---METADATA---
VENDOR: Raera
PRODUCT: Destekz
AFFECTED_VERSIONS: Through 02062026
---END_METADATA---

Description Summary:
A critical SQL injection vulnerability in the Raera Destekz application allows unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
The Raera Destekz application contains a critical SQL injection vulnerability that enables unauthenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-4321

Affected Software: Raera Destekz

Affected Versions: Through 02062026

Vulnerability: This is an SQL injection vulnerability resulting from improper neutralization of special elements in database queries. An unauthenticated attacker can exploit this flaw to manipulate database contents or exfiltrate sensitive data.

Business Impact

The exploitation of this vulnerability poses a severe threat to data confidentiality, integrity, and availability. With a CVSS score of 9.8, this flaw could lead to complete database compromise, potentially resulting in unauthorized access to sensitive user information and total system takeover.

Remediation Plan

Immediate Action: As the vendor has declared this product end-of-life and unsupported, the primary remediation is to decommission the application immediately. If migration is not possible, isolate the host system from all networks.

Proactive Monitoring: Review database query logs for anomalous syntax, specifically looking for common SQL injection patterns such as UNION SELECT or tautology-based queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection rulesets to filter malicious traffic, though this should be considered a temporary measure given the lack of official patches.

Exploitation Status

Public Exploit Available: N/A

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the software is no longer supported by the vendor, the risk of unpatched exploitation remains extremely high.

Analyst Recommendation

Given that Destekz is no longer supported, the risk profile for this vulnerability is effectively permanent. Organizations still utilizing this software must prioritize the migration to a secure, supported alternative to mitigate the risk of a catastrophic data breach.

---METADATA---
VENDOR: WP Extended
PRODUCT: The Ultimate WordPress Toolkit – WP Extended
AFFECTED_VERSIONS: Up to and including 3.x
---END_METADATA---

Description Summary:
The WP Extended plugin for WordPress is vulnerable to privilege escalation, allowing low-privileged users to gain administrative access.

Executive Summary:
A high-severity privilege escalation vulnerability in the WP Extended plugin allows attackers to gain unauthorized administrative control over WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-4314

Affected Software: WP Extended The Ultimate WordPress Toolkit – WP Extended

Affected Versions: All versions up to, and including, 3.x

Vulnerability: This vulnerability allows an authenticated attacker with low-level permissions to escalate their privileges to those of an administrator. This is typically caused by a lack of proper capability checks in the plugin's functional code.

Business Impact

Successful exploitation results in a complete site takeover. An attacker with administrative privileges can delete content, steal user data, install malicious scripts, and potentially use the site to distribute malware. The CVSS score of 8.8 reflects the high impact on site integrity and confidentiality.

Remediation Plan

Immediate Action: Update the WP Extended plugin to the latest version immediately. If the plugin is not essential, consider deactivating and removing it.

Proactive Monitoring: Review the list of administrative users for any unauthorized accounts and audit recent changes to site settings or plugin configurations.

Compensating Controls: Implement the principle of least privilege by limiting the number of users with any level of dashboard access and using a security plugin to monitor for privilege escalation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. Privilege escalation flaws in popular toolkits are high-value targets for attackers seeking persistent access to WordPress environments.

Analyst Recommendation

Immediate remediation is required. Privilege escalation bypasses the fundamental security model of WordPress, making the application of the vendor's patch a critical priority for site administrators.

---METADATA---
VENDOR: DrangSoft
PRODUCT: GCB/FCB Audit Software
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A missing authentication vulnerability in DrangSoft GCB/FCB Audit Software allows unauthenticated remote attackers to create unauthorized administrative accounts via exposed APIs.

Executive Summary:
DrangSoft GCB/FCB Audit Software is susceptible to a critical authentication bypass that allows unauthenticated attackers to grant themselves full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-4312

Affected Software: DrangSoft GCB/FCB Audit Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software fails to enforce authentication on specific API endpoints used for account management. This allows an unauthenticated remote attacker to directly call these APIs and create a new account with administrative privileges.

Business Impact

The impact of this vulnerability is Critical (CVSS 9.8). An attacker with administrative access can modify audit records, delete sensitive data, and manipulate financial or compliance reports. This completely undermines the integrity of the audit software and could lead to severe legal and regulatory consequences.

Remediation Plan

Immediate Action: Update the DrangSoft GCB/FCB Audit Software to the latest version to enforce proper authentication checks on all API endpoints.

Proactive Monitoring: Review the administrative user list for any unrecognized accounts and audit the system logs for API calls originating from unexpected IP addresses.

Compensating Controls: Place the audit software behind a VPN or a Zero Trust Network Access (ZTNA) solution to restrict API access to authorized personnel only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 17, 2026, there is no public information indicating active exploitation. However, the simplicity of exploiting missing authentication makes this a high-risk target.

Analyst Recommendation

Apply the vendor's patch immediately. Administrative account creation is the "keys to the kingdom," and leaving this vulnerability unpatched is an unacceptable risk to organizational data integrity and compliance posture.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (wl1251 driver)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Linux kernel's wl1251 Wi-Fi driver exists due to missing bounds validation on firmware-supplied packet IDs.

Executive Summary:
A critical buffer overflow in the Linux kernel wl1251 Wi-Fi driver could allow attackers to trigger memory corruption via malicious firmware communication.

Vulnerability Details

CVE-ID: CVE-2026-43113

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a buffer overflow vulnerability in the wl1251_tx_packet_cb() function. The driver uses a completion ID provided by the firmware as an index for the wl->tx_frames[] array without verifying if the ID exceeds the array's bounds.

Business Impact

An attacker capable of influencing the firmware or intercepting the firmware-host communication could trigger this memory corruption, leading to system crashes or arbitrary code execution. Given the CVSS score of 8.8, this represents a significant threat to systems using the affected hardware, particularly in embedded or IoT environments.

Remediation Plan

Immediate Action: Apply vendor security updates as they become available. If no patch is currently available for your specific distribution, consider disabling the wl1251 driver if not strictly required.

Proactive Monitoring: Monitor system logs for driver-level errors or unexpected crashes related to Wi-Fi transmission completions.

Compensating Controls: Implement network-level security to prevent untrusted devices from interacting with the host's wireless firmware management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of trusting firmware-supplied indices in kernel drivers. Organizations should prioritize updating kernel packages and, where possible, restrict wireless device access to mitigate the risk of malicious firmware-based exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (CIFS client)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the Linux kernel's CIFS client allows a system crash when processing empty or malformed path strings.

Executive Summary:
A vulnerability in the Linux kernel CIFS client can be triggered by specifically crafted file paths, leading to a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2026-43112

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an out-of-bounds read vulnerability occurring within the cifs_sanitize_prepath function. It is triggered when the function receives an empty string or a string containing only delimiters, which can cause the kernel to access memory outside of the intended buffer.

Business Impact

The primary impact of this vulnerability is a denial-of-service, as the out-of-bounds read will likely result in a kernel panic and subsequent system crash. With a CVSS score of 8.8, this poses a substantial risk to file server stability and availability for any system utilizing the CIFS/SMB client.

Remediation Plan

Immediate Action: Apply available kernel updates provided by your distribution. Note that for some distributions, a vendor-supplied patch may not yet be available; monitor vendor security trackers closely.

Proactive Monitoring: Monitor kernel logs for recurring crashes associated with CIFS mount operations or unusual file system activity.

Compensating Controls: If patching is delayed, restrict the use of untrusted or externally sourced SMB shares that may provide malicious path strings to the client.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should audit their infrastructure for systems utilizing CIFS mounts. While this is primarily a denial-of-service vulnerability, the risk to system availability is high, and patching should be performed as soon as a stable update is released by the distribution vendor.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (brcmfmac driver)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Linux kernel's brcmfmac Wi-Fi driver allows out-of-bounds memory access via malformed IF events from the firmware.

Executive Summary:
A critical out-of-bounds memory access vulnerability in the Linux kernel's brcmfmac driver could lead to system instability or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-43110

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an improper input validation vulnerability where the brcmf_fweh_handle_if_event() function fails to perform range checks on the bsscfgidx field before using it as an array index. The vulnerability is triggered when the host processes a crafted IF event from the Wi-Fi firmware, placing the attack surface at the firmware-host boundary.

Business Impact

Successful exploitation of this vulnerability could lead to a denial-of-service (system crash) or potentially allow a local attacker to escalate privileges by manipulating kernel memory. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of Linux-based systems relying on Broadcom Wi-Fi hardware.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution (e.g., SUSE or Red Hat). Fixed versions include kernel-source >= 6.4.0-150700.53.55.1 for supported SUSE distributions.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected Wi-Fi driver resets that may indicate attempts to trigger an out-of-bounds access.

Compensating Controls: Ensure that systems are running with kernel hardening features enabled, such as Address Space Layout Randomization (ASLR) and stack canaries, to mitigate potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical nature of the kernel-level impact, administrators should prioritize patching their Linux kernels. Organizations relying on Broadcom Wi-Fi chipsets must verify their kernel version against the provided security updates to ensure the bsscfgidx range check is properly implemented.

---METADATA---
VENDOR: WeePie
PRODUCT: Cookie Allow
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL injection via the 'consent' parameter, posing a risk to database security.

Executive Summary:
The WeePie Cookie Allow plugin contains a high-severity SQL injection vulnerability that could allow unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-4304

Affected Software: WeePie Cookie Allow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an SQL injection flaw triggered via the 'consent' parameter. By supplying crafted input, an attacker can execute arbitrary SQL commands against the WordPress database.

Business Impact

A CVSS score of 7.5 highlights the potential for significant impact, including the compromise of sensitive user consent data and broader database exposure. This poses a compliance risk and a direct threat to the security posture of the affected WordPress site.

Remediation Plan

Immediate Action: Update the WeePie Cookie Allow plugin to the latest version as soon as the vendor releases a patch.

Proactive Monitoring: Regularly review application and database error logs for signs of injection attempts or unusual query execution patterns.

Compensating Controls: Implement WAF rules specifically configured to sanitize or block input to the 'consent' parameter to mitigate the risk until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is essential to prevent unauthorized access to the database. Given the nature of the vulnerability, prompt updates are the most effective way to eliminate this security risk.

---METADATA---
VENDOR: Google
PRODUCT: Google Compute (Linux Kernel)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Linux kernel's BPF sockmap implementation, specifically within the sk_psock_verdict_data_ready function.

Executive Summary:
A use-after-free vulnerability in the Linux kernel could allow a local attacker to cause system instability or gain elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-43016

Affected Software: Google Compute (Linux Kernel)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw arises from improper handling of sk->sk_socket within the BPF sockmap code, leading to a use-after-free condition. This is a memory management issue that can be triggered by an attacker with sufficient local access.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a significant risk to cloud instances using affected Linux kernels. Successful exploitation could lead to arbitrary code execution, potentially allowing an attacker to escape container boundaries or gain root access, threatening the confidentiality and integrity of the entire compute instance.

Remediation Plan

Immediate Action: Update the kernel on all Google Compute instances to the latest version provided by your distribution vendor that includes the fix for this BPF vulnerability.

Proactive Monitoring: Implement kernel-level monitoring and log analysis to detect unusual system behavior or crashes that may coincide with exploit attempts.

Compensating Controls: Use container security tools to limit the BPF capabilities of non-privileged users, thereby reducing the attack surface for this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The urgency of this update is high, particularly for multi-tenant or containerized environments. Administrators should test and deploy the kernel patches as part of their next maintenance window to prevent potential privilege escalation.

---METADATA---
VENDOR: OpenStack
PRODUCT: Ironic-python-agent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security issue has been identified in OpenStack ironic-python-agent, potentially impacting the security posture of hardware management services.

Executive Summary:
A high-severity vulnerability in OpenStack ironic-python-agent requires immediate attention to prevent potential unauthorized access to hardware management interfaces.

Vulnerability Details

CVE-ID: CVE-2026-43003

Affected Software: OpenStack Ironic-python-agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited, the vulnerability affects the ironic-python-agent, which is responsible for managing bare-metal hardware. The nature of the flaw suggests potential for unauthorized control or data access.

Business Impact

A CVSS score of 8.0 indicates a high risk to infrastructure availability and control. Unauthorized access to the ironic-python-agent could allow an attacker to disrupt bare-metal provisioning, compromise hardware control, or gain unauthorized access to the underlying management network.

Remediation Plan

Immediate Action: Upgrade to the latest version of ironic-python-agent as specified in the OpenStack security advisory.

Proactive Monitoring: Monitor management network traffic for unusual API requests or unauthorized attempts to interact with the ironic-python-agent service.

Compensating Controls: Isolate the management network used by OpenStack Ironic from general-purpose networks to restrict access to the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Infrastructure teams should prioritize the remediation of this vulnerability, as it directly impacts the management plane of the cloud environment. Ensure that all affected nodes are patched and verified for compliance with security best practices.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1607 (10.0.14393.0-10.0.14393.9338), Windows 10 Version 1809 (10.0.17763.0-10.0.17763.9019), Windows 10 Version 21H2 (10.0.19044.0-10.0.19044.7547), Windows 10 Version 22H2 (10.0.19045.0-10.0.19045.7547), Windows 11 Version 23H2 (10.0.22631.0-10.0.22631.7375)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow exists in the SQL Server ODBC driver on various Windows versions, allowing unauthenticated remote code execution.

Executive Summary:
A critical heap-based buffer overflow in the SQL Server ODBC driver affects multiple versions of Windows and allows for unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-42990

Affected Software: Microsoft Windows

Affected Versions: See metadata for specific build ranges.

Vulnerability: The vulnerability is a heap-based buffer overflow (CWE-122) within the SQL Server ODBC driver. An unauthenticated attacker can trigger this flaw over a network to execute arbitrary code on the host system.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for full system compromise. Successful exploitation could allow an attacker to gain complete control over affected servers, leading to unauthorized data access, lateral movement within the network, and significant operational downtime.

Remediation Plan

Immediate Action: Apply the vendor-supplied security updates immediately to bring systems to the non-vulnerable build versions listed in the metadata.

Proactive Monitoring: Monitor network traffic for unusual patterns directed at database ports and review system logs for signs of unexpected process execution or memory corruption errors.

Compensating Controls: Deploy network segmentation to restrict access to the SQL Server ODBC driver interfaces to only known and trusted hosts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated nature and the potential for total impact.

Analyst Recommendation

Given the critical severity and the potential for remote code execution without authentication, administrators must prioritize patching this vulnerability across all identified Windows platforms. Apply the available updates as soon as possible to mitigate the risk of system compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Remote Desktop Client
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Executive Summary:
A critical heap-based buffer overflow in the Remote Desktop Client enables remote code execution, creating a significant risk of system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-42985

Affected Software: Microsoft Remote Desktop Client

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the heap management of the Remote Desktop Client. An unauthenticated attacker can trigger a buffer overflow by sending specially crafted packets, potentially leading to arbitrary code execution within the security context of the user running the client.

Business Impact

With a CVSS score of 8.8, the ability for an attacker to execute code remotely via a client-side overflow is severe. This could lead to complete workstation compromise, allowing the attacker to steal credentials, access sensitive corporate data, or pivot into the internal network.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft for the Remote Desktop Client application.

Proactive Monitoring: Monitor network traffic for unusual Remote Desktop Protocol (RDP) activity and investigate any unexpected system crashes occurring during RDP sessions.

Compensating Controls: Restrict RDP access to trusted networks and ensure that endpoints are protected by robust Endpoint Detection and Response (EDR) solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that Remote Desktop is a primary attack vector, this vulnerability must be treated with extreme urgency. IT teams should ensure all endpoints running the Remote Desktop Client are patched immediately to prevent potential remote exploitation.

---METADATA---
VENDOR: Welcome Software
PRODUCT: Welcome Software Publishing Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Welcome Software Publishing plugin for WordPress is vulnerable to arbitrary options updates, potentially leading to privilege escalation.

Executive Summary:
An arbitrary options update vulnerability in the Welcome Software Publishing WordPress plugin could lead to full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-4297

Affected Software: Welcome Software Publishing Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw allows an attacker to modify arbitrary WordPress options, which can be leveraged to alter site settings, inject malicious scripts, or escalate privileges. This vulnerability is typically exploitable by an unauthenticated user due to a lack of proper capability checks in the plugin's functions.

Business Impact

Successful exploitation allows an attacker to manipulate the core configuration of a WordPress site. With a CVSS score of 8.8, this vulnerability carries a high risk of total site takeover, which could result in data theft, site defacement, or the redirection of users to malicious third-party domains.

Remediation Plan

Immediate Action: Update the Welcome Software Publishing plugin to the latest version immediately to ensure proper capability checks are implemented.

Proactive Monitoring: Monitor the wp_options database table for unexpected changes and audit all administrative user accounts for unauthorized modifications.

Compensating Controls: Use security plugins to lock down the WordPress configuration and restrict access to the plugin's administrative functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The capability for an attacker to modify arbitrary site options is a critical security failure. Administrators must apply the latest plugin update immediately and conduct a thorough audit of their site settings to ensure no unauthorized configuration changes have already occurred.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: Unbound
AFFECTED_VERSIONS: Up to and including 1.25.0
---END_METADATA---

Description Summary:
NLnet Labs Unbound is vulnerable to cache poisoning via promiscuous RRSets in the authority section of DNS replies, allowing attackers to inject malicious records into the cache.

Executive Summary:
A critical cache poisoning vulnerability in NLnet Labs Unbound allows attackers to redirect traffic by injecting malicious DNS records into the resolver's cache.

Vulnerability Details

CVE-ID: CVE-2026-42960

Affected Software: NLnet Labs Unbound

Affected Versions: Up to and including 1.25.0

Vulnerability: This is a DNS cache poisoning vulnerability. An attacker can exploit this by crafting malicious DNS replies—via spoofing or fragmentation—that force the resolver to cache unauthorized address records.

Business Impact

Successful exploitation allows an adversary to redirect legitimate user traffic to malicious infrastructure, facilitating man-in-the-middle attacks, credential theft, and malware distribution. With a CVSS score of 10.0, this flaw poses a severe risk to the integrity of DNS resolution services across the enterprise.

Remediation Plan

Immediate Action: Upgrade to Unbound version 1.25.1 or later immediately.

Proactive Monitoring: Monitor DNS query traffic for unexpected resolution patterns or signs of cache poisoning attempts.

Compensating Controls: Use DNSSEC validation where possible and ensure the resolver is not reachable from untrusted networks to limit the scope of potential spoofing attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of DNS cache poisoning is critical. Administrators must update to the patched version of Unbound to ensure that the resolver correctly validates additional section records and rejects malicious data.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: Unbound
AFFECTED_VERSIONS: 0 up to 1.25.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in NLnet Labs Unbound versions prior to 1.25.1 allows unauthenticated remote attackers to cause a denial-of-service via an uninitialized pointer access.

Executive Summary:
A critical vulnerability in NLnet Labs Unbound versions prior to 1.25.1 allows unauthenticated attackers to trigger a denial-of-service condition through the access of an uninitialized pointer.

Vulnerability Details

CVE-ID: CVE-2026-42959

Affected Software: NLnet Labs Unbound

Affected Versions: 0 up to 1.25.1

Vulnerability: This vulnerability (CWE-824) involves the access of an uninitialized pointer within the DNS resolver. The attack vector is network-based and does not require authentication, making it highly automatable for remote attackers.

Business Impact

As a core DNS recursive resolver, a successful exploit results in service unavailability, which can disrupt all network-dependent services relying on the affected Unbound instance. The CVSS score of 7.5 reflects the high impact on service availability, potentially causing widespread network outages if the resolver is critical to infrastructure.

Remediation Plan

Immediate Action: Update NLnet Labs Unbound to version 1.25.1 or later.

Proactive Monitoring: Monitor Unbound service logs and system stability metrics for unexpected crashes or restarts that may indicate exploitation attempts.

Compensating Controls: If an immediate update is not feasible, configure the setting 'val-clean-additional: no' in the Unbound configuration file, which bypasses the vulnerable code path.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its reachability from the network without authentication.

Analyst Recommendation

The reliance of network infrastructure on DNS resolvers makes this vulnerability a high priority for remediation. Administrators should apply the update or implement the suggested configuration change immediately to maintain service stability and prevent remote denial-of-service attacks.

---METADATA---
VENDOR: Labcenter
PRODUCT: Proteus
AFFECTED_VERSIONS: 9.1_SP4_Build-42914
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Labcenter Proteus during file parsing can lead to memory corruption, potentially allowing an attacker to execute arbitrary code.

Executive Summary:
A memory corruption vulnerability in Labcenter Proteus could allow an attacker to execute arbitrary code through the processing of specially crafted files.

Vulnerability Details

CVE-ID: CVE-2026-42958

Affected Software: Labcenter Proteus

Affected Versions: 9.1_SP4_Build-42914

Vulnerability: The application contains a use-after-free (CWE-416) flaw triggered during the parsing of malicious files. This vulnerability requires the user to interact with a crafted file and does not require the attacker to be authenticated to the system.

Business Impact

A successful exploit could result in memory corruption, leading to application crashes or the execution of arbitrary code, which could compromise the integrity of engineering designs and intellectual property. With a CVSS score of 7.8, this vulnerability represents a high-severity risk to environments utilizing Proteus for circuit design and simulation.

Remediation Plan

Immediate Action: Update the Proteus installation to the latest version (9.2 SP0) via the application's home page or the Help menu.

Proactive Monitoring: Review system logs for unexpected application termination or memory access violations associated with the Proteus executable.

Compensating Controls: Restrict the opening of files from untrusted sources and utilize sandboxing technologies to isolate the Proteus environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the availability of a vendor-supplied update to version 9.2 SP0, administrators should immediately initiate the upgrade process for all affected Proteus instances. Ensuring software is up-to-date is the only effective mitigation for this memory-related vulnerability.

---METADATA---
VENDOR: Labcenter
PRODUCT: Proteus
AFFECTED_VERSIONS: 9.1_SP4_Build-42914
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Labcenter Proteus contains an out-of-bounds write vulnerability that allows an attacker to cause the application to write data past the end of an allocated memory buffer.

Executive Summary:
An out-of-bounds write vulnerability in Labcenter Proteus could allow an attacker to trigger memory corruption and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-42953

Affected Software: Labcenter Proteus

Affected Versions: 9.1_SP4_Build-42914

Vulnerability: This is an out-of-bounds write vulnerability (CWE-787). The flaw can be exploited when an attacker triggers the application to write data beyond the boundaries of an allocated buffer, potentially leading to arbitrary code execution or a crash.

Business Impact

The exploitation of this memory corruption vulnerability carries significant risk, including potential system instability, loss of data integrity, and unauthorized code execution. Given the CVSS score of 8.4, this is classified as a high-severity issue that could disrupt operational workflows if the software is integrated into critical design or engineering environments.

Remediation Plan

Immediate Action: Upgrade to version 9.2 SPO or later, as recommended by Labcenter. Users can verify their current version via the "About" menu or the home page and trigger the update through the software's built-in notification system.

Proactive Monitoring: Review system and application access logs for anomalous behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Ensure the application is run with the least privilege necessary to limit the impact should an attacker successfully trigger the memory corruption.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this memory corruption flaw necessitates prompt attention. Administrators should prioritize updating all instances of Labcenter Proteus to the latest version to mitigate the risk of exploitation and ensure stable, secure operations.

---METADATA---
VENDOR: Hydro-Québec
PRODUCT: Le Circuit Electrique charging station backend
AFFECTED_VERSIONS: 0 up to (excluding) June_2026
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A lack of request throttling on the charging station backend of Le Circuit Electrique allows unauthenticated attackers to perform denial-of-service attacks.

Executive Summary:
A high-severity denial-of-service vulnerability in the Hydro-Québec Le Circuit Electrique charging station backend allows unauthenticated attackers to disrupt service via excessive requests.

Vulnerability Details

CVE-ID: CVE-2026-42952

Affected Software: Hydro-Québec Le Circuit Electrique charging station backend

Affected Versions: 0 up to (excluding) June_2026

Vulnerability: The system fails to implement throttling on authentication attempts (CWE-307), allowing unauthenticated attackers to overwhelm the service and trigger a denial-of-service condition.

Business Impact

This vulnerability could result in the total unavailability of charging services for users, causing significant operational disruption and reputational harm. With a CVSS score of 7.5, the risk to service availability is substantial, particularly given the critical infrastructure nature of the software.

Remediation Plan

Immediate Action: Ensure all charging stations have been updated as per the vendor's June 2026 update, which disables insecure OCPP configurations and implements proper authentication.

Proactive Monitoring: Monitor backend logs for spikes in authentication requests or abnormal traffic patterns that indicate a potential DoS attempt.

Compensating Controls: If stations cannot be updated, restrict network access to the charging station backend to authorized IP ranges only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently susceptible to simple resource exhaustion attacks.

Analyst Recommendation

Operators of the affected charging infrastructure must verify that the June 2026 updates have been applied. Given the potential for service disruption, maintaining the integrity and availability of these controls is essential for continued operation.

---METADATA---
VENDOR: Naxclow
PRODUCT: IoT Platform (Smart Doorbell X3, X Smart Home, V720, ix cam)
AFFECTED_VERSIONS: All versions
---END_METADATA---

Description Summary:
A flaw in the Naxclow IoT onboarding workflow allows attackers to replay binding sequences to silently hijack device ownership.

Executive Summary:
A critical design flaw in the Naxclow IoT platform enables unauthorized device takeover by allowing attackers to reassign ownership without user interaction.

Vulnerability Details

CVE-ID: CVE-2026-42947

Affected Software: Naxclow IoT Platform

Affected Versions: All versions of Smart Doorbell X3, X Smart Home, V720, and ix cam.

Vulnerability: This is an authentication and authorization bypass vulnerability within the onboarding workflow. The platform fails to verify legitimate ownership during the confirm-then-bind sequence, allowing any authenticated user to claim another user's device.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to user privacy and physical security. An attacker can gain full control over IoT devices, such as doorbells and cameras, leading to unauthorized surveillance, data exfiltration, and potential physical intrusion.

Remediation Plan

Immediate Action: Apply all available vendor security updates provided via the Naxclow IoT platform.

Proactive Monitoring: Audit device ownership logs for unexpected changes or account reassignments that were not initiated by the authorized owner.

Compensating Controls: If updates are unavailable, restrict device access to secure, isolated network segments to limit the exposure of the management interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to hijack IoT devices silently is a high-risk security failure. Administrators must ensure all Naxclow-based hardware is patched immediately and monitor for any suspicious binding activity within their IoT environments.

---METADATA---
VENDOR: F5
PRODUCT: NGINX
AFFECTED_VERSIONS: NGINX Open Source versions 0.6.27 through 1.30.0, NGINX Plus vR32 through R36; also affects F5 products incorporating NGINX.
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability exists in the ngx_http_rewrite_module of NGINX, which can be triggered by crafted HTTP requests to cause service crashes or potential remote code execution.

Executive Summary:
The "NGINX Rift" heap buffer overflow vulnerability in NGINX Open Source and NGINX Plus poses a significant risk of service disruption and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-42945

Affected Software: F5 NGINX

Affected Versions: NGINX Open Source versions 0.6.27 through 1.30.0, NGINX Plus vR32 through R36. Also affects F5 products that incorporate NGINX, such as NGINX Ingress Controller and F5 WAF for NGINX.

Vulnerability: This is a heap buffer overflow (CWE-122) in the ngx_http_rewrite_module, which is accessible to unauthenticated remote attackers. The flaw is triggered by specific configurations using unnamed PCRE captures when combined with crafted HTTP requests.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high severity. Successful exploitation could lead to denial-of-service via worker process crashes or, in specific environments, remote code execution. This poses a critical risk to web infrastructure availability and the integrity of data processed by public-facing NGINX instances.

Remediation Plan

Immediate Action: Upgrade to NGINX 1.30.1 (stable) or 1.31.0 (mainline) immediately, or consult the vendor advisory for specific patches for NGINX Plus and integrated F5 products.

Proactive Monitoring: Monitor NGINX error logs for recurring worker process crashes or segmentation faults, which may indicate exploitation attempts.

Compensating Controls: While a WAF may struggle to inspect the specific internal rewrite logic, ensure that strict request validation is enabled to block malformed or unusually long HTTP headers and request strings.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of May 15, 2026, active exploitation has been confirmed. VulnCheck canary systems detected exploitation attempts starting May 16, 2026, following the release of a proof-of-concept exploit. Given the availability of public exploits and confirmed activity in the wild, the urgency for remediation is extreme.

Analyst Recommendation

Due to confirmed exploitation in the wild and the availability of functional proof-of-concept code, this vulnerability must be treated as a priority. Administrators should audit their NGINX configurations for the vulnerable rewrite patterns and apply the official vendor patches immediately to prevent service degradation and potential system compromise.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: Unbound
AFFECTED_VERSIONS: 1.14.0 up to 1.25.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
NLnet Labs Unbound versions 1.14.0 through 1.25.1 are susceptible to an out-of-bounds write caused by a numeric truncation error, potentially leading to denial-of-service.

Executive Summary:
A critical vulnerability in NLnet Labs Unbound versions 1.14.0 through 1.25.1 allows unauthenticated attackers to trigger an out-of-bounds write, resulting in service disruption.

Vulnerability Details

CVE-ID: CVE-2026-42944

Affected Software: NLnet Labs Unbound

Affected Versions: 1.14.0 up to 1.25.1

Vulnerability: This vulnerability stems from a numeric truncation error (CWE-197) leading to an out-of-bounds write (CWE-787). The vulnerability is network-accessible and requires no authentication to trigger by an external party.

Business Impact

Exploitation of this vulnerability poses a severe risk to DNS service availability. By triggering an out-of-bounds write, an attacker can crash the Unbound process, leading to a denial-of-service for all clients utilizing the resolver, which significantly impacts organizational network operations.

Remediation Plan

Immediate Action: Upgrade NLnet Labs Unbound to version 1.25.1 or later to resolve the underlying memory management defect.

Proactive Monitoring: Monitor Unbound service logs for abnormal termination events and verify that process monitoring tools are correctly alerting on service outages.

Compensating Controls: Implement network-level rate limiting or ingress filtering to restrict traffic to the DNS resolver, which may reduce the likelihood of successful exploitation attempts by untrusted sources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of memory corruption flaws often makes them candidates for future development of denial-of-service exploits.

Analyst Recommendation

Given that this vulnerability shares the same fix version and risk profile as other recent Unbound issues, it should be treated with high urgency. Administrators must update to 1.25.1 to ensure the integrity and availability of their DNS services.

---METADATA---
VENDOR: Pronetiqs
PRODUCT: Panduit Intravue
AFFECTED_VERSIONS: 0 through 3.2.1a14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pronetiqs Panduit Intravue is vulnerable to an unintended proxy or intermediary flaw that allows unauthenticated attackers to bypass OT network segmentation.

Executive Summary:
A critical unintended proxy vulnerability in Pronetiqs Panduit Intravue allows unauthenticated remote attackers to bypass critical network segmentation controls.

Vulnerability Details

CVE-ID: CVE-2026-42933

Affected Software: Pronetiqs Panduit Intravue

Affected Versions: 0 through 3.2.1a14

Vulnerability: This vulnerability, classified as CWE-441 (Confused Deputy), enables an attacker to leverage the software as an active proxy, effectively bridging the gap between disparate network zones. The attack vector is network-based and requires no authentication or user interaction.

Business Impact

The ability to bypass OT network segmentation poses a severe risk to industrial control systems and operational technology environments. A successful exploit could lead to unauthorized lateral movement, exposure of sensitive process data, and complete compromise of network integrity. Given the maximum CVSS score of 10.0, this vulnerability represents an extreme risk to business continuity and safety.

Remediation Plan

Immediate Action: Update all instances of Pronetiqs Panduit Intravue to version 3.2.1a16 or later to address the proxy vulnerability.

Proactive Monitoring: Review network access logs for anomalous traffic patterns originating from the Intravue server, particularly connections directed toward restricted OT segments.

Compensating Controls: Implement strict firewall egress filtering for the Intravue server to prevent it from acting as an unauthorized bridge between network zones.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its potential to neutralize network-level security controls in industrial environments.

Analyst Recommendation

This vulnerability carries a maximum severity rating and requires immediate attention, particularly for organizations operating within industrial or critical infrastructure sectors. Administrators must prioritize updating to version 3.2.1a16 or later to eliminate the proxy capability and restore network segmentation.

---METADATA---
VENDOR: F5
PRODUCT: BIG-IP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in F5 BIG-IP Appliance mode allows administrators to circumvent existing system restrictions.

Executive Summary:
A high-severity vulnerability in F5 BIG-IP allows an authenticated administrator to bypass critical Appliance mode security restrictions, potentially leading to unauthorized configuration changes.

Vulnerability Details

CVE-ID: CVE-2026-42930

Affected Software: F5 BIG-IP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects BIG-IP systems operating in Appliance mode. An attacker who has already been assigned the 'Administrator' role can leverage this flaw to bypass established security restrictions, effectively escalating their control beyond the intended operational boundaries.

Business Impact

The ability to bypass Appliance mode restrictions undermines the security posture of the network perimeter. With a CVSS score of 8.7, this vulnerability could allow an attacker to modify security policies, disable logging, or pivot further into the internal network, leading to a major security breach and compliance violations.

Remediation Plan

Immediate Action: Apply the vendor-provided software update to the affected BIG-IP platforms as soon as it becomes available.

Proactive Monitoring: Audit administrative logs for unusual configuration changes or attempts to access restricted system functions that should be blocked in Appliance mode.

Compensating Controls: Restrict administrative access to the BIG-IP management interface to known, secure management networks only, utilizing multi-factor authentication where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize the review of their F5 BIG-IP environments to determine if they are running in Appliance mode. Once the vendor releases the necessary patch, it should be deployed urgently to prevent unauthorized configuration overrides that could jeopardize the entire network infrastructure.

---METADATA---
VENDOR: F5
PRODUCT: BIG-IP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authenticated privilege escalation vulnerability exists in F5 BIG-IP via the iControl SOAP interface, allowing administrators to create unauthorized SNMP configuration objects.

Executive Summary:
A high-severity privilege escalation vulnerability in F5 BIG-IP allows authenticated users to perform unauthorized configuration changes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-42924

Affected Software: F5 BIG-IP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an improper authorization flaw within the iControl SOAP API. An attacker possessing Resource Administrator or Administrator privileges can manipulate SNMP configuration objects to escalate their operational control.

Business Impact

The ability to escalate privileges within the BIG-IP management plane poses a significant risk to network infrastructure integrity. Successful exploitation could allow an attacker to gain unauthorized control over device monitoring and management, potentially facilitating data exfiltration or lateral movement. With a CVSS score of 8.7, this flaw represents a major security risk to critical infrastructure.

Remediation Plan

Immediate Action: Identify and apply the vendor-supplied security patch or upgrade to the recommended version as detailed in the official F5 security advisory.

Proactive Monitoring: Audit iControl SOAP access logs for unusual SNMP configuration activity or unauthorized attempts to modify system-level settings.

Compensating Controls: Restrict access to the iControl SOAP interface to trusted management IP addresses and enforce strict Role-Based Access Control (RBAC) to limit the number of users with administrative privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for administrative privilege escalation, organizations must prioritize the review of administrative accounts and apply necessary vendor patches immediately. Failure to remediate this vulnerability may allow malicious actors to compromise the management layer of critical network infrastructure.

---METADATA---
VENDOR: Microsoft
PRODUCT: Dynamics 365 (on-premises)
AFFECTED_VERSIONS: 9.0 up to (excluding) 9.1.45.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in Microsoft Dynamics 365 (on-premises) allows an authenticated attacker to execute arbitrary code over a network.

Executive Summary:
A critical code injection vulnerability in Microsoft Dynamics 365 (on-premises) allows authenticated users to achieve remote code execution, threatening internal system integrity.

Vulnerability Details

CVE-ID: CVE-2026-42898

Affected Software: Microsoft Dynamics 365 (on-premises)

Affected Versions: Version 9.0 up to (excluding) 9.1.45.11

Vulnerability: This is a code injection flaw (CWE-94) that permits an attacker with low-level privileges (per CVSS vector PR:L) to execute code in the context of the application over a network.

Business Impact

With a CVSS score of 9.9, this vulnerability presents a high risk of unauthorized system access and potential data exfiltration. Because it allows code execution, an attacker could manipulate business logic, corrupt databases, or pivot to other systems within the internal network, leading to significant operational disruption.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft to reach or exceed version 9.1.45.11.

Proactive Monitoring: Review application-level access logs for anomalous execution patterns or unauthorized modifications to system configurations.

Compensating Controls: Enforce strict least-privilege access policies to limit the potential pool of users who could exploit this vulnerability.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

While this vulnerability requires prior authentication, the high severity score and potential for full system compromise warrant immediate patching. Organizations should prioritize updating their on-premises Dynamics 365 environments during the next maintenance window.

---METADATA---
VENDOR: Microsoft
PRODUCT: Exchange Server
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows unauthenticated attackers to perform spoofing over a network.

Executive Summary:
Microsoft Exchange Server is susceptible to an actively exploited cross-site scripting vulnerability that allows unauthenticated attackers to perform spoofing attacks.

Vulnerability Details

CVE-ID: CVE-2026-42897

Affected Software: Microsoft Exchange Server

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a cross-site scripting (XSS) vulnerability caused by improper input neutralization, which can be leveraged by an unauthenticated attacker to execute malicious scripts in the context of the victim's session.

Business Impact

Successful exploitation allows attackers to spoof communications, potentially leading to phishing, credential theft, or unauthorized actions within the Exchange environment. The CVSS score of 8.1 and the confirmation of active exploitation classify this as a high-urgency issue.

Remediation Plan

Immediate Action: Apply the latest vendor security updates immediately to mitigate the risk of active exploitation.

Proactive Monitoring: Monitor Exchange logs for suspicious web requests containing script tags or abnormal patterns targeting web-based interfaces.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious input strings and block known XSS attack vectors targeting Exchange services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, exploitation of this vulnerability has been observed in the wild. This confirms that the risk is immediate and active.

Analyst Recommendation

Due to confirmed active exploitation, this CVE requires immediate attention. Security teams should prioritize patching all affected Microsoft Exchange instances to prevent potential spoofing and unauthorized access.

---METADATA---
VENDOR: Relay
PRODUCT: Relay Server
AFFECTED_VERSIONS: 0.9.0 through 0.9.6
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in WebSocket endpoints, allowing unauthenticated attackers to read or modify document contents.

Executive Summary:
An authentication bypass vulnerability in Relay Server versions 0.9.0 through 0.9.6 allows unauthenticated attackers to access and modify sensitive data via WebSocket endpoints.

Vulnerability Details

CVE-ID: CVE-2026-42889

Affected Software: Relay Relay Server

Affected Versions: 0.9.0 through 0.9.6

Vulnerability: This is an authentication bypass vulnerability occurring in multi-document WebSocket endpoints. It allows an unauthenticated network attacker to interact with the sync service without a valid token.

Business Impact

This vulnerability poses a significant threat to data confidentiality and integrity. With a CVSS score of 9.1, it allows an unauthenticated attacker to manipulate or exfiltrate documents, which could lead to severe reputational damage and loss of intellectual property.

Remediation Plan

Immediate Action: Update Relay Server to version 0.9.7 or later to resolve the authentication bypass.

Proactive Monitoring: Review WebSocket connection logs for unauthorized access attempts or unusual traffic patterns directed at document sync endpoints.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Relay Server to trusted IP ranges and implement a Web Application Firewall (WAF) to filter malicious WebSocket traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency. Given the ease of access for unauthenticated attackers, deploying the update to version 0.9.7 is the only reliable way to mitigate the risk of unauthorized data access.