---METADATA---
VENDOR: SECCN
PRODUCT: Dingcheng G10
AFFECTED_VERSIONS: 3.1.0.181203
---END_METADATA---

Description Summary:
A command injection vulnerability in the SECCN Dingcheng G10 login script allows unauthenticated remote attackers to execute OS commands via the User argument.

Executive Summary:
A critical OS command injection vulnerability in SECCN Dingcheng G10 devices allows unauthenticated remote attackers to execute arbitrary system commands and take full control of the appliance.

Vulnerability Details

CVE-ID: CVE-2026-2686

Affected Software: SECCN Dingcheng G10

Affected Versions: 3.1.0.181203

Vulnerability: The vulnerability exists in the qq function within /cgi-bin/session_login.cgi. Improper sanitization of the User argument allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands.

Business Impact

This flaw provides a direct path to total system compromise. Attackers can execute commands with the privileges of the web server, potentially escalating to root, stealing sensitive credentials, or disrupting critical business operations. The CVSS score of 9.8 indicates an extremely high risk.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by SECCN to patch the vulnerable CGI script. If a patch is unavailable, restrict access to the management interface.

Proactive Monitoring: Monitor web server logs for suspicious characters (e.g., ;, |, &) within the User parameter of requests directed at session_login.cgi.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block OS command injection patterns in HTTP POST/GET parameters.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Feb 19, 2026, the exploit for this vulnerability has been disclosed publicly. Given the availability of public exploit code and the critical nature of command injection, active exploitation is highly likely.

Analyst Recommendation

With a public exploit available, the urgency to remediate this vulnerability is critical. Organizations using the SECCN Dingcheng G10 must update their devices immediately to prevent unauthenticated attackers from gaining full control of their network appliances.

---METADATA---
VENDOR: node-tesseract-ocr (NPM Package)
PRODUCT: node-tesseract-ocr
AFFECTED_VERSIONS: All versions through 2.2.1
---END_METADATA---

Description Summary:
The node-tesseract-ocr npm package allows OS command injection in the recognize() function. File path parameters are concatenated into shell commands without proper sanitization.

Executive Summary:
A critical command injection vulnerability in the node-tesseract-ocr library enables attackers to execute arbitrary system commands by providing malicious file paths to the OCR processing function.

Vulnerability Details

CVE-ID: CVE-2026-26832

Affected Software: node-tesseract-ocr (npm package)

Affected Versions: All versions through 2.2.1

Vulnerability: The recognize() function in src/index.js is vulnerable to OS Command Injection. It improperly concatenates user-controlled file path parameters into a shell command string which is then executed via child_process.exec() without sanitization.

Business Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the Node.js process. This can result in complete server takeover, data exfiltration, and the installation of persistent backdoors. The CVSS score of 9.8 indicates a critical risk to any application relying on this library for OCR tasks.

Remediation Plan

Immediate Action: Update the node-tesseract-ocr dependency to a version higher than 2.2.1. If no update is available, sanitize all inputs to the recognize() function to remove shell metacharacters.

Proactive Monitoring: Monitor for unexpected shell execution or outbound network connections from servers performing OCR processing.

Compensating Controls: Run the Node.js application within a containerized environment with restricted system call capabilities (e.g., using Seccomp or AppArmor) to limit the damage of a command injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Library-level command injections are particularly dangerous as they can be exploited through any application endpoint that eventually calls the vulnerable function.

Analyst Recommendation

This vulnerability highlights the danger of shell interpolation. Immediate remediation is required for any application that processes user-uploaded files via this OCR wrapper. Developers should prioritize upgrading the package or implementing rigorous input sanitization to prevent command execution.

---METADATA---
VENDOR: pdf-image (NPM Package)
PRODUCT: pdf-image
AFFECTED_VERSIONS: Through version 2.0.0
---END_METADATA---

Description Summary:
The pdf-image npm package is vulnerable to OS command injection via the pdfFilePath parameter. This occurs due to improper interpolation of user paths into shell commands.

Executive Summary:
The pdf-image library for Node.js contains a critical command injection vulnerability that allows unauthenticated attackers to execute arbitrary OS commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-26830

Affected Software: pdf-image (npm package)

Affected Versions: Through version 2.0.0

Vulnerability: This is an OS Command Injection vulnerability triggered via the pdfFilePath parameter. The functions constructGetInfoCommand and constructConvertCommandForPage use util.format() to build shell strings that are passed directly to child_process.exec() without sanitization.

Business Impact

An attacker can exploit this flaw to gain a shell on the application server. This leads to full system compromise, potential lateral movement within the network, and unauthorized access to application databases or environment variables. The CVSS score of 9.8 reflects the ease of exploitation and the total impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Developers should immediately stop using vulnerable versions of the pdf-image package and update to a patched version if available, or migrate to a more secure alternative.

Proactive Monitoring: Implement runtime application self-protection (RASP) or monitor system logs for suspicious child processes spawned by Node.js applications.

Compensating Controls: Use input validation to strictly enforce file path patterns and ensure the application runs with the least privilege necessary to minimize the impact of a command injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. However, command injection in popular npm packages is frequently targeted by automated scanners and supply chain attackers.

Analyst Recommendation

The use of child_process.exec() with unsanitized input is a high-risk practice. Organizations using this package in their production applications must audit their code immediately. If a patch is not provided by the maintainer, the library should be replaced with one that uses safer execution methods like execFile.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-AR300M16
AFFECTED_VERSIONS: v4.3.11
---END_METADATA---

Description Summary:
The GL-iNet GL-AR300M16 router contains a command injection vulnerability in the set_config function, allowing for arbitrary command execution.

Executive Summary:
A critical command injection vulnerability in GL-iNet GL-AR300M16 routers allows attackers to execute arbitrary commands and gain full control over the device.

Vulnerability Details

CVE-ID: CVE-2026-26793

Affected Software: GL-iNet GL-AR300M16

Affected Versions: v4.3.11

Vulnerability: The set_config function in the router's firmware fails to properly sanitize user input, leading to a command injection vulnerability. An attacker can provide crafted input to execute arbitrary system commands on the router.

Business Impact

A successful exploit grants the attacker full administrative control over the router. With a CVSS score of 9.8, this allows for persistent network monitoring, traffic redirection, and a foothold for lateral movement within the local network. This is particularly dangerous for remote offices or small businesses relying on these devices for secure connectivity.

Remediation Plan

Immediate Action: Update the GL-iNet firmware to the latest available version that includes a fix for the set_config function.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or unusual outbound traffic that might indicate a compromised device.

Compensating Controls: Disable remote management interfaces and ensure that access to the router's web interface is restricted to trusted local devices only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation of this vulnerability. Command injection flaws in network hardware are frequently targeted by botnets, making this a high-risk entry.

Analyst Recommendation

It is critical to update the firmware on all affected GL-iNet devices immediately. Given the role of routers in network security, a compromise at this level can undermine all other security controls within the environment.

---METADATA---
VENDOR: Twenty CRM
PRODUCT: Twenty CRM
AFFECTED_VERSIONS: v1.15.0 and before
---END_METADATA---

Description Summary:
Twenty CRM is vulnerable to arbitrary code execution via the local.driver.ts module, allowing a remote attacker to compromise the application server.

Executive Summary:
Twenty CRM versions v1.15.0 and earlier contain a critical vulnerability in the local.driver.ts module that allows remote attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-26720

Affected Software: Twenty CRM

Affected Versions: v1.15.0 and before

Vulnerability: The vulnerability resides in the local.driver.ts module, where insufficient input validation allows a remote attacker to inject and execute arbitrary code. This typically occurs through unauthenticated or lowly privileged requests to the driver interface.

Business Impact

A successful exploit allows for full application and server compromise, leading to the exposure of sensitive CRM data, including customer contacts and business leads. The CVSS score of 9.8 reflects the critical threat to the confidentiality and integrity of the entire CRM platform.

Remediation Plan

Immediate Action: Update Twenty CRM to the latest patched version immediately to remediate the flaw in the driver module.

Proactive Monitoring: Audit application logs for suspicious file system activities or unauthorized modifications to the local.driver.ts or related TypeScript files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming requests for common code injection patterns and restrict file upload/execution capabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. Given that CRM systems house highly sensitive data, this flaw is likely to be targeted by financially motivated actors.

Analyst Recommendation

Organizations utilizing Twenty CRM should treat this as a critical priority. The ability to execute code remotely through a core module necessitates immediate patching and a thorough review of the application's security configuration.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Food Order System
AFFECTED_VERSIONS: v1.0
---END_METADATA---

Description Summary:
The Simple Food Order System v1.0 contains a critical SQL Injection vulnerability in the cancel-order.php script, posing a risk of unauthorized database access.

Executive Summary:
An unauthenticated SQL Injection vulnerability in the cancel-order.php component of Simple Food Order System v1.0 allows for complete database compromise.

Vulnerability Details

CVE-ID: CVE-2026-26713

Affected Software: Simple Food Order System

Affected Versions: v1.0

Vulnerability: The vulnerability is located in /food/routers/cancel-order.php. The application fails to properly validate or escape user input before including it in SQL queries, allowing an unauthenticated attacker to manipulate database operations.

Business Impact

A successful attack could result in the deletion of order records, theft of user data, or administrative credential harvesting. The CVSS score of 9.8 reflects the critical nature of this flaw and the potential for significant business disruption and data loss.

Remediation Plan

Immediate Action: Update the software to a patched version or implement parameterized queries in /food/routers/cancel-order.php to neutralize the injection vector.

Proactive Monitoring: Review application access logs for suspicious parameters sent to the cancel-order.php endpoint, particularly those containing SQL keywords.

Compensating Controls: Implement a WAF to detect and drop requests containing SQL injection signatures and enforce strict input validation at the application entry points.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. The simplicity of the exploit makes it a high-probability target for script-based attacks.

Analyst Recommendation

Given the critical CVSS score, this vulnerability must be addressed immediately. Developers and administrators should ensure that all database interactions are secured using modern coding practices to prevent unauthorized data manipulation.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Food Order System
AFFECTED_VERSIONS: v1.0
---END_METADATA---

Description Summary:
The Simple Food Order System v1.0 is vulnerable to SQL Injection in the view-ticket-admin.php file, allowing attackers to compromise the administrative database interface.

Executive Summary:
A critical SQL Injection vulnerability in the view-ticket-admin.php component of Simple Food Order System v1.0 allows attackers to gain unauthorized access to administrative data.

Vulnerability Details

CVE-ID: CVE-2026-26712

Affected Software: Simple Food Order System

Affected Versions: v1.0

Vulnerability: The vulnerability exists in /food/view-ticket-admin.php. Although the filename suggests an administrative function, the lack of proper input sanitization allows an attacker to perform SQL injection, potentially bypassing authentication or escalating privileges.

Business Impact

Exploitation of this flaw can lead to the total compromise of the administrative interface and the underlying database. With a CVSS score of 9.8, the risk includes complete data loss, unauthorized access to sensitive business records, and potential service termination.

Remediation Plan

Immediate Action: Immediately secure /food/view-ticket-admin.php by implementing prepared statements and ensuring that the page is protected by robust session-based authentication.

Proactive Monitoring: Monitor for unauthorized access attempts to administrative PHP files and analyze logs for SQL injection strings like ' OR '1'='1.

Compensating Controls: Implement IP-based access control lists (ACLs) to restrict access to the /food/view-ticket-admin.php page to known administrative IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. Administrative endpoints are high-value targets, and this vulnerability provides a direct path to system-wide compromise.

Analyst Recommendation

This vulnerability represents a significant threat to the application's security posture. Immediate action to patch the SQL injection and enforce strict access controls on administrative endpoints is essential to protect the system.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Food Order System
AFFECTED_VERSIONS: v1.0
---END_METADATA---

Description Summary:
Simple Food Order System v1.0 is vulnerable to SQL Injection in the view-ticket.php file, allowing unauthenticated attackers to extract sensitive information from the database.

Executive Summary:
Simple Food Order System v1.0 contains a critical SQL Injection vulnerability in view-ticket.php that enables unauthenticated remote attackers to access sensitive database content.

Vulnerability Details

CVE-ID: CVE-2026-26711

Affected Software: Simple Food Order System

Affected Versions: v1.0

Vulnerability: The /food/view-ticket.php endpoint is vulnerable to SQL Injection. An unauthenticated attacker can manipulate the ticket ID or other parameters to execute arbitrary SQL commands against the backend database.

Business Impact

This vulnerability allows for the unauthorized viewing of all support tickets, customer details, and potentially administrative credentials stored in the database. The CVSS score of 9.8 highlights the severe risk to data confidentiality and the potential for full system compromise.

Remediation Plan

Immediate Action: Manually patch view-ticket.php to use prepared statements or update to a secured version of the software if available.

Proactive Monitoring: Audit database activity for queries that access sensitive tables (e.g., users, admins) originating from the view-ticket.php script.

Compensating Controls: Use a WAF to inspect all GET and POST requests for SQL injection patterns and restrict database user permissions to the minimum necessary for application function.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. SQL injection remains a primary vector for data breaches in legacy or unpatched PHP applications.

Analyst Recommendation

The presence of SQL injection in a public-facing script like view-ticket.php is a critical security risk. Immediate remediation through code updates or the implementation of robust virtual patching via a WAF is highly recommended.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Food Order System
AFFECTED_VERSIONS: v1.0
---END_METADATA---

Description Summary:
The Simple Food Order System v1.0 is vulnerable to a critical SQL Injection in the edit-orders.php router, allowing for full database compromise.

Executive Summary:
Simple Food Order System v1.0 is susceptible to a critical SQL Injection vulnerability that allows unauthenticated attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2026-26710

Affected Software: Simple Food Order System

Affected Versions: v1.0

Vulnerability: A critical SQL Injection vulnerability exists in /food/routers/edit-orders.php. Due to insufficient sanitization of user-supplied input, an unauthenticated attacker can inject malicious SQL queries to bypass security controls or extract data.

Business Impact

Exploitation can lead to the unauthorized disclosure of customer information, order history, and administrative credentials. With a CVSS score of 9.8, the integrity and confidentiality of the entire application database are at extreme risk, potentially leading to total system takeover.

Remediation Plan

Immediate Action: Since this appears to be a flaw in a project-based system, immediately apply any available patches or manually sanitize the input in edit-orders.php using prepared statements.

Proactive Monitoring: Monitor database logs for unusual query syntax or error messages that indicate SQL injection attempts (e.g., UNION SELECT statements).

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection enabled to filter and block malicious payloads targeting the affected PHP scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. However, SQL injection in open-source projects is a common target for automated vulnerability scanners.

Analyst Recommendation

Immediate remediation is required to prevent data theft. Users of this system should prioritize migrating to a supported platform or applying rigorous input validation to all PHP router files.

---METADATA---
VENDOR: Mobvoi
PRODUCT: Tichome Mini
AFFECTED_VERSIONS: 012-18853 and 027-58389
---END_METADATA---

Description Summary:
A shell command injection vulnerability in Mobvoi Tichome Mini allows unauthenticated remote attackers to execute arbitrary code as root via specially crafted UDP datagrams.

Executive Summary:
The Mobvoi Tichome Mini smart speaker is vulnerable to a critical remote command injection that allows unauthenticated attackers to gain root-level shell access via the network.

Vulnerability Details

CVE-ID: CVE-2026-26478

Affected Software: Mobvoi Tichome Mini

Affected Versions: 012-18853 and 027-58389

Vulnerability: A shell command injection vulnerability exists in the way the device processes UDP datagrams. An unauthenticated remote attacker can send a specially crafted UDP packet to the device, triggering the execution of arbitrary shell commands with root-level privileges on the underlying operating system.

Business Impact

With a CVSS score of 9.8, this vulnerability is extremely severe. An attacker can gain full control of the device, listen to audio, pivot to other devices on the local network, or incorporate the speaker into a botnet. This represents a significant breach of privacy and a security risk to the network where the device is deployed.

Remediation Plan

Immediate Action: Apply the latest firmware update from Mobvoi to the Tichome Mini smart speaker immediately.

Proactive Monitoring: Monitor local network traffic for anomalous UDP traffic directed at smart speakers and audit for unexpected outbound connections from these devices.

Compensating Controls: Place IoT devices like smart speakers on a dedicated, isolated VLAN to prevent them from interacting with sensitive corporate or personal data systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation. However, command injection via simple UDP packets is a highly reliable and easily exploitable vector.

Analyst Recommendation

Users and administrators should immediately update their Mobvoi Tichome Mini devices. Given the potential for root-level access via the network, these devices should be strictly isolated from critical network segments until the patch is confirmed to be in place.

---METADATA---
VENDOR: DokuWiki
PRODUCT: DokuWiki
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A security issue has been identified in DokuWiki, a popular open-source wiki software, which could lead to unauthorized system access or data exposure.

Executive Summary:
A vulnerability in DokuWiki could allow attackers to compromise the wiki platform, potentially leading to unauthorized modification of content or data theft.

Vulnerability Details

CVE-ID: CVE-2026-26477

Affected Software: DokuWiki

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An unspecified security issue exists in DokuWiki. In the context of wiki software, such vulnerabilities typically involve cross-site scripting (XSS), path traversal, or improper access control, allowing an attacker to manipulate files or execute malicious scripts.

Business Impact

A compromise of DokuWiki can lead to the loss of proprietary information, the defacement of internal documentation, and the distribution of malware to wiki users. Depending on the nature of the flaw, an attacker might gain full control over the wiki server. The CVSS score of 7.5 indicates a High severity risk to the organization’s information assets.

Remediation Plan

Immediate Action: Update DokuWiki to the latest stable release that addresses this vulnerability.

Proactive Monitoring: Review file integrity on the server and check DokuWiki access logs for suspicious activity or unauthorized changes to wiki pages.

Compensating Controls: Implement a Web Application Firewall (WAF) with rulesets specifically designed to block common CMS and Wiki exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Wikis are often targeted for their wealth of internal corporate information.

Analyst Recommendation

Organizations should immediately verify their DokuWiki version and apply the necessary updates. Ensuring the wiki is running the most recent version is vital for protecting internal knowledge bases from unauthorized access and manipulation.

---METADATA---
VENDOR: Unknown
PRODUCT: Offline Hospital Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been identified in the Offline Hospital Management System version 5.

Executive Summary:
A security vulnerability in the Offline Hospital Management System 5 requires immediate investigation and remediation to protect sensitive patient data.

Vulnerability Details

CVE-ID: CVE-2026-26462

Affected Software: Offline Hospital Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided information is limited; however, the vulnerability affects the Offline Hospital Management System 5. Further technical specifics regarding the attack vector or the authentication state required for exploitation are currently unavailable.

Business Impact

Hospital management systems process highly sensitive Protected Health Information (PHI). A vulnerability in this software, rated at 7.3 on the CVSS scale, could lead to unauthorized access to patient records, potential data breaches, or operational disruption, causing significant reputational and regulatory harm.

Remediation Plan

Immediate Action: Contact the software vendor or check the official support portal immediately to identify the specific nature of this vulnerability and obtain the necessary security patches.

Proactive Monitoring: Monitor the application for any unauthorized access patterns or abnormal database activity that may suggest exploitation of this system.

Compensating Controls: Ensure the system is placed behind a robust firewall and restricted to authorized personnel only, minimizing exposure to external network threats.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the lack of specific technical details, organizations using this software must treat this as a high-priority security issue. Reach out to the vendor's security team immediately to confirm the update status and verify whether your specific deployment is susceptible to this threat.

---METADATA---
VENDOR: clash-verge-service
PRODUCT: ipc
AFFECTED_VERSIONS: Versions before 2
---END_METADATA---

Description Summary:
A vulnerability has been identified in the clash-verge-service-ipc package before version 2.

Executive Summary:
A high-severity vulnerability in the clash-verge-service-ipc package exposes systems to potential unauthorized actions due to insufficient security controls.

Vulnerability Details

CVE-ID: CVE-2026-26422

Affected Software: clash-verge-service-ipc

Affected Versions: Versions before 2

Vulnerability: The vulnerability exists in the inter-process communication (IPC) mechanism, which, if improperly secured, can be leveraged to gain unauthorized access or influence service operations.

Business Impact

The CVSS score of 8.4 confirms the High severity of this flaw, suggesting that an attacker could potentially escalate privileges or perform unauthorized operations within the service context. Such exposure poses a significant risk to the integrity and confidentiality of the host environment.

Remediation Plan

Immediate Action: Upgrade to version 2 or higher of the clash-verge-service-ipc package immediately.

Proactive Monitoring: Monitor system processes for unusual IPC calls or unexpected service behavior.

Compensating Controls: Restrict local user permissions and ensure that the service is running with the least privilege necessary to limit potential attack surfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to mitigate this high-risk vulnerability. Administrators should ensure that all instances are updated to version 2 or later and verify that service configurations follow security best practices.

---METADATA---
VENDOR: eNet
PRODUCT: SMART HOME server
AFFECTED_VERSIONS: 2.2.1 and 2.3.1
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the setUserGroup JSON-RPC method allows low-privileged users to gain administrative control by sending crafted POST requests to the management endpoint.

Executive Summary:
A critical privilege escalation vulnerability in eNet SMART HOME server versions 2.2.1 and 2.3.1 allows low-privileged users to bypass access controls and gain full administrative capabilities.

Vulnerability Details

CVE-ID: CVE-2026-26369

Affected Software: eNet SMART HOME server

Affected Versions: 2.2.1 and 2.3.1

Vulnerability: This flaw exists due to insufficient authorization checks within the setUserGroup JSON-RPC method. A low-privileged attacker (UG_USER) can submit a crafted POST request to /jsonrpc/management to elevate their account to the UG_ADMIN group.

Business Impact

A successful exploit grants the attacker total control over the smart home environment, including device configurations, network settings, and security functions. Given the CVSS score of 9.8, the impact is critical, as it allows for complete unauthorized administrative access, potentially leading to physical security breaches or persistent surveillance of the premises.

Remediation Plan

Immediate Action: Update the eNet SMART HOME server software to the latest available version immediately to patch the vulnerable JSON-RPC method.

Proactive Monitoring: Review system logs for unusual POST requests directed at the /jsonrpc/management endpoint, specifically those attempting to modify user group assignments.

Compensating Controls: Implement network segmentation to ensure the management interface is only accessible from trusted internal segments and utilize a Web Application Firewall (WAF) to filter JSON-RPC traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of crafting the required POST request, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe risk to the integrity and privacy of the smart home environment. The ability for a standard user to elevate themselves to an administrator without proper validation is a fundamental security failure. It is strongly recommended that administrators apply the vendor-provided security updates immediately to mitigate the risk of unauthorized system takeover.

---METADATA---
VENDOR: eNet
PRODUCT: SMART HOME server
AFFECTED_VERSIONS: 2.x (See vendor advisory for specific versions)
---END_METADATA---

Description Summary:
The eNet SMART HOME server version 2 contains a security flaw that could allow for unauthorized access or system manipulation.

Executive Summary:
A high-severity vulnerability in the eNet SMART HOME server version 2 poses a significant risk to the security and privacy of the smart home environment.

Vulnerability Details

CVE-ID: CVE-2026-26368

Affected Software: eNet SMART HOME server

Affected Versions: Version 2 (See vendor advisory for specific sub-versions).

Vulnerability: While the description is brief, the CVSS score of 8.8 indicates a high-severity issue, likely involving a remote attack vector or a significant bypass of security controls within the server's management interface.

Business Impact

A successful exploit could allow an attacker to gain control over the smart home system, leading to the compromise of connected devices, unauthorized access to the home network, and potential physical security risks. The high CVSS score reflects the severe impact on system integrity and user privacy.

Remediation Plan

Immediate Action: Apply the latest security updates and firmware patches from eNet immediately to address the identified flaw.

Proactive Monitoring: Review device logs for unauthorized access attempts and monitor for any changes to smart home configurations that were not initiated by an authorized user.

Compensating Controls: Isolate the smart home server on a dedicated network segment and use a VPN for remote access instead of exposing the management interface directly to the internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 16, 2026, there is no public information indicating active exploitation. However, the high severity of the flaw makes it an attractive target for attackers.

Analyst Recommendation

Given the central role of the eNet SMART HOME server in managing household security and automation, this vulnerability must be treated with high urgency. It is critical to apply the primary remediation (the patch) immediately to protect the system from unauthorized takeover.

---METADATA---
VENDOR: eNet
PRODUCT: SMART HOME server
AFFECTED_VERSIONS: 2.2.1 and 2.3.1
---END_METADATA---

Description Summary:
The eNet SMART HOME server utilizes default credentials that remain active post-installation, allowing unauthenticated attackers to gain administrative access to the system.

Executive Summary:
The eNet SMART HOME server is vulnerable to complete administrative takeover due to the presence of active default credentials that are not forcibly changed during the commissioning process.

Vulnerability Details

CVE-ID: CVE-2026-26366

Affected Software: eNet SMART HOME server

Affected Versions: 2.2.1 and 2.3.1

Vulnerability: The system ships with static default credentials (user:user, admin:admin) that are not subject to a mandatory change policy upon installation. This allows unauthenticated attackers with network access to log in with administrative privileges.

Business Impact

The use of default credentials results in a CVSS score of 9.8, reflecting a critical risk to system confidentiality and integrity. An attacker can gain full control over smart home functions, modify sensitive configurations, and potentially use the server as a pivot point for further network attacks, leading to significant reputational and privacy risks.

Remediation Plan

Immediate Action: Immediately change all default passwords for the 'user' and 'admin' accounts to unique, complex passwords and ensure the latest firmware is applied.

Proactive Monitoring: Audit access logs for successful logins using default account names and monitor for unauthorized configuration changes within the smart home server interface.

Compensating Controls: Enforce strong password policies and implement multi-factor authentication (MFA) if supported by the platform to prevent unauthorized access via credential-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, because default credentials are well-known and easily tested, the likelihood of exploitation by opportunistic attackers is extremely high.

Analyst Recommendation

The failure to enforce password changes upon initial setup is a critical security oversight. Organizations and homeowners must treat this as an urgent priority. Immediately update all account credentials and apply the latest security patches to ensure that default access vectors are permanently closed.

---METADATA---
VENDOR: MLflow
PRODUCT: MLflow
AFFECTED_VERSIONS: All installations using default basic_auth.ini configurations
---END_METADATA---

Description Summary:
MLflow contains a critical authentication bypass vulnerability due to hard-coded default credentials in the basic_auth.ini file, allowing remote attackers to gain administrative access.

Executive Summary:
A critical authentication bypass in MLflow allows unauthenticated remote attackers to gain full administrative control and execute arbitrary code by exploiting hard-coded default credentials.

Vulnerability Details

CVE-ID: CVE-2026-2635

Affected Software: MLflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw stems from the use of hard-coded default credentials within the basic_auth.ini configuration file. An unauthenticated remote attacker can exploit this weakness to bypass standard security protocols and execute arbitrary code with the privileges of the administrator.

Business Impact

A successful exploit poses a catastrophic risk to the organization’s machine learning pipeline and underlying infrastructure. Attackers can gain unauthorized access to sensitive models, manipulate data, or achieve full remote code execution (RCE). Given the CVSS score of 9.8, this vulnerability represents a critical threat to data integrity and system availability.

Remediation Plan

Immediate Action: Update MLflow to the latest secure version immediately and ensure that the default credentials in basic_auth.ini are changed to strong, unique values.

Proactive Monitoring: Review access logs for any unauthorized logins using default accounts and monitor for unusual administrative activities or unexpected code execution patterns.

Compensating Controls: Restrict access to the MLflow management interface using network-level access control lists (ACLs) or a VPN to ensure only trusted IPs can reach the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the simplicity of exploiting default credentials, the potential for widespread exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it grants complete control over the MLflow environment without requiring any prior authentication. Organizations must prioritize the rotation of all default credentials and update the software to the latest version immediately to mitigate the risk of administrative takeover.

---METADATA---
VENDOR: Hyland
PRODUCT: Alfresco Transformation Service
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
Hyland Alfresco Transformation Service is vulnerable to unauthenticated remote code execution via argument injection in its document processing functionality.

Executive Summary:
Hyland Alfresco Transformation Service contains a critical argument injection vulnerability that allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-26339

Affected Software: Hyland Alfresco Transformation Service

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: This vulnerability exists in the document processing functionality of the Transformation Service. An unauthenticated attacker can exploit this flaw via argument injection to execute arbitrary code on the underlying host system.

Business Impact

As an unauthenticated remote code execution (RCE) vulnerability, this flaw poses a severe threat to the entire Alfresco infrastructure. Given the 9.8 CVSS score, the impact includes potential unauthorized data access, system disruption, and the compromise of sensitive documents processed by the service.

Remediation Plan

Immediate Action: Consult the official Hyland security advisory to identify and apply the necessary patches for the Transformation Service.

Proactive Monitoring: Monitor document processing workflows for anomalous arguments and inspect system logs for evidence of unauthorized process execution.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming requests for malicious argument patterns and restrict access to the transformation service interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of unauthenticated remote code execution necessitates urgent remediation. Organizations should verify their current version against the vendor's security bulletin and apply the relevant security updates immediately to secure their document processing environments.