---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Cloud (SaaS)
AFFECTED_VERSIONS: Prior to version 3.30.4
---END_METADATA---

Description Summary:
Budibase Cloud suffers from an unsafe eval() vulnerability in its view filtering, allowing authenticated users to execute arbitrary JavaScript and access sensitive environment secrets.

Executive Summary:
An authenticated remote code execution vulnerability in Budibase Cloud allows users to compromise the server environment and extract highly sensitive administrative credentials.

Vulnerability Details

CVE-ID: CVE-2026-27702

Affected Software: Budibase Budibase Cloud (SaaS)

Affected Versions: Prior to version 3.30.4

Vulnerability: This flaw involves an unsafe eval() call within the inMemoryView.ts component where user-controlled input is processed without sanitization. Any authenticated user, including those on free tier accounts, can trigger this to execute arbitrary code with the privileges of the application service.

Business Impact

A successful exploit grants an attacker access to the pod's environment variables, which include critical secrets such as INTERNAL_API_KEY, JWT_SECRET, and AWS keys. This leads to total database compromise, the ability to enumerate all tenant databases, and unauthorized access to sensitive user records and email addresses. With a CVSS score of 9.9, this represents a critical risk to data confidentiality and platform integrity.

Remediation Plan

Immediate Action: Budibase Cloud users must ensure they are using version 3.30.4 or later; as this is a SaaS product, confirm with the vendor that the patch is applied.

Proactive Monitoring: Security teams should review access logs for unusual view filtering activity and rotate any credentials or API keys that may have been exposed in the environment.

Compensating Controls: Implement strict egress filtering on the application environment to prevent the exfiltration of environment variables to external attacker-controlled servers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the sensitivity of the exposed secrets, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, as it exposes the foundational secrets of the Budibase Cloud infrastructure. Organizations must verify that their instances are running the patched version and immediately rotate all administrative secrets to mitigate the risk of persistent access by a malicious actor.

---METADATA---
VENDOR: Hono
PRODUCT: Hono
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Hono web application framework is affected by a high-severity vulnerability that could impact any JavaScript runtime environment it supports.

Executive Summary:
A high-severity vulnerability in the Hono web framework poses a significant risk to applications deployed across various JavaScript runtimes, requiring urgent updates.

Vulnerability Details

CVE-ID: CVE-2026-27700

Affected Software: Hono Hono

Affected Versions: See vendor advisory for affected versions

Vulnerability: Hono is a web framework supporting multiple JavaScript runtimes. This vulnerability, carrying a CVSS score of 8.2, indicates a significant flaw in the framework's handling of web requests or runtime execution, though specific technical details are currently withheld by the vendor.

Business Impact

Applications built on the Hono framework may be susceptible to exploitation, leading to unauthorized data access or service disruption. Because Hono is runtime-agnostic, the vulnerability could manifest across diverse cloud and edge computing environments. The High severity rating reflects the potential for widespread impact across the framework's user base.

Remediation Plan

Immediate Action: Developers should update the Hono framework to the latest version in their project dependencies and redeploy affected applications.

Proactive Monitoring: Monitor application logs for anomalous request patterns or runtime errors that could indicate attempted exploitation of the framework.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic and provide an additional layer of protection while updates are being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public exploit code provides a window for organizations to patch before widespread attacks occur.

Analyst Recommendation

The Hono framework is a critical component for many modern web applications. To maintain a strong security posture, it is essential to apply the latest security updates immediately and verify the integrity of application deployments.

---METADATA---
VENDOR: SAP
PRODUCT: NetWeaver Enterprise Portal
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
SAP NetWeaver Enterprise Portal is vulnerable to a critical deserialization flaw that allows privileged users to compromise the confidentiality, integrity, and availability of the host system.

Executive Summary:
Privileged users can compromise the SAP NetWeaver Enterprise Portal host system by uploading malicious content that triggers an unsafe deserialization process.

Vulnerability Details

CVE-ID: CVE-2026-27685

Affected Software: SAP NetWeaver Enterprise Portal

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the Administration interface where a privileged user can upload untrusted content. Upon deserialization by the system, this content can execute arbitrary code, leading to a high impact on the host system's security posture. This is an authenticated vulnerability requiring administrative or portal-management privileges.

Business Impact

With a CVSS score of 9.1, the impact is severe. A malicious insider or a compromised administrative account could gain full control over the SAP NetWeaver host. This jeopardizes sensitive corporate data, business processes, and the overall availability of the portal, potentially leading to significant financial and reputational damage.

Remediation Plan

Immediate Action: Apply the specific security patches detailed in the SAP vendor advisory for NetWeaver Enterprise Portal Administration.

Proactive Monitoring: Audit portal upload logs for unusual file types or content and monitor for unauthorized changes to system configurations or unexpected process activity.

Compensating Controls: Restrict administrative access to the SAP NetWeaver Portal to trusted networks and implement multi-factor authentication (MFA) to prevent account takeover.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. Deserialization vulnerabilities are highly reliable for attackers once a payload is successfully delivered, making this a high-risk flaw.

Analyst Recommendation

SAP environments are critical to business operations. It is essential to apply the vendor-recommended patches immediately. Organizations should also enforce the principle of least privilege to ensure only necessary personnel have the ability to upload content to the portal.

---METADATA---
VENDOR: SAP
PRODUCT: Business Planning and Consolidation / Business Warehouse
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
Insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse allow authenticated users to execute arbitrary SQL statements.

Executive Summary:
A critical SQL injection vulnerability in SAP Business Planning and Consolidation allows authenticated users to compromise data confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-27681

Affected Software: SAP Business Planning and Consolidation / Business Warehouse

Affected Versions: See vendor advisory

Vulnerability: This vulnerability stems from improper authorization checks, allowing an authenticated user to inject and execute malicious SQL queries against the underlying database. This permits the unauthorized reading, modification, or deletion of sensitive business data.

Business Impact

The ability to manipulate database contents directly poses a severe risk to organizational operations. With a CVSS score of 9.9, this flaw could lead to total loss of data integrity, unauthorized disclosure of sensitive financial or business information, and significant system downtime, potentially resulting in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by SAP for the affected Business Planning and Consolidation and Business Warehouse environments immediately.

Proactive Monitoring: Review database access logs for unusual query patterns, such as unexpected administrative commands or large-scale data export requests originating from standard user accounts.

Compensating Controls: Implement strict database-level permissions and utilize Database Activity Monitoring (DAM) to detect or block unauthorized SQL execution attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity score of 9.9, organizations must prioritize the identification of all instances of SAP Business Planning and Consolidation and SAP Business Warehouse. Immediate patching is required to prevent authenticated attackers from leveraging this SQL injection flaw to compromise the integrity of the enterprise database.

---METADATA---
VENDOR: SAP
PRODUCT: NetWeaver Application Server ABAP
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the SAP Kernel allows unauthenticated attackers to trigger crashes or execute code via crafted RFC requests.

Executive Summary:
A critical memory corruption flaw in the SAP Kernel enables unauthenticated remote attackers to compromise the confidentiality, integrity, and availability of SAP NetWeaver environments.

Vulnerability Details

CVE-ID: CVE-2026-27671

Affected Software: SAP NetWeaver Application Server ABAP (Kernel)

Affected Versions: See vendor advisory

Vulnerability: The vulnerability stems from improper RFC protocol validation within the SAP Kernel, allowing an unauthenticated attacker to inject crafted requests. These requests exploit logical errors in memory management, resulting in memory corruption.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk that could lead to full system compromise. Successful exploitation allows for remote code execution, which could result in the exfiltration of core business data, complete loss of system control, and prolonged service outages, severely impacting business continuity.

Remediation Plan

Immediate Action: Update the SAP Kernel to the latest version provided by the vendor to remediate the RFC protocol validation errors.

Proactive Monitoring: Monitor network traffic for malformed or suspicious RFC requests directed at the SAP Application Server.

Compensating Controls: Utilize a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) to filter and block non-standard or malformed RFC traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to trigger memory corruption makes this a high-priority threat. Organizations should treat this as a top-tier patching requirement and ensure all SAP Kernel components are updated to the latest secure versions immediately.

---METADATA---
VENDOR: OpenHarmony
PRODUCT: OpenHarmony
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in OpenHarmony version 6.

Executive Summary:
OpenHarmony v6 contains an unspecified security vulnerability that poses a significant risk to system integrity and data security.

Vulnerability Details

CVE-ID: CVE-2026-27648

Affected Software: OpenHarmony

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The input data does not specify the vulnerability type or authentication vector, necessitating a review of the vendor's detailed security disclosure.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a High-risk threat to systems utilizing OpenHarmony v6. Potential impacts include unauthorized system access, privilege escalation, or full system compromise, depending on the nature of the underlying flaw.

Remediation Plan

Immediate Action: Update OpenHarmony instances to the latest available version as specified by the vendor.

Proactive Monitoring: Monitor system logs for unexpected privilege escalation attempts or unauthorized configuration changes.

Compensating Controls: Restrict network access to critical OpenHarmony components using network segmentation and host-based firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The CVSS score of 8.8 warrants immediate attention and proactive management. Organizations should treat this as a high-priority update once the vendor releases specific patch instructions.

---METADATA---
VENDOR: Flask-Reuploaded
PRODUCT: Flask-Reuploaded
AFFECTED_VERSIONS: Versions prior to 1.5.0
---END_METADATA---

Description Summary:
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows for arbitrary file writes and remote code execution (RCE) via Server-Side Template Injection (SSTI).

Executive Summary:
Attackers can bypass file upload restrictions in Flask-Reuploaded to write malicious files to the server, leading to full remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27641

Affected Software: Flask-Reuploaded

Affected Versions: Versions prior to 1.5.0

Vulnerability: The flaw involves a combination of path traversal and extension bypass. Attackers can manipulate the name parameter to write files to unintended locations. If these files are processed as templates, it leads to SSTI and subsequent RCE.

Business Impact

Successful exploitation allows an attacker to gain a persistent foothold on the server. By achieving RCE, they can steal application data, access backend databases, or use the server as a pivot point for further internal network attacks. The CVSS score of 9.8 reflects the high probability of total system compromise.

Remediation Plan

Immediate Action: Update Flask-Reuploaded to version 1.5.0. If an immediate update is not possible, ensure that user input is never passed to the name parameter and use auto-generated filenames.

Proactive Monitoring: Scan the application's upload directories for files with unexpected extensions or those containing template syntax (e.g., {{ ... }}).

Compensating Controls: Implement strict input validation for all upload parameters and run the application in a containerized environment with a read-only root filesystem where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, no active exploitation has been confirmed. However, file upload vulnerabilities are among the most commonly exploited vectors for gaining initial access to web servers.

Analyst Recommendation

The risk of RCE via SSTI makes this a critical priority for any Flask-based application using this library. We strongly recommend immediate migration to version 1.5.0 and the adoption of secure file-naming conventions to prevent similar path traversal issues in the future.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Versions prior to 1.8.206
---END_METADATA---

Description Summary:
A critical authentication bypass in FreeScout allows attackers to compute valid session tokens and take over any user account, including administrators, if the application key is exposed.

Executive Summary:
Predictable authentication tokens in FreeScout allow attackers to perform full account takeovers, potentially compromising all help desk communications and administrative controls.

Vulnerability Details

CVE-ID: CVE-2026-27637

Affected Software: FreeScout

Affected Versions: Versions prior to 1.8.206

Vulnerability: The TokenAuth middleware uses a predictable MD5 hash of the user ID, creation timestamp, and the APP_KEY. If an attacker obtains the APP_KEY, they can generate valid, non-expiring tokens for any user account without needing a password.

Business Impact

Full account takeover of an administrator allows an attacker to read all private communications, delete data, and modify system settings. The CVSS score of 9.8 indicates a critical risk, especially given how frequently Laravel APP_KEY values are accidentally exposed in logs or environment files.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.206. After upgrading, it is highly recommended to rotate the Laravel APP_KEY to invalidate any potentially compromised tokens.

Proactive Monitoring: Inspect logs for suspicious logins using API tokens and verify the security of the .env file and other configuration backups.

Compensating Controls: Ensure that environment files are not accessible via the web and implement multi-factor authentication (MFA) where supported to provide an additional layer of security.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no evidence of active exploitation. This vulnerability is often paired with CVE-2026-27636, making the update to 1.8.206 essential.

Analyst Recommendation

The reliance on a predictable hash for authentication is a severe architectural flaw. Organizations must update FreeScout immediately and treat their APP_KEY as a high-value secret that requires immediate rotation if exposure is suspected.

---METADATA---
VENDOR: OliveTin
PRODUCT: OliveTin
AFFECTED_VERSIONS: Versions up to and including 3000.10.0
---END_METADATA---

Description Summary:
OliveTin is vulnerable to unauthenticated remote code execution (RCE) via two vectors: shell argument injection and unsafe webhook processing.

Executive Summary:
OliveTin is susceptible to unauthenticated remote code execution, allowing attackers to take full control of the host system via malicious webhooks or shell command manipulation.

Vulnerability Details

CVE-ID: CVE-2026-27626

Affected Software: OliveTin

Affected Versions: Versions up to and including 3000.10.0

Vulnerability: Vector 1 involves a failure in checkShellArgumentSafety to block the password argument type, allowing authenticated RCE. Vector 2 allows unauthenticated RCE by bypassing type safety checks for JSON values extracted from webhooks before they reach sh -c.

Business Impact

This vulnerability allows for total system takeover. Since OliveTin is often used to manage server operations, an attacker could execute any command the OliveTin process is authorized to run. The CVSS score of 9.9 is justified by the ease of unauthenticated exploitation via the webhook vector.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should immediately disable the webhook feature or restrict access to the OliveTin web interface via firewall/VPN.

Proactive Monitoring: Review system logs for unauthorized shell command execution and monitor for suspicious incoming webhook requests from unknown sources.

Compensating Controls: Implement strict network-level access controls and consider using a proxy to sanitize incoming webhook payloads before they reach OliveTin.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no patched version. The default configuration of "authType: none" significantly increases the risk for any instance exposed to the network.

Analyst Recommendation

The lack of a current patch necessitates extreme caution. We recommend taking OliveTin instances offline or isolating them entirely from external networks until a security update is released. Prioritize securing the webhook ingest points as they represent the most dangerous unauthenticated entry path.

---METADATA---
VENDOR: Stirling-PDF
PRODUCT: Stirling-PDF
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Stirling-PDF, a locally hosted web application for PDF operations, is affected by a high-severity vulnerability that could lead to unauthorized data access.

Executive Summary:
A security vulnerability in Stirling-PDF could allow attackers to compromise PDF document security and gain unauthorized access to the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-27625

Affected Software: Stirling-PDF

Affected Versions: See vendor advisory for affected versions

Vulnerability: Stirling-PDF contains a flaw in its web-based PDF processing logic. With a CVSS score of 8.1, the vulnerability likely involves a path traversal or remote code execution (RCE) vector, potentially allowing an attacker to interact with the underlying host system via specially crafted PDF files or web requests.

Business Impact

An exploit could result in the theft of sensitive documents processed by the application or the full compromise of the server hosting the Stirling-PDF instance. The high CVSS score of 8.1 indicates a significant risk to organizational data privacy and infrastructure security, especially if the application is exposed to the internet.

Remediation Plan

Immediate Action: Apply the latest security updates for Stirling-PDF immediately and restrict network access to the application to trusted users only.

Proactive Monitoring: Review application logs for unusual file upload patterns or unexpected system commands being executed by the web server user.

Compensating Controls: Deploy Stirling-PDF within an isolated network segment and use a Web Application Firewall (WAF) to filter malicious requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, PDF processing tools are frequent targets for exploitation due to the complexity of the PDF format.

Analyst Recommendation

Organizations using Stirling-PDF should apply the vendor-provided patch immediately. Given the high severity, it is also recommended to review the deployment architecture to ensure the application is properly firewalled and isolated from sensitive internal networks.

---METADATA---
VENDOR: Valkey
PRODUCT: Valkey
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security issue in the Valkey key-value database management system may lead to unauthorized exploitation of database functions or service disruption.

Executive Summary:
The Valkey distributed database faces a high-severity risk that could lead to unauthorized access or service disruption within key-value storage environments.

Vulnerability Details

CVE-ID: CVE-2026-27623

Affected Software: Valkey

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a secondary high-severity vulnerability identified in the Valkey distributed key-value database. It likely involves a different attack vector or functional component than previous entries, potentially allowing an attacker to manipulate the database state or crash the service.

Business Impact

The potential for unauthorized data manipulation or denial of service poses a significant threat to business continuity. With a CVSS score of 7.5, the impact is classified as High, as it could lead to the exposure of sensitive cached information or the failure of mission-critical applications that depend on the Valkey storage layer.

Remediation Plan

Immediate Action: Apply the recommended security patches from the Valkey project immediately to all production and staging environments.

Proactive Monitoring: Implement real-time alerting for database crashes and audit configuration changes to ensure no unauthorized modifications have occurred.

Compensating Controls: Restrict database access to trusted internal networks using firewalls and implement strong authentication mechanisms for all clients connecting to the Valkey cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, the discovery of multiple vulnerabilities in a short period often attracts increased scrutiny from the research community and threat actors.

Analyst Recommendation

We strongly recommend an immediate audit of all Valkey installations to ensure they are running the latest secured versions. Given the High severity rating, this vulnerability should be treated as a priority for remediation to prevent potential data breaches or prolonged system downtime.

---METADATA---
VENDOR: Bugsink
PRODUCT: Bugsink
AFFECTED_VERSIONS: Versions prior to 2.0.13
---END_METADATA---

Description Summary:
An unauthenticated stored cross-site scripting (XSS) vulnerability in Bugsink allows attackers to execute arbitrary JavaScript in an administrator's browser, leading to account takeover.

Executive Summary:
Unauthenticated attackers can inject malicious scripts into Bugsink error logs, which execute when viewed by an administrator, potentially resulting in full administrative compromise.

Vulnerability Details

CVE-ID: CVE-2026-27614

Affected Software: Bugsink Error Tracking Tool

Affected Versions: Versions prior to 2.0.13

Vulnerability: The vulnerability is located in the _pygmentize_lines() function within theme/templatetags/issues.py. An unauthenticated attacker can submit a crafted event that triggers a raw input fallback, which is then passed to mark_safe() without sanitization, allowing for stored XSS.

Business Impact

A successful exploit allows an attacker to hijack administrative sessions, modify project settings, or access sensitive error data and source code snippets. The CVSS score of 9.3 reflects the critical nature of this vulnerability, as it requires no authentication to plant the payload and targets high-privilege users.

Remediation Plan

Immediate Action: Update Bugsink to version 2.0.13 immediately to ensure that all stacktrace outputs are properly sanitized before rendering.

Proactive Monitoring: Review web server and application logs for unusual DSN endpoint activity or suspicious JavaScript payloads within the event database.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter common XSS patterns and restrict access to the Bugsink web UI to known administrative IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no public information indicating active exploitation. The requirement for an administrator to view the specific event provides a small window for detection, but the unauthenticated nature of the injection makes it a high-risk flaw.

Analyst Recommendation

The ability for unauthenticated external actors to target internal administrators via standard error reporting protocols is a significant risk. We strongly recommend immediate deployment of version 2.0.13 and a thorough audit of existing stored events for any suspicious scripts.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: 0.5.4 through 0.7.9
---END_METADATA---

Description Summary:
An authorization bypass in the FOSSBilling API allows unauthenticated attackers to invoke administrative system functions by accessing restricted endpoints.

Executive Summary:
FOSSBilling contains a critical authentication bypass vulnerability that permits unauthenticated attackers to execute administrative API methods, risking full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27604

Affected Software: FOSSBilling FOSSBilling

Affected Versions: 0.5.4 through 0.7.9

Vulnerability: An authorization flaw in the API role handling logic fails to enforce proper credentials for /api/system/* endpoints. This allows an unauthenticated user to assume the identity of the cron administrator and execute sensitive system-level commands.

Business Impact

With a CVSS score of 10.0, this vulnerability allows for total unauthorized control over the billing and client management system. Attackers could exfiltrate sensitive client data, modify billing records, or gain persistent access to the server, leading to severe reputational and financial damage.

Remediation Plan

Immediate Action: Upgrade to FOSSBilling version 0.8.0 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Review API access logs for any requests directed at /api/system/* originating from untrusted sources and treat such activity as a potential security incident.

Compensating Controls: Block external access to /api/system/* endpoints at the reverse proxy or WAF level and restrict API access to known, trusted source IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw allows for trivial exploitation, elevating the overall risk.

Analyst Recommendation

Immediate remediation is required to secure the FOSSBilling environment. Beyond updating the software, administrators should rotate all API tokens and invalidate existing sessions to ensure that any potential unauthorized access that occurred prior to patching is terminated.

---METADATA---
VENDOR: Enclave
PRODUCT: enclave-vm
AFFECTED_VERSIONS: Versions prior to 2.11.1
---END_METADATA---

Description Summary:
A security boundary escape vulnerability in the Enclave JavaScript sandbox core allows attackers to bypass restrictions and achieve remote code execution (RCE).

Executive Summary:
A critical vulnerability in Enclave allows for a complete escape of the JavaScript sandbox, enabling unauthorized remote code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-27597

Affected Software: Enclave enclave-vm

Affected Versions: Versions prior to 2.11.1

Vulnerability: This flaw exists within the @enclave-vm/core component, where insufficient isolation allows code to break out of the intended sandbox environment. An attacker capable of submitting code for execution can leverage this escape to execute arbitrary commands with the privileges of the sandbox process.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as the primary security control of the product—the sandbox—is rendered ineffective. Given the CVSS score of 10.0, this represents the highest possible risk, potentially leading to total loss of confidentiality, integrity, and availability of the host infrastructure and sensitive AI agent data.

Remediation Plan

Immediate Action: Administrators must upgrade the Enclave environment to version 2.11.1 or later immediately to restore sandbox integrity.

Proactive Monitoring: Implement strict logging of sandbox execution attempts and monitor for unusual system calls or outbound network connections originating from the sandbox process.

Compensating Controls: Restrict the permissions of the user account running the Enclave process to the absolute minimum required to limit the impact of a potential escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of sandbox escapes in AI execution environments, the potential for targeted exploitation is extremely high.

Analyst Recommendation

This vulnerability represents a total failure of the product's primary security function. Organizations utilizing Enclave for AI agent execution must prioritize the application of the version 2.11.1 patch immediately. Failure to do so leaves the underlying infrastructure exposed to complete remote takeover.

---METADATA---
VENDOR: Statamic
PRODUCT: Statamic CMS
AFFECTED_VERSIONS: Prior to versions 6.3.3 and 5.73.10
---END_METADATA---

Description Summary:
Statamic CMS contains a flaw in its password reset feature that allows attackers to capture reset tokens. By knowing a user's email, an attacker can hijack the reset process and take over accounts.

Executive Summary:
Statamic CMS is vulnerable to a critical account takeover flaw where attackers can intercept password reset tokens to gain unauthorized access to valid user accounts.

Vulnerability Details

CVE-ID: CVE-2026-27593

Affected Software: Statamic CMS

Affected Versions: Prior to versions 6.3.3 and 5.73.10

Vulnerability: The vulnerability exists in the password reset logic, allowing an unauthenticated attacker to capture a user's reset token. While the attack requires the attacker to know a target's email address and involves some user interaction, the technical flaw allows for a complete bypass of the intended authentication security.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a significant risk to data integrity and confidentiality. Unauthorized access to a CMS can lead to website defacement, the injection of malicious scripts (Magecart-style attacks), or the theft of sensitive customer data. For organizations relying on Statamic for business operations, this could result in severe reputational damage.

Remediation Plan

Immediate Action: Update Statamic CMS to version 6.3.3 or 5.73.10 (depending on your major version branch) immediately to resolve the token capture flaw.

Proactive Monitoring: Audit user account logs for unexpected password changes or logins from unfamiliar geographic locations, especially following password reset requests.

Compensating Controls: Implement multi-factor authentication (MFA) for all CMS users, which would prevent account takeover even if a password is reset by an attacker.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation. The requirement for a user to click a link increases the complexity slightly, but the high CVSS score reflects the ease of token capture once initiated.

Analyst Recommendation

Account takeover vulnerabilities in web-facing applications are prime targets for automated attacks. We recommend that administrators apply the relevant security patches immediately. Furthermore, educating users to be wary of unsolicited password reset emails is a critical supplementary defense against this specific exploit vector.

---METADATA---
VENDOR: Winter
PRODUCT: Winter CMS
AFFECTED_VERSIONS: Prior to 1.0.477, 1.1.12, and 1.2.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Winter CMS is vulnerable to privilege escalation where authenticated backend users can modify their roles and permissions via specially crafted requests.

Executive Summary:
A privilege escalation vulnerability in Winter CMS versions prior to 1.0.477, 1.1.12, and 1.2.12 allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-27591

Affected Software: Winter, Winter CMS

Affected Versions: Prior to 1.0.477, 1.1.12, and 1.2.12

Vulnerability: The CMS fails to properly validate role and permission changes for authenticated backend users. An attacker with existing low-level access can escalate their privileges by submitting crafted requests to the backend.

Business Impact

A CVSS score of 9.9 indicates an extreme risk, as it allows for trivial escalation to full administrative control. This could lead to total data exposure, content modification, and full system takeover, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Upgrade to Winter CMS version 1.0.477, 1.1.12, or 1.2.12, depending on your current release branch.

Proactive Monitoring: Audit backend access logs for unusual account modifications or unauthorized permission changes.

Compensating Controls: Implement strict role-based access control (RBAC) and restrict backend access to trusted internal IP addresses using a WAF or VPN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents an critical risk for CMS integrity. All administrators should verify their current version of Winter CMS and apply the necessary updates immediately to prevent unauthorized privilege escalation.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: 9.5.13 and below
---END_METADATA---

Description Summary:
A sandbox escape in OneUptime allows users with low privileges or anonymous access to execute arbitrary code and gain full access to cluster credentials and environment variables.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows unauthenticated or low-privileged users to achieve full cluster compromise and steal sensitive infrastructure credentials within seconds.

Vulnerability Details

CVE-ID: CVE-2026-27574

Affected Software: OneUptime

Affected Versions: 9.5.13 and below

Vulnerability: This vulnerability stems from the use of the insecure node:vm module for custom JavaScript monitoring, which permits a trivial sandbox escape. Exploitation is possible by unauthenticated users if open registration is enabled, or by users with the "ProjectMember" role.

Business Impact

A successful exploit grants an attacker full access to the underlying process and host networking. This results in the immediate exposure of critical secrets, including ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, and CLICKHOUSE_PASSWORD. Given the CVSS score of 9.9, this represents a total loss of confidentiality, integrity, and availability for the entire monitoring cluster.

Remediation Plan

Immediate Action: Administrators must upgrade OneUptime to version 10.0.5 or later immediately to resolve the insecure code execution path.

Proactive Monitoring: Review system environment logs and audit project member activity for any unauthorized custom JavaScript monitors created prior to patching.

Compensating Controls: Disable open registration and restrict the "ProjectMember" role's ability to create custom monitors until the environment is fully patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the trivial nature of the sandbox escape and the high-value credentials at risk, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path from low-privileged access to full infrastructure control. Organizations using OneUptime must prioritize the update to version 10.0.5 immediately to prevent catastrophic data breaches and system takeover.

---METADATA---
VENDOR: Rymera Web Co Pty Ltd
PRODUCT: Woocommerce Wholesale Lead Capture
AFFECTED_VERSIONS: n/a through 2.0.3.1
---END_METADATA---

Description Summary:
The Woocommerce Wholesale Lead Capture plugin is vulnerable to incorrect privilege assignment, which allows attackers to escalate their privileges within the WordPress environment.

Executive Summary:
A critical privilege escalation vulnerability in the Woocommerce Wholesale Lead Capture plugin allows users to gain unauthorized elevated permissions, potentially compromising the entire WordPress site.

Vulnerability Details

CVE-ID: CVE-2026-27542

Affected Software: Rymera Web Co Pty Ltd Woocommerce Wholesale Lead Capture

Affected Versions: n/a through 2.0.3.1

Vulnerability: The plugin contains an "Incorrect Privilege Assignment" flaw. This typically occurs when a plugin fails to properly validate user roles during registration or profile updates, allowing a standard user to assign themselves administrative or other high-level privileges.

Business Impact

Successful exploitation allows an attacker to take full control of the WordPress site, leading to data breaches, site defacement, or the installation of malware. The CVSS score of 9.8 reflects the extreme severity of allowing an unprivileged user to become an administrator, resulting in a total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Woocommerce Wholesale Lead Capture plugin to version 2.0.3.2 or the latest version available from the vendor.

Proactive Monitoring: Audit WordPress user accounts for any unauthorized changes to user roles, particularly new administrator accounts created through the wholesale lead capture forms.

Compensating Controls: Implement a "Least Privilege" model and use security plugins that alert on any changes to the administrator user group.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. Given the high impact of privilege escalation, this vulnerability is likely to be targeted by attackers once the update is publicized.

Analyst Recommendation

This vulnerability poses a critical threat to site integrity. Organizations must apply the latest security updates for the Woocommerce Wholesale Lead Capture plugin immediately to prevent unauthorized users from gaining administrative control.

---METADATA---
VENDOR: Rymera Web Co Pty Ltd
PRODUCT: Woocommerce Wholesale Lead Capture
AFFECTED_VERSIONS: n/a through 2.0.3.1
---END_METADATA---

Description Summary:
The Woocommerce Wholesale Lead Capture plugin allows for the unrestricted upload of files with dangerous types, enabling attackers to upload and execute malicious files on the server.

Executive Summary:
A critical file upload vulnerability in the Woocommerce Wholesale Lead Capture plugin allows attackers to upload web shells and execute arbitrary code on the WordPress server.

Vulnerability Details

CVE-ID: CVE-2026-27540

Affected Software: Rymera Web Co Pty Ltd Woocommerce Wholesale Lead Capture

Affected Versions: n/a through 2.0.3.1

Vulnerability: The plugin fails to restrict the types of files uploaded through its lead capture forms. This allows an attacker to upload files with dangerous extensions (such as .php), which can then be accessed via the web to execute arbitrary code (RCE).

Business Impact

With a CVSS score of 9.0, this vulnerability poses a severe threat. Successful exploitation results in a full site compromise, allowing attackers to steal customer data, modify site content, or use the server for malicious purposes. This leads to significant reputational damage and potential financial loss.

Remediation Plan

Immediate Action: Update the Woocommerce Wholesale Lead Capture plugin to the latest version (2.0.3.2 or later). Ensure that the upload directory is configured to prevent the execution of scripts.

Proactive Monitoring: Review the plugin's upload directory for any suspicious files, particularly those with .php, .html, or .js extensions that do not correspond to legitimate user data.

Compensating Controls: Use a Web Application Firewall (WAF) to block the upload of executable file types and implement server-side restrictions that prevent script execution in public upload folders.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. Unrestricted file upload is a common and high-impact vulnerability that is frequently targeted by automated scanners.

Analyst Recommendation

Organizations must prioritize this update. The ability to upload and execute files is a direct path to server compromise. Immediate patching and the implementation of strict file upload controls are essential to secure the environment.

---METADATA---
VENDOR: Binardat
PRODUCT: 10G08-0800GSM Network Switch
AFFECTED_VERSIONS: Firmware versions prior to V300SP10260209
---END_METADATA---

Description Summary:
Binardat network switches generate predictable numeric session identifiers in their web management interface. This flaw allows attackers to guess active session IDs and hijack authenticated administrative sessions.

Executive Summary:
Binardat network switches are vulnerable to unauthenticated session hijacking due to the generation of predictable session identifiers in the web management console.

Vulnerability Details

CVE-ID: CVE-2026-27515

Affected Software: Binardat 10G08-0800GSM Network Switch

Affected Versions: Firmware versions prior to V300SP10260209

Vulnerability: The web management interface uses a weak algorithm to generate session IDs, resulting in predictable numeric values. An unauthenticated attacker can perform a brute-force or prediction attack to identify a valid, active session ID belonging to a logged-in administrator, thereby gaining full access without credentials.

Business Impact

With a CVSS score of 9.1, this vulnerability allows for the complete takeover of network hardware management. An attacker who hijacks an admin session can change routing tables, disable security features, or create backdoors for persistent access. This poses a severe risk to the confidentiality and availability of all data passing through the switch.

Remediation Plan

Immediate Action: Update the firmware of the Binardat 10G08-0800GSM switch to version V300SP10260209 or later to implement secure session management.

Proactive Monitoring: Audit the web management logs for multiple rapid login attempts or session access from multiple IP addresses simultaneously.

Compensating Controls: Disable the web-based management interface if it is not required, or restrict access to a trusted management workstation via IP-based firewall rules.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation. However, session hijacking via predictable IDs is a well-understood attack vector that can be automated easily once the ID generation pattern is identified.

Analyst Recommendation

Session management is a cornerstone of web security. The predictable nature of these IDs makes the switch a high-value target. Administrators should apply the firmware update immediately and enforce short session timeouts to reduce the window of opportunity for an attacker to hijack an active session.

---METADATA---
VENDOR: the affected software
PRODUCT: Service Dependencies Management Component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability exists in the Service Dependencies deletion function due to the failure to sanitize array keys.

Executive Summary:
A high-severity Blind SQL Injection vulnerability in the Service Dependencies component allows attackers to perform unauthorized database queries and potentially compromise the entire backend.

Vulnerability Details

CVE-ID: CVE-2026-2751

Affected Software: Service Dependencies Management Component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Blind SQL Injection occurring during the deletion of service dependencies. It is caused by the application using unsanitized array keys directly in SQL queries, allowing an attacker to inject malicious SQL commands that are executed by the database engine.

Business Impact

A successful exploit could allow an attacker to exfiltrate sensitive database content, modify critical system records, or potentially gain administrative access to the application. The CVSS score of 8.3 indicates a High-severity risk, emphasizing the potential for complete data compromise and significant operational disruption.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches immediately to address the improper handling of array keys in the deletion function.

Proactive Monitoring: Enable and review database query logs for evidence of "Boolean-based" or "Time-based" Blind SQL injection patterns, such as unusual SLEEP() commands or complex SELECT statements.

Compensating Controls: Implement parameterized queries or an Object-Relational Mapping (ORM) layer that automatically sanitizes inputs, and utilize a WAF to filter out malicious SQL syntax in incoming requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, SQL injection remains a highly reliable attack vector, and the potential for exploitation is very high.

Analyst Recommendation

This vulnerability represents a critical risk to data integrity. We recommend the immediate application of the primary security patch. Furthermore, developers should conduct a comprehensive code review of all database interaction points to ensure that array keys and other metadata are properly sanitized before being used in SQL statements.