---METADATA---
VENDOR: Binardat
PRODUCT: 10G08-0800GSM Network Switch
AFFECTED_VERSIONS: Firmware version V300SP10260209 and prior
---END_METADATA---

Description Summary:
Binardat 10G08-0800GSM switches contain hard-coded administrative credentials in firmware. Knowledge of these static credentials allows an attacker to gain full administrative control of the device.

Executive Summary:
A critical vulnerability in Binardat network switches involves hard-coded administrative credentials that grant unauthenticated attackers full control over the device's management interface.

Vulnerability Details

CVE-ID: CVE-2026-27507

Affected Software: Binardat 10G08-0800GSM Network Switch

Affected Versions: Firmware V300SP10260209 and prior

Vulnerability: This vulnerability stems from the use of hard-coded credentials within the switch firmware that cannot be modified by the end-user. An unauthenticated attacker with knowledge of these credentials can bypass standard security protocols to gain administrative access to the device.

Business Impact

The presence of immutable, hard-coded credentials represents a severe risk to network integrity. A successful exploit allows an attacker to intercept traffic, modify network configurations, or disable critical infrastructure entirely. Given the CVSS score of 9.8, this flaw poses a critical threat to the confidentiality and availability of the organizational network.

Remediation Plan

Immediate Action: Administrators must update the Binardat 10G08-0800GSM firmware to the latest version provided by the vendor immediately to invalidate the hard-coded access.

Proactive Monitoring: Organizations should review device access logs for any logins originating from unexpected IP addresses and monitor for unauthorized configuration changes.

Compensating Controls: Restrict access to the switch management interface using Access Control Lists (ACLs) or place the management interface on a dedicated, isolated VLAN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, because hard-coded credentials are often discovered through reverse engineering and shared in underground forums, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of hard-coded credentials in network infrastructure cannot be overstated, as it provides a "front door" for attackers. It is vital that IT teams apply the vendor-supplied firmware patch immediately. Until patching is complete, ensure the management web interface is not exposed to the public internet or untrusted internal segments.

---METADATA---
VENDOR: Centreon
PRODUCT: Centreon Open Tickets Module
AFFECTED_VERSIONS: All versions before 25.10, 24.10, and 24.04
---END_METADATA---

Description Summary:
An improper input validation vulnerability in Centreon Open Tickets allows attackers to submit malicious data that could compromise the Central Server.

Executive Summary:
Improper input validation in the Centreon Open Tickets module allows attackers to exploit the Central Server, leading to significant security risks and potential data integrity loss.

Vulnerability Details

CVE-ID: CVE-2026-2750

Affected Software: Centreon Open Tickets

Affected Versions: All versions before 25.10, 24.10, and 24.04

Vulnerability: This vulnerability stems from a failure to properly validate user-supplied input within the Open Tickets module. This can lead to various attacks, such as cross-site scripting (XSS), injection, or other malformed data attacks against the Central Server.

Business Impact

The impact of improper input validation on a central monitoring platform includes the potential for unauthorized configuration changes and the theft of sensitive infrastructure data. The CVSS score of 9.1 underscores the high severity and the potential for significant operational impact.

Remediation Plan

Immediate Action: Upgrade the Centreon Open Tickets module to the latest stable versions (25.10, 24.10, or 24.04 branches).

Proactive Monitoring: Audit input logs for the Open Tickets module and check for any anomalous entries or scripts submitted through ticket forms.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and sanitize incoming requests to the Centreon interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. Input validation flaws are common entry points for more complex multi-stage attacks.

Analyst Recommendation

Maintaining the security of monitoring modules is essential for overall network visibility. IT teams should apply the necessary updates immediately to mitigate the risk of input-based attacks against the Centreon environment.

---METADATA---
VENDOR: Centreon
PRODUCT: Centreon Open Tickets Module
AFFECTED_VERSIONS: All versions before 25.10.3, 24.10.8, and 24.04.7
---END_METADATA---

Description Summary:
The Centreon Open Tickets module on Central Server contains a critical vulnerability that could lead to unauthorized system access or compromise.

Executive Summary:
A critical vulnerability in the Centreon Open Tickets module poses a severe risk to Central Server security, potentially allowing for full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-2749

Affected Software: Centreon Open Tickets

Affected Versions: All versions before 25.10.3, 24.10.8, and 24.04.7

Vulnerability: While the specific technical vector is not detailed in the summary, the high CVSS score indicates a critical flaw in the Open Tickets module. Given the context of monitoring systems, this likely involves a path to unauthorized data access or command execution.

Business Impact

A compromise of a monitoring server like Centreon can provide an attacker with a "god-eye" view of the entire IT infrastructure. With a CVSS score of 9.9, this vulnerability could lead to massive data breaches, lateral movement across the network, and total loss of monitoring capabilities.

Remediation Plan

Immediate Action: Update the Centreon Open Tickets module to versions 25.10.3, 24.10.8, or 24.04.7 as appropriate for your current release branch.

Proactive Monitoring: Monitor the Central Server for unauthorized ticket creation, unusual module activity, or unexpected network connections originating from the Centreon server.

Compensating Controls: Restrict access to the Centreon web interface and ensure the server is isolated from the public internet via a firewall.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. Monitoring platforms are high-value targets for advanced persistent threats (APTs).

Analyst Recommendation

Due to the critical nature of monitoring infrastructure, this update should be treated as an emergency. Apply the relevant security patches immediately to protect the Central Server from potential takeover.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw AI Assistant
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The OpenClaw personal AI assistant contains a vulnerability that could allow for unauthorized access to personal data or the execution of unintended commands.

Executive Summary:
A high-severity vulnerability in OpenClaw poses a risk to user privacy and the security of the host system through potential unauthorized interactions.

Vulnerability Details

CVE-ID: CVE-2026-27487

Affected Software: OpenClaw

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: OpenClaw is a personal AI assistant. The vulnerability may involve improper handling of user prompts or insecure integration with the underlying operating system, potentially allowing an attacker to bypass intended restrictions.

Business Impact

For individuals or organizations using AI assistants, this flaw could lead to the exposure of private conversations, personal data, or the execution of malicious scripts on the user's device. The CVSS score of 7.6 reflects a significant risk to data integrity and user privacy.

Remediation Plan

Immediate Action: Update the OpenClaw application to the latest version to ensure all security patches are applied.

Proactive Monitoring: Monitor the application's activity logs for any unusual commands or data access patterns that were not initiated by the user.

Compensating Controls: Run the AI assistant in a restricted user environment or container to limit its access to the broader host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. As AI assistants gain more system-level access, the impact of such vulnerabilities increases significantly.

Analyst Recommendation

Users should be cautious about the permissions granted to AI assistants. It is essential to keep the OpenClaw software updated and to monitor its behavior to prevent unauthorized data access or system manipulation.

---METADATA---
VENDOR: MindsDB
PRODUCT: MindsDB
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
MindsDB, an AI engineering platform, is affected by a high-severity vulnerability that could lead to unauthorized access or platform compromise.

Executive Summary:
A high-severity vulnerability in the MindsDB AI platform could allow attackers to compromise enterprise data and AI workflows, necessitating immediate patching.

Vulnerability Details

CVE-ID: CVE-2026-27483

Affected Software: MindsDB MindsDB

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited in the current disclosure, the vulnerability affects the MindsDB platform, which is used for building AI from enterprise data. Based on the CVSS score of 8.8, this likely involves a significant flaw such as unauthorized access or code execution.

Business Impact

A compromise of the MindsDB platform could expose sensitive enterprise datasets used for machine learning and allow attackers to manipulate AI models. This results in significant data privacy risks and potential loss of intellectual property. The severity is classified as High, indicating a substantial risk to organizational data integrity.

Remediation Plan

Immediate Action: Apply the latest security updates from MindsDB immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review access logs for the MindsDB platform to identify any unauthorized attempts to access datasets or modify AI models.

Compensating Controls: Ensure that MindsDB is deployed within a secure network segment and that access is restricted to authorized users via multi-factor authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Users should consult the vendor's security advisory for detailed version information and specific technical guidance.

Analyst Recommendation

Given the central role AI platforms play in modern enterprise operations, this vulnerability must be addressed urgently. Organizations should apply the necessary patches immediately to protect their data and AI infrastructure from potential compromise.

---METADATA---
VENDOR: Unity Catalog
PRODUCT: Unity Catalog
AFFECTED_VERSIONS: 0.4.0 and earlier
---END_METADATA---

Description Summary:
Unity Catalog 0.4.0 and earlier contains a critical authentication bypass in the token exchange endpoint due to improper validation of the issuer claim in incoming JSON Web Tokens (JWTs).

Executive Summary:
Unity Catalog versions 0.4.0 and earlier are subject to a critical authentication bypass that allows attackers to spoof identities by providing untrusted JWT issuer claims.

Vulnerability Details

CVE-ID: CVE-2026-27478

Affected Software: Unity Catalog

Affected Versions: 0.4.0 and earlier

Vulnerability: The vulnerability resides in the /api/1.0/unity-control/auth/tokens endpoint, which extracts the "iss" (issuer) claim from JWTs without verification. An attacker can provide a malicious issuer URL, forcing the system to fetch a JWKS from an attacker-controlled server to "validate" the token's signature.

Business Impact

This flaw facilitates a complete authentication bypass, allowing unauthorized users to access data and AI assets managed within the Unity Catalog. Given the CVSS score of 9.1, the impact is severe, potentially leading to the exposure of proprietary machine learning models and sensitive organizational datasets.

Remediation Plan

Immediate Action: Update Unity Catalog to the latest available version (post-0.4.0) that enforces a whitelist of trusted identity providers.

Proactive Monitoring: Audit authentication logs for unusual token exchange requests and monitor outbound network traffic for requests to unknown or suspicious domains originating from the Unity Catalog server.

Compensating Controls: Implement network-level egress filtering to prevent the Unity Catalog server from connecting to untrusted external JWKS endpoints or use a dedicated identity proxy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, JWT implementation flaws are frequently targeted once discovered due to the high value of the bypassed security layer.

Analyst Recommendation

The reliance on untrusted issuer claims for signature verification fundamentally breaks the security model of the Unity Catalog. Organizations using this software for data governance must apply the vendor-provided patches immediately to prevent unauthorized access to critical AI infrastructure.

---METADATA---
VENDOR: RustFly
PRODUCT: RustFly
AFFECTED_VERSIONS: 2.0.0
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism, allowing execution of system commands via UDP port 5005.

Executive Summary:
RustFly 2.0.0 is susceptible to critical command injection via its remote UI control mechanism, enabling unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-27476

Affected Software: RustFly RustFly

Affected Versions: 2.0.0

Vulnerability: The application fails to properly sanitize hex-encoded instructions received via UDP port 5005. This allows unauthenticated attackers to inject system commands, leading to full remote control, including the establishment of reverse shells.

Business Impact

The ability to execute arbitrary system commands poses an extreme risk to the integrity and confidentiality of the host machine. With a CVSS score of 9.8, this vulnerability could lead to total system takeover, data exfiltration, and the establishment of persistent backdoors in the environment.

Remediation Plan

Immediate Action: Update RustFly to the latest version that implements proper input sanitization for the remote UI control mechanism.

Proactive Monitoring: Monitor UDP port 5005 for suspicious traffic and inspect system logs for unauthorized command executions or reverse shell activity.

Compensating Controls: Restrict access to UDP port 5005 via network firewalls to only known, trusted IP addresses until a patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that allows direct command injection. It is imperative that administrators restrict network access to the affected port immediately and apply the vendor-provided security update as soon as it becomes available.

---METADATA---
VENDOR: BigBlueButton
PRODUCT: BigBlueButton
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the BigBlueButton open-source virtual classroom software could allow an attacker to compromise session integrity or access unauthorized data.

Executive Summary:
A high-severity security flaw in BigBlueButton threatens the confidentiality and integrity of virtual classroom sessions and user data.

Vulnerability Details

CVE-ID: CVE-2026-27466

Affected Software: BigBlueButton

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the BigBlueButton platform, an open-source solution for online learning. Based on the CVSS score of 7.2, the flaw likely involves improper access controls or input validation within the web-based conferencing interface.

Business Impact

A successful exploit could lead to unauthorized access to private meetings, exposure of student/teacher information, or disruption of educational services. The CVSS score of 7.2 reflects a high risk to organizational reputation and data privacy, particularly for institutions handling sensitive educational records.

Remediation Plan

Immediate Action: Administrators should update their BigBlueButton instances to the latest stable release provided by the developers.

Proactive Monitoring: Review meeting access logs for anomalous join patterns or unauthorized administrative actions within the classroom dashboard.

Compensating Controls: Ensure that all sessions are protected by strong passwords and that the "waiting room" feature is enabled to vet participants manually.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. Organizations using this platform for sensitive communications should remain vigilant and patch promptly.

Analyst Recommendation

Virtual classroom environments are frequent targets for disruption. We recommend that security teams apply the available vendor updates immediately to prevent potential session hijacking or data exposure that could impact institutional operations.

---METADATA---
VENDOR: Umbraco
PRODUCT: Umbraco Engage
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Umbraco Engage, a business intelligence platform, is affected by a high-severity vulnerability that could lead to unauthorized platform access.

Executive Summary:
Umbraco Engage contains a high-severity vulnerability that poses a significant risk to business intelligence data and platform security.

Vulnerability Details

CVE-ID: CVE-2026-27449

Affected Software: Umbraco Engage

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited, the vulnerability affects the Umbraco Engage platform and carries a CVSS score of 7.5. This typically indicates a flaw that could allow for unauthorized data access or privilege escalation.

Business Impact

A compromise of a business intelligence platform like Umbraco Engage could lead to the exposure of sensitive corporate data, analytics, and strategic insights. The High severity rating (7.5) suggests that successful exploitation could result in significant data confidentiality breaches or unauthorized modifications to business reports.

Remediation Plan

Immediate Action: Organizations should immediately consult the Umbraco security advisory and apply the recommended security updates to all Engage instances.

Proactive Monitoring: Review access logs for the Umbraco Engage dashboard for any unauthorized login attempts or unusual data export activities.

Compensating Controls: Ensure the platform is behind a VPN or protected by multi-factor authentication (MFA) to reduce the attack surface while waiting for patch deployment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 28, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public exploit code provides a brief window for administrators to secure their environments.

Analyst Recommendation

Given the high severity of this vulnerability and the sensitive nature of business intelligence data, immediate patching is required. Administrators must verify their current version against the vendor's advisory and update to a secure release to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Rustaurius
PRODUCT: Five Star Business Profile and Schema
AFFECTED_VERSIONS: <= 2.3.19
---END_METADATA---

Description Summary:
An arbitrary code execution vulnerability exists in Rustaurius Five Star Business Profile and Schema versions 2.3.19 and earlier, exploitable by authenticated users with Editor capabilities.

Executive Summary:
A critical arbitrary code execution vulnerability in Rustaurius Five Star Business Profile and Schema allows authenticated Editors to gain unauthorized control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-27436

Affected Software: Rustaurius Five Star Business Profile and Schema

Affected Versions: <= 2.3.19

Vulnerability: This vulnerability enables authenticated attackers with 'Editor' privileges to execute arbitrary code on the underlying server. The flaw stems from insufficient input validation, allowing malicious files or commands to be processed by the server-side application.

Business Impact

The ability for an authenticated user to execute arbitrary code leads to a total compromise of the application and potentially the underlying web server. With a CVSS score of 9.1, this represents a severe risk of lateral movement, privilege escalation, and persistent backend access that could lead to complete system takeover.

Remediation Plan

Immediate Action: Update the Rustaurius Five Star Business Profile and Schema plugin to the latest version immediately to patch the code execution vector.

Proactive Monitoring: Audit user activity logs to identify any unauthorized or suspicious actions performed by accounts with Editor-level privileges.

Compensating Controls: Restrict or audit the permissions of all accounts with 'Editor' roles and ensure that file upload restrictions are strictly enforced at the server level.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation by malicious insiders or compromised accounts is high.

Analyst Recommendation

Given the critical nature of this arbitrary code execution flaw, organizations must treat this as a high-priority update. Promptly applying the vendor-provided patch is the only effective way to mitigate the risk of full system compromise via elevated user accounts.

---METADATA---
VENDOR: Zozothemes
PRODUCT: Zegen
AFFECTED_VERSIONS: <= 1.1.9
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in Zozothemes Zegen allows authenticated attackers to execute malicious code.

Executive Summary:
An arbitrary file upload vulnerability in the Zozothemes Zegen theme poses a critical risk of remote code execution for affected WordPress environments.

Vulnerability Details

CVE-ID: CVE-2026-27419

Affected Software: Zozothemes Zegen

Affected Versions: <= 1.1.9

Vulnerability: This vulnerability stems from improper validation of file uploads, allowing an authenticated user with subscriber-level access to upload arbitrary files to the server. By bypassing file type restrictions, an attacker can upload malicious scripts to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized control over the web server, leading to full site compromise, data exfiltration, or the deployment of malware. Given the CVSS score of 9.9, this flaw represents an extreme risk to the confidentiality, integrity, and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update the Zozothemes Zegen theme to the latest available version provided by the vendor to patch the upload validation flaw.

Proactive Monitoring: Review web server access logs for requests targeting directory paths where uploaded files are stored, specifically looking for suspicious file extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict file uploads to verified, safe file types and block direct access to known upload directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent total system compromise. Administrators must prioritize updating the Zegen theme to the latest version and perform a thorough audit of the server for any web shells or unauthorized files uploaded prior to the patch.

---METADATA---
VENDOR: Fuelthemes
PRODUCT: Werkstatt
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A PHP Object Injection vulnerability in the Werkstatt theme allows authenticated contributors to execute arbitrary code.

Executive Summary:
A high-severity PHP Object Injection flaw in the Fuelthemes Werkstatt theme enables authenticated contributors to compromise the hosting environment.

Vulnerability Details

CVE-ID: CVE-2026-27414

Affected Software: Fuelthemes Werkstatt

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from improper handling of serialized data by the theme, which can be exploited by an authenticated contributor. This allows the attacker to inject malicious objects into the application flow, resulting in remote code execution.

Business Impact

Successful exploitation allows an attacker to gain control over the WordPress instance, potentially resulting in data theft, malware distribution, or site defacement. With a CVSS score of 8.8, this flaw necessitates urgent attention to maintain the security and availability of the web infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Werkstatt theme provided by Fuelthemes to mitigate the injection risk.

Proactive Monitoring: Review application access logs for suspicious user behavior and monitor the integrity of critical application configuration files.

Compensating Controls: Deploy WAF rules designed to filter and block suspicious POST requests containing serialized PHP objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with high priority, as it permits unauthorized code execution within the application context. Updating the theme is the primary defense; failure to do so leaves the environment exposed to potential remote compromise.

---METADATA---
VENDOR: Cozmoslabs
PRODUCT: Profile Builder Pro
AFFECTED_VERSIONS: n/a through 3.13.9
---END_METADATA---

Description Summary:
Cozmoslabs Profile Builder Pro is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive information from the database by sending crafted queries.

Executive Summary:
A critical Blind SQL Injection vulnerability in Profile Builder Pro allows attackers to silently exfiltrate sensitive database information, including user credentials and configuration data.

Vulnerability Details

CVE-ID: CVE-2026-27413

Affected Software: Cozmoslabs Profile Builder Pro

Affected Versions: n/a through 3.13.9

Vulnerability: The plugin fails to properly neutralize special elements used in SQL commands. This allows an attacker to perform "Blind" SQL injection, where they can infer database content based on the server's response time or HTTP status codes, even if direct error messages are suppressed.

Business Impact

With a CVSS score of 9.3, this vulnerability represents a major threat to data confidentiality. Attackers can extract user hashes, personal information, and site metadata, which can be used for further attacks or sold on the dark web. This could lead to significant regulatory fines and a loss of customer trust.

Remediation Plan

Immediate Action: Update Cozmoslabs Profile Builder Pro to the latest version (above 3.13.9) immediately to resolve the improper query handling.

Proactive Monitoring: Monitor database logs for unusual query patterns and look for time-delay based attacks in web server access logs (e.g., requests that take exactly 5 or 10 seconds to respond).

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection enabled to filter out malicious payloads targeting database parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. However, SQL injection remains one of the most common and damaging attack vectors for web applications.

Analyst Recommendation

Organizations must prioritize the application of the patch. The ability to extract the entire database through blind injection is a critical risk that must be mitigated immediately to protect sensitive user and corporate data.

---METADATA---
VENDOR: StylemixThemes
PRODUCT: Pearl - Corporate Business
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Local File Inclusion (LFI) vulnerability exists in the Pearl - Corporate Business theme, allowing unauthenticated attackers to read sensitive files on the server.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the StylemixThemes Pearl - Corporate Business theme poses a severe risk of unauthorized file access and potential server compromise.

Vulnerability Details

CVE-ID: CVE-2026-27412

Affected Software: StylemixThemes Pearl - Corporate Business

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw that allows an unauthenticated attacker to manipulate file paths and access arbitrary files on the underlying server. Because no authentication is required, any remote actor can exploit this to read sensitive configuration files or credentials.

Business Impact

Successful exploitation of this flaw can lead to the exposure of sensitive system files, configuration data, and potentially database credentials, facilitating further attacks. With a CVSS score of 8.1, this is a high-severity issue that could result in a complete compromise of the web application and unauthorized access to hosted data.

Remediation Plan

Immediate Action: Update the Pearl - Corporate Business theme to the latest version provided by the vendor immediately.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences (e.g., ../) or attempts to access system files like /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for unauthenticated attackers to access sensitive files, this vulnerability must be treated with extreme urgency. Administrators should verify their current version and apply security patches as soon as they are released to prevent potential data exfiltration or system compromise.

---METADATA---
VENDOR: BookPro
PRODUCT: BookPro
AFFECTED_VERSIONS: <= 1
---END_METADATA---

Description Summary:
BookPro versions 1 and earlier contain an unauthenticated arbitrary file deletion vulnerability.

Executive Summary:
An unauthenticated arbitrary file deletion vulnerability in BookPro allows remote attackers to delete critical system files, threatening service availability.

Vulnerability Details

CVE-ID: CVE-2026-27400

Affected Software: BookPro BookPro

Affected Versions: <= 1

Vulnerability: The application fails to implement adequate access controls, enabling an unauthenticated attacker to delete arbitrary files on the server. This vulnerability stems from improper input validation regarding file operations.

Business Impact

With a CVSS score of 8.6, the vulnerability represents a high risk to business operations. The ability for an unauthenticated user to delete files can lead to permanent data loss and total system compromise, necessitating an urgent response to prevent exploitation.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor for BookPro immediately.

Proactive Monitoring: Inspect system logs for suspicious file system activity and monitor for unauthorized access patterns.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block potentially malicious file deletion commands.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using BookPro should treat this as a high-priority update. The lack of authentication requirements makes this vulnerability highly accessible to attackers, and remediation should be performed without delay.

---METADATA---
VENDOR: Zohocorp
PRODUCT: ManageEngine ADSelfService Plus
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus contain a third-party dependency vulnerability allowing authenticated remote code execution on agent machines.

Executive Summary:
A vulnerability in a third-party dependency allows authenticated remote code execution on agent machines managed by Zohocorp ManageEngine products.

Vulnerability Details

CVE-ID: CVE-2026-2740

Affected Software: Zohocorp ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from a flaw in a third-party component. It requires an authenticated attacker to trigger the remote code execution (RCE) on agent machines.

Business Impact

With a CVSS score of 8.4, this vulnerability represents a critical risk to organizational security. Successful exploitation grants an attacker the ability to execute arbitrary code on agent machines, likely leading to a full compromise of the affected endpoints and potential lateral movement across the network.

Remediation Plan

Immediate Action: Update ADSelfService Plus (to at least 6525), DataSecurity Plus (to at least 6264), and RecoveryManager Plus (to at least 6313) immediately.

Proactive Monitoring: Audit agent machine logs for unauthorized process creation and unusual network activity originating from the agent software.

Compensating Controls: Restrict network access to the agent management ports and ensure that the administrative accounts used for these services follow the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that directly impacts the integrity of managed agent machines. IT administrators must prioritize updating these ManageEngine products to the specified versions to remediate the vulnerable third-party dependency.

---METADATA---
VENDOR: Unknown
PRODUCT: Paid Videochat Turnkey Site
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated insecure deserialization vulnerability in Paid Videochat Turnkey Site allows attackers to execute arbitrary code.

Executive Summary:
The Paid Videochat Turnkey Site is susceptible to an unauthenticated remote code execution vulnerability via insecure deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2026-27333

Affected Software: Unknown Paid Videochat Turnkey Site

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an insecure deserialization vulnerability affecting the application's data handling processes. Because it does not require authentication, any remote attacker can submit maliciously crafted data to trigger code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a critical threat to the entire hosting environment. Successful exploitation grants an attacker the ability to execute arbitrary commands, potentially leading to full server takeover, data theft, and significant service disruption.

Remediation Plan

Immediate Action: Apply security updates immediately. If no patch is available, disable the affected functionality until a fix is released.

Proactive Monitoring: Inspect server logs for unexpected code execution patterns or anomalous outbound network connections from the web server.

Compensating Controls: Utilize a WAF to inspect incoming traffic for serialized object signatures that are commonly associated with deserialization exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability, it poses an extreme risk to all deployed instances. Immediate mitigation is required; if patching is not possible, isolating the affected system from public access is strongly advised.

---METADATA---
VENDOR: Adobe
PRODUCT: ColdFusion
AFFECTED_VERSIONS: 2023.18, 2025.6 and earlier
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Adobe ColdFusion versions 2023.18, 2025.6 and earlier are susceptible to an Improper Input Validation vulnerability, enabling unauthenticated arbitrary code execution.

Executive Summary:
A critical improper input validation flaw in Adobe ColdFusion enables unauthenticated remote attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-27304

Affected Software: Adobe ColdFusion

Affected Versions: 2023.18, 2025.6 and earlier

Vulnerability: The vulnerability is caused by improper input validation within the ColdFusion environment. This allows an attacker to execute arbitrary code in the context of the current system user without requiring any user interaction or authentication.

Business Impact

With a CVSS score of 9.3, this vulnerability represents a severe threat to the entire server infrastructure. Successful exploitation grants an attacker full control over the application server, facilitating data exfiltration, lateral movement within the network, and the deployment of persistent malware or ransomware, leading to catastrophic business disruption.

Remediation Plan

Immediate Action: Update all Adobe ColdFusion instances to the latest available version provided by the vendor to remediate the input validation defect.

Proactive Monitoring: Monitor server logs for suspicious process execution, unusual inbound network traffic, or unauthorized file modifications that could indicate successful code injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to inspect incoming traffic and block malicious payloads targeting ColdFusion input parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of required authentication or user interaction. Administrators must treat this as a high-priority patching task, ensuring all vulnerable ColdFusion instances are updated immediately to prevent potential remote code execution by external adversaries.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Adobe Connect versions 2025.3, 12.10 and earlier are vulnerable to deserialization of untrusted data, allowing for unauthenticated arbitrary code execution.

Executive Summary:
A critical deserialization vulnerability in Adobe Connect allows unauthenticated attackers to execute arbitrary code, posing a severe threat to system security.

Vulnerability Details

CVE-ID: CVE-2026-27303

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, which can be leveraged by an attacker to execute arbitrary code on the host system. The exploit does not require authentication or user interaction, and it results in a change of security scope.

Business Impact

Given the CVSS score of 9.6, this flaw allows for full system compromise. Successful exploitation could result in the total breach of sensitive communication data, unauthorized access to the Adobe Connect platform, and the potential use of the server as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Apply the latest security update provided by Adobe to all Adobe Connect deployments to resolve the deserialization flaw.

Proactive Monitoring: Review system and application logs for unusual deserialization errors or unexpected outbound connections from the Adobe Connect server to external, untrusted IP addresses.

Compensating Controls: Utilize a WAF or an Intrusion Prevention System (IPS) to filter malicious serialized objects from incoming traffic streams, effectively mitigating the attack vector.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this deserialization vulnerability necessitates immediate attention. Organizations should prioritize updating all Adobe Connect installations, as the lack of authentication requirements makes this an attractive target for automated exploitation.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Connect allows attackers to execute malicious JavaScript in a victim's browser via DOM manipulation.

Executive Summary:
Adobe Connect contains a critical DOM-based XSS vulnerability that could allow attackers to execute arbitrary JavaScript within a user's browser session, potentially leading to full account compromise.

Vulnerability Details

CVE-ID: CVE-2026-27246

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a DOM-based Cross-Site Scripting (XSS) vulnerability where the application improperly handles user-supplied input within the Document Object Model. Exploitation requires user interaction, specifically tricking a victim into visiting a crafted webpage to trigger the malicious script execution.

Business Impact

Successful exploitation poses a severe risk to organizational security, as an attacker could hijack user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of the victim. Given the CVSS score of 9.3, this vulnerability represents a critical threat to data integrity and confidentiality within the Adobe Connect environment.

Remediation Plan

Immediate Action: Update Adobe Connect to the latest available version provided by Adobe to remediate this flaw.

Proactive Monitoring: Review web server and application access logs for suspicious URL patterns or unexpected JavaScript execution requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block malicious script injection attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the potential for session hijacking, the risk remains significant.

Analyst Recommendation

The critical nature of this vulnerability necessitates immediate attention. IT administrators should prioritize patching Adobe Connect installations to the latest version to prevent potential cross-site scripting attacks that could compromise user accounts and sensitive data.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected Cross-Site Scripting (XSS) vulnerability in Adobe Connect enables attackers to execute malicious JavaScript in a victim's browser by enticing them to click a crafted link.

Executive Summary:
Adobe Connect is susceptible to a critical reflected XSS vulnerability that enables attackers to execute arbitrary code in a victim's browser session through malicious URL manipulation.

Vulnerability Details

CVE-ID: CVE-2026-27245

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a reflected Cross-Site Scripting (XSS) vulnerability where the application fails to properly sanitize input before reflecting it back to the user. An attacker can exploit this by crafting a URL that, when visited by a target, executes unauthorized JavaScript in the context of their session.

Business Impact

Reflected XSS can be leveraged to perform phishing, session hijacking, or unauthorized administrative actions. With a CVSS score of 9.3, the impact is critical, as it allows attackers to bypass security boundaries and potentially gain control over authenticated user sessions.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Adobe to ensure all vulnerable endpoints are patched.

Proactive Monitoring: Monitor for anomalous traffic or URLs containing suspicious script-like parameters directed at the Adobe Connect instance.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious payloads commonly used in XSS attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease with which reflected XSS can be weaponized in social engineering campaigns necessitates prompt action.

Analyst Recommendation

Given the critical severity rating, organizations must treat this vulnerability as a high priority. Ensure all systems are updated to the vendor-recommended versions to mitigate the risk of malicious script injection and unauthorized access.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected Cross-Site Scripting (XSS) vulnerability exists in Adobe Connect, allowing attackers to execute malicious JavaScript via crafted URLs.

Executive Summary:
Adobe Connect contains a critical reflected XSS vulnerability that allows an attacker to execute malicious scripts in the victim's browser, potentially leading to complete session compromise.

Vulnerability Details

CVE-ID: CVE-2026-27243

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a reflected Cross-Site Scripting (XSS) vulnerability resulting from insufficient input validation. By enticing a user to visit a malicious URL, an attacker can force the victim's browser to execute arbitrary JavaScript, which runs within the context of the vulnerable application.

Business Impact

The impact of this vulnerability is critical, as evidenced by the CVSS score of 9.3. Successful exploitation allows for the theft of session cookies and sensitive data, potentially leading to unauthorized access to the Adobe Connect platform and broader impacts on organizational data privacy.

Remediation Plan

Immediate Action: Update all Adobe Connect installations to the most recent version released by the vendor.

Proactive Monitoring: Audit application logs for patterns indicating attempts to inject scripts via URL parameters or malicious redirects.

Compensating Controls: Implement robust WAF configurations to detect and block reflected XSS payloads before they reach the application server.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high due to the potential for attackers to easily distribute malicious links to unsuspecting users.

Analyst Recommendation

Security teams should prioritize the application of vendor-provided patches immediately. Failure to address this vulnerability increases the risk of session hijacking and unauthorized access, which could have severe consequences for organizational security.

---METADATA---
VENDOR: bleon-ethical
PRODUCT: api-gateway-deploy
AFFECTED_VERSIONS: Version 1.0.0
---END_METADATA---

Description Summary:
A critical attack chain involving OS command injection and privilege escalation in api-gateway-deploy allows for root-level execution and container escape.

Executive Summary:
Attackers can exploit command injection flaws in the api-gateway-deploy container to gain root privileges and potentially escape to the host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27208

Affected Software: bleon-ethical api-gateway-deploy

Affected Versions: Version 1.0.0

Vulnerability: The vulnerability stems from insecure input handling in entrypoint.sh and the use of the root user within the Dockerfile. An attacker can use OS command injection to execute arbitrary code, which, combined with the default root configuration, facilitates a container escape.

Business Impact

This vulnerability poses a severe threat to infrastructure integrity, as a successful container escape can lead to unauthorized access to the underlying host and adjacent network resources. With a CVSS score of 9.2, the risk of significant infrastructure modification and data theft is critical.

Remediation Plan

Immediate Action: Upgrade to version 1.0.1, which implements strict input sanitization and enforces a non-root "appuser" for container execution.

Proactive Monitoring: Monitor container logs for suspicious shell commands and audit host systems for unauthorized processes originating from the container runtime.

Compensating Controls: Utilize runtime security tools (e.g., Falco or AppArmor) to restrict container capabilities and prevent unauthorized system calls or file access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 24, 2026, no active exploitation has been reported. However, the combination of command injection and root execution makes this a highly attractive target for attackers seeking to compromise cloud environments.

Analyst Recommendation

The transition from root to a non-privileged user is a fundamental security best practice that was missing in the initial release. Organizations must update to version 1.0.1 immediately to mitigate the risk of host-level compromise and ensure secure deployment of their API gateways.

---METADATA---
VENDOR: Formwork
PRODUCT: Formwork CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Formwork, a flat file-based CMS, is susceptible to a high-severity vulnerability that could allow for unauthorized file access or system compromise.

Executive Summary:
A critical security flaw in the Formwork CMS could allow attackers to bypass security controls, potentially leading to unauthorized data access or site takeover.

Vulnerability Details

CVE-ID: CVE-2026-27198

Affected Software: Formwork

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: As a flat file-based CMS, Formwork relies on the file system for data storage. This vulnerability likely involves improper sanitization of file paths or administrative inputs, which could be exploited by an attacker to manipulate the CMS's internal files.

Business Impact

A compromise of the CMS can lead to the defacement of websites, theft of sensitive content, and the distribution of malware to site visitors. The CVSS score of 8.8 indicates a high level of risk to the integrity and confidentiality of any web presence powered by Formwork.

Remediation Plan

Immediate Action: Update the Formwork CMS installation to the latest version immediately to apply necessary security patches.

Proactive Monitoring: Review web server logs for unusual POST requests or attempts to access sensitive file paths (e.g., configuration files).

Compensating Controls: Apply strict file system permissions to the Formwork directory, ensuring the web server only has the minimum necessary write access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. CMS vulnerabilities are frequently targeted by automated scanners for large-scale exploitation.

Analyst Recommendation

Maintaining the security of web-facing content management systems is vital. We recommend an immediate audit of all Formwork installations and the application of the latest security updates to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry (SAML SSO)
AFFECTED_VERSIONS: 21.12.0 through 26.1.0
---END_METADATA---

Description Summary:
A critical flaw in Sentry's SAML SSO implementation allows account takeover via malicious Identity Providers in multi-organization or specifically configured self-hosted instances.

Executive Summary:
A critical vulnerability in Sentry's SAML implementation enables attackers to take over any user account by exploiting weaknesses in multi-organization SSO configurations.

Vulnerability Details

CVE-ID: CVE-2026-27197

Affected Software: Sentry

Affected Versions: 21.12.0 through 26.1.0

Vulnerability: The SAML SSO implementation fails to properly isolate organizations, allowing an attacker with a malicious SAML Identity Provider to impersonate users from another organization on the same instance. This requires the instance to have multiple organizations or specific SSO modification permissions enabled.

Business Impact

A successful account takeover gives attackers access to sensitive error logs, source code snippets, and performance data. Given the CVSS score of 9.1, this represents a high-impact risk to corporate intellectual property and security monitoring integrity.

Remediation Plan

Immediate Action: Update Sentry to version 26.2.0 immediately to resolve the SAML isolation flaw.

Proactive Monitoring: Audit SAML configuration changes and review login logs for unexpected authentication events originating from unfamiliar Identity Providers.

Compensating Controls: As a workaround, mandate individual user-based two-factor authentication (2FA), which prevents attackers from completing the login process even if the SAML bypass is successful.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation. The vulnerability is most dangerous in multi-tenant environments or large self-hosted installations.

Analyst Recommendation

Updating to version 26.2.0 is the most effective way to mitigate this risk. Additionally, administrators should strongly encourage or enforce 2FA for all users, as it provides a critical second layer of defense against account takeover vulnerabilities like this one.

---METADATA---
VENDOR: Deno
PRODUCT: Deno Runtime
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Deno JavaScript and TypeScript runtime that could potentially allow for unauthorized code execution or system interference.

Executive Summary:
A high-severity vulnerability in the Deno runtime poses a significant risk to the security and stability of applications executing JavaScript or TypeScript code.

Vulnerability Details

CVE-ID: CVE-2026-27190

Affected Software: Deno

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the current disclosure, the flaw involves the core Deno runtime environment. The vulnerability likely impacts the boundary between the runtime and the host system, potentially requiring specific user-driven execution.

Business Impact

Compromise of a runtime environment like Deno can lead to arbitrary code execution, allowing attackers to bypass security sandboxes. With a CVSS score of 8.1, this vulnerability could result in significant data exfiltration or unauthorized access to the host server's resources and sensitive files.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Deno Land team immediately to ensure the runtime environment is secured.

Proactive Monitoring: Monitor application logs for unusual crashes or unexpected system calls originating from the Deno process.

Compensating Controls: Implement strict file system and network permission flags (e.g., --allow-net, --allow-read) to limit the potential impact of a runtime compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. Given the high CVSS score, security teams should treat this as a priority update for all Deno-based infrastructure.

Analyst Recommendation

The Deno runtime is often used in security-sensitive backend environments. It is critical that administrators identify all instances of Deno within their stack and apply the necessary updates immediately to mitigate the risk of remote or local exploitation.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via update URL poisoning, allowing an attacker to force the system to download and extract a malicious update package.

Executive Summary:
A critical supply chain vulnerability in MajorDoMo allows unauthenticated attackers to hijack the system update process and deploy webshells by poisoning the update URL.

Vulnerability Details

CVE-ID: CVE-2026-27180

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This unauthenticated RCE vulnerability exists in the saverestore module. An attacker can use a crafted request to change the system's update URL to a malicious server, then trigger a "force update" that downloads and extracts an unverified tarball containing arbitrary PHP files into the webroot.

Business Impact

This vulnerability is assigned a CVSS score of 9.8 due to the ease with which an attacker can achieve full system compromise. By poisoning the update mechanism, an attacker can gain persistent access through webshells, bypass all traditional security controls, and effectively own the entire MajorDoMo environment and its data.

Remediation Plan

Immediate Action: Update to the latest version of MajorDoMo, which includes improved authentication checks and secure update verification.

Proactive Monitoring: Monitor network traffic for outbound connections to unknown or suspicious update servers and check the webroot for newly created or modified PHP files.

Compensating Controls: Use egress filtering to restrict the server's ability to communicate with unauthorized external IP addresses and implement file integrity monitoring (FIM).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the multi-step nature of this exploit (poisoning then triggering) can be easily scripted, making it a high-risk flaw for any internet-facing instance.

Analyst Recommendation

The ability to redirect system updates to a malicious source is a severe architectural flaw. Organizations must apply the latest security updates immediately. Furthermore, ensure that the system is not exposed to the public internet without additional layers of authentication, such as a reverse proxy or VPN.