---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via a race condition and unsanitized user input in the rc/index.php and cycle_execs.php components.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on MajorDoMo systems by exploiting a race condition in the command queuing mechanism, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27175

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves unauthenticated OS command injection where user input is interpolated into shell commands without sanitization. By exploiting a race condition between the web-accessible rc endpoint and the cycle_execs.php polling loop, an attacker can inject shell metacharacters that are executed with the permissions of the web server.

Business Impact

The impact of this vulnerability is critical, as reflected in its CVSS score of 9.8. Successful exploitation grants the attacker full remote code execution (RCE) without requiring any credentials. This can lead to the complete takeover of the host system, lateral movement within the network, and the deployment of ransomware or data exfiltration tools.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the MajorDoMo project immediately or disable web access to the rc/ directory and cycle_execs.php.

Proactive Monitoring: Inspect system logs for unusual shell command executions or suspicious activity originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block shell metacharacters (e.g., semicolons, backticks, pipes) in HTTP GET and POST requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit requires no authentication and targets a common home automation platform, the risk of rapid exploit development is extremely high.

Analyst Recommendation

This vulnerability represents a "worst-case" scenario for networked software: unauthenticated RCE. IT administrators must treat this as a top priority and apply updates immediately. Given the complexity of the race condition, manual sanitization is not recommended; a full vendor-supplied patch is the only reliable solution.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo allows unauthenticated remote code execution via the admin panel's PHP console due to a logic error that bypasses authentication and passes input to the eval() function.

Executive Summary:
MajorDoMo systems are at risk of complete takeover due to a flaw that allows unauthenticated attackers to execute arbitrary PHP code through the administrative console feature.

Vulnerability Details

CVE-ID: CVE-2026-27174

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A logic error in modules/panel.class.php fails to terminate execution after a redirect, allowing unauthenticated requests to reach an AJAX handler. This handler passes user-supplied GET parameters directly to the eval() function, facilitating unauthenticated remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a catastrophic risk to the confidentiality, integrity, and availability of the affected system. An attacker can execute arbitrary PHP code, which allows for database manipulation, file system access, and the ability to use the compromised host as a staging point for further internal network attacks.

Remediation Plan

Immediate Action: Update MajorDoMo to the latest version immediately to resolve the authentication bypass and remove the insecure use of the eval() function.

Proactive Monitoring: Review web server access logs for requests to /admin.php containing ajax_panel, op, and command parameters from unauthorized IP addresses.

Compensating Controls: Restrict access to the /admin.php endpoint using IP whitelisting or a VPN to prevent external exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of exploiting an eval()-based vulnerability makes it a highly attractive target for automated scanning and exploitation scripts.

Analyst Recommendation

The presence of an unauthenticated eval() sink is a critical security failure. Administrators should not wait for evidence of exploitation before acting. The primary remediation—applying the vendor patch—must be performed immediately to prevent unauthorized remote command execution.

---METADATA---
VENDOR: Kubernetes
PRODUCT: Executors
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A security flaw in Kubernetes Executors causes the exposure of worker JWT tokens to users with read-only access to Pods.

Executive Summary:
An information disclosure vulnerability in Kubernetes Executors may allow unauthorized access to sensitive JWT tokens, leading to potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-27173

Affected Software: Kubernetes Executors

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the improper handling of JSON Web Tokens (JWT) used by workers, which are inadvertently exposed to users possessing only read-only access to Kubernetes Pods. This allows authenticated users with limited privileges to gain unauthorized access to credentials intended for worker processes.

Business Impact

The exposure of JWT tokens significantly lowers the barrier for privilege escalation and unauthorized API access within the cluster. With a CVSS score of 8.7, this is a High-severity risk that could result in the total compromise of containerized workloads or unauthorized access to sensitive cluster management functions.

Remediation Plan

Immediate Action: Audit current Kubernetes configurations and apply vendor-supplied security patches to the affected Executor components as soon as they are made available.

Proactive Monitoring: Review Kubernetes audit logs for suspicious activity involving the use of leaked worker tokens or unauthorized attempts to access sensitive Pod information.

Compensating Controls: Enforce the principle of least privilege using RBAC policies to further restrict access to Pod information, reducing the window of opportunity for token harvesting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical failure in credential isolation within the Kubernetes ecosystem. Administrators should prioritize identifying vulnerable Executor instances and apply updates immediately to prevent unauthorized cluster-wide access.

---METADATA---
VENDOR: SAIL
PRODUCT: SAIL Image Library
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SAIL image library contains a high-severity vulnerability that could lead to memory corruption or arbitrary code execution when processing malicious image files.

Executive Summary:
A vulnerability in the SAIL image library allows attackers to potentially execute code or crash applications by providing specially crafted image files.

Vulnerability Details

CVE-ID: CVE-2026-27168

Affected Software: SAIL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: SAIL is a library used for loading and saving various image formats. The vulnerability likely involves improper handling of metadata, ICC profiles, or animation frames, which can be triggered during the parsing of an untrusted image.

Business Impact

Applications using the SAIL library to process user-uploaded content are at high risk. A successful exploit could lead to full system compromise or a significant denial-of-service condition. The CVSS score of 8.8 reflects the high severity and the potential for remote exploitation through common web or desktop application workflows.

Remediation Plan

Immediate Action: Developers should update the SAIL library to the latest patched version and recompile any dependent applications.

Proactive Monitoring: Implement robust input validation and use sandboxed processes for image parsing to contain potential exploits.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and filter suspicious image uploads that may contain exploit payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. Image parsing vulnerabilities are common vectors for initial access and should be addressed with high priority.

Analyst Recommendation

Given the high CVSS score, organizations should immediately identify all applications utilizing the SAIL library. Ensuring these libraries are updated is essential to preventing remote code execution via malicious media files.

---METADATA---
VENDOR: Strimzi
PRODUCT: Strimzi Kafka Operator
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Strimzi deployment configuration for Apache Kafka on Kubernetes or OpenShift could allow for unauthorized access or cluster compromise.

Executive Summary:
A significant security flaw in Strimzi’s Kafka deployment framework on Kubernetes poses a critical risk to data streaming infrastructure and cluster security.

Vulnerability Details

CVE-ID: CVE-2026-27134

Affected Software: Strimzi (Apache Kafka on Kubernetes)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While the specific technical vector is not detailed in the summary, the high CVSS score of 8.1 in the context of Strimzi suggests a flaw in how Kafka clusters are orchestrated or secured within Kubernetes/OpenShift environments. This likely involves improper access control or insecure default configurations in the operator.

Business Impact

A successful exploit could lead to the unauthorized interception of data streams, disruption of critical messaging services, or full compromise of the Kubernetes namespace. Given that Kafka often handles sensitive real-time data, the business impact includes potential regulatory non-compliance and significant operational downtime. The CVSS score of 8.1 indicates a High-severity threat that requires immediate attention.

Remediation Plan

Immediate Action: Apply the latest security updates for the Strimzi operator and associated Kafka container images immediately.

Proactive Monitoring: Monitor Kubernetes audit logs for unauthorized changes to Custom Resource Definitions (CRDs) related to Kafka and review network policy logs for unexpected traffic patterns.

Compensating Controls: Enforce strict NetworkPolicies to isolate Kafka clusters and use Role-Based Access Control (RBAC) to limit who can modify Strimzi-managed resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of Kubernetes orchestration makes these types of vulnerabilities highly attractive targets for attackers seeking to compromise cloud-native infrastructure.

Analyst Recommendation

Security teams must prioritize the update of the Strimzi operator across all environments. Given the central role Kafka plays in modern data architectures, a compromise of this component could have cascading effects across the entire enterprise. Immediate patching is the only effective mitigation.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: 0.26.6 and below
---END_METADATA---

Description Summary:
Dokploy 0.26.6 and below contain an OS command injection vulnerability in the appName parameter, allowing authenticated attackers to execute arbitrary commands with server-level privileges.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows attackers to achieve server-level code execution, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27130

Affected Software: Dokploy

Affected Versions: 0.26.6 and below

Vulnerability: The application fails to properly sanitize the appName parameter before passing it to system shell commands, allowing an authenticated attacker to inject shell metacharacters.

Business Impact

The CVSS score of 9.9 reflects the high severity of this command injection. An authenticated attacker can escalate their access to full server control, potentially destroying the PaaS environment or gaining access to all hosted applications and their associated data.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.26.7 or later.

Proactive Monitoring: Review application logs for unexpected shell commands or character sequences in the appName field.

Compensating Controls: Implement strict input validation on the application creation interface and limit user access to sensitive administrative functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: Syarif Mobile
PRODUCT: Mobile App Editor
AFFECTED_VERSIONS: n/a through 1.3.1
CONFIDENCE: high
MISSING: exploit_status, technical_details
---END_METADATA---

Description Summary:
The Syarif Mobile App Editor is vulnerable to an unrestricted file upload flaw, which allows an attacker to upload a web shell to the server.

Executive Summary:
Syarif Mobile App Editor versions up to 1.3.1 are susceptible to an unrestricted file upload vulnerability, enabling attackers to deploy web shells and achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-27067

Affected Software: Syarif Mobile App Editor

Affected Versions: n/a through 1.3.1

Vulnerability: The application fails to properly validate the types of files uploaded, allowing an attacker to bypass restrictions and upload a malicious web shell to the web server.

Business Impact

Successful exploitation allows an attacker to gain persistent remote access to the underlying server environment. With a CVSS score of 9.1, this flaw presents a critical risk of data breach, unauthorized modification of application files, and complete loss of server confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade to the latest available version of Syarif Mobile App Editor that addresses this file upload restriction flaw.

Proactive Monitoring: Regularly scan the web server directory for unauthorized script files or unexpected changes to the file system.

Compensating Controls: Implement file extension and MIME type validation at the Web Application Firewall (WAF) level to block suspicious file uploads.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the vulnerability (web shell deployment) makes it an attractive target for automated exploitation.

Analyst Recommendation

The risk associated with unrestricted file uploads is severe, as it provides a direct path to server compromise. Organizations should apply the necessary updates immediately and audit their file upload directories for existing indicators of compromise.

---METADATA---
VENDOR: ThimPress
PRODUCT: BuilderPress
AFFECTED_VERSIONS: n/a through 2.0.1
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
BuilderPress by ThimPress contains a PHP Local File Inclusion (LFI) vulnerability caused by improper control of filenames in include/require statements.

Executive Summary:
ThimPress BuilderPress versions through 2.0.1 are vulnerable to a critical Local File Inclusion flaw, permitting attackers to read sensitive system files or execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-27065

Affected Software: ThimPress BuilderPress

Affected Versions: n/a through 2.0.1

Vulnerability: The application exhibits improper control of filenames used in include or require statements, resulting in a PHP Local File Inclusion vulnerability that allows attackers to manipulate file paths.

Business Impact

This vulnerability, rated with a critical CVSS score of 9.8, allows an attacker to access sensitive information or execute malicious code on the server. The potential for full system compromise and unauthorized data access makes this an urgent priority for remediation to prevent complete breach of the application environment.

Remediation Plan

Immediate Action: Update the BuilderPress plugin to the latest version provided by ThimPress to fix the file inclusion logic.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences or attempts to access system files (e.g., /etc/passwd).

Compensating Controls: Configure the web server to restrict directory access and utilize a WAF to block requests containing directory traversal characters or suspicious file path patterns.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, LFI vulnerabilities are frequently targeted due to their high impact.

Analyst Recommendation

Given the critical nature of this LFI vulnerability, it is imperative that administrators update to the latest version of the BuilderPress plugin immediately. Failure to patch may result in unauthorized access to sensitive configuration files or remote code execution.

---METADATA---
VENDOR: Reputeinfosystems
PRODUCT: ARMember Premium
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A PHP Object Injection vulnerability in ARMember Premium allows authenticated contributors to execute arbitrary code.

Executive Summary:
A critical PHP Object Injection vulnerability in ARMember Premium poses a significant risk of remote code execution by authenticated contributors.

Vulnerability Details

CVE-ID: CVE-2026-27060

Affected Software: Reputeinfosystems ARMember Premium

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a PHP Object Injection flaw triggered by a contributor-level user. An attacker can manipulate serialized objects to execute arbitrary code or perform unauthorized actions within the WordPress environment.

Business Impact

The ability for a contributor to perform object injection could lead to a full site compromise, including unauthorized data access and potential server-side execution. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity, potentially leading to total system takeover.

Remediation Plan

Immediate Action: Update the ARMember Premium plugin to the latest version as recommended by Reputeinfosystems.

Proactive Monitoring: Inspect server logs for unusual PHP error patterns and monitor for unexpected file modifications or unauthorized user activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block malicious serialized object payloads directed at the web application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ARMember Premium must prioritize this update, as the vulnerability allows for privilege escalation and arbitrary code execution. Patching immediately is necessary to prevent unauthorized access and potential data exfiltration by malicious actors.

---METADATA---
VENDOR: WordPress
PRODUCT: Broadcast Live Video
AFFECTED_VERSIONS: < 7.1.3
---END_METADATA---

Description Summary:
An unauthenticated PHP object injection vulnerability in the Broadcast Live Video plugin for WordPress allows remote code execution.

Executive Summary:
A critical PHP object injection vulnerability in the Broadcast Live Video WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-27053

Affected Software: WordPress Broadcast Live Video

Affected Versions: < 7.1.3

Vulnerability: This vulnerability involves the insecure deserialization of user-supplied data. An unauthenticated attacker can inject a malicious PHP object, leading to remote code execution within the context of the web server.

Business Impact

With a 9.8 CVSS score, this is a Critical vulnerability. Code execution allows an attacker to gain full control over the web server, potentially compromising the entire hosting environment, stealing data, or utilizing the server as a node for further malicious activities.

Remediation Plan

Immediate Action: Update the Broadcast Live Video plugin to version 7.1.3 or later immediately.

Proactive Monitoring: Monitor for suspicious outbound network connections originating from the web server, which may indicate command-and-control communication.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out serialized PHP objects in HTTP requests, which can mitigate the risk of object injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

PHP object injection is a severe vulnerability that grants an attacker significant control. Organizations must prioritize the patch and consider resetting any credentials stored on the server, as they must be assumed compromised if the system was potentially exposed to this attack.

---METADATA---
VENDOR: TotalSuite
PRODUCT: Total Poll Lite
AFFECTED_VERSIONS: From n/a through 4.12.0
---END_METADATA---

Description Summary:
Total Poll Lite is vulnerable to Remote Code Inclusion (RCI) due to improper control of code generation. This affects versions up to and including 4.12.0.

Executive Summary:
The Total Poll Lite WordPress plugin contains a critical Remote Code Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-27044

Affected Software: Total Poll Lite (WordPress Plugin)

Affected Versions: From n/a through 4.12.0

Vulnerability: This is a Remote Code Inclusion (RCI) vulnerability caused by the improper control of code generation within the totalpoll-lite component. An unauthenticated attacker can manipulate the plugin to include and execute remote files or malicious code strings.

Business Impact

RCI vulnerabilities are among the most severe, as they provide a direct path to Remote Code Execution (RCE). An attacker can take full control of the web server, deface the website, or use the server as a jumping-off point for further internal network attacks. The CVSS score of 9.9 reflects a near-maximum severity level.

Remediation Plan

Immediate Action: Immediately update Total Poll Lite to a version newer than 4.12.0. If no patch is available, deactivate and remove the plugin until a fix is released.

Proactive Monitoring: Check for the presence of unauthorized PHP files in the WordPress uploads directory and review logs for requests fetching remote assets.

Compensating Controls: Use a WAF to block requests containing external URLs in parameters and disable allow_url_include in the PHP configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. However, RCI vulnerabilities are highly sought after by botnet operators for mass website compromise.

Analyst Recommendation

The critical nature of this vulnerability (CVSS 9.9) necessitates immediate action. Organizations must update or remove this plugin immediately. RCI allows for total system takeover, making this the highest priority for WordPress administrators in this batch.

---METADATA---
VENDOR: OCPP-compliant Charging Infrastructure
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Unauthenticated attackers can perform station impersonation and manipulate backend data due to a lack of proper authentication on OCPP WebSocket endpoints.

Executive Summary:
An unauthenticated attacker can exploit a lack of authentication in OCPP WebSocket endpoints to gain unauthorized control over charging infrastructure and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-27028

Affected Software: OCPP-compliant Charging Infrastructure

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists because WebSocket endpoints fail to validate the identity of connecting chargers. An unauthenticated attacker can bypass security controls by using a known charging station identifier to intercept or forge OCPP commands.

Business Impact

The potential for unauthorized manipulation of charging data and infrastructure control poses a severe threat to operational continuity. With a CVSS score of 9.4, this vulnerability could result in significant financial loss, data corruption within the charging network, and safety risks associated with unmanaged power equipment.

Remediation Plan

Immediate Action: Deploy the latest security updates from the vendor immediately to enforce robust authentication for all charging station connections.

Proactive Monitoring: Enable detailed logging for WebSocket handshakes and monitor for anomalies, such as multiple concurrent connections using the same station identifier.

Compensating Controls: Utilize a Web Application Firewall (WAF) capable of inspecting WebSocket traffic or implement mTLS (Mutual TLS) to ensure only authorized hardware can connect.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical details suggest that crafting an exploit would be straightforward for a motivated actor.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Organizations should prioritize patching all affected OCPP-compliant gateways and backend systems to prevent unauthorized station impersonation and protect the integrity of the charging network.

---METADATA---
VENDOR: OpenSTAManager
PRODUCT: OpenSTAManager
AFFECTED_VERSIONS: 2.9.8 and earlier
---END_METADATA---

Description Summary:
An authentication bypass in OpenSTAManager allows attackers to arbitrarily modify user groups, leading to full administrative privilege escalation.

Executive Summary:
A critical privilege escalation vulnerability in OpenSTAManager allows any attacker to promote themselves to the administrator group by directly accessing a vulnerable script.

Vulnerability Details

CVE-ID: CVE-2026-27012

Affected Software: OpenSTAManager

Affected Versions: 2.9.8 and earlier

Vulnerability: A flaw in modules/utenti/actions.php allows for authentication bypass and unauthorized group modification. An attacker can directly call this script to change the 'idgruppo' parameter of any user, effectively granting themselves administrative rights or demoting existing admins.

Business Impact

With a CVSS score of 9.8, the business impact is severe. An attacker can gain full access to invoicing, technical assistance records, and sensitive customer data. By demoting existing administrators, an attacker can also lock legitimate users out of the system, causing significant operational downtime.

Remediation Plan

Immediate Action: Update OpenSTAManager to a version newer than 2.9.8. If a patch is not immediately available, restrict access to the modules/utenti/ directory.

Proactive Monitoring: Audit the 'utenti' (users) table in the database for unauthorized changes to user groups and review web logs for direct requests to actions.php.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized direct access to PHP scripts in the modules directory that should require a valid session.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. The ability to bypass authentication to modify user roles is a highly critical flaw that is relatively easy to exploit once identified.

Analyst Recommendation

Immediate remediation is required to prevent unauthorized access to sensitive business management data. Administrators should verify the integrity of all administrative accounts after applying the update.

---METADATA---
VENDOR: Unknown
PRODUCT: Affected Software
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An authenticated file upload vulnerability allows attackers to upload and execute malicious files, leading to remote code execution on the server.

Executive Summary:
An authenticated remote code execution vulnerability exists due to improper file upload restrictions, allowing users to compromise the host server by executing malicious scripts.

Vulnerability Details

CVE-ID: CVE-2026-2701

Affected Software: Affected Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly validate the contents and extensions of uploaded files. An authenticated user can bypass existing checks to upload a malicious script (such as a web shell) and execute it, resulting in full Remote Code Execution (RCE).

Business Impact

While this exploit requires authentication, the impact is critical as it allows any user with upload privileges to escalate their access to the server level. This can lead to lateral movement within the network, data exfiltration, and the installation of persistent malware, justifying the CVSS score of 9.1.

Remediation Plan

Immediate Action: Update the affected software to the latest version and implement strict file-type validation (MIME-type and extension) for all upload fields.

Proactive Monitoring: Audit all recently uploaded files in the application's storage directories for suspicious scripts (.php, .asp, .exe) and review web server execution logs.

Compensating Controls: Configure the upload directory with "no-execute" permissions at the web server level and utilize an antivirus/malware scanner to inspect all incoming files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. Authenticated RCE is frequently used by disgruntled employees or attackers who have obtained legitimate credentials via phishing.

Analyst Recommendation

Organizations should immediately apply the available patch to secure the file upload mechanism. Furthermore, the principle of least privilege should be applied to ensure that only necessary users have file upload permissions, reducing the overall attack surface.

---METADATA---
VENDOR: OpenClaw
PRODUCT: tool sandbox
AFFECTED_VERSIONS: Prior to version 2026.2.15
---END_METADATA---

Description Summary:
OpenClaw's Docker tool sandbox is vulnerable to configuration injection, allowing dangerous Docker options that can lead to container escape and host data access.

Executive Summary:
A critical configuration injection vulnerability in OpenClaw's Docker sandbox enables attackers to escape container environments and access sensitive host system data.

Vulnerability Details

CVE-ID: CVE-2026-27002

Affected Software: Docker tool sandbox (OpenClaw)

Affected Versions: Prior to version 2026.2.15

Vulnerability: This issue involves the injection of dangerous Docker configuration options (such as bind mounts and host networking) into the sandbox environment. This allows an attacker to bypass container isolation, potentially achieving a full container escape or gaining unauthorized access to the host file system.

Business Impact

An exploit could lead to the total compromise of the host server supporting the AI assistant. Attackers could steal sensitive host data, escalate privileges, or move laterally within the network. The CVSS score of 9.8 underscores the critical risk to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.2.15 or later, which implements runtime enforcement and validation of Docker arguments.

Proactive Monitoring: Audit Docker logs for unauthorized container creations with network=host or unconfined profiles and monitor host file systems for unauthorized access.

Compensating Controls: As a workaround, ensure that sandbox configurations do not use system directory bind mounts, keep networking set to none or bridge, and enforce strict seccomp/AppArmor profiles.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation. The vendor has proactively released a patch and detailed workarounds to mitigate the risk.

Analyst Recommendation

Organizations using OpenClaw must prioritize the update to version 2026.2.15. In environments where immediate updates are not possible, the provided configuration workarounds should be applied manually to prevent the use of dangerous Docker options that facilitate container escapes.

---METADATA---
VENDOR: Citrix
PRODUCT: ShareFile Storage Zones Controller (SZC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Citrix ShareFile Storage Zones Controller (SZC) contains a flaw allowing unauthenticated attackers to access restricted configuration pages, leading to system changes and remote code execution.

Executive Summary:
Unauthenticated attackers can bypass access controls on Citrix ShareFile Storage Zones Controllers to modify system configurations and execute arbitrary code, posing a critical risk to data sovereignty.

Vulnerability Details

CVE-ID: CVE-2026-2699

Affected Software: Citrix ShareFile Storage Zones Controller (SZC)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability allows an unauthenticated remote attacker to bypass authorization checks and access restricted administrative configuration pages. By manipulating these settings, the attacker can achieve Remote Code Execution (RCE) on the SZC instance.

Business Impact

The ShareFile Storage Zones Controller is responsible for managing sensitive data storage; a compromise here allows an attacker to intercept, modify, or delete corporate data. With a CVSS score of 9.8, this vulnerability represents a near-total loss of security controls, potentially leading to significant regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor for the ShareFile Storage Zones Controller immediately to close the unauthorized access path.

Proactive Monitoring: Review web server logs for unauthorized hits to administrative URL paths (e.g., /config) originating from external or unexpected IP addresses.

Compensating Controls: Restrict access to the SZC management interface using IP whitelisting or a VPN, and ensure a Web Application Firewall (WAF) is configured to block unauthorized administrative requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, unauthenticated RCE vulnerabilities in edge-facing storage controllers are frequent targets for ransomware groups and state-sponsored actors.

Analyst Recommendation

Given that this vulnerability requires no authentication and can lead to full system takeover, it must be treated as a top-tier priority. Organizations should assume that any SZC exposed to the internet is at immediate risk and must apply the vendor-supplied patches without delay.

---METADATA---
VENDOR: LibreNMS
PRODUCT: LibreNMS
AFFECTED_VERSIONS: 25.12.0 and below
---END_METADATA---

Description Summary:
LibreNMS contains an SQL injection vulnerability in the ajax_table.php endpoint due to improper sanitization of IPv6 address parameters, allowing unauthorized database access.

Executive Summary:
A critical SQL injection vulnerability in LibreNMS allows attackers to execute arbitrary database commands and potentially compromise sensitive network monitoring data.

Vulnerability Details

CVE-ID: CVE-2026-26988

Affected Software: LibreNMS

Affected Versions: 25.12.0 and below

Vulnerability: The vulnerability exists within the ajax_table.php endpoint during the processing of IPv6 searches. The application fails to sanitize the "address" parameter, specifically concatenating the prefix portion directly into an SQL query string, allowing for unauthenticated or low-privileged SQL injection.

Business Impact

A successful SQL injection attack could result in the disclosure of sensitive network topology data, device credentials, and configuration information stored in the LibreNMS database. With a CVSS score of 9.1, this represents a high risk to the confidentiality and integrity of the organization’s network monitoring infrastructure.

Remediation Plan

Immediate Action: Update LibreNMS to version 26.2.0 or higher to apply the security fix for the ajax_table.php endpoint.

Proactive Monitoring: Review database query logs for unusual syntax or errors related to IPv6 address lookups and monitor for unauthorized data export attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block SQL injection patterns in AJAX requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation. However, SQL injection in a core monitoring tool is a high-value target for attackers looking to gain network intelligence.

Analyst Recommendation

The immediate application of the version 26.2.0 patch is critical. Because LibreNMS holds sensitive information about the entire network, any database compromise could serve as a stepping stone for wider corporate network infiltration.

---METADATA---
VENDOR: Ghost Foundation
PRODUCT: Ghost CMS
AFFECTED_VERSIONS: 3.24.0 through 6.19.0
---END_METADATA---

Description Summary:
Ghost CMS is vulnerable to unauthenticated arbitrary database reads, allowing attackers to extract sensitive information directly from the underlying database.

Executive Summary:
Ghost CMS versions 3.24.0 through 6.19.0 contain a critical vulnerability allowing unauthenticated attackers to perform arbitrary database reads, risking total data exposure.

Vulnerability Details

CVE-ID: CVE-2026-26980

Affected Software: Ghost CMS

Affected Versions: 3.24.0 through 6.19.0

Vulnerability: The vulnerability allows an unauthenticated attacker to bypass standard access controls to read arbitrary data from the database. This occurs due to insufficient input validation within the Node.js-based content management system's core logic.

Business Impact

The ability to read arbitrary database content poses a severe risk to confidentiality, potentially exposing user credentials, private posts, and configuration secrets. The CVSS score of 9.4 reflects the high impact on data integrity and confidentiality, which could lead to significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Administrators must upgrade Ghost CMS to version 6.19.1 or later to resolve the information disclosure flaw.

Proactive Monitoring: Inspect database access logs for unusual query patterns or high volumes of data requests originating from the CMS application layer.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious SQL-like injection patterns or unauthorized REST API requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation of this vulnerability. Given that the exploit is unauthenticated, the likelihood of automated scanning and exploitation is high.

Analyst Recommendation

This vulnerability grants unauthenticated access to the heart of the CMS data layer. Security teams should treat this as a high-priority incident and apply the version 6.19.1 update immediately to prevent unauthorized data exfiltration.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: 3.10.4
---END_METADATA---

Description Summary:
A full sandbox escape vulnerability in vm2 version 3.10.4 allows attackers to access the host process object and execute arbitrary host commands.

Executive Summary:
A critical sandbox escape vulnerability in vm2 allows attackers to gain access to the host process object and execute arbitrary commands on the system.

Vulnerability Details

CVE-ID: CVE-2026-26956

Affected Software: vm2 (Node.js)

Affected Versions: 3.10.4

Vulnerability: This is a full sandbox escape that allows code running within VM.run() to obtain the host process object. With this access, an attacker can execute arbitrary commands on the host system without any cooperation from the host itself.

Business Impact

The CVSS score of 9.8 indicates that this is a critical vulnerability. An attacker can achieve complete system compromise, bypassing all intended restrictions of the vm2 sandbox, potentially leading to unauthorized data access and system manipulation.

Remediation Plan

Immediate Action: Upgrade vm2 to version 3.10.5 or later to resolve the sandbox escape.

Proactive Monitoring: Monitor for suspicious process activity or unauthorized modifications to the host system by the Node.js application.

Compensating Controls: Utilize kernel-level security features to limit the process's capabilities and prevent the exploitation of process objects.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is exceptionally dangerous as it grants direct access to the host process. Immediate patching is required. Organizations should treat this as a high-priority security update and review their application's dependency tree to ensure the patch is correctly applied.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.34
---END_METADATA---

Description Summary:
SandboxJS versions prior to 0.8.34 allow attackers to escape the JavaScript sandbox by obtaining arrays containing Function objects, leading to arbitrary code execution.

Executive Summary:
A critical sandbox escape vulnerability in SandboxJS allows attackers to bypass security restrictions and execute arbitrary JavaScript code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-26954

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.34

Vulnerability: The library fails to properly restrict access to the Function constructor when specific array and object methods are used. An attacker can use Object.fromEntries to construct malicious objects that grant access to restricted functions, effectively breaking the sandbox environment.

Business Impact

The ability to escape a security sandbox represents a total failure of the primary security control of the library, justifying the CVSS score of 10.0. This allows for unauthenticated arbitrary code execution, which can lead to full system compromise, data exfiltration, and the deployment of malware. For applications relying on SandboxJS to run untrusted code, this is a catastrophic risk.

Remediation Plan

Immediate Action: Upgrade SandboxJS to version 0.8.34 or higher to resolve the logic error allowing the sandbox escape.

Proactive Monitoring: Audit application logs for unusual JavaScript execution patterns or attempts to access the Function constructor from within sandboxed environments.

Compensating Controls: Implement secondary isolation layers, such as running the sandboxed process within a low-privilege container or a separate virtual machine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, sandbox escape techniques are highly sought after by attackers, and the technical details suggest a reliable exploit could be developed quickly.

Analyst Recommendation

This vulnerability represents the highest possible technical risk, as it completely negates the security guarantees provided by the product. IT administrators must ensure that all instances of SandboxJS are updated to version 0.8.34 immediately. Continuous monitoring of sandboxed execution environments is also recommended to detect any further bypass attempts.

---METADATA---
VENDOR: SmarterTools
PRODUCT: SmarterMail
AFFECTED_VERSIONS: Before 9526
---END_METADATA---

Description Summary:
SmarterTools SmarterMail is vulnerable to Cross-Site Scripting (XSS) via MAPI requests in versions prior to 9526, potentially allowing session hijacking.

Executive Summary:
SmarterMail users are at risk of account takeover and data theft due to a high-severity Cross-Site Scripting vulnerability in the handling of MAPI requests.

Vulnerability Details

CVE-ID: CVE-2026-26930

Affected Software: SmarterTools SmarterMail

Affected Versions: Before 9526

Vulnerability: This vulnerability allows an attacker to inject malicious scripts into MAPI requests. When an administrative or standard user views the affected content, the script executes in their browser, potentially allowing the attacker to steal session cookies or perform actions on behalf of the user.

Business Impact

A successful XSS attack against a mail server can lead to the compromise of sensitive corporate communications. If an administrator's session is hijacked, the attacker could gain full control over the mail server, leading to widespread data exposure and reputational damage. The CVSS score is 7.2.

Remediation Plan

Immediate Action: Upgrade SmarterMail to version 9526 or later immediately to resolve the XSS vulnerability.

Proactive Monitoring: Review mail server logs for unusual MAPI requests and monitor for suspicious administrative login activity.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and use a Web Application Firewall (WAF) to filter malicious XSS payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. XSS in mail clients is a common vector for targeted phishing and credential theft.

Analyst Recommendation

The 7.2 CVSS score underscores the importance of securing communication platforms. Administrators should apply the SmarterMail update immediately to protect users from script injection attacks that could compromise their accounts and sensitive data.