---METADATA---
VENDOR: Honeywell
PRODUCT: IQ4x
AFFECTED_VERSIONS: Factory-default configuration
---END_METADATA---

Description Summary:
Honeywell IQ4x controllers allow unauthenticated remote attackers to create administrative accounts and take full control of building management systems.

Executive Summary:
The Honeywell IQ4x building management controller is subject to a critical authentication bypass that allows unauthenticated attackers to gain full administrative control and lock out legitimate users.

Vulnerability Details

CVE-ID: CVE-2026-3611

Affected Software: Honeywell IQ4x building management controller

Affected Versions: Factory-default configuration (prior to user module enablement)

Vulnerability: In its default state, the device's HMI is exposed without authentication. Because the account creation function (U.htm) is accessible to unauthenticated users, an attacker can create an administrative account, which then enables the user module and locks the system under the attacker's credentials.

Business Impact

This vulnerability has a CVSS score of 10.0, the highest possible. An attacker can take complete control of building systems (HVAC, lighting, etc.) and effectively lock out legitimate operators. This poses significant risks to physical safety, operational continuity, and the security of the facility.

Remediation Plan

Immediate Action: Immediately enable the user module by creating a secure administrative account and updating the firmware to the latest version.

Proactive Monitoring: Scan the network for any Honeywell IQ4x devices that are still operating in a factory-default state or showing unauthorized administrative accounts.

Compensating Controls: Ensure that building management controllers are never exposed directly to the public internet and are protected by a VPN or a robust firewall.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation. However, the "insecure by design" nature of the default configuration makes these devices extremely vulnerable to discovery via automated internet scanning tools.

Analyst Recommendation

This is a critical flaw that requires immediate attention to prevent unauthorized physical infrastructure control. Administrators must ensure that all IQ4x controllers have authentication enabled and are updated to the latest firmware to mitigate this risk.

---METADATA---
VENDOR: Pensar
PRODUCT: apex
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the @pensar/apex package that could lead to unauthorized system impact.

Executive Summary:
The @pensar/apex package is affected by a critical vulnerability that may allow for significant system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36044

Affected Software: Pensar apex

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is characterized by a high severity score, though specific technical details regarding the vulnerable function or parameter are currently unavailable. Based on the CVSS vector, the attack vector is network-based and requires no authentication, though it does involve user interaction.

Business Impact

The potential for total technical impact presents a significant risk to organizational assets. A successful exploit could lead to unauthorized data access, integrity loss, or service disruption, justifying the 8.8 CVSS severity rating.

Remediation Plan

Immediate Action: Monitor the official @pensar/apex GitHub repository and npm registry for security advisories and patch releases.

Proactive Monitoring: Review application access logs for unusual patterns or unexpected network traffic originating from the apex module.

Compensating Controls: Implement strict network ingress/egress filtering and utilize a Web Application Firewall (WAF) to detect and block common exploit patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of specific technical documentation necessitates a proactive approach to monitoring vendor communications.

Analyst Recommendation

Given the high CVSS score and the potential for total system impact, organizations utilizing the @pensar/apex package should treat this as a high-priority item. Administrators must stay vigilant for updates from the maintainers and apply all security patches immediately upon availability to mitigate the risk of exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Riaxe Product Customizer
AFFECTED_VERSIONS: 2.1.2 and below
---END_METADATA---

Description Summary:
The Riaxe Product Customizer plugin for WordPress allows unauthenticated attackers to update arbitrary site options via an unprotected AJAX action.

Executive Summary:
A critical privilege escalation vulnerability in the Riaxe Product Customizer plugin enables unauthenticated attackers to modify site settings and gain administrative control.

Vulnerability Details

CVE-ID: CVE-2026-3596

Affected Software: WordPress Riaxe Product Customizer

Affected Versions: 2.1.2 and below

Vulnerability: The plugin provides an unauthenticated AJAX hook ('wp_ajax_nopriv_install-imprint') that lacks any nonce verification or capability checks. This allows attackers to manipulate critical WordPress options, such as enabling user registration and setting the default user role to administrator.

Business Impact

This vulnerability carries a 9.8 CVSS score, enabling complete site compromise. Attackers can gain unauthorized administrative access, leading to full system takeover and potential data theft.

Remediation Plan

Immediate Action: Update to the latest version of the plugin or deactivate the Riaxe Product Customizer immediately if no patch is available.

Proactive Monitoring: Audit the 'wp_options' table for suspicious changes, particularly settings related to user registration and default roles.

Compensating Controls: Utilize a WAF to block unauthorized requests to the 'wp-admin/admin-ajax.php' endpoint that include the 'install-imprint' action.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of basic security checks in this plugin makes it a high-risk vector. Immediate removal or patching is required to prevent unauthorized administrative escalation.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.20.0-9.20.22, 9.21.0-9.21.21, 9.20.9-S1-9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 may allow for memory corruption or unstable behavior.

Executive Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 poses a risk of service disruption and potential memory exploitation.

Vulnerability Details

CVE-ID: CVE-2026-3593

Affected Software: ISC BIND 9

Affected Versions: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This is a use-after-free vulnerability (CWE-416) within the DNS-over-HTTPS component. The vulnerability is triggered when the application improperly handles memory, which can lead to crashes or arbitrary code execution by an unauthenticated attacker.

Business Impact

The vulnerability carries a CVSS score of 7.4, indicating a High severity risk. Successful exploitation could lead to a denial-of-service (DoS) condition, impacting critical DNS infrastructure, or potentially allow an attacker to gain unauthorized control over the affected BIND server, compromising the integrity of network traffic.

Remediation Plan

Immediate Action: Upgrade immediately to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1.

Proactive Monitoring: Monitor BIND 9 process logs for unexpected termination or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, consider disabling DNS-over-HTTPS functionality if it is not business-critical to mitigate the primary attack vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of DNS services, this vulnerability requires urgent attention. Administrators should prioritize patching BIND instances to the specified versions to prevent potential service instability and unauthorized access, ensuring that critical infrastructure remains resilient against exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Linux-based OS
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can escape a restricted CLI interface in certain Linux-based operating systems to gain root access.

Executive Summary:
A critical vulnerability in the CLI prompt of certain Linux-based systems allows unauthenticated remote attackers to bypass restrictions and gain full root privileges.

Vulnerability Details

CVE-ID: CVE-2026-3587

Affected Software: Linux Linux-based OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a hidden function within the CLI prompt that can be triggered by an unauthenticated remote attacker. This allows the attacker to "escape" the restricted shell environment and execute commands with root-level permissions on the underlying operating system.

Business Impact

The impact is a total compromise of the affected device. With root access, an attacker has unrestricted control over the system, including the ability to modify files, steal data, install persistent malware, and use the system to attack other internal assets. The CVSS score of 10.0 represents the maximum possible risk level.

Remediation Plan

Immediate Action: Apply the latest security patches from the OS vendor immediately to remove the hidden CLI function and secure the restricted interface.

Proactive Monitoring: Audit CLI logs for unusual command sequences and monitor for unauthorized privilege escalation or the creation of new root-level accounts.

Compensating Controls: Restrict access to the CLI interface using network-level access control lists (ACLs) and implement multi-factor authentication (MFA) for all remote access points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, a CVSS 10.0 vulnerability that grants root access is a prime target for sophisticated threat actors and state-sponsored groups.

Analyst Recommendation

This is a "patch now" scenario. The ability for an unauthenticated attacker to gain root access remotely is the highest possible security risk. Immediate remediation via vendor updates is mandatory to protect the integrity of the environment.

---METADATA---
VENDOR: Kali Forms
PRODUCT: Kali Forms plugin for WordPress
AFFECTED_VERSIONS: All versions up to, and including, 2.4.9
---END_METADATA---

Description Summary:
The Kali Forms WordPress plugin is vulnerable to Remote Code Execution (RCE) via the form_process function, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
Unauthenticated attackers can achieve full server compromise by exploiting a Remote Code Execution (RCE) vulnerability in the Kali Forms WordPress plugin.

Vulnerability Details

CVE-ID: CVE-2026-3584

Affected Software: Kali Forms plugin for WordPress

Affected Versions: All versions up to, and including, 2.4.9

Vulnerability: This critical RCE vulnerability exists in the form_process function due to the prepare_post_data function mapping user-supplied keys directly into internal storage. When combined with the insecure use of call_user_func on these values, unauthenticated attackers can trigger arbitrary PHP code execution.

Business Impact

An RCE vulnerability is the most severe type of security flaw, as it allows an attacker to take complete control of the web server. This can lead to total data theft, website defacement, and the use of the server as a pivot point for further internal network attacks. The CVSS score of 9.8 underscores the extreme urgency of this issue.

Remediation Plan

Immediate Action: Update the Kali Forms plugin to the latest patched version (2.5.0 or higher) immediately. If a patch is unavailable, deactivate and remove the plugin.

Proactive Monitoring: Scan for suspicious PHP files in the WordPress uploads and plugin directories and review web server access logs for unusual POST requests to the Kali Forms endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) with generic RCE protection rules to block malicious payloads targeting PHP functions like call_user_func.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in popular WordPress plugins are frequently targeted by automated exploit kits shortly after disclosure.

Analyst Recommendation

Due to the critical nature of unauthenticated Remote Code Execution, this vulnerability must be addressed with the highest priority. Administrators should update the Kali Forms plugin immediately and conduct a thorough security audit of the WordPress environment to ensure no backdoors were established.

---METADATA---
VENDOR: Xtreeme
PRODUCT: Planyo Online Reservation System
AFFECTED_VERSIONS: <= 3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Planyo Online Reservation System plugin for WordPress contains an SSRF vulnerability leading to Local File Inclusion (LFI) due to improper input validation.

Executive Summary:
An unauthenticated Server-Side Request Forgery and Local File Inclusion vulnerability in the Planyo Online Reservation System plugin allows attackers to read arbitrary files from the server.

Vulnerability Details

CVE-ID: CVE-2026-3576

Affected Software: Xtreeme Planyo Online Reservation System

Affected Versions: Up to and including 3.0

Vulnerability: The vulnerability (CWE-20) stems from improper input validation, allowing an unauthenticated attacker to perform SSRF, which can be leveraged to achieve Local File Inclusion (LFI) on the underlying server.

Business Impact

This vulnerability carries a CVSS score of 7.2, reflecting a high risk of sensitive information disclosure. An attacker could read configuration files, source code, or other sensitive data residing on the web server, which could lead to a full system compromise.

Remediation Plan

Immediate Action: Update the Planyo Online Reservation System plugin to version 3.1 or higher immediately.

Proactive Monitoring: Monitor server logs for attempts to access local files or unexpected outbound connections from the web server.

Compensating Controls: If immediate patching is not feasible, disable the plugin and implement WAF rules to filter malicious input strings commonly associated with LFI/SSRF attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to the combination of SSRF and LFI primitives.

Analyst Recommendation

The risk posed by this plugin vulnerability is substantial. Security teams must ensure the plugin is updated to version 3.1 immediately to prevent unauthorized access to sensitive server files.

---METADATA---
VENDOR: thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to (excluding) 4.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated password reset vulnerability in phpMyFAQ before 4.1.3 allows attackers to compromise user accounts via the password update endpoint.

Executive Summary:
A critical vulnerability in phpMyFAQ prior to 4.1.3 allows unauthenticated attackers to reset passwords, leading to potential account takeover.

Vulnerability Details

CVE-ID: CVE-2026-35676

Affected Software: thorsten phpMyFAQ

Affected Versions: 0 up to (excluding) 4.1.3

Vulnerability: This is a weak password recovery mechanism (CWE-640) that permits an unauthenticated attacker to manipulate the password update process. The vulnerability resides in the user password update endpoint, allowing attackers to change passwords without proper authorization.

Business Impact

The CVSS score of 8.2 reflects the high risk of unauthorized account takeover, which can lead to significant data compromise. In an environment where phpMyFAQ holds sensitive documentation or internal data, this vulnerability could result in unauthorized information disclosure and loss of user trust.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.3 or later immediately to resolve the password reset flaw.

Proactive Monitoring: Monitor authentication logs for an unusual spike in password reset requests or suspicious account modification activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block abnormal traffic patterns directed at the password recovery endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

This vulnerability is highly dangerous due to its unauthenticated nature and the ease of account takeover. Organizations running phpMyFAQ should prioritize the update to version 4.1.3 to close this critical security gap.

---METADATA---
VENDOR: Thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to (excluding) 4.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper restriction of excessive authentication attempts in phpMyFAQ allows unauthenticated remote attackers to potentially manipulate password reset tokens.

Executive Summary:
A critical authentication vulnerability in phpMyFAQ allows unauthenticated attackers to bypass security controls related to password management.

Vulnerability Details

CVE-ID: CVE-2026-35675

Affected Software: Thorsten phpMyFAQ

Affected Versions: 0 up to (excluding) 4.1.3

Vulnerability: The vulnerability is identified as CWE-307: Improper Restriction of Excessive Authentication Attempts. It allows an unauthenticated attacker to interact with the API to potentially update user passwords due to missing token validation.

Business Impact

The ability for an unauthenticated attacker to manipulate password reset tokens poses a severe risk to account integrity and data confidentiality. With a CVSS score of 8.2, this vulnerability could lead to widespread unauthorized account takeovers, potentially granting attackers administrative access to the knowledge base and sensitive internal information.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.3 or later immediately to incorporate the required token validation logic.

Proactive Monitoring: Review application logs for unusual patterns of password reset requests or high volumes of API calls directed at the user-update endpoints.

Compensating Controls: Implement rate limiting at the Web Application Firewall (WAF) level to throttle requests directed at authentication and password-related endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its automatable nature and lack of authentication requirements.

Analyst Recommendation

Given the ease of exploitation and the potential for full account compromise, organizations utilizing phpMyFAQ should prioritize patching to version 4.1.3. Organizations unable to patch immediately must implement strict network-level access controls and monitoring to detect and block suspicious API activity.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in OpenClaw allows authenticated users to bypass scope restrictions via the inherited chat send route.

Executive Summary:
A critical authorization bypass vulnerability in OpenClaw allows authenticated attackers to perform unauthorized actions, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-35674

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.18

Vulnerability: This vulnerability (CWE-863) stems from an incorrect authorization check within the chat send route, permitting authenticated users to access functions outside their designated scope.

Business Impact

The exploit allows for unauthorized command execution or data manipulation within the application context, potentially leading to full compromise of the affected service. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and system security, as it bypasses intended access control mechanisms.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.5.18 or later via your package manager (e.g., npm).

Proactive Monitoring: Audit application logs for unusual chat activity or requests to administrative routes originating from standard user accounts.

Compensating Controls: Implement strict network-level access controls to limit the exposure of the application's internal API routes to trusted networks only.

Exploitation Status

Public Exploit Available: No (Exploit available: false)

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user due to the missing permission validation in the chat route.

Analyst Recommendation

Given the high CVSS severity and the potential for unauthorized privilege escalation, administrators must prioritize upgrading to version 2026.5.18. Regular maintenance of the OpenClaw dependency tree is recommended to ensure such authorization flaws are mitigated promptly.

---METADATA---
VENDOR: Thorsten
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to (excluding) 4.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in the phpMyFAQ user password API allows authenticated users to perform unauthorized actions.

Executive Summary:
A critical privilege escalation vulnerability in phpMyFAQ allows authenticated users to gain unauthorized access to sensitive account functions.

Vulnerability Details

CVE-ID: CVE-2026-35671

Affected Software: Thorsten phpMyFAQ

Affected Versions: 0 up to (excluding) 4.1.3

Vulnerability: The vulnerability, classified as CWE-266: Incorrect Privilege Assignment, occurs within the user password API. It requires an authenticated user to exploit, allowing them to perform actions beyond their assigned privilege level.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk of privilege escalation. A malicious or compromised standard user account could potentially escalate privileges to perform administrative actions, resulting in total system compromise and unauthorized access to protected knowledge base content.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.3 or later to correct the privilege assignment logic within the API.

Proactive Monitoring: Monitor user activity logs for suspicious privilege escalation attempts or unauthorized access to administrative functions by non-privileged accounts.

Compensating Controls: Enforce the principle of least privilege and restrict access to the application’s API endpoints to known, trusted IP addresses where possible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly impactful as it facilitates lateral movement within the application.

Analyst Recommendation

Security teams must treat this vulnerability with high priority, as it allows for the subversion of internal authorization controls. Updating to the latest version is the only definitive way to resolve the underlying flaw in privilege management.

---METADATA---
VENDOR: ConnectWise
PRODUCT: ScreenConnect
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical flaw in ScreenConnect allows attackers with access to server-level cryptographic material to obtain unauthorized access and elevated privileges.

Executive Summary:
ConnectWise ScreenConnect contains a high-severity vulnerability that could allow an attacker to gain unauthorized administrative access by leveraging server-level cryptographic materials.

Vulnerability Details

CVE-ID: CVE-2026-3564

Affected Software: ConnectWise ScreenConnect

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves a condition where an actor who has obtained server-level cryptographic material used for authentication can bypass security checks. This allows for unauthorized access and the potential for privilege escalation within the ScreenConnect environment.

Business Impact

Unauthorized access to a remote monitoring and management (RMM) tool like ScreenConnect can lead to a total compromise of all managed endpoints. The CVSS score of 9.0 highlights the severe risk of data exfiltration, ransomware deployment, and long-term persistence within an organization's infrastructure.

Remediation Plan

Immediate Action: Update ScreenConnect to the latest version provided by the vendor and rotate all server-level cryptographic keys and authentication tokens.

Proactive Monitoring: Review ScreenConnect audit logs for unusual login activity, especially from unknown IP addresses or at irregular times, and monitor for unauthorized privilege changes.

Compensating Controls: Implement multi-factor authentication (MFA) for all ScreenConnect accounts and restrict access to the management console using IP allowlisting and VPNs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, ScreenConnect is a high-value target for threat actors, making immediate patching essential.

Analyst Recommendation

Administrators must treat this vulnerability with the highest urgency due to the potential for widespread endpoint compromise. Apply the vendor's updates immediately and ensure that cryptographic secrets are rotated to invalidate any potentially compromised material.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiClientEMS
AFFECTED_VERSIONS: 7.4.5 through 7.4.6
---END_METADATA---

Description Summary:
Fortinet FortiClientEMS versions 7.4.5 and 7.4.6 contain an improper access control vulnerability. Unauthenticated attackers can execute unauthorized code or commands via crafted requests.

Executive Summary:
Fortinet FortiClientEMS is vulnerable to unauthenticated remote command execution due to improper access controls, posing a critical risk to endpoint management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35616

Affected Software: Fortinet FortiClientEMS

Affected Versions: 7.4.5 through 7.4.6

Vulnerability: This vulnerability involves improper access control within the FortiClientEMS management server. An unauthenticated attacker can send specially crafted network requests to the server to execute unauthorized code or OS commands.

Business Impact

Compromise of a FortiClientEMS server is a tier-0 security event, as it allows an attacker to potentially control all connected endpoints. The CVSS score of 9.8 reflects the extreme severity of unauthenticated code execution on a central security management platform. This could lead to enterprise-wide ransomware or data exfiltration.

Remediation Plan

Immediate Action: Update Fortinet FortiClientEMS to the latest patched version (refer to the vendor advisory for specific build numbers) immediately.

Proactive Monitoring: Monitor FortiClientEMS logs for anomalous requests and check for unauthorized administrative accounts or changes in endpoint policies.

Compensating Controls: Restrict access to the FortiClientEMS management ports to trusted administrative IP addresses using a hardware firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, Fortinet products are frequent targets for advanced persistent threat (APT) groups, making immediate patching vital.

Analyst Recommendation

Because FortiClientEMS manages the security posture of all corporate endpoints, this vulnerability represents a critical path for attackers to achieve total environment compromise. Apply the vendor-provided updates immediately and perform a retrospective log analysis to ensure the system has not already been compromised.

---METADATA---
VENDOR: Emissary
PRODUCT: Emissary
AFFECTED_VERSIONS: Prior to 8.39.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A shell injection vulnerability in Emissary workflow files allows attackers with repository write access to execute arbitrary commands, leading to supply chain compromise.

Executive Summary:
A critical shell injection vulnerability in the Emissary workflow engine allows attackers with repository write access to execute arbitrary commands and compromise downstream users.

Vulnerability Details

CVE-ID: CVE-2026-35580

Affected Software: Emissary Emissary

Affected Versions: Prior to 8.39.0

Vulnerability: The vulnerability exists due to the insecure interpolation of user-controlled workflow_dispatch inputs directly into shell commands via ${{ }} syntax within workflow files. This allows an authenticated attacker with repository write access to inject malicious shell commands.

Business Impact

This flaw facilitates supply chain attacks, potentially allowing an attacker to poison build artifacts and impact all users downstream of the affected workflow. The CVSS score of 9.1 reflects the high potential for widespread disruption and unauthorized code execution within the software development lifecycle.

Remediation Plan

Immediate Action: Upgrade the Emissary workflow engine to version 8.39.0 or later to ensure proper sanitization of inputs.

Proactive Monitoring: Inspect existing workflow files for suspicious ${{ }} expressions and review audit logs for unexpected shell commands executed by the workflow engine.

Compensating Controls: Restrict repository write access to trusted personnel only and implement strict peer review processes for all changes to workflow configuration files.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Supply chain security is paramount; failure to remediate this vulnerability could result in the compromise of downstream development pipelines. Organizations should prioritize updating to version 8.39.0 and reviewing repository access permissions to mitigate the risk of malicious command injection.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 6.5.3
---END_METADATA---

Description Summary:
ChurchCRM's backup restore functionality is vulnerable to path traversal, allowing authenticated administrators to overwrite configuration files and achieve remote code execution.

Executive Summary:
A path traversal flaw in ChurchCRM allows an authenticated administrator to achieve remote code execution by overwriting sensitive system configuration files.

Vulnerability Details

CVE-ID: CVE-2026-35573

Affected Software: ChurchCRM

Affected Versions: Prior to 6.5.3

Vulnerability: The vulnerability resides in the src/ChurchCRM/Backup/RestoreJob.php file, where improper handling of the $rawUploadedFile['name'] parameter allows for path traversal. An authenticated administrator can upload arbitrary files, such as a malicious .htaccess file, to the server's directory structure to gain code execution.

Business Impact

While this vulnerability requires administrative authentication, the impact is critical (CVSS 9.1). A compromised administrator account can lead to full server takeover, unauthorized access to sensitive donor and member data, and significant operational disruption of the church management system.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary path validation fixes.

Proactive Monitoring: Audit logs for administrative file upload activity and monitor for unexpected changes to .htaccess files or other sensitive configuration files.

Compensating Controls: Ensure that the web server process runs with the least privileges necessary and that the /tmp_attach/ directory is restricted from executing scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ChurchCRM must verify their current version and apply the 6.5.3 update immediately. Additionally, ensure that administrative access is restricted to authorized personnel only to mitigate the risk of account compromise.