permits an unauthenticated remote attacker to trigger a crash of the BEAM VM by sending a specially crafted SCTP ERROR chunk.

Business Impact

The ability for an unauthenticated attacker to remotely crash the BEAM VM poses a significant risk to service availability. Given the CVSS score of 8.2, this vulnerability is classified as high severity, as it can lead to unplanned system downtime for any application relying on the Erlang runtime, potentially disrupting critical business operations.

Remediation Plan

Immediate Action: Identify and update all instances of Erlang OTP to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor system logs for unusual SCTP traffic or unexpected process terminations of the BEAM VM.

Compensating Controls: Utilize network-level filtering or an Intrusion Prevention System (IPS) to block malformed SCTP packets targeting the Erlang runtime environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote service disruption without the need for authentication, organizations should treat this vulnerability with high priority. Administrators must prioritize patching the Erlang runtime across their infrastructure to mitigate the risk of denial-of-service attacks.

---METADATA---
VENDOR: Tenda
PRODUCT: AC15
AFFECTED_VERSIONS: 15.03.05.19
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353862","name":"VDB-353862 | Tenda AC15 POST Request setcfm formSetCfm memory corruption","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353862","name":"VDB-353862 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.778261","name":"Submit #778261 | Tenda AC15 AC15 V1.0 V15.03.05.19_multi Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC15-setcfm-32153a41781f807b8945dd8920fafc14?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC15 POST request handler allows remote attackers to compromise device integrity via the funcpara1 argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC15 firmware exposes affected devices to remote code execution and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4975

Affected Software: Tenda AC15

Affected Versions: 15.03.05.19

Vulnerability: The flaw exists within the formSetCfm function of the /goform/setcfm file, where improper handling of the funcpara1 argument during a POST request leads to a stack-based buffer overflow. While the CVSS vector indicates low privileges are required, the vulnerability is remotely exploitable and allows for memory corruption.

Business Impact

A successful exploit of this vulnerability could allow an attacker to achieve remote code execution, potentially leading to a full compromise of the networking device. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized network access, interception of traffic, or the use of the device as a pivot point for further lateral movement within the corporate environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management interface of the Tenda AC15 to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/setcfm endpoint and watch for signs of abnormal device behavior or unexpected restarts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block malicious payloads targeting the funcpara1 argument in HTTP POST requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the researcher write-up referenced in the vulnerability disclosure.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of technical documentation detailing the exploit vector significantly lowers the barrier for motivated threat actors to develop functional exploits.

Analyst Recommendation

Due to the severity of this memory corruption flaw and the existence of public proof-of-concept material, immediate defensive action is required. Organizations utilizing Tenda AC15 devices must isolate them from the public internet and implement strict access controls until the vendor releases a security update addressing the buffer overflow.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A vulnerability in the Imagination Technologies Graphics DDK allows non-privileged users to perform improper GPU system calls, leading to kernel memory out of bounds read and potential use after free.

Executive Summary:
A high-severity memory corruption vulnerability in Imagination Technologies Graphics DDK allows a local authenticated user to gain unauthorized kernel memory access or cause system crashes.

Vulnerability Details

CVE-ID: CVE-2026-49746

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: The vulnerability stems from improper validation of array indices during GPU system calls, specifically categorized as CWE-823: Use of Out-of-range Pointer Offset. A local user with low privileges can exploit this flaw to trigger out of bounds kernel memory reads or use after free conditions.

Business Impact

The ability for a non-privileged user to access kernel memory poses a significant risk to system integrity and confidentiality. While the CVSS score of 7.1 indicates a high risk, the potential for kernel-level memory corruption could lead to privilege escalation or system instability, directly impacting operational uptime and the security of data processed within the kernel environment.

Remediation Plan

Immediate Action: Update the Imagination Technologies Graphics DDK to version 26.1 RTM2 or later to apply the necessary index validation fixes.

Proactive Monitoring: Monitor system logs for unusual GPU driver behavior or crash reports that may indicate attempts to exploit memory vulnerabilities.

Compensating Controls: Restrict access to the graphics subsystem for unauthorized users where possible, and ensure that kernel-level protections are active to limit the impact of potential memory corruption.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its location in the kernel-mode driver code, which typically provides a high-value target for privilege escalation if a reliable exploit is developed.

Analyst Recommendation

Given the severity of a kernel-mode vulnerability, organizations should prioritize updating the Graphics DDK across all affected systems. Failure to address this flaw could allow local attackers to bypass security boundaries, making the immediate application of the vendor-provided patch critical to maintaining a secure computing environment.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Imagination Graphics DDK allows a guest virtual machine to trigger out-of-range memory writes via improper GPU firmware commands.

Executive Summary:
A high-severity out-of-range pointer vulnerability in the Imagination Graphics DDK could allow a guest VM to perform unauthorized memory writes outside its permitted address space.

Vulnerability Details

CVE-ID: CVE-2026-49745

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: This is an out-of-range pointer offset vulnerability (CWE-823) where improper commands sent from a Guest VM to the GPU firmware result in memory corruption. The flaw allows an attacker within a virtualized guest to bypass memory isolation constraints.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of virtualized systems. An attacker may be able to manipulate data in memory outside of the guest, leading to potential privilege escalation or the theft of sensitive data from the host or other guests.

Remediation Plan

Immediate Action: Update the Graphics DDK to version 26.1 RTM2 or later to address the memory safety issue.

Proactive Monitoring: Review audit logs for suspicious GPU command activity and monitor for memory access errors or unexpected system behavior on hosts supporting guest GPU pass-through.

Compensating Controls: If patching is not immediately feasible, restrict the use of GPU pass-through features for untrusted or public-facing virtual machines.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific access to a guest environment, the impact of breaking out of these bounds is severe.

Analyst Recommendation

The risk of memory corruption in a virtualized environment necessitates prompt remediation. Administrators should verify their current DDK versions and apply the recommended updates to prevent potential unauthorized access to protected memory regions.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-range pointer offset vulnerability in the Imagination Graphics DDK allows a guest virtual machine to trigger unauthorized writes outside of its allocated GPU memory.

Executive Summary:
A high-severity memory safety vulnerability in the Imagination Graphics DDK allows a malicious guest VM to write data outside of its virtualized memory boundaries.

Vulnerability Details

CVE-ID: CVE-2026-49744

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM

Vulnerability: This vulnerability (CWE-823) involves the use of an out-of-range pointer offset when processing commands sent from a Guest VM to the GPU firmware. An attacker with access to a Guest VM can trigger memory writes outside the intended memory region, potentially affecting the host or other virtual machines.

Business Impact

The CVSS score of 7.8 indicates a critical threat to virtualized environments. Exploitation could lead to cross-VM data leakage or host-level compromise, undermining the security guarantees of the virtualization platform and exposing sensitive information to unauthorized actors.

Remediation Plan

Immediate Action: Upgrade to the Graphics DDK version 26.1 RTM1 or later to resolve the pointer offset error.

Proactive Monitoring: Monitor hypervisor and GPU firmware logs for irregular command sequences or unexpected memory access violations occurring within guest environments.

Compensating Controls: Isolate sensitive virtual machines that utilize GPU acceleration until the patch can be applied, as this reduces the attack surface for potential inter-VM exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it a high-value target for attackers looking to break out of virtualized environments.

Analyst Recommendation

This vulnerability represents a serious threat to multi-tenant or virtualized infrastructure. Security teams must ensure that all affected virtualization hosts and guest drivers are updated immediately to prevent potential cross-boundary memory corruption.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Use After Free vulnerability in the Imagination Graphics DDK allows a local authenticated user to manipulate kernel synchronization objects via improper GPU system calls.

Executive Summary:
A high-severity Use After Free vulnerability in the Imagination Graphics DDK could allow an authenticated local attacker to achieve kernel-level memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-49743

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: This is a Use After Free (CWE-416) vulnerability occurring within the kernel due to improper handling of GPU system calls. An attacker with local access and low privileges can influence the lifetime of synchronization objects, resulting in read or write operations on freed memory.

Business Impact

The CVSS score of 7.8 reflects a high-severity risk that could lead to full system compromise. Successful exploitation allows an attacker to gain elevated privileges or cause a system crash, resulting in significant data exposure and potential denial of service for mission-critical graphics workloads.

Remediation Plan

Immediate Action: Update the Imagination Graphics DDK to the fixed versions, which include 1.18 RTM2, 23.2 RTM2, or 26.1 RTM2, depending on your deployment branch.

Proactive Monitoring: Monitor system logs for unusual kernel-level activity or repeated application crashes that may indicate exploitation attempts targeting GPU drivers.

Compensating Controls: Limit access to the affected system to trusted users only, as the attack requires local execution capabilities to initiate the malicious GPU system calls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it involves kernel-level memory management, which is a common target for privilege escalation attacks.

Analyst Recommendation

Given the potential for kernel-level memory corruption and privilege escalation, this vulnerability presents a significant security risk. System administrators should prioritize the deployment of the vendor-provided patches to the Graphics DDK to ensure kernel stability and prevent unauthorized access.

---METADATA---
VENDOR: Tenda
PRODUCT: AC7
AFFECTED_VERSIONS: Tenda AC7: 15.03.06.44
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353861","name":"VDB-353861 | Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353861","name":"VDB-353861 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.778207","name":"Submit #778207 | Tenda AC7 AC7V1.0 V15.03.06.44 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC7-fromSetSysTime-32153a41781f801c95b0f8a53eaa9a1f?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC7 POST request handler allows remote attackers to trigger memory corruption via the Time argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC7 routers allows for remote code execution via a manipulated system time configuration request.

Vulnerability Details

CVE-ID: CVE-2026-4974

Affected Software: Tenda AC7

Affected Versions: Tenda AC7: 15.03.06.44

Vulnerability: This vulnerability exists in the fromSetSysTime function within the /goform/SetSysTimeCfg component. An authenticated user can trigger a stack-based buffer overflow by sending a crafted Time argument via a POST request.

Business Impact

The ability to trigger a stack-based buffer overflow remotely poses a severe threat to network integrity. If exploited, this flaw could allow an attacker to execute arbitrary code with system-level privileges, leading to a complete compromise of the router, unauthorized access to network traffic, or the potential for lateral movement within the environment. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent device takeover.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the web management interface to trusted internal IP addresses only. Disable remote management features if they are not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /goform/SetSysTimeCfg endpoint. Review system logs for signs of process crashes or unexpected service restarts on the device.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and block malformed payloads sent to the SetSysTimeCfg function.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher write-up linked in the references.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of necessary user interaction and the relative ease of reaching the vulnerable function via the network.

Analyst Recommendation

This vulnerability represents a significant security risk to Tenda AC7 devices. Because a public proof-of-concept is available, the barrier to entry for potential attackers is low. Organizations should prioritize isolating affected devices from public-facing networks and monitor for vendor-provided firmware updates. Apply all available security patches immediately upon their release by the manufacturer.

---METADATA---
VENDOR: Letta
PRODUCT: Letta
AFFECTED_VERSIONS: 0.16.4
CONFIDENCE: high
MISSING: none
CREDITS: Eric-z (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353842","name":"VDB-353842 | letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353842","name":"VDB-353842 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777654","name":"Submit #777654 | letta-ai letta 0.16.4 CWE-95","tags":["third-party-advisory"]},{"url":"https://gist.github.com/YLChen-007/fc09bc447a73bba526c1642d9ce73ca5","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
Letta 0.16.4 contains a code injection vulnerability in the resolve_type function within letta/functions/ast_parsers.py due to an insecure fallback to eval().

Executive Summary:
An unauthenticated remote code execution vulnerability exists in Letta 0.16.4 due to an insecure eval() fallback in type annotation processing, posing a critical risk to affected systems.

Vulnerability Details

CVE-ID: CVE-2026-4965

Affected Software: Letta Letta

Affected Versions: 0.16.4

Vulnerability: The application incorrectly utilizes an eval() fallback for processing Python type annotations when safe AST parsing fails. Because the allow_unsafe_eval flag is hardcoded to true in all sandbox execution paths, an unauthenticated attacker can inject arbitrary Python code via the POST /v1/tools/run endpoint.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code on the underlying host system. This level of access typically leads to complete system compromise, unauthorized data exfiltration, and the potential for lateral movement within the network. Given the CVSS score of 7.3, this flaw represents a significant threat to operational integrity and data confidentiality.

Remediation Plan

Immediate Action: Update the Letta software to a version that properly neutralizes dynamic code evaluation and enforces secure type parsing. If a patch is unavailable, immediately restrict access to the /v1/tools/run endpoint to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unusual POST requests to the /v1/tools/run endpoint, specifically looking for payloads containing Python built-in functions or suspicious type annotations. Implement alerts for any unexpected execution of shell commands originating from the Letta service process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect JSON payloads for malicious Python syntax or attempts to invoke system-level commands within the tool submission process.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the GitHub Gist referenced by the vulnerability report.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from an incomplete fix for a previous issue, where unsafe code paths were left enabled despite the introduction of a safer alternative.

Analyst Recommendation

This vulnerability is critical due to the ease of remote code execution without authentication. Organizations running Letta 0.16.4 must prioritize applying security updates as soon as the vendor provides them. Until an official patch is verified, network-level restrictions on the vulnerable API endpoint are essential to prevent unauthorized command execution.

---METADATA---
VENDOR: UltraVNC
PRODUCT: UltraVNC
AFFECTED_VERSIONS: 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4.0
CONFIDENCE: high
MISSING: patch
CREDITS: haehanse (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353839","name":"VDB-353839 | UltraVNC Service version.dll uncontrolled search path","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.353839","name":"VDB-353839 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777619","name":"Submit #777619 | UltraVNC 1.6.4.0 Uncontrolled Search Path-Privilege escalation with version.dll","tags":["third-party-advisory"]},{"url":"https://drive.google.com/file/d/1QC-MrqGsfjr4phEN77krLFZHQN8S48U_/view","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
UltraVNC suffers from an uncontrolled search path vulnerability in the version.dll library within the Service component, potentially allowing local privilege escalation.

Executive Summary:
An uncontrolled search path vulnerability in UltraVNC versions up to 1.6.4.0 may allow a local attacker to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-4962

Affected Software: UltraVNC

Affected Versions: 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4.0

Vulnerability: This vulnerability is caused by an uncontrolled search path (CWE-427) in the version.dll library of the UltraVNC Service component. Successful exploitation requires an attacker to have local access to the system.

Business Impact

The exploitation of this flaw could allow a local user to compromise the integrity and availability of the affected system by executing code with the permissions of the UltraVNC service. Given the CVSS score of 7.0, this represents a high severity risk that could lead to full system compromise if the service runs with administrative or system-level privileges.

Remediation Plan

Immediate Action: As no official patch is currently available, organizations should restrict local access to the affected system and monitor the file system for unauthorized library placements.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or modifications to the directory where UltraVNC is installed.

Compensating Controls: Ensure that the service account running UltraVNC follows the principle of least privilege to limit the potential damage should an attacker successfully trigger the search path flaw.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the vulnerability references.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is considered difficult to exploit due to high complexity and the requirement for local access.

Analyst Recommendation

While this vulnerability requires local access, the potential for total system impact necessitates immediate attention. Until a vendor patch is released, prioritize restricting local user permissions on systems running the UltraVNC service. Organizations should maintain a high state of vigilance and prepare to deploy updates immediately upon the release of a fix by the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: AC6
AFFECTED_VERSIONS: 15.03.05.16
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353838","name":"VDB-353838 | Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353838","name":"VDB-353838 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777617","name":"Submit #777617 | Tenda AC6 AC6 V1.0 V15.03.05.16 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC6-QuickIndex-32053a41781f80758e27fa4259ec80cf?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda AC6 router allows remote attackers to trigger memory corruption via the PPPOEPassword argument in the formQuickIndex function.

Executive Summary:
A remote stack-based buffer overflow vulnerability in Tenda AC6 routers poses a critical risk of system compromise due to the availability of proof-of-concept exploit material.

Vulnerability Details

CVE-ID: CVE-2026-4961

Affected Software: Tenda AC6

Affected Versions: 15.03.05.16

Vulnerability: The vulnerability exists in the formQuickIndex function within the /goform/QuickIndex component, where improper handling of the PPPOEPassword argument leads to a stack-based buffer overflow. This flaw is remotely exploitable by an authenticated user, leading to potential memory corruption.

Business Impact

The exploitation of this buffer overflow can lead to complete system compromise, including unauthorized execution of arbitrary code, denial of service, or total loss of router control. With a CVSS score of 8.8, this vulnerability represents a high severity risk that could facilitate unauthorized network access and compromise of internal traffic, threatening the confidentiality and integrity of the entire connected infrastructure.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain firmware updates, as no official patch version is currently identified. If no patch is available, isolate the device from external network exposure until a secure version is released.

Proactive Monitoring: Monitor device access logs for unusual POST requests directed at the /goform/QuickIndex endpoint, particularly those containing oversized or unexpected strings in the PPPOEPassword field.

Compensating Controls: Deploy a network-level Web Application Firewall or intrusion prevention system to filter and block malicious traffic targeting the router administration interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of technical analysis documenting the overflow mechanism increases the likelihood of threat actors developing weaponized payloads.

Analyst Recommendation

Given the high severity score and the existence of public proof-of-concept material, administrators should prioritize the mitigation of this vulnerability. Immediate steps should be taken to restrict access to the management interface of the affected Tenda AC6 devices and to monitor for any signs of exploitation attempts until a vendor-supplied firmware update is applied.

---METADATA---
VENDOR: Tenda
PRODUCT: AC6
AFFECTED_VERSIONS: 15.03.05.16
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353837","name":"VDB-353837 | Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353837","name":"VDB-353837 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777616","name":"Submit #777616 | Tenda AC6 AC6 V1.0 V15.03.05.16 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/Tenda-AC6-WizardHandle-32053a41781f800eb05feb16885747f7?source=copy_link","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
Tenda AC6 version 15.03.05.16 contains a stack-based buffer overflow in the /goform/WizardHandle function, reachable via the WANT/WANS argument.

Executive Summary:
A stack-based buffer overflow in Tenda AC6 allows remote authenticated attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-4960

Affected Software: Tenda AC6

Affected Versions: 15.03.05.16

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) triggered by manipulating the WANT/WANS argument in the /goform/WizardHandle function. The vulnerability is remotely exploitable by an authenticated user.

Business Impact

The potential for stack-based buffer overflow allows an attacker to achieve remote code execution, which could lead to full device compromise. Given the CVSS score of 8.8, this vulnerability poses a high risk to network integrity, as compromised routers may be used to intercept traffic or facilitate lateral movement within the local network.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, verify if the vendor has released a firmware update addressing this specific function and apply it immediately. If no update is available, restrict management access to the router to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/WizardHandle endpoint. Investigate any unexpected device reboots or performance degradation that may indicate exploitation attempts.

Compensating Controls: If the device supports it, disable the web management interface from the WAN side to prevent remote access by unauthorized actors. Ensure the router is placed behind a robust firewall that inspects administrative traffic.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher write-up linked in the vulnerability references.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows memory corruption via standard POST request parameters.

Analyst Recommendation

The presence of a publicly disclosed proof-of-concept significantly lowers the barrier for exploitation, making this a high-priority concern for administrators of Tenda AC6 hardware. It is essential to restrict administrative access and prioritize the application of any forthcoming vendor firmware updates to mitigate the threat of remote code execution.

---METADATA---
VENDOR: OpenBMB
PRODUCT: XAgent
AFFECTED_VERSIONS: 1.0.0
CONFIDENCE: high
MISSING: patch
CREDITS: Eric-z (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353836","name":"VDB-353836 | OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353836","name":"VDB-353836 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777622","name":"Submit #777622 | OpenBMB XAgent v1.0.0 CWE-306","tags":["third-party-advisory"]},{"url":"https://gist.github.com/YLChen-007/531ec6b169f4b9ecbc8c2f0b2cd7c5ee","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the XAgent WebSocket endpoint allows unauthenticated remote attackers to access and exfiltrate sensitive interaction data, including plaintext API keys.

Executive Summary:
A critical authentication bypass in the OpenBMB XAgent ShareServer WebSocket endpoint allows unauthenticated attackers to remotely steal sensitive interaction history and third-party API keys.

Vulnerability Details

CVE-ID: CVE-2026-4959

Affected Software: OpenBMB XAgent

Affected Versions: 1.0.0

Vulnerability: The vulnerability exists in the on_connect handler within XAgentServer/application/websockets/share.py, where the authentication check has been commented out. This allows any unauthenticated user to connect to the /ws/share/{interaction_id} endpoint and retrieve private execution data without valid credentials.

Business Impact

The exposure of plaintext third-party API keys represents a severe security failure that can lead to unauthorized access to external services, data breaches, and potential financial loss. Because the vulnerability allows for the retrieval of any interaction history by simply providing an interaction_id, an attacker can systematically scrape private agent data. Given the CVSS score of 7.3, this flaw presents a high risk to organizational integrity and confidentiality.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the WebSocket endpoint at the network or firewall level. If possible, disable the affected ShareServer functionality until the vendor provides a security update that restores the check_user authentication logic.

Proactive Monitoring: Review application logs for unusual WebSocket connection requests or spikes in traffic to the /ws/share/ path. Monitor for unauthorized access attempts from unknown IP addresses that correlate with the interaction_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to enforce strict authentication headers and rate-limiting for all WebSocket connections. Ensure that the application infrastructure is isolated from public access where possible.

Exploitation Status

Public Exploit Available: Yes — a functional proof-of-concept exists as detailed in the technical write-up provided by the researcher (YLChen-007) on GitHub.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently easy to exploit because the authentication mechanism was explicitly disabled in the source code, requiring no complex bypass techniques.

Analyst Recommendation

Due to the ease of exploitation and the exposure of highly sensitive credential data, this vulnerability must be treated with high priority. Organizations utilizing OpenBMB XAgent 1.0.0 should isolate the affected services from external networks immediately and maintain strict monitoring until the vendor releases a corrective patch to re-enable mandatory authentication.

---METADATA---
VENDOR: Shenzhen Ruiming Technology
PRODUCT: Streamax Crocus
AFFECTED_VERSIONS: 1.3.44
CONFIDENCE: high
MISSING: patch
CREDITS: 0menc (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353833","name":"VDB-353833 | Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353833","name":"VDB-353833 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777534","name":"Submit #777534 | Shenzhen Ruiming Technology Co., Ltd. Streamax Crocus O&M Platform 1.3.44 SQL Injection","tags":["third-party-advisory"]},{"url":"https://my.feishu.cn/docx/J8fHdY906o98pax4oCacWLTKndP?from=from_copylink","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A remote SQL injection vulnerability exists in the Parameter Handler component of Streamax Crocus 1.3.44, allowing unauthenticated attackers to manipulate the State argument via DevicePrint.do.

Executive Summary:
A critical SQL injection vulnerability in Shenzhen Ruiming Technology Streamax Crocus 1.3.44 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-4956

Affected Software: Shenzhen Ruiming Technology Streamax Crocus

Affected Versions: 1.3.44

Vulnerability: The vulnerability is a SQL injection (CWE-89) located in the DevicePrint.do endpoint within the Parameter Handler component. An unauthenticated attacker can inject malicious SQL commands through the State parameter to interact with the underlying database.

Business Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the device database, potentially leading to unauthorized data access or modification. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of device management systems. If the database contains administrative credentials or sensitive configuration data, this could lead to a full system compromise.

Remediation Plan

Immediate Action: Since no vendor patch is currently available, restrict access to the affected device management interface to trusted networks only and block requests containing suspicious SQL patterns.

Proactive Monitoring: Monitor network traffic and application logs for unusual GET requests targeting the DevicePrint.do endpoint, specifically looking for SQL syntax characters within the State parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious input targeting the known vulnerable parameter and endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided by the researcher at the referenced Feishu link.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Organizations utilizing Streamax Crocus 1.3.44 must treat this vulnerability with high priority due to the presence of a public proof-of-concept and the lack of a vendor-provided fix. Immediately isolate the device from public internet access and apply strict ingress filtering to mitigate the risk of unauthorized remote exploitation.

---METADATA---
VENDOR: Shenzhen Ruiming Technology
PRODUCT: Streamax Crocus
AFFECTED_VERSIONS: 1.3.44
CONFIDENCE: high
MISSING: patch
CREDITS: 0menc (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353143","name":"VDB-353143 | Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353143","name":"VDB-353143 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.776083","name":"Submit #776083 | Shenzhen Ruiming Technology Co., Ltd. Crocus System 1.3.44 SQL Injection","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.778514","name":"Submit #778514 | Shenzhen Ruiming Technology Co., Ltd. Streamax Crocus O&M Platform 1.3.44 SQL Injection (Duplicate)","tags":["third-party-advisory"]},{"url":"https://my.feishu.cn/docx/C16HdO89zo9OCrxn5B2c8bTqnvb?from=from_copylink","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the Streamax Crocus 1.3.44 /OperateStatistic.do endpoint, allowing remote attackers to manipulate the VehicleID argument.

Executive Summary:
A remote SQL injection vulnerability in Streamax Crocus 1.3.44 poses a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-4955

Affected Software: Shenzhen Ruiming Technology Streamax Crocus

Affected Versions: 1.3.44

Vulnerability: The vulnerability is a SQL injection flaw (CWE-89) located in the /OperateStatistic.do file. Unauthenticated remote attackers can exploit this by injecting malicious input into the VehicleID parameter to execute unauthorized database queries.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive database information or the modification of application data. With a CVSS score of 7.3, this high-severity flaw represents a substantial risk of data compromise and potential service disruption, especially given the lack of vendor response and publicly available exploit code.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /OperateStatistic.do endpoint immediately.

Proactive Monitoring: Monitor web server logs for suspicious activity involving the /OperateStatistic.do path and unusual patterns in the VehicleID query parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block common SQL injection payloads targeted at this endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote code execution via database manipulation.

Analyst Recommendation

Given the public availability of exploit material and the lack of a vendor-supplied patch, organizations utilizing Streamax Crocus 1.3.44 must treat this as a high-priority risk. Immediately isolate the affected component from public-facing networks and implement strict WAF filtering to prevent exploitation until a formal update is released by the manufacturer.

---METADATA---
VENDOR: mingSoft
PRODUCT: MCMS
AFFECTED_VERSIONS: 5.0, 5.1, 5.2, 5.3, 5.4, 5.5.0
CONFIDENCE: high
MISSING: patch
CREDITS: Winegee (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.353831","name":"VDB-353831 | mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.353831","name":"VDB-353831 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.777516","name":"Submit #777516 | mingSoft MCMS 5.5.0 Server-Side Request Forgery","tags":["third-party-advisory"]},{"url":"https://github.com/wing3e/public_exp/issues/3","name":null,"tags":["exploit","issue-tracking"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.211Z
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the MCMS editor component allows remote attackers to force the server to send requests to arbitrary internal or external targets.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in mingSoft MCMS versions 5.0 through 5.5.0 allows attackers to perform unauthorized requests from the application server, posing a significant risk of internal network compromise.

Vulnerability Details

CVE-ID: CVE-2026-4953

Affected Software: mingSoft MCMS

Affected Versions: 5.0, 5.1, 5.2, 5.3, 5.4, 5.5.0

Vulnerability: The vulnerability exists in the catchImage function within net/mingsoft/cms/action/BaseAction.java, where user-supplied URLs in the source[] parameter are fetched by the server without adequate validation. This allows an unauthenticated or low-privileged attacker (depending on deployment configuration) to trigger outbound requests from the application server.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal network resources, cloud metadata services, and local services that are not exposed to the public internet. By abusing the server as a proxy, an attacker can bypass perimeter security controls, potentially leading to sensitive data exposure or further lateral movement within the network. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the internal infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the editor endpoint or disable the remote image capture feature if it is not business-critical.

Proactive Monitoring: Review web server and application logs for suspicious action=catchimage requests, particularly those containing non-standard URLs or internal IP addresses (e.g., 127.0.0.1, 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal network segments and sensitive metadata endpoints. A Web Application Firewall (WAF) can be configured to block requests containing malicious source[] parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up referenced in the GitHub issue tracker (github.com/wing3e/public_exp/issues/3).

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows an attacker to pivot into internal networks from a public-facing application.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for internal network reconnaissance, this vulnerability should be treated with high priority. Organizations using affected versions of mingSoft MCMS must implement egress filtering and restrict access to the vulnerable editor endpoint immediately. Security teams should monitor for vendor updates and apply them as soon as they become available to permanently remediate the underlying flaw.

---METADATA---
VENDOR: Dell
PRODUCT: PowerProtect Data Manager
AFFECTED_VERSIONS: 0 up to (excluding) 20.2.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dell PowerProtect Data Manager is vulnerable to an incorrect security token generation flaw, which may allow an authenticated attacker to bypass security controls.

Executive Summary:
A security token generation vulnerability in Dell PowerProtect Data Manager allows an authenticated attacker to compromise the integrity and confidentiality of the system.

Vulnerability Details

CVE-ID: CVE-2026-49499

Affected Software: Dell PowerProtect Data Manager

Affected Versions: Prior to 20.2.0.0

Vulnerability: This vulnerability (CWE-1270) involves the generation of incorrect security tokens. An authenticated attacker can exploit this flaw to perform unauthorized actions or bypass intended security restrictions within the application environment.

Business Impact

By manipulating security tokens, an attacker can escalate their access or perform actions they are not authorized to execute. The CVSS score of 8.8 reflects the high risk posed to the confidentiality and integrity of protected data, potentially resulting in unauthorized access to sensitive backups or system configurations within the PowerProtect environment.

Remediation Plan

Immediate Action: Upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later as specified in the vendor security advisory.

Proactive Monitoring: Review audit logs for suspicious activity, specifically looking for irregular token usage or unauthorized administrative actions.

Compensating Controls: Ensure that access to the management interface is strictly limited to authorized personnel and protected by multi-factor authentication where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated user to initiate, limiting the attack surface to those already inside the system.

Analyst Recommendation

Given the significant impact on administrative security, organizations should treat this update with high priority. Apply the provided patch to version 20.2.0.0 immediately to secure the PowerProtect Data Manager against unauthorized token manipulation.

---METADATA---
VENDOR: National Security Agency (NSA)
PRODUCT: Ghidra
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Ghidra 11 is affected by a high-severity vulnerability related to superuser privilege handling.

Executive Summary:
A vulnerability in Ghidra 11 could potentially be leveraged to escalate privileges or bypass security constraints.

Vulnerability Details

CVE-ID: CVE-2026-49498

Affected Software: NSA Ghidra

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves the handling of superuser privileges within the Ghidra software suite. It potentially allows an attacker to perform unauthorized actions by manipulating privilege levels.

Business Impact

With a CVSS score of 8.8, the potential for privilege escalation is significant. If an attacker gains unauthorized administrative control over the Ghidra instance, they could manipulate sensitive reverse-engineering projects, leading to intellectual property theft or the alteration of analysis results.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor immediately to address the privilege management flaw.

Proactive Monitoring: Review access logs for any unauthorized attempts to access administrative functions or perform actions outside of standard user roles.

Compensating Controls: Implement strict access controls and ensure that Ghidra is run within an isolated or containerized environment with limited system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. The severity score warrants immediate proactive patching.

Analyst Recommendation

Users of Ghidra should prioritize this update to prevent unauthorized privilege escalation. Verify the current version and apply the latest security patch as soon as possible to maintain the integrity of your analysis environment.

---METADATA---
VENDOR: Comodo
PRODUCT: Internet Security
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the firewall driver component of Comodo Internet Security.

Executive Summary:
A critical security flaw in the Comodo Internet Security firewall driver could allow attackers to bypass security controls or impact system stability.

Vulnerability Details

CVE-ID: CVE-2026-49494

Affected Software: Comodo Internet Security

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability specifically resides within the firewall driver component, which is responsible for inspecting network traffic; failure to secure this driver may allow for unauthorized bypass or system-level interference.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to endpoints protected by Comodo Internet Security. Successful exploitation may result in the complete bypass of firewall protections, exposing the host system to external threats and potential unauthorized access, leading to significant security degradation.

Remediation Plan

Immediate Action: Update the Comodo Internet Security suite to the latest version provided by the vendor to ensure the firewall driver is properly patched.

Proactive Monitoring: Monitor endpoint systems for unexpected network behavior or attempts to disable security features.

Compensating Controls: Utilize host-based intrusion detection systems and ensure that secondary security layers are enabled to provide defense-in-depth.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects a security-critical component, it is imperative that all affected endpoints are updated immediately. Administrators should verify the successful application of the patch and continue to monitor for anomalous system activity.

---METADATA---
VENDOR: Markdown Preview Enhanced
PRODUCT: Markdown Preview Enhanced
AFFECTED_VERSIONS: Markdown Preview Enhanced before 0.8.28
---END_METADATA---

Description Summary:
Markdown Preview Enhanced contains a remote code execution vulnerability due to improper parsing of Bitfield fenced code blocks using unsafe JavaScript evaluation.

Executive Summary:
A critical remote code execution vulnerability in Markdown Preview Enhanced allows unauthenticated attackers to execute arbitrary code via crafted markdown documents.

Vulnerability Details

CVE-ID: CVE-2026-49493

Affected Software: Markdown Preview Enhanced

Affected Versions: Markdown Preview Enhanced before 0.8.28

Vulnerability: The application utilizes the interpretJS() function to parse Bitfield fenced code blocks, which evaluates content via vm.runInNewContext(). This allows an unauthenticated attacker to trigger arbitrary code execution on the server side when a malicious markdown document is rendered or exported.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure. Successful exploitation grants an attacker the ability to execute code with the privileges of the application process, potentially leading to full system compromise, unauthorized data access, and lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to version 0.8.28 or later immediately to implement secure JSON5 parsing for bitfield definitions.

Proactive Monitoring: Audit server logs for unexpected child process creation or unusual outbound network connections originating from the markdown rendering service.

Compensating Controls: Implement strict input validation or utilize a Web Application Firewall (WAF) to inspect incoming markdown content for suspicious Bitfield patterns, though patching remains the only definitive fix.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 7, 2026, public proof-of-concept exploits exist for this vulnerability. Given the ease of triggering this flaw through document rendering, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators must prioritize updating to version 0.8.28 to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Markdown Preview Enhanced
PRODUCT: Markdown Preview Enhanced
AFFECTED_VERSIONS: Markdown Preview Enhanced before 0.8.28
---END_METADATA---

Description Summary:
Markdown Preview Enhanced contains vulnerabilities allowing for OS command injection and arbitrary JavaScript execution via untrusted markdown content.

Executive Summary:
Markdown Preview Enhanced is vulnerable to OS command injection and arbitrary JavaScript execution, enabling attackers to compromise systems through malicious markdown documents.

Vulnerability Details

CVE-ID: CVE-2026-49492

Affected Software: Markdown Preview Enhanced

Affected Versions: Markdown Preview Enhanced before 0.8.28

Vulnerability: The plugin suffers from OS command injection when opening external files/links due to lack of input validation. Furthermore, it parses WaveDrom diagrams by evaluating untrusted content with eval(), leading to arbitrary JavaScript execution.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a high risk to developer workstations and systems where Markdown Preview Enhanced is utilized. Successful exploitation allows for complete control over the user's local environment, potentially leading to the theft of sensitive development credentials or source code.

Remediation Plan

Immediate Action: Update the Markdown Preview Enhanced extension to version 0.8.28 or later.

Proactive Monitoring: Review system logs for suspicious process creation or unexpected network connections originating from the editor environment.

Compensating Controls: Disable the automatic rendering of untrusted markdown files or diagrams until the update can be applied, and restrict the editor's permissions if possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of command injection and arbitrary code execution makes this a severe risk for any software development environment. Users should upgrade to version 0.8.28 immediately and exercise caution when opening markdown documents from untrusted sources.

---METADATA---
VENDOR: OpenCATS
PRODUCT: OpenCATS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the OpenCATS software that may allow for unauthorized system interaction.

Executive Summary:
OpenCATS is affected by a high-severity vulnerability that could allow unauthorized actors to gain elevated access or compromise the applicant tracking environment.

Vulnerability Details

CVE-ID: CVE-2026-49490

Affected Software: OpenCATS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the OpenCATS applicant tracking software. The flaw may allow an attacker to bypass authentication or manipulate application data, potentially leading to unauthorized system access.

Business Impact

A CVSS score of 8.1 indicates a high risk of compromise to the OpenCATS platform. As this system often handles sensitive candidate data, unauthorized access could lead to significant data privacy violations, reputational damage, and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Update the OpenCATS installation to the latest version provided by the vendor to remediate the vulnerability.

Proactive Monitoring: Monitor database query logs and application access logs for unusual activity or unauthorized attempts to access candidate records.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious traffic and block known attack patterns targeting recruitment software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the sensitive nature of the data stored in OpenCATS, immediate remediation is required. Security teams should verify the integrity of their installation and ensure all security patches are applied to prevent potential data breaches.

---METADATA---
VENDOR: OpenCATS
PRODUCT: OpenCATS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
OpenCATS contains a high-severity vulnerability that could allow for unauthorized actions, requiring immediate attention from security administrators.

Executive Summary:
OpenCATS is affected by a high-severity vulnerability that poses a significant risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-49489

Affected Software: OpenCATS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a critical flaw in the OpenCATS software that may allow an attacker to bypass security controls or perform unauthorized operations within the application.

Business Impact

With a CVSS score of 8.5, this vulnerability presents a substantial risk to the confidentiality and integrity of the data managed within the OpenCATS platform. Unauthorized access could result in the exposure of sensitive applicant or organizational data, leading to significant reputational and legal consequences.

Remediation Plan

Immediate Action: Update to the most recent version of OpenCATS provided by the vendor. Consult the official OpenCATS security advisories for specific version requirements and mitigation instructions.

Proactive Monitoring: Monitor application logs for unauthorized access attempts or unusual administrative activities that may indicate an exploitation attempt.

Compensating Controls: Ensure that the OpenCATS instance is isolated behind a secure network perimeter and utilize a WAF to inspect incoming web traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, it is imperative that organizations running OpenCATS prioritize the application of security patches. Failure to remediate this issue promptly could leave the system vulnerable to exploitation by remote attackers.

---METADATA---
VENDOR: hapifhir
PRODUCT: org.hl7.fhir.core
AFFECTED_VERSIONS: < 6.9.4.2, >= 6.9.5, < 6.9.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HAPI FHIR is susceptible to uncontrolled resource consumption due to inefficient regular expression complexity, which can be triggered by unauthenticated attackers to cause a denial of service.

Executive Summary:
A high-severity denial of service vulnerability in HAPI FHIR allows attackers to exhaust system resources through complex regular expression processing.

Vulnerability Details

CVE-ID: CVE-2026-49485

Affected Software: hapifhir org.hl7.fhir.core

Affected Versions: < 6.9.4.2, >= 6.9.5, < 6.9.9

Vulnerability: The library is vulnerable to inefficient regular expression complexity (CWE-1333) and uncontrolled resource consumption (CWE-400). This permits unauthenticated attackers to send specially crafted payloads that force the application to consume excessive CPU or memory.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a significant risk to service availability. Exploitation can lead to application crashes or severe performance degradation, effectively causing a denial of service for critical healthcare interoperability workflows.

Remediation Plan

Immediate Action: Upgrade to version 6.9.4.2 or 6.9.9 to resolve the underlying regex inefficiency.

Proactive Monitoring: Monitor application CPU and memory utilization patterns for sudden, unexplained spikes that may indicate a resource exhaustion attack.

Compensating Controls: Implement input length limits and request timeouts at the gateway level to mitigate the impact of complex payload processing.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user capable of submitting input to the affected FHIR endpoints.

Analyst Recommendation

System administrators must update the HAPI FHIR core library to the recommended versions immediately. Ensuring the library is patched is essential to maintaining the stability of FHIR-based services and preventing potential service outages.

---METADATA---
VENDOR: sigstore
PRODUCT: fulcio
AFFECTED_VERSIONS: < 1.8.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The sigstore fulcio certificate authority is vulnerable to Server-Side Request Forgery, which could allow unauthorized certificate issuance.

Executive Summary:
A server-side request forgery vulnerability in sigstore fulcio presents a high-risk scenario where an attacker could compromise the integrity of the code signing certificate process.

Vulnerability Details

CVE-ID: CVE-2026-49478

Affected Software: sigstore fulcio

Affected Versions: < 1.8.6

Vulnerability: The vulnerability is a Server-Side Request Forgery (SSRF) flaw, classified as CWE-918. It allows an attacker to manipulate the certificate authority into making unauthorized requests, potentially leading to the issuance of fraudulent code signing certificates.

Business Impact

With a CVSS score of 8.7, the impact on integrity is severe. If exploited, an attacker could issue trusted code signing certificates for malicious software, bypassing security controls that rely on sigstore for provenance verification. This undermines the trust model of the entire supply chain, potentially leading to widespread reputational and security damage.

Remediation Plan

Immediate Action: Update the fulcio deployment to version 1.8.6 or later to incorporate the security fix.

Proactive Monitoring: Audit certificate issuance logs for anomalous requests or certificates issued to unexpected identities.

Compensating Controls: Restrict outbound network access from the fulcio service to only essential endpoints to mitigate the impact of potential SSRF attempts.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities in identity-related services are highly critical as they often bypass perimeter defenses.

Analyst Recommendation

Given the critical role of fulcio in the software supply chain, this update is essential to maintain the integrity of code signing operations. Organizations should prioritize the deployment of version 1.8.6 to prevent potential misuse of the certificate authority.

---METADATA---
VENDOR: cedar-policy
PRODUCT: authorization-for-expressjs
AFFECTED_VERSIONS: < 0.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An interpretation conflict and authorization flaw in the @cedar-policy/authorization-for-expressjs package allows authenticated users to bypass intended security controls.

Executive Summary:
An authorization bypass vulnerability in @cedar-policy/authorization-for-expressjs permits authenticated attackers to circumvent security policies, leading to unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-49473

Affected Software: cedar-policy authorization-for-expressjs

Affected Versions: < 0.3.0

Vulnerability: The package suffers from an interpretation conflict (CWE-436) and incorrect authorization logic (CWE-863), which can be exploited by authenticated users to gain unauthorized access to protected resources.

Business Impact

This vulnerability undermines the core authorization enforcement of ExpressJS applications using this library. An attacker could potentially gain access to unauthorized data or perform actions they are not permitted to execute. Given the CVSS score of 8.8, this flaw represents a significant risk to the overall security architecture of affected applications.

Remediation Plan

Immediate Action: Update the @cedar-policy/authorization-for-expressjs package to version 0.3.0 or later.

Proactive Monitoring: Review application authorization logs and audit access patterns to identify attempts to access restricted endpoints.

Compensating Controls: Implement additional server-side authorization checks as a secondary layer of defense while the primary update is being applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in fundamental logic errors, which generally require a deep understanding of the policy engine to exploit.

Analyst Recommendation

Developers should treat this authorization flaw with high priority. Updating to the latest version is the only effective way to remediate the underlying logic failure and restore the integrity of the authorization layer.

---METADATA---
VENDOR: Oraios
PRODUCT: Serena
AFFECTED_VERSIONS: < 1.5.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Oraios Serena is vulnerable to missing authentication and Cross-Site Request Forgery (CSRF), allowing unauthorized users to potentially trigger critical functions.

Executive Summary:
A high-severity vulnerability in the Oraios Serena MCP toolkit allows unauthenticated attackers to perform unauthorized actions, posing a significant risk to data integrity and system control.

Vulnerability Details

CVE-ID: CVE-2026-49471

Affected Software: Oraios Serena

Affected Versions: < 1.5.2

Vulnerability: The application suffers from missing authentication for critical functions (CWE-306) and Cross-Site Request Forgery (CWE-352) flaws. These vulnerabilities allow an unauthenticated attacker to bypass security controls and perform unauthorized operations via malicious requests.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a severe threat to business operations. Exploitation could lead to unauthorized modification of code, semantic retrieval data leakage, or total system compromise, resulting in significant reputational damage and loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade to Oraios Serena version 1.5.2 or later immediately to resolve the authentication and CSRF flaws.

Proactive Monitoring: Review application access logs for unusual patterns, such as unauthorized API calls or unexpected state-changing requests originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict CSRF protection rules to filter malicious traffic until the software can be patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of the affected component and the potential for unauthenticated access, organizations must prioritize patching this vulnerability. Apply the version 1.5.2 update as the primary mitigation to eliminate the security gap.

---METADATA---
VENDOR: BerriAI
PRODUCT: LiteLLM
AFFECTED_VERSIONS: prior to version 1.84.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass in LiteLLM allows unauthenticated remote attackers to access restricted management endpoints by spoofing request attributes.

Executive Summary:
A critical authentication bypass vulnerability in BerriAI LiteLLM prior to version 1.84.0 enables unauthenticated remote attackers to gain unauthorized access to the AI gateway.

Vulnerability Details

CVE-ID: CVE-2026-49468

Affected Software: BerriAI LiteLLM

Affected Versions: prior to version 1.84.0

Vulnerability: This vulnerability [CWE-290] exists in the get_request_route() function, where improper validation of request paths allows an unauthenticated attacker to manipulate the Host header. This creates a discrepancy between the authentication layer and the FastAPI routing, permitting unauthorized access to restricted management endpoints.

Business Impact

Successful exploitation allows an unauthorized actor to bypass credential checks, leading to full control or manipulation of the AI proxy server. With a CVSS score of 9.5, this flaw poses a severe risk to confidentiality, integrity, and availability, potentially exposing sensitive downstream AI systems and credentials.

Remediation Plan

Immediate Action: Update BerriAI LiteLLM to version 1.84.0 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review access logs for anomalous requests featuring unusual Host headers or attempts to access internal management paths.

Compensating Controls: Ensure the LiteLLM proxy is deployed behind a robust upstream CDN, WAF, or reverse proxy configured to strictly validate and sanitize the Host header.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of crafting the malicious Host header and the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Given the critical nature of this authentication bypass, organizations must prioritize patching to version 1.84.0. If immediate patching is not possible, ensure the proxy is not directly exposed to the internet and enforce strict header validation at the network perimeter.

---METADATA---
VENDOR: smp46
PRODUCT: pingvin-share-x
AFFECTED_VERSIONS: >= 1.5.0, < 1.18.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pingvin Share X contains authentication vulnerabilities involving incorrect implementation and missing critical steps in the authentication algorithm.

Executive Summary:
A vulnerability in Pingvin Share X allows authenticated attackers to potentially bypass security controls due to flaws in the authentication implementation.

Vulnerability Details

CVE-ID: CVE-2026-49467

Affected Software: smp46 pingvin-share-x

Affected Versions: >= 1.5.0, < 1.18.1

Vulnerability: This issue involves CWE-303 and CWE-304, where the application fails to correctly implement authentication algorithms or misses critical verification steps. The CVSS vector indicates that while the attacker must be authenticated, they can achieve high impacts on confidentiality, integrity, and availability.

Business Impact

The CVSS score of 8.8 reflects the high potential for unauthorized access to sensitive file shares, data manipulation, or service disruption. Successful exploitation could lead to significant data breaches and loss of control over the self-hosted file sharing environment.

Remediation Plan

Immediate Action: Update pingvin-share-x to version 1.18.1 or later to resolve the authentication flaws.

Proactive Monitoring: Monitor application access logs for unusual patterns or privilege escalation attempts originating from standard user accounts.

Compensating Controls: Ensure the application is behind a robust firewall and restrict network access to trusted IP ranges to limit the exposure of the authentication interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Given the high severity of this authentication flaw, administrators should prioritize updating their instances of pingvin-share-x. Failure to patch allows authenticated users to potentially compromise the integrity of the entire file-sharing platform.

---METADATA---
VENDOR: National Security Agency (NSA)
PRODUCT: Ghidra
AFFECTED_VERSIONS: NSA Ghidra: 0 up to (excluding) 12.0.3
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (finder); todb of AHA! (coordinator)
SOURCES_JSON: [{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111111000111111110000000000000000000000000000000000000000000000000000000110","name":null,"tags":["third-party-advisory"]},{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-mc3p-mq2p-xw6v","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.187Z
---END_METADATA---

Description Summary:
Ghidra versions prior to 12.0.3 are vulnerable to OS command injection via malicious annotation directives in binary files, allowing arbitrary code execution when an analyst interacts with the UI.

Executive Summary:
A critical vulnerability in NSA Ghidra allows an attacker to achieve arbitrary command execution on the analyst's machine through the processing of crafted binary annotations.

Vulnerability Details

CVE-ID: CVE-2026-4946

Affected Software: National Security Agency (NSA) Ghidra

Affected Versions: NSA Ghidra: 0 up to (excluding) 12.0.3

Vulnerability: This is an OS command injection flaw (CWE-78) where the software improperly parses @execute annotations within binary metadata. The vulnerability can be triggered by an unauthenticated attacker providing a malicious binary that, when analyzed, causes the Ghidra UI to execute arbitrary commands if a user clicks on the crafted text.

Business Impact

Successful exploitation of this vulnerability permits an attacker to execute arbitrary OS commands with the privileges of the Ghidra user. Given the CVSS score of 8.8, this represents a high risk to organizations that perform reverse engineering, as it could lead to full system compromise, exfiltration of sensitive internal research, or lateral movement into secure development environments.

Remediation Plan

Immediate Action: Upgrade to Ghidra version 12.0.3 or later immediately to incorporate the necessary input neutralization patches.

Proactive Monitoring: Review analyst workstations for unusual child processes spawned by the Ghidra binary or unexpected network connections originating from the Ghidra application.

Compensating Controls: Ensure that Ghidra instances are executed within isolated, non-privileged environments, such as a sandbox or a dedicated virtual machine, to minimize the impact of potential command execution.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it weaponizes the very data analysts are tasked with inspecting.

Analyst Recommendation

Organizations utilizing Ghidra for security research or binary analysis must prioritize this update to prevent remote code execution on analyst workstations. Given the nature of the flaw, apply the 12.0.3 patch across all installations immediately to eliminate the risk of command injection via malicious binary files.

---METADATA---
VENDOR: authentik
PRODUCT: authentik
AFFECTED_VERSIONS: Prior to 2025.12.6, 2026.2.4, and 2026.5.1
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in the authentik Source stage allows unauthenticated attackers to bypass security checks by sending an empty POST request.

Executive Summary:
A critical authentication bypass in the authentik identity provider allows unauthenticated attackers to potentially gain unauthorized access to protected services.

Vulnerability Details

CVE-ID: CVE-2026-49448

Affected Software: authentik

Affected Versions: Prior to 2025.12.6, 2026.2.4, and 2026.5.1

Vulnerability: The vulnerability exists in the Source stage of the authentik identity provider. An unauthenticated attacker can bypass the intended authentication flow simply by submitting an empty POST request, effectively circumventing identity verification.

Business Impact

With a CVSS score of 9.8, this flaw is extremely critical as it undermines the foundation of identity and access management. Unauthorized access to the identity provider can lead to a complete compromise of all downstream applications integrated with authentik, resulting in massive data breaches and loss of control over organizational resources.

Remediation Plan

Immediate Action: Upgrade all instances of authentik to versions 2025.12.6, 2026.2.4, 2026.5.1, or later immediately.

Proactive Monitoring: Review authentication logs for anomalous login patterns or spikes in empty POST requests targeting the Source stage.

Compensating Controls: Implement additional network-level access controls or WAF rules to block malformed or unexpected requests directed at the identity provider's authentication endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the criticality of the target, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a high-severity authentication bypass that should be remediated immediately. Given that it affects the identity provider, any delay in patching significantly increases the risk of unauthorized access across the entire integrated application ecosystem.

---METADATA---
VENDOR: authentik
PRODUCT: authentik
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in authentik, an open-source identity provider, requiring immediate attention from security administrators.

Executive Summary:
A high-severity vulnerability in the authentik identity provider platform mandates immediate review and patching to ensure secure authentication services.

Vulnerability Details

CVE-ID: CVE-2026-49443

Affected Software: authentik

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the authentik identity provider. While specific technical details are pending further disclosure, identity provider flaws typically involve unauthorized access or authentication bypass vectors.

Business Impact

The compromise of an identity provider like authentik can lead to widespread unauthorized access across all integrated applications, resulting in total loss of confidentiality and integrity for managed user accounts. With a CVSS score of 8.8, the potential for catastrophic failure of access control mechanisms is high. Organizations should treat this as a critical threat to their authentication infrastructure and overall security perimeter.

Remediation Plan

Immediate Action: Check the official authentik security repository or vendor advisory for the latest release and apply the update immediately.

Proactive Monitoring: Review authentication logs for unusual login patterns, unexpected administrative access, or failed authentication attempts that may indicate probing.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) across all integrated services and consider placing the authentik instance behind a restricted-access network or VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Identity providers are high-value targets for attackers. Administrators should prioritize the update of their authentik instance. If an immediate patch is not currently available, ensure that monitoring is heightened and that all administrative interfaces are shielded from public access to minimize the attack surface.

---METADATA---
VENDOR: vllm-project
PRODUCT: vllm
AFFECTED_VERSIONS: unspecified through latest
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The vllm library is vulnerable to path traversal, allowing attackers to potentially access or manipulate files outside of the intended directory.

Executive Summary:
A path traversal vulnerability in the vllm library poses a significant risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4944

Affected Software: vllm-project vllm

Affected Versions: unspecified through latest

Vulnerability: This vulnerability is a Path Traversal (CWE-22) issue, where improper limitation of a pathname allows unauthorized file system access. The attack vector is network-based and does not require authentication, though it may require user interaction.

Business Impact

Successful exploitation allows an attacker to read or potentially write arbitrary files on the host system, leading to full confidentiality, integrity, and availability impact. With a CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate credential theft or further lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Monitor official repository channels for a security patch; if no fix is available, restrict network access to the vllm service to trusted segments only.

Proactive Monitoring: Inspect system logs for unusual file access patterns or attempts to navigate directory structures outside of expected application paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) or file system monitoring tools to detect and block path traversal sequences (e.g., ../) in incoming traffic.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, users should prioritize isolating vulnerable instances from external networks. Organizations must monitor the vllm-project repository for release updates and apply the necessary patches as soon as they become available.

---METADATA---
VENDOR: Keysight
PRODUCT: Hawkeye, IxChariot, IxTap, IxProbe, IxByPass
AFFECTED_VERSIONS: See enrichment data in Vulnerability Details
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple Keysight products contain a stack-based buffer overflow vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code with administrative privileges.

Executive Summary:
A critical stack-based buffer overflow across several Keysight products allows unauthenticated remote attackers to achieve administrative code execution, requiring immediate patching across the enterprise.

Vulnerability Details

CVE-ID: CVE-2026-49435

Affected Software: Keysight Hawkeye, IxChariot, IxTap, IxProbe, and IxByPass.

Affected Versions: Hawkeye (< 6.0.7), IxChariot (< 10.0.254), IxTap (< 3.13.0), IxProbe (< 3.13.0), IxByPass (< 3.13.0.69).

Vulnerability: This is a stack-based buffer overflow (CWE-121) that permits an unauthenticated attacker to send crafted packets to the affected software. Successful exploitation results in arbitrary code execution running with administrative privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8 and allows for full administrative control over the affected hardware and software. Such a compromise could lead to complete loss of confidentiality, integrity, and availability of network testing infrastructure, potentially exposing sensitive internal network traffic or configuration data to adversaries.

Remediation Plan

Immediate Action: Update all affected software and firmware to the specified fixed versions: Hawkeye 6.0.7, IxChariot 10.0.254, IxTap 3.13.0, IxProbe 3.13.0, and IxByPass 3.13.0.69.

Proactive Monitoring: Watch for unusual administrative login activity or service behavior on all updated devices.

Compensating Controls: Isolate testing and monitoring segments from general-purpose network traffic to minimize the attack surface until all systems can be updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The administrative privilege level associated with this flaw makes it a highly attractive target for sophisticated threat actors.

Analyst Recommendation

Given the broad impact across multiple Keysight product lines and the administrative level of access granted to attackers, this update should be prioritized across all affected environments. Failure to address this vulnerability poses a severe risk to the entire network monitoring and testing infrastructure.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: 15.1-RELEASE (before p1), 15.0-RELEASE (before p11), 14.4-RELEASE (before p7), 14.3-RELEASE (before p16)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the FreeBSD libalias RTSP handler allows for memory corruption due to missing length checks when rewriting outgoing packets.

Executive Summary:
A stack-based buffer overflow in the FreeBSD libalias component could lead to arbitrary code execution or system instability when processing malformed RTSP packets.

Vulnerability Details

CVE-ID: CVE-2026-49420

Affected Software: FreeBSD FreeBSD

Affected Versions: 15.1-RELEASE (before p1), 15.0-RELEASE (before p11), 14.4-RELEASE (before p7), 14.3-RELEASE (before p16)

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the libalias RTSP handler. It occurs because the software fails to validate if rewritten packet data fits within the allocated stack buffer, allowing an unauthenticated attacker on the local network segment (AV:A) to trigger a memory corruption event.

Business Impact

Successful exploitation results in significant security impact, including potential remote code execution and system crashes. Given the CVSS score of 8.8, this vulnerability poses a severe threat to infrastructure stability and data confidentiality for any organization relying on FreeBSD libalias for packet processing.

Remediation Plan

Immediate Action: Apply the vendor security updates provided in FreeBSD-SA-26:41.libalias to all affected release versions immediately.

Proactive Monitoring: Monitor network traffic for malformed RTSP packets or unusual spikes in system crashes related to the libalias component.

Compensating Controls: Deploy firewall rules to restrict access to RTSP services and ensure that only authorized traffic is allowed to reach vulnerable network interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires local network access, the nature of the flaw as a buffer overflow makes it a prime target for weaponization.

Analyst Recommendation

FreeBSD administrators should treat this vulnerability with high urgency due to the risk of memory corruption and potential code execution. Updating to the patched releases identified in the security advisory is the only effective way to remediate this flaw and ensure the continued security of the FreeBSD environment.

---METADATA---
VENDOR: Deno Land
PRODUCT: Deno
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists within the Deno JavaScript/TypeScript runtime that may allow for unauthorized system-level interactions.

Executive Summary:
The Deno runtime is vulnerable to a security flaw that could potentially lead to unauthorized system access or execution, posing a high risk to environments utilizing this infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-49402

Affected Software: Deno Land Deno

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified flaw within the Deno runtime environment. The specific authentication requirements for exploitation remain indeterminate pending further vendor disclosure.

Business Impact

The potential for exploitation in a core runtime environment like Deno presents a significant risk to the integrity and confidentiality of applications built upon it. Given the CVSS score of 8.1, this is classified as a High-severity vulnerability that could lead to full application compromise, service disruption, or unauthorized data exfiltration if exploited.

Remediation Plan

Immediate Action: Administrators must monitor the official Deno security advisories and apply the latest patches as soon as they are made available by the vendor.

Proactive Monitoring: Review system and application logs for unusual runtime behavior, unexpected process spawning, or unauthorized network connections originating from the Deno environment.

Compensating Controls: Implement strict sandbox policies and use containerization with restricted resource access to limit the potential blast radius of an exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role Deno plays in modern development stacks, this vulnerability warrants immediate attention. Security teams should prioritize identifying all instances of Deno within their environment and prepare for an emergency patching cycle as soon as the vendor releases remediating updates.

---METADATA---
VENDOR: JetBrains
PRODUCT: YouTrack
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.13162
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability exists in JetBrains YouTrack that allows authenticated users to execute malicious scripts in the context of the application.

Executive Summary:
A Cross-Site Scripting (XSS) vulnerability in JetBrains YouTrack could allow authenticated attackers to execute arbitrary scripts, compromising user sessions and data.

Vulnerability Details

CVE-ID: CVE-2026-49368

Affected Software: JetBrains YouTrack

Affected Versions: 0 up to (excluding) 2026.1.13162

Vulnerability: This is a Cross-Site Scripting (CWE-79) vulnerability that requires an authenticated user to trigger the malicious script execution, often facilitated by a victim interacting with a crafted UI element.

Business Impact

An authenticated attacker could leverage this vulnerability to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of other users, including administrators. With a CVSS score of 8.7, the impact on organizational security is significant, as it undermines the trust and integrity of the YouTrack collaboration platform.

Remediation Plan

Immediate Action: Update JetBrains YouTrack to version 2026.1.13162 or later immediately.

Proactive Monitoring: Monitor web application traffic for patterns indicative of XSS attempts, such as unusual script tags or encoded payloads in input fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, effectively mitigating the impact of potential XSS attacks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction and authenticated access limits the immediate reach of this flaw.

Analyst Recommendation

JetBrains YouTrack instances should be updated immediately to the latest patched version to prevent potential session compromise. Security teams should prioritize patching this vulnerability to ensure that the collaboration environment remains secure against authenticated-user-driven attacks.

---METADATA---
VENDOR: DataRecce
PRODUCT: recce
AFFECTED_VERSIONS: < 1.50.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability exists in the DataRecce recce toolkit, allowing unauthenticated attackers to manipulate file paths via external control.

Executive Summary:
A path traversal vulnerability in the DataRecce recce toolkit could allow unauthorized file system access by an unauthenticated attacker.

Vulnerability Details

CVE-ID: CVE-2026-49360

Affected Software: DataRecce recce

Affected Versions: < 1.50.0

Vulnerability: The application is susceptible to CWE-73: External Control of File Name or Path. This allows an unauthenticated remote attacker to influence file operations, potentially leading to unauthorized access or manipulation of sensitive system files.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could lead to the exposure of sensitive configuration files or data, resulting in a breach of confidentiality and integrity, which may disrupt internal data validation workflows and compromise the security of the broader data pipeline.

Remediation Plan

Immediate Action: Update the recce package to version 1.50.0 or later to include the necessary path validation fixes.

Proactive Monitoring: Monitor file access logs for unusual read requests or access attempts targeting directories outside of the intended scope of the application.

Compensating Controls: Implement strict file system permissions for the service account running the toolkit and utilize a Web Application Firewall to filter requests containing suspicious path traversal patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for unrestricted file path manipulation.

Analyst Recommendation

Given the high CVSS score, organizations utilizing the recce toolkit for dbt PR reviews must prioritize the update to version 1.50.0. Failure to patch allows for potential unauthorized file system access, which could be leveraged to extract sensitive information from the host environment.

---METADATA---
VENDOR: decolua
PRODUCT: 9router
AFFECTED_VERSIONS: 0.2.21 up to 0.4.44
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
9Router contains a hardcoded fallback JWT secret in its authentication routing and middleware, allowing unauthenticated attackers to forge authentication tokens.

Executive Summary:
A hardcoded authentication secret in the decolua 9router package allows unauthenticated attackers to bypass security controls and forge administrative tokens.

Vulnerability Details

CVE-ID: CVE-2026-49352

Affected Software: decolua 9router

Affected Versions: 0.2.21 up to 0.4.44

Vulnerability: This vulnerability involves the use of a hardcoded fallback JWT secret (9router-default-secret-change-me) within the application authentication logic. Because the vulnerability is present in the login routing and middleware, unauthenticated attackers can successfully forge authentication cookies if the primary JWT_SECRET environment variable is not explicitly set.

Business Impact

The ability to forge authentication tokens grants an attacker complete unauthorized access to the application, effectively bypassing all authentication and authorization mechanisms. Given the CVSS score of 9.8, this represents a critical risk that could lead to full system compromise, data exfiltration, or administrative account takeover, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the decolua 9router package to version 0.4.44 or later immediately.

Proactive Monitoring: Review authentication logs for suspicious login patterns or unauthorized access attempts using unexpected session tokens.

Compensating Controls: Ensure the JWT_SECRET environment variable is explicitly and securely configured for all deployments to prevent the application from falling back to the hardcoded default.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository is available, which significantly lowers the barrier for potential attackers. The presence of a hardcoded credential in a critical authentication path makes this vulnerability highly susceptible to automated exploitation.

Analyst Recommendation

This is a critical security flaw that requires immediate attention. Organizations utilizing decolua 9router must upgrade to version 0.4.44 without delay to remove the hardcoded secret. Failure to patch will leave the authentication layer entirely exposed to trivial token forgery attacks.

---METADATA---
VENDOR: OttoKit
PRODUCT: OttoKit: All-in-One Automation Platform
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.23
CONFIDENCE: high
MISSING: none
CREDITS: mcdruid (finder); WPScan (coordinator)
SOURCES_JSON: [{"url":"https://wpscan.com/vulnerability/54bc1bf4-1033-49e2-aff9-a14c834c35bd/","name":null,"tags":["exploit","vdb-entry","technical-description"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:26:12.056Z
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the OttoKit WordPress plugin allows unauthenticated attackers to execute arbitrary database queries via unsanitized user input.

Executive Summary:
An unauthenticated SQL injection vulnerability in the OttoKit WordPress plugin allows remote attackers to compromise database confidentiality, posing a critical risk to affected systems.

Vulnerability Details

CVE-ID: CVE-2026-4935

Affected Software: OttoKit OttoKit: All-in-One Automation Platform

Affected Versions: 0 up to (excluding) 1.1.23

Vulnerability: This flaw is classified as a SQL Injection (CWE-89) arising from improper input sanitization in user-supplied parameters, allowing unauthenticated attackers to interact directly with the underlying database.

Business Impact

A successful exploit grants unauthorized actors direct access to database contents, potentially exposing sensitive data such as user credentials, personal information, and proprietary application content. Given the high CVSS score of 8.6, the vulnerability poses a severe threat to data confidentiality and integrity, which can lead to regulatory non-compliance, financial loss, and severe reputational damage.

Remediation Plan

Immediate Action: Update the OttoKit: All-in-One Automation Platform WordPress plugin to version 1.1.23 or later.

Proactive Monitoring: Monitor database query logs for unusual query structures, unexpected error messages, or signs of automated SQL injection scanning tools.

Compensating Controls: Deploy a Web Application Firewall with rules designed to detect and block common SQL injection patterns and parameter tampering attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is remotely exploitable over the network without requiring any user interaction or privileges.

Analyst Recommendation

Organizations utilizing the OttoKit plugin must treat this vulnerability with high priority due to its unauthenticated remote attack vector and potential for sensitive data exposure. Apply the official vendor update immediately to mitigate the risk of unauthorized database access.

---METADATA---
VENDOR: gonic
PRODUCT: gonic
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The gonic music streaming server and Subsonic API implementation contains a security vulnerability that may impact server stability or data access.

Executive Summary:
The gonic music streaming server is affected by a security vulnerability that poses a significant risk to the integrity and availability of the service.

Vulnerability Details

CVE-ID: CVE-2026-49340

Affected Software: gonic

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the gonic music streaming server, specifically within its Subsonic API implementation. The flaw potentially allows for unauthorized access or service disruption, though the specific attack vector remains dependent on the implementation of the API endpoints.

Business Impact

With a CVSS score of 8.1 (High), the vulnerability represents a substantial risk of unauthorized access to media assets or the underlying server infrastructure. Exploitation could result in the compromise of user data or the total disruption of the streaming service, negatively impacting operational continuity.

Remediation Plan

Immediate Action: Update the gonic server to the latest version released by the vendor to ensure all security patches are applied.

Proactive Monitoring: Review access logs for anomalous API requests or unexpected authentication attempts directed at the Subsonic interface.

Compensating Controls: Restrict access to the gonic server using network-level controls or VPNs to limit exposure to untrusted entities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is critical that administrators prioritize patching this vulnerability to prevent potential exploitation of the API. Ensure that the server is not exposed to the public internet without adequate authentication and network restrictions.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Container Platform 4
AFFECTED_VERSIONS: Red Hat OpenShift Container Platform 4
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the Red Hat OpenShift oauth-proxy component allows for interpretation conflicts, potentially impacting security controls.

Executive Summary:
A high-severity interpretation conflict vulnerability in Red Hat OpenShift Container Platform 4 could allow an authenticated attacker to bypass or manipulate security controls.

Vulnerability Details

CVE-ID: CVE-2026-49332

Affected Software: Red Hat OpenShift Container Platform 4

Affected Versions: Red Hat OpenShift Container Platform 4

Vulnerability: The vulnerability is categorized as CWE-436: Interpretation Conflict. An authenticated attacker with low privileges can exploit this flaw to cause the oauth-proxy to interpret requests in an unintended manner, leading to unauthorized access or security policy bypass.

Business Impact

The vulnerability carries a CVSS score of 8.5, indicating a high risk to the integrity and confidentiality of the container environment. Successful exploitation could lead to unauthorized access to sensitive application data or the escalation of privileges within the OpenShift cluster, resulting in potential data exfiltration or service disruption.

Remediation Plan

Immediate Action: Monitor official Red Hat security advisories for the release of a patched version of the oauth-proxy component and apply it to all affected clusters immediately.

Proactive Monitoring: Review audit logs for unusual authentication patterns or unexpected API request behaviors that deviate from established baselines.

Compensating Controls: Implement strict network policies and ensure that ingress traffic is inspected by a robust Web Application Firewall to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity is low, which may increase the likelihood of exploitation if functional exploit code is developed.

Analyst Recommendation

Given the high CVSS score and the critical nature of identity management in container platforms, administrators should treat this vulnerability with high priority. Organizations must ensure that their OpenShift environments are monitored closely and that security updates are applied as soon as they are made available by Red Hat.

---METADATA---
VENDOR: Apache
PRODUCT: Airflow
AFFECTED_VERSIONS: before 3.2.2
---END_METADATA---

Description Summary:
A bug in Apache Airflow's KubernetesExecutor causes sensitive JWT tokens to be exposed as command-line arguments in pod specifications.

Executive Summary:
Apache Airflow contains a vulnerability in its KubernetesExecutor that exposes authentication tokens to unauthorized users within the cluster.

Vulnerability Details

CVE-ID: CVE-2026-49298

Affected Software: Apache Airflow

Affected Versions: before 3.2.2

Vulnerability: The KubernetesExecutor improperly handles JWT tokens used for Execution API authentication by passing them as visible command-line arguments. This allows an authenticated UI or API user with Kubernetes read-only access to harvest these tokens and perform unauthorized state-mutating actions.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a high risk of privilege escalation and unauthorized API manipulation. Successful exploitation could allow attackers to bypass intended access controls, potentially compromising the integrity of data pipelines and the underlying Airflow execution environment.

Remediation Plan

Immediate Action: Upgrade to apache-airflow 3.2.2 or later to ensure JWT tokens are no longer exposed in pod specifications.

Proactive Monitoring: Review Kubernetes pod logs and audit access logs for suspicious API calls or unexpected execution patterns.

Compensating Controls: Restrict Kubernetes read-only access for users who do not strictly require it, and implement network policies to isolate the Execution API.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized execution of API commands, administrators should prioritize updating to version 3.2.2. Restricting cluster-level visibility is a critical secondary defense measure to mitigate the risk until the patch can be deployed.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Airflow Google provider
AFFECTED_VERSIONS: 0 up to 22.2.1 (excluding 22.2.1)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in Apache Airflow's Google provider allows attackers to potentially write files to unauthorized locations due to insufficient sanitization of GCS object names.

Executive Summary:
A high-severity path traversal vulnerability in Apache Airflow’s Google provider could allow an attacker to write files outside of intended directories.

Vulnerability Details

CVE-ID: CVE-2026-49297

Affected Software: Apache Software Foundation Apache Airflow Google provider

Affected Versions: 0 up to 22.2.1 (excluding 22.2.1)

Vulnerability: The operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator fail to normalize or check GCS object names retrieved from the bucket listing API. This allows an attacker to influence the destination filesystem path, resulting in an improper limitation of a pathname to a restricted directory (path traversal).

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting a high risk to system integrity. By exploiting path traversal, an attacker could potentially overwrite critical system files or configuration files, leading to unauthorized code execution or service disruption.

Remediation Plan

Immediate Action: Update the Apache Airflow Google provider package to version 22.2.1 or later.

Proactive Monitoring: Audit logs for unusual file write operations or attempts to access directories outside of the designated storage paths.

Compensating Controls: Implement strict filesystem permissions for the service user running the Airflow operators to limit the scope of potential file system modifications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of the Apache Airflow Google provider should prioritize upgrading to the patched version. Ensuring proper input validation for external API data is essential to preventing path traversal attacks in cloud-integrated workflows.

---METADATA---
VENDOR: MCP
PRODUCT: mcp-memory-service
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The mcp-memory-service, a semantic memory layer for AI applications, is affected by a security vulnerability that may expose sensitive data or allow unauthorized system access.

Executive Summary:
A high-severity vulnerability in the mcp-memory-service AI memory layer poses a substantial risk of unauthorized data access and potential exploitation of AI application logic.

Vulnerability Details

CVE-ID: CVE-2026-49291

Affected Software: MCP mcp-memory-service

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the mcp-memory-service, which functions as a semantic memory layer for AI applications. The flaw potentially allows attackers to interact with or manipulate the stored memory state, leading to unauthorized data exposure or service disruption.

Business Impact

The CVSS score of 8.1 reflects a High-severity risk. As this service handles semantic data for AI applications, an exploit could result in the leakage of sensitive training data, poisoning of the AI's memory, or unauthorized control over the application's reasoning capabilities, leading to significant business disruption.

Remediation Plan

Immediate Action: Update the mcp-memory-service to the latest version released by the vendor to address the identified vulnerability.

Proactive Monitoring: Monitor service logs for anomalous read/write operations or unauthorized attempts to access or query the semantic memory layer.

Compensating Controls: Restrict network access to the memory service using strict firewall rules or VPC security groups to ensure only trusted application components can communicate with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance of AI applications on the mcp-memory-service makes this vulnerability critical to remediate. Teams should prioritize updating this component to maintain the integrity and confidentiality of their AI-driven workflows.

---METADATA---
VENDOR: PhpWeasyPrint
PRODUCT: PhpWeasyPrint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
PhpWeasyPrint is susceptible to security vulnerabilities due to its functionality as a PHP library for PDF generation from URLs or HTML pages.

Executive Summary:
The PhpWeasyPrint library contains a security vulnerability that could potentially expose systems to unauthorized interactions through its PDF generation functionality.

Vulnerability Details

CVE-ID: CVE-2026-49286

Affected Software: PhpWeasyPrint

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the library's core functionality of rendering PDF content from external URLs or HTML input, which may allow for server-side request forgery or arbitrary file access depending on implementation. Without specific authentication requirements listed, it is assumed that any application utilizing this library in an unauthenticated context is at risk.

Business Impact

A successful exploit could lead to unauthorized data exfiltration, internal network scanning, or full system compromise. With a CVSS score of 8.1 (High), this vulnerability poses a significant risk to the confidentiality and integrity of the hosting environment, necessitating immediate attention to prevent malicious abuse.

Remediation Plan

Immediate Action: Review the official PhpWeasyPrint repository and apply the latest security patches or updates provided by the maintainers.

Proactive Monitoring: Monitor server logs for unusual outbound requests or unexpected file access patterns originating from the application process.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input and restrict the library's ability to reach internal network resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, organizations should treat this vulnerability with urgency. Evaluate the necessity of the library's current configuration and ensure that all updates are applied promptly to mitigate potential unauthorized access vectors.