---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: >= 0.6.0, < 0.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FOSSBilling contains an unauthenticated payment bypass vulnerability in the IPN callback endpoint, allowing attackers to mark invoices as paid without actual payment.

Executive Summary:
An unauthenticated payment bypass vulnerability in FOSSBilling allows attackers to manipulate invoice statuses and credit accounts without completing financial transactions.

Vulnerability Details

CVE-ID: CVE-2026-42341

Affected Software: FOSSBilling FOSSBilling

Affected Versions: >= 0.6.0, < 0.8.0

Vulnerability: This is a critical authentication bypass and validation error in the IPN callback endpoint. The vulnerability allows an unauthenticated remote attacker to send a crafted HTTP request to mark invoices as paid when the Custom payment adapter is enabled.

Business Impact

The CVSS score of 9.2 highlights the severe financial and operational impact of this vulnerability. Attackers can gain services or products without payment, leading to direct financial loss and potential manipulation of client account records, which could undermine the integrity of the billing and customer management system.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later to implement the necessary authentication checks for payment callbacks.

Proactive Monitoring: Monitor invoice payment logs for anomalies or batches of payments marked as "paid" that lack corresponding transaction records from legitimate payment gateways.

Compensating Controls: Disable the "Custom" payment gateway if it is not strictly required, or restrict access to the /ipn.php endpoint via web server rules to trusted IP addresses only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the attack vector makes it an attractive target for financial fraud.

Analyst Recommendation

This vulnerability represents a significant financial risk to any organization using FOSSBilling for revenue collection. Immediate application of the 0.8.0 update is required to prevent unauthorized service provisioning and financial fraud.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: < 0.8.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
FOSSBilling is susceptible to missing authentication and incorrect authorization vulnerabilities, potentially allowing unauthenticated attackers to manipulate critical system functions.

Executive Summary:
A critical authentication and authorization flaw in FOSSBilling versions prior to 0.8.0 exposes the billing and client management system to unauthorized administrative actions by unauthenticated users.

Vulnerability Details

CVE-ID: CVE-2026-42331

Affected Software: FOSSBilling FOSSBilling

Affected Versions: < 0.8.0

Vulnerability: This vulnerability involves missing authentication for critical functions (CWE-306) and incorrect authorization (CWE-863). These flaws allow unauthenticated remote attackers to perform sensitive operations within the billing system that should be restricted to authorized users.

Business Impact

The ability for unauthenticated users to bypass security controls poses a significant risk to the integrity of client data and billing operations. With a CVSS score of 7.7, this high-severity vulnerability could lead to unauthorized administrative modifications, potentially resulting in financial discrepancies, data exfiltration, or complete loss of control over the application environment.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later immediately to address these security defects.

Proactive Monitoring: Review application access logs for unusual administrative activity or unauthorized requests originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting administrative endpoints until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative access. Administrators should prioritize upgrading to version 0.8.0 to ensure the security and integrity of the FOSSBilling platform.

---METADATA---
VENDOR: pyload
PRODUCT: pyload
AFFECTED_VERSIONS: < 0.5.0b3.dev100
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
pyLoad is vulnerable to path traversal, allowing authenticated users to read or write files outside of the intended directories.

Executive Summary:
An authenticated path traversal vulnerability in pyLoad versions prior to 0.5.0b3.dev100 permits unauthorized file system access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-42315

Affected Software: pyload pyload

Affected Versions: < 0.5.0b3.dev100

Vulnerability: This vulnerability involves Improper Limitation of a Pathname (CWE-22) and Absolute Path Traversal (CWE-36). Exploitation requires low-privileged authentication (PR:L) and allows an attacker to impact file integrity and system availability (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Business Impact

With a CVSS score of 8.1, this vulnerability presents a High risk to system integrity. An authenticated attacker can overwrite critical application files or system components, potentially leading to a denial of service or further escalation of privileges, which could disrupt business operations.

Remediation Plan

Immediate Action: Upgrade to pyLoad version 0.5.0b3.dev100 or later to resolve the path traversal flaw.

Proactive Monitoring: Monitor application logs for unusual file write or access attempts that deviate from standard user behavior.

Compensating Controls: Restrict access to the pyLoad web interface via VPN or IP-based access control lists (ACLs) to ensure only authorized personnel can interact with the management console.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for low-level authentication slightly limits the attack surface but does not negate the high impact of the flaw.

Analyst Recommendation

Given the capability for file manipulation, this vulnerability should be patched promptly. Organizations should enforce strict access controls on the management interface while performing the necessary version upgrades to mitigate the risk of unauthorized system modification.

---METADATA---
VENDOR: pyLoad
PRODUCT: pyLoad
AFFECTED_VERSIONS: < 0.5.0b3.dev100
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
pyLoad is vulnerable to Server-Side Request Forgery (SSRF) and authorization bypass due to unintended intermediary proxy behavior, allowing authenticated attackers to perform unauthorized actions.

Executive Summary:
A vulnerability in pyLoad allows authenticated attackers to perform unauthorized actions and Server-Side Request Forgery (SSRF), posing a significant risk to internal network security.

Vulnerability Details

CVE-ID: CVE-2026-42313

Affected Software: pyLoad pyLoad

Affected Versions: < 0.5.0b3.dev100

Vulnerability: This issue encompasses multiple weaknesses including SSRF, incorrect authorization, and a "confused deputy" scenario, requiring an attacker to have authenticated (low-privileged) access to the application.

Business Impact

Successful exploitation allows an attacker to bypass intended access controls and potentially interact with internal services that are not exposed to the internet. With a CVSS score of 8.3, this represents a high-severity risk that could lead to data exfiltration or unauthorized internal network reconnaissance, impacting the confidentiality and integrity of the hosting environment.

Remediation Plan

Immediate Action: Update pyLoad to version 0.5.0b3.dev100 or later to resolve the underlying authorization and SSRF flaws.

Proactive Monitoring: Monitor network egress traffic for unusual requests originating from the pyLoad server and review application access logs for suspicious administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SSRF patterns and unauthorized API calls directed at the pyLoad backend.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user with low-level authenticated access.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, organizations should prioritize patching pyLoad instances immediately. Ensure that the application is isolated within the network to minimize the potential impact of any successful SSRF attempts.

---METADATA---
VENDOR: Jelmer Vernooij (Dulwich)
PRODUCT: Dulwich
AFFECTED_VERSIONS: 0.20.15-1 (bullseye), 0.21.2-1 (bookworm), 0.22.7-1 (trixie), 1.2.1-1 (forky)
---END_METADATA---

Description Summary:
Dulwich contains an arbitrary file write vulnerability via NTFS-hostile tree entries, enabling remote code execution when checking out malicious Git repositories.

Executive Summary:
A high-severity arbitrary file write vulnerability in the Dulwich library allows for remote code execution when processing untrusted Git repositories on Windows.

Vulnerability Details

CVE-ID: CVE-2026-42305

Affected Software: Dulwich (Python Git implementation)

Affected Versions: 0.20.15-1 (bullseye), 0.21.2-1 (bookworm), 0.22.7-1 (trixie), 1.2.1-1 (forky)

Vulnerability: The vulnerability is an arbitrary file write caused by improper handling of NTFS-hostile tree entries. An unauthenticated attacker can achieve remote code execution when a user performs a clone, fetch, or checkout of a malicious Git repository.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to developers and build systems. Exploitation can lead to full system compromise, as arbitrary code execution allows an attacker to install backdoors, steal source code, or exfiltrate sensitive environment credentials.

Remediation Plan

Immediate Action: Update the Dulwich library to version 1.2.5-1 or later across all affected development environments and CI/CD pipelines.

Proactive Monitoring: Audit Git repository cloning activities and monitor for unusual file system modifications in directory paths associated with version control operations.

Compensating Controls: Avoid cloning or checking out repositories from untrusted or unverified sources, especially when using Windows-based development environments.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 11, 2026, a public exploit is available for this vulnerability. Organizations should consider this an active and high-priority threat.

Analyst Recommendation

Given the existence of a public exploit, the risk of exploitation is immediate. Development teams must prioritize updating the Dulwich package to version 1.2.5-1. Any system currently utilizing older versions to process external Git repositories should be considered at risk of remote code execution.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: 4.14.10 to 4.14.12
---END_METADATA---

Description Summary:
An unauthenticated RCE vulnerability in FastGPT's agent-sandbox component stems from insecure default configurations in the startup script.

Executive Summary:
An unauthenticated remote code execution vulnerability in the FastGPT agent-sandbox allows attackers to gain full control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-42302

Affected Software: FastGPT

Affected Versions: 4.14.10 through 4.14.12

Vulnerability: The entrypoint.sh script incorrectly initializes code-server with --auth none and binds it to all network interfaces, allowing unauthenticated remote access to the sandbox environment.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete system compromise, enabling attackers to execute arbitrary code, steal sensitive data, or pivot into internal infrastructure. This poses a catastrophic risk to confidentiality, integrity, and availability of the platform.

Remediation Plan

Immediate Action: Upgrade FastGPT to version 4.14.13 or later to ensure proper authentication is enforced on the agent-sandbox.

Proactive Monitoring: Review system and network access logs for unauthorized connections to port 8080 or suspicious process execution originating from the sandbox.

Compensating Controls: Immediately restrict network access to the sandbox port (8080) via firewall rules to allow only authorized administrative IPs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of exploitation for this RCE makes it a priority for immediate remediation. Administrators should treat this as a high-urgency update to prevent unauthorized code execution and complete system takeover.

---METADATA---
VENDOR: Postiz
PRODUCT: Postiz
AFFECTED_VERSIONS: Prior to commit da44801
---END_METADATA---

Description Summary:
A "Pwn Request" vulnerability in Postiz allows unauthenticated users to execute arbitrary code via malicious pull requests, leading to credential exfiltration.

Executive Summary:
An unauthenticated arbitrary code execution vulnerability in the Postiz CI/CD workflow allows attackers to exfiltrate highly privileged tokens.

Vulnerability Details

CVE-ID: CVE-2026-42298

Affected Software: Postiz

Affected Versions: Prior to commit da44801

Vulnerability: The Docker build workflow fails to safely handle external inputs, allowing an unauthenticated attacker to inject malicious code during the build process and exfiltrate the GITHUB_TOKEN.

Business Impact

The ability to steal write-access tokens grants attackers control over the repository and potentially the entire software supply chain. Given the CVSS score of 10, this is a critical threat that could lead to widespread unauthorized code commits and severe reputational damage.

Remediation Plan

Immediate Action: Update the affected workflow files to the version provided in commit da44801 or later.

Proactive Monitoring: Audit recent pull requests and review repository audit logs for any unauthorized access or unusual CI/CD pipeline behavior.

Compensating Controls: Implement stricter branch protection rules and limit the permissions of the GITHUB_TOKEN used in automated workflows.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely severe supply chain vulnerability. Security teams must ensure all CI/CD pipelines are patched and that access tokens are rotated if there is any suspicion of compromise.

---METADATA---
VENDOR: Argo
PRODUCT: Workflows
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Argo Workflows contains a high-severity vulnerability that could impact the security of container-native job orchestration on Kubernetes.

Executive Summary:
A security vulnerability in Argo Workflows may allow attackers to compromise the integrity of containerized job orchestration on Kubernetes clusters.

Vulnerability Details

CVE-ID: CVE-2026-42296

Affected Software: Argo Workflows

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects Argo Workflows, an engine used for orchestrating parallel jobs on Kubernetes. The exact technical nature of the exploit is currently being detailed by the vendor.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a high risk to Kubernetes-based operations. Compromise of the workflow engine could allow an attacker to execute arbitrary jobs, steal secrets from the cluster, or disrupt critical business processes that rely on parallel job execution.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to the Argo Workflows controller and associated components.

Proactive Monitoring: Review Kubernetes audit logs for suspicious job submissions, unexpected container executions, or unauthorized access attempts to the Argo API.

Compensating Controls: Implement Kubernetes Network Policies to restrict the communication capabilities of the Argo Workflows pods and minimize the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of Argo Workflows in orchestrating containerized jobs, this vulnerability must be treated with high priority. Administrators should monitor vendor channels for patches and prepare for an urgent deployment to secure their Kubernetes environments.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 7.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ChurchCRM before 7.3.2 is susceptible to multiple vulnerabilities including improper privilege management, missing authentication for critical functions, and CSRF, potentially leading to system compromise.

Executive Summary:
Multiple security flaws in ChurchCRM, including missing authentication and privilege management issues, allow remote attackers to compromise the application integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-42289

Affected Software: ChurchCRM CRM

Affected Versions: < 7.3.2

Vulnerability: The application suffers from a combination of missing authentication for critical functions (CWE-306), improper privilege management (CWE-269), and Cross-Site Request Forgery (CWE-352). These flaws allow unauthenticated or low-privileged attackers to perform sensitive actions.

Business Impact

The combined impact of these vulnerabilities is severe, with a CVSS score of 8.8. An attacker could gain unauthorized administrative access, modify sensitive church management data, or perform unauthorized actions, leading to significant reputational damage and loss of trust.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 7.3.2 or later immediately to address these security gaps.

Proactive Monitoring: Review application logs for unauthorized administrative actions or suspicious requests that could indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to mitigate potential CSRF attacks and block suspicious traffic patterns targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of multiple chained vulnerabilities makes this system highly attractive for automated exploitation.

Analyst Recommendation

ChurchCRM users should treat this advisory with high urgency and perform the recommended upgrade to version 7.3.2. Because the vulnerability includes missing authentication for critical functions, the application is at high risk of unauthorized manipulation by remote parties.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ChurchCRM is vulnerable to pre-authentication remote code execution via an unsanitized database password in the setup wizard.

Executive Summary:
An incomplete fix for a critical pre-authentication remote code execution vulnerability in ChurchCRM allows unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-42288

Affected Software: ChurchCRM

Affected Versions: Prior to 7.3.2

Vulnerability: This is a pre-authentication remote code execution vulnerability occurring in the setup wizard, caused by improper sanitization of the DB_PASSWORD field; it represents an incomplete fix for CVE-2026-39337.

Business Impact

With a CVSS score of 10, this vulnerability is of the highest severity, enabling an unauthenticated attacker to execute arbitrary code on the underlying server. Successful exploitation could lead to total system compromise, including the theft of sensitive congregant data, unauthorized modification of records, and the use of the server as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.3.2 or later immediately to resolve the incomplete patch.

Proactive Monitoring: Monitor server logs for suspicious process execution or unauthorized attempts to access the setup wizard or database configuration files.

Compensating Controls: If an immediate update is not possible, restrict access to the web interface to trusted IP addresses using a Web Application Firewall (WAF) or network ACLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw as an incomplete patch for a critical RCE makes it a highly attractive target for attackers.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to remote code execution without requiring authentication. Administrators must treat this as a high-priority remediation task and deploy version 7.3.2 without delay.

---METADATA---
VENDOR: DevSpace
PRODUCT: DevSpace
AFFECTED_VERSIONS: < 6.3.21
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
DevSpace is vulnerable to missing authentication and sensitive information exposure, potentially allowing unauthorized access to critical functions.

Executive Summary:
DevSpace versions prior to 6.3.21 are susceptible to missing authentication and information disclosure, which could lead to unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-42283

Affected Software: DevSpace

Affected Versions: < 6.3.21

Vulnerability: The application suffers from missing authentication for critical functions (CWE-306) and sensitive information exposure (CWE-200). These flaws allow an attacker to potentially interact with sensitive developer tool functions without proper authorization.

Business Impact

The vulnerability carries a CVSS score of 7.7 (High), reflecting a significant risk to the integrity and confidentiality of cloud-native development environments. Successful exploitation could lead to unauthorized access to Kubernetes configuration data, potentially facilitating broader compromise of the development lifecycle and associated cloud infrastructure.

Remediation Plan

Immediate Action: Update the DevSpace Go package to version 6.3.21 or later to apply the necessary security fixes.

Proactive Monitoring: Review access logs for unusual command execution patterns or unauthorized attempts to access sensitive developer functions.

Compensating Controls: Ensure that the environment where DevSpace is executed is restricted via network policies and robust identity and access management (IAM) controls to limit the blast radius.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is serious, it currently lacks evidence of widespread weaponized exploitation.

Analyst Recommendation

Given the severity of the identified authentication and disclosure flaws, administrators should prioritize updating to version 6.3.21 immediately. Failure to patch may expose development environments to unauthorized access and potential manipulation of cloud-native deployment workflows.

---METADATA---
VENDOR: LiteLLM
PRODUCT: LiteLLM
AFFECTED_VERSIONS: From version 1.74.2 to before version 1.83.7
---END_METADATA---

Description Summary:
LiteLLM contains a command injection vulnerability in its MCP server test endpoints that, when chained with a host header bypass, enables unauthenticated remote code execution.

Executive Summary:
Actively exploited in the wild, this command injection vulnerability in LiteLLM allows attackers to achieve remote code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-42271

Affected Software: LiteLLM

Affected Versions: From version 1.74.2 to before version 1.83.7

Vulnerability: This is a command injection vulnerability within the MCP server test endpoints. Authenticated users can execute arbitrary commands on the host, and when chained with a Starlette host header validation bypass (CVE-2026-48710), it results in unauthenticated remote code execution.

Business Impact

With a CVSS score of 8.8 and confirmed active exploitation, this vulnerability poses an extreme business risk. Attackers can gain complete control over the AI gateway infrastructure, leading to potential lateral movement, data theft, and the deployment of malicious payloads.

Remediation Plan

Immediate Action: Update LiteLLM to version 1.83.7 immediately to mitigate the command injection risk.

Proactive Monitoring: Monitor system logs for unauthorized process execution and unexpected network outbound connections originating from the LiteLLM service.

Compensating Controls: Use a WAF or reverse proxy to strictly validate host headers and sanitize incoming requests to the MCP server endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jun 9, 2026, there is evidence of active exploitation in the wild. CISA has added this flaw to the KEV catalog, and researchers have confirmed a chained exploit path enabling remote code execution.

Analyst Recommendation

Given the active exploitation and the severity of the impact, this update is critical. All affected organizations should treat this as a top-tier security priority and verify system integrity for signs of previous unauthorized access.

---METADATA---
VENDOR: Jupyter
PRODUCT: JupyterLab
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in JupyterLab, an extensible environment for interactive computing.

Executive Summary:
A critical security vulnerability in JupyterLab requires immediate attention to prevent unauthorized access to interactive computing environments.

Vulnerability Details

CVE-ID: CVE-2026-42266

Affected Software: JupyterLab

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are developing, the vulnerability affects the JupyterLab environment. Such environments are frequent targets due to their ability to execute arbitrary code within the context of the user's session.

Business Impact

An exploit could allow an attacker to gain unauthorized access to an organization's data science environment, potentially exposing proprietary algorithms, sensitive datasets, or credentials stored within notebooks. The 8.8 CVSS score highlights the high-risk nature of this vulnerability.

Remediation Plan

Immediate Action: Update JupyterLab to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor for anomalous notebook activity, unauthorized access to Jupyter instances, or suspicious outbound network connections from the host.

Compensating Controls: Use containerization to isolate individual JupyterLab instances and enforce strict authentication mechanisms for access to the interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this update with high priority to protect sensitive research and data analytics environments. Ensuring that JupyterLab instances are updated and properly isolated is essential to mitigating this risk.

---METADATA---
VENDOR: Aas-ee
PRODUCT: open-webSearch
AFFECTED_VERSIONS: < 2.1.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability exists in the open-webSearch MCP server, allowing unauthenticated attackers to perform unauthorized requests.

Executive Summary:
A critical SSRF vulnerability in open-webSearch allows unauthenticated attackers to perform unauthorized requests, potentially leading to information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-42260

Affected Software: Aas-ee open-webSearch

Affected Versions: < 2.1.7

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in the open-webSearch component. The vulnerability is exploitable by unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N).

Business Impact

Successful exploitation of this SSRF vulnerability allows an attacker to force the server to make unintended requests to internal or external resources. This can result in unauthorized access to internal network services, sensitive configuration data exposure, or the bypassing of firewall restrictions, warranting the 8.2 CVSS score.

Remediation Plan

Immediate Action: Update the open-webSearch package to version 2.1.7 or later via your package manager.

Proactive Monitoring: Monitor server logs for unusual outbound connection attempts to internal IP addresses or sensitive domains.

Compensating Controls: Implement strict egress filtering on the server hosting the MCP daemon to prevent unauthorized requests to internal resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and ability to interact with internal network infrastructure.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for network-level compromise, administrators should prioritize updating open-webSearch to version 2.1.7 immediately. Failure to patch may expose internal network segments to unauthorized reconnaissance and interaction.

---METADATA---
VENDOR: Avo
PRODUCT: Avo Framework
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Avo framework for Ruby on Rails admin panels contains a security vulnerability that could impact administrative access controls.

Executive Summary:
A high-severity vulnerability within the Avo framework poses a significant risk to the integrity and confidentiality of Ruby on Rails administrative interfaces.

Vulnerability Details

CVE-ID: CVE-2026-42205

Affected Software: Avo (Ruby on Rails Admin Framework)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Avo framework, which is utilized for constructing administrative panels. The flaw potentially allows for unauthorized access or privilege escalation within the admin interface, likely requiring authenticated access to the application.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical as it targets the management layer of business applications. Successful exploitation grants attackers administrative control over the underlying Ruby on Rails application, leading to total data compromise or unauthorized system configuration changes.

Remediation Plan

Immediate Action: Update the Avo framework to the latest patched version identified in the vendor security documentation.

Proactive Monitoring: Audit access logs for the admin panel to identify any suspicious user activity or unauthorized elevation of privileges.

Compensating Controls: Restrict access to administrative panels by IP address or require multi-factor authentication (MFA) at the network or application level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates immediate attention to prevent targeted attacks against administrative backends.

Analyst Recommendation

Given the sensitivity of administrative panels, this vulnerability must be treated with extreme urgency. Administrators should verify their Avo dependency versions and apply the necessary patches to maintain the security posture of their Ruby on Rails infrastructure.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: >= 4.0.0-beta.471, < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to OS command injection, allowing authenticated attackers to execute arbitrary system commands via improper neutralization of special elements.

Executive Summary:
A high-severity OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system-level commands, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-42204

Affected Software: CoolLabs Coolify

Affected Versions: >= 4.0.0-beta.471, < 4.0.0-beta.474

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. It requires an authenticated user to provide malicious input that is not properly sanitized, enabling the execution of unauthorized commands on the underlying host operating system.

Business Impact

The exploitation of this flaw allows an attacker to gain full control over the server hosting Coolify. Given the CVSS score of 8.8, this represents a high risk of total system compromise, including unauthorized data access, modification of application databases, and potential lateral movement into the broader network infrastructure.

Remediation Plan

Immediate Action: Update the Coolify instance to version 4.0.0-beta.474 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution, unexpected shell commands, or unauthorized modifications to critical configuration files.

Compensating Controls: Implement strict network segmentation and ensure the Coolify service runs with the least-privileged user account necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to execute arbitrary OS commands is a critical security failure. Administrators must prioritize upgrading to version 4.0.0-beta.474 without delay. Failure to patch this vulnerability leaves the underlying server environment exposed to full administrative takeover.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify contains a path traversal vulnerability that allows authenticated users to access or manipulate restricted files on the server.

Executive Summary:
A path traversal vulnerability in Coolify allows authenticated users to access sensitive files outside of the intended directory, threatening system confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-42200

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.474

Vulnerability: This is a Path Traversal (CWE-22) vulnerability that arises from the improper restriction of file paths. Authenticated attackers can supply specially crafted inputs to access directories or files that should be protected, leading to unauthorized read or write access.

Business Impact

The CVSS score of 8.8 indicates a high severity level. Successful exploitation could allow an attacker to read sensitive configuration files, credentials, or system files, leading to privilege escalation or complete system takeover.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.474 or newer to incorporate the necessary file path validation fixes.

Proactive Monitoring: Monitor filesystem access logs for attempts to access directories outside of the designated web root or expected application paths.

Compensating Controls: Use file system permissions to restrict the Coolify service account to the absolute minimum set of directories required for its operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities are frequently chained to achieve more severe impact. Administrators are strongly advised to apply the update to version 4.0.0-beta.474 as soon as possible to prevent unauthorized access to the host file system.

---METADATA---
VENDOR: Inducer
PRODUCT: RELATE
AFFECTED_VERSIONS: Versions prior to 555f0efb1c5bd7531c07cd73724d7e566a81f620
CONFIDENCE: high
MISSING: patch (specific version number)
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability in the RELATE web-based courseware package allows authenticated attackers to execute malicious scripts in the context of a victim's session.

Executive Summary:
The RELATE courseware package contains a stored cross-site scripting vulnerability that could allow an authenticated attacker to perform unauthorized actions on behalf of other users.

Vulnerability Details

CVE-ID: CVE-2026-42197

Affected Software: Inducer RELATE

Affected Versions: Versions prior to 555f0efb1c5bd7531c07cd73724d7e566a81f620

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) within the courseware administration interface. It requires an authenticated user with sufficient privileges to inject malicious input that is subsequently executed in the browser of other users, including administrators.

Business Impact

An attacker exploiting this vulnerability could hijack administrative sessions, modify course content, or perform unauthorized administrative actions. The CVSS score of 8.7 reflects the high potential for impact on integrity and confidentiality, as the flaw allows for the execution of scripts within the context of the application's administrative domain.

Remediation Plan

Immediate Action: Update the RELATE installation by pulling the latest source code from the main repository, specifically ensuring the inclusion of commit 555f0efb1c5bd7531c07cd73724d7e566a81f620.

Proactive Monitoring: Audit administrative logs for suspicious input patterns or unexpected changes to course configuration settings.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts within the browser.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the improper sanitization of administrative inputs.

Analyst Recommendation

Administrators must verify their current version of RELATE against the repository commit history and apply the necessary security patch immediately. Due to the high risk to administrative integrity, restrict access to the courseware management interface to authorized personnel only.

---METADATA---
VENDOR: Plunk
PRODUCT: Plunk (Email platform)
AFFECTED_VERSIONS: Prior to 0.9.0
---END_METADATA---

Description Summary:
The Plunk email platform fails to verify SNS signatures, allowing unauthenticated attackers to forge webhook requests.

Executive Summary:
A critical authentication bypass in the Plunk platform allows unauthenticated attackers to spoof AWS SNS events and manipulate email delivery workflows.

Vulnerability Details

CVE-ID: CVE-2026-42193

Affected Software: Plunk

Affected Versions: Prior to 0.9.0

Vulnerability: The /webhooks/sns endpoint does not validate the Amazon SNS signature, certificate, or topic ARN, allowing an attacker to submit forged requests.

Business Impact

This vulnerability allows attackers to manipulate email metrics, unsubscribe users, and potentially exhaust billing credits. With a CVSS score of 9.1, it represents a significant risk to operational integrity and potential financial loss for businesses relying on the platform.

Remediation Plan

Immediate Action: Update Plunk to version 0.9.0 or later to enable proper signature verification.

Proactive Monitoring: Review application logs for unexpected webhook activity or high volumes of SNS events that do not correlate with legitimate traffic.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict access to the /webhooks/sns endpoint to only traffic originating from verified AWS IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The inability to verify the authenticity of webhook requests makes this a high-priority update. Organizations should ensure their instance is patched to prevent unauthorized manipulation of email operations.

---METADATA---
VENDOR: Tauri
PRODUCT: Tauri Framework
AFFECTED_VERSIONS: 2.0 to 2.11.0
---END_METADATA---

Description Summary:
A flaw in Tauri's URL validation incorrectly classifies remote URLs as trusted local origins.

Executive Summary:
The Tauri framework is affected by a high-severity vulnerability that could allow unauthorized access to local IPC commands.

Vulnerability Details

CVE-ID: CVE-2026-42184

Affected Software: Tauri Framework

Affected Versions: 2.0 to 2.11.0

Vulnerability: A flaw in the is_local_url() function incorrectly classifies remote URLs as trusted local origins on Windows and Android, allowing an attacker to invoke local-only IPC commands.

Business Impact

With a CVSS score of 8.8, this vulnerability allows a remote attacker to bypass security boundaries and execute local-only commands. This could lead to sensitive data exposure or unauthorized actions being performed on the user's desktop or mobile device.

Remediation Plan

Immediate Action: Update the Tauri framework to version 2.10.3 or 2.11.1 immediately to resolve the URL validation issue.

Proactive Monitoring: Monitor application behavior for unexpected calls to local IPC interfaces originating from remote network locations.

Compensating Controls: Implement strict Content Security Policies (CSP) to restrict the origins that the application can communicate with.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers utilizing the Tauri framework must upgrade to the specified patched versions immediately. This vulnerability poses a significant risk to application integrity and should be addressed without delay.

---METADATA---
VENDOR: Nullsoft
PRODUCT: NSIS (Nullsoft Scriptable Install System)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The NSIS (Nullsoft Scriptable Install System) 3 is affected by a high-severity vulnerability that could be leveraged by attackers during software installation.

Executive Summary:
A high-severity vulnerability in the NSIS 3 installer framework could allow for malicious code execution during the software installation process.

Vulnerability Details

CVE-ID: CVE-2026-42171

Affected Software: NSIS (Nullsoft Scriptable Install System) 3

Affected Versions: See vendor advisory for affected versions

Vulnerability: NSIS is a widely used tool for creating Windows installers. This vulnerability, with a CVSS score of 7.8, likely involves insecure handling of installation scripts or temporary files, potentially allowing an attacker to execute arbitrary code with the same privileges as the installer process.

Business Impact

A CVSS score of 7.8 poses a significant threat, as installers often run with administrative privileges. Successful exploitation could lead to full system compromise during the installation of legitimate software that happens to use the vulnerable NSIS version.

Remediation Plan

Immediate Action: Update to the latest version of NSIS and ensure that all software packages distributed within the organization are rebuilt using the patched installer.

Proactive Monitoring: Monitor for unusual file creation or process execution during the software installation phase on enterprise endpoints.

Compensating Controls: Use application whitelisting and ensure that only signed installers from reputable vendors are allowed to execute on end-user machines.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must coordinate with development and IT operations to identify software packages using NSIS 3 and initiate updates. Standardizing on secure installer versions is critical to protecting endpoints from compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in the GIMP DirectDraw Surface file parser, which could allow for code execution when processing malicious files.

Executive Summary:
A heap-based buffer overflow in the GIMP DDS file parser on Red Hat Enterprise Linux may allow an attacker to execute arbitrary code via a specially crafted image file.

Vulnerability Details

CVE-ID: CVE-2026-42170

Affected Software: Red Hat Enterprise Linux

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9

Vulnerability: This is a heap-based buffer overflow (CWE-131) occurring within the DirectDraw Surface (DDS) parser. The vulnerability requires user interaction, as a victim must open a maliciously crafted image file for the overflow to be triggered.

Business Impact

Successful exploitation of this buffer overflow could result in arbitrary code execution, potentially leading to total system compromise or data exfiltration. Given the CVSS score of 7.8, this flaw represents a significant risk to workstations or servers that process image files from untrusted sources.

Remediation Plan

Immediate Action: Monitor the Red Hat security advisory page for the release of updated packages and apply them immediately upon availability.

Proactive Monitoring: Review application logs for crashes associated with image processing software and restrict the opening of files from unknown or untrusted external sources.

Compensating Controls: Utilize sandboxing technologies for image viewers or file conversion utilities to limit the impact of potential memory corruption vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Heap-based overflows of this nature are inherently complex to weaponize reliably.

Analyst Recommendation

Users should exercise caution when handling DDS files from untrusted origins until official security patches are applied. Organizations should ensure that all systems running Red Hat Enterprise Linux are patched as soon as the vendor updates are released.