---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
A vulnerability involving SuppressedError in the vm2 library allows attackers to escape the sandbox and execute arbitrary code on the host system.

Executive Summary:
A critical sandbox breakout vulnerability in vm2 allows attackers to leverage SuppressedError to execute arbitrary code on the host.

Vulnerability Details

CVE-ID: CVE-2026-26332

Affected Software: vm2 (Node.js)

Affected Versions: Prior to 3.11.0

Vulnerability: The SuppressedError object in the vm2 environment can be manipulated to facilitate a sandbox escape. By exploiting this, an attacker can move outside the restricted environment and execute arbitrary code on the host.

Business Impact

A CVSS score of 9.8 reflects the high severity of this sandbox escape. Exploitation could allow an attacker to gain full control over the host system, leading to complete data compromise and potential disruption of critical business processes.

Remediation Plan

Immediate Action: Update the vm2 dependency to version 3.11.0 or later to address this breakout vulnerability.

Proactive Monitoring: Monitor application logs for unexpected error patterns or unusual code execution sequences.

Compensating Controls: Run the Node.js application with minimal system privileges and use containerization to restrict access to the underlying host resources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The continued discovery of sandbox escapes in vm2 underscores the difficulty of maintaining a secure JavaScript sandbox. Updating the library is mandatory, but organizations should also assess the necessity of running untrusted code and consider more secure architectural alternatives.

---METADATA---
VENDOR: Datalogics
PRODUCT: Ecommerce Delivery (WordPress plugin)
AFFECTED_VERSIONS: Versions before 2.6.60
---END_METADATA---

Description Summary:
The Datalogics Ecommerce Delivery plugin for WordPress before 2.6.60 contains an unauthenticated REST endpoint vulnerability allowing remote attackers to modify site options and gain admin access.

Executive Summary:
A critical vulnerability in the Datalogics Ecommerce Delivery WordPress plugin allows unauthenticated attackers to escalate privileges to Administrator by manipulating site configuration options.

Vulnerability Details

CVE-ID: CVE-2026-2631

Affected Software: Datalogics Ecommerce Delivery (WordPress plugin)

Affected Versions: Versions before 2.6.60

Vulnerability: This flaw exists in an unauthenticated REST endpoint that permits the modification of the datalogics_token option. An attacker can exploit this lack of verification to authenticate against a protected endpoint and execute arbitrary update_option() calls, enabling user registration and setting the default role to Administrator.

Business Impact

A successful exploit grants an attacker full control over the WordPress environment. By enabling registration and promoting themselves to the Administrator role, attackers can steal sensitive customer data, deface the website, or deploy malware. The CVSS score of 9.8 reflects the critical nature of this unauthenticated remote privilege escalation.

Remediation Plan

Immediate Action: Update the Datalogics Ecommerce Delivery plugin to version 2.6.60 or later immediately to patch the vulnerable REST endpoint.

Proactive Monitoring: Review WordPress user logs for unauthorized new Administrator accounts and inspect the wp_options table for unexpected changes to the default_role or users_can_register settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block unauthorized requests to WordPress REST API endpoints, specifically those targeting plugin-specific options.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of automating REST API attacks, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total loss of confidentiality, integrity, and availability for affected WordPress sites. IT administrators must prioritize this update, as the ability for unauthenticated users to modify core site options is a worst-case scenario. Apply the version 2.6.60 patch immediately.

---METADATA---
VENDOR: Unknown
PRODUCT: OCPP Charging Infrastructure
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A lack of authentication in WebSocket endpoints allows unauthenticated attackers to impersonate charging stations, manipulate data, and issue unauthorized commands via the OCPP protocol.

Executive Summary:
Missing authentication in OCPP WebSocket endpoints enables unauthenticated attackers to impersonate charging stations, leading to unauthorized infrastructure control and data corruption.

Vulnerability Details

CVE-ID: CVE-2026-26288

Affected Software: OCPP-based Charging Management Systems

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a total lack of authentication on WebSocket endpoints used for the Open Charge Point Protocol (OCPP). An unauthenticated attacker can establish a connection using a valid station ID, allowing them to intercept or inject charging commands and manipulate the backend's view of the network status.

Business Impact

The impact is critical, as evidenced by the CVSS score of 9.4, involving potential privilege escalation and unauthorized control over EV charging hardware. Successful exploitation could lead to revenue loss, incorrect billing, and significant reputational damage if the charging network is compromised or rendered inoperable.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to enforce authentication on all WebSocket communication channels.

Proactive Monitoring: Implement logging for all WebSocket connection attempts and set up alerts for any connection requests that do not provide valid, pre-shared credentials.

Compensating Controls: Utilize a Web Application Firewall (WAF) capable of inspecting WebSocket traffic or place the management backend behind a secure gateway that requires mutual TLS (mTLS) for all station connections.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of exploiting unauthenticated endpoints suggests that scanning for vulnerable instances may begin shortly.

Analyst Recommendation

Immediate action is required to secure the charging infrastructure. Security teams should verify that all endpoints require robust authentication and that no "default" or "test" endpoints remain exposed to the public internet.

---METADATA---
VENDOR: miniOrange
PRODUCT: All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login (WordPress Plugin)
AFFECTED_VERSIONS: Up to, and including, 2.2.5
---END_METADATA---

Description Summary:
The All-in-One Microsoft 365 SSO Login plugin for WordPress allows unauthenticated attackers to bypass authentication and gain full administrative access due to an insecure login implementation.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the miniOrange Microsoft 365 SSO plugin for WordPress allows remote attackers to gain full administrative control over affected websites.

Vulnerability Details

CVE-ID: CVE-2026-2628

Affected Software: miniOrange All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login

Affected Versions: Up to, and including, 2.2.5

Vulnerability: This vulnerability constitutes a critical authentication bypass. It allows unauthenticated remote attackers to spoof identities and log in as any existing user, including site administrators, without requiring a password or valid SSO token.

Business Impact

A successful exploit grants the attacker total control over the WordPress environment, leading to complete data exfiltration, site defacement, or the installation of persistent backdoors. Given the CVSS score of 9.8, this represents a critical risk to confidentiality, integrity, and availability, potentially resulting in significant reputational damage and loss of sensitive customer data.

Remediation Plan

Immediate Action: Update the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin to the latest version (at least 2.2.6) immediately to close the authentication gap.

Proactive Monitoring: Review WordPress audit logs for unexpected administrative logins or the creation of new, unauthorized administrator accounts originating from unknown IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block unauthorized access to wp-login.php and monitor for suspicious SSO callback patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows for unauthenticated administrative access, the potential for exploitation is extremely high once technical details are reverse-engineered.

Analyst Recommendation

This vulnerability is critical and should be treated as a top priority for remediation. Organizations using this plugin for SSO must apply the vendor-provided update immediately to prevent unauthorized administrative access and potential site takeover.

---METADATA---
VENDOR: Froxlor
PRODUCT: Froxlor
AFFECTED_VERSIONS: Prior to 2.3.4
---END_METADATA---

Description Summary:
A typo in Froxlor's input validation enables an authenticated administrator to achieve root-level remote code execution via shell command injection.

Executive Summary:
A critical input validation failure in Froxlor allows an authenticated administrator to gain full root-level control of the server through malicious shell command injection.

Vulnerability Details

CVE-ID: CVE-2026-26279

Affected Software: Froxlor

Affected Versions: Prior to 2.3.4

Vulnerability: A logic error (using "==" instead of "=") disables email format checking in settings fields. An authenticated administrator can inject arbitrary strings into the panel.adminmail setting, which is subsequently executed as root by a system cron job using a shell command.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk to server infrastructure. A compromised administrator account can be leveraged to gain total control over the underlying operating system. This could lead to data destruction, lateral movement within the network, and complete service disruption.

Remediation Plan

Immediate Action: Update Froxlor to version 2.3.4 immediately to correct the validation logic and prevent command injection.

Proactive Monitoring: Review the panel.adminmail setting for suspicious characters (such as pipes or semicolons) and inspect cron job logs for unauthorized command execution.

Compensating Controls: Implement the principle of least privilege for administrative accounts and use file integrity monitoring on critical system configuration files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. However, the simplicity of the typo makes this vulnerability trivial to exploit for any user with administrative panel access.

Analyst Recommendation

While this requires administrative authentication, the resulting root-level access makes it a critical priority. Organizations must update to version 2.3.4 immediately to secure their server management infrastructure.

---METADATA---
VENDOR: Known
PRODUCT: Known (Social Publishing Platform)
AFFECTED_VERSIONS: 1.6.2 and earlier
---END_METADATA---

Description Summary:
A broken authentication vulnerability in Known allows unauthenticated attackers to retrieve password reset tokens from hidden HTML fields, enabling full account takeover of any user.

Executive Summary:
Known social publishing platform is vulnerable to full account takeover because password reset tokens are leaked to unauthenticated attackers via the password reset page.

Vulnerability Details

CVE-ID: CVE-2026-26273

Affected Software: Known

Affected Versions: 1.6.2 and earlier

Vulnerability: The application incorrectly includes the password reset token within a hidden HTML input field on the reset request page. This allows any unauthenticated attacker to capture the token by querying a target's email address, bypassing the need for email inbox access.

Business Impact

This vulnerability poses a critical risk to user privacy and platform integrity, as it facilitates unauthorized access to any account, including administrative profiles. Such an exploit could lead to complete site defacement, data theft, and loss of user trust. The CVSS score of 9.8 underscores the ease of exploitation and the severe impact on account security.

Remediation Plan

Immediate Action: Update the Known installation to version 1.6.3 or later immediately to ensure password reset tokens are no longer exposed in the browser.

Proactive Monitoring: Monitor web server logs for a high volume of requests to the password reset endpoint, which may indicate an attacker attempting to harvest tokens for multiple users.

Compensating Controls: Implement rate limiting on password reset requests and consider disabling the reset feature temporarily if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw is trivially exploitable via standard browser tools, the risk of rapid adoption by threat actors is significant.

Analyst Recommendation

The ability to take over any user account without authentication represents a terminal risk to the platform. Administrators must treat this as a high-priority emergency and apply the 1.6.3 patch immediately to protect the user base from unauthorized account access.

---METADATA---
VENDOR: Softland
PRODUCT: FBackup
AFFECTED_VERSIONS: Up to version 9
---END_METADATA---

Description Summary:
A security flaw has been identified in Softland FBackup up to version 9 that could allow for unauthorized access or data manipulation.

Executive Summary:
Softland FBackup versions up to 9 contain a high-severity security flaw that threatens the integrity and confidentiality of backup data.

Vulnerability Details

CVE-ID: CVE-2026-2627

Affected Software: Softland FBackup

Affected Versions: Up to version 9

Vulnerability: While specific technical details are limited, the flaw in FBackup versions up to 9 suggests a vulnerability that could be exploited to compromise the backup software's operations. Based on the "High" severity, it likely involves unauthorized access or local privilege escalation.

Business Impact

The compromise of backup software is a critical risk, as it can lead to the loss of data recovery capabilities or the exposure of sensitive archived information. The CVSS score of 7.8 indicates a significant risk to the business's disaster recovery posture and data privacy.

Remediation Plan

Immediate Action: Apply the latest security updates from Softland immediately to move beyond version 9 and resolve the identified flaw.

Proactive Monitoring: Monitor for unusual file access patterns within the FBackup directories and review logs for unauthorized backup job modifications.

Compensating Controls: Ensure that backup repositories are encrypted and restricted to only the necessary service accounts to limit the impact of a software compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Backup systems are a primary target for attackers, particularly in ransomware scenarios. Administrators should treat this high-severity update as a priority to ensure the continued security and reliability of their data protection strategy.

---METADATA---
VENDOR: Anysphere
PRODUCT: Cursor
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Cursor AI-powered code editor is affected by a high-severity vulnerability that could impact the security of the developer's environment and source code.

Executive Summary:
Cursor, a popular AI-integrated code editor, contains a high-severity vulnerability that poses a risk to developer workstation security and the integrity of source code repositories.

Vulnerability Details

CVE-ID: CVE-2026-26268

Affected Software: Anysphere Cursor

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Cursor code editor. While the specific vulnerability type is not disclosed, a CVSS score of 8.0 suggests a High severity flaw that could potentially allow for remote code execution or unauthorized access to the local file system through the editor's AI or extension capabilities.

Business Impact

A vulnerability in a code editor can lead to the compromise of a developer's entire workstation. This provides a pathway for attackers to steal source code, inject malicious code into software products (Supply Chain Attack), or steal sensitive environment variables and SSH keys. The CVSS score of 8.0 underscores the significant risk to the software development lifecycle.

Remediation Plan

Immediate Action: Developers should update the Cursor editor to the latest version immediately via the in-app update mechanism or the official website.

Proactive Monitoring: Review repository commit history for unauthorized changes and monitor developer workstations for unusual process activity or unauthorized file access.

Compensating Controls: Use endpoint detection and response (EDR) solutions to monitor for suspicious behavior originating from development tools and enforce the use of signed commits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in modern IDEs are increasingly exploited to facilitate supply chain compromises.

Analyst Recommendation

We recommend that all organizations using Cursor for development mandate an immediate update across all engineering teams. The potential for a workstation compromise to escalate into a full-scale supply chain attack makes this a critical priority for security administrators. Focus on ensuring the integrity of the development environment.

---METADATA---
VENDOR: AliasVault
PRODUCT: AliasVault Web Client
AFFECTED_VERSIONS: 0.25.3 and lower
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in AliasVault Web Client allows attackers to execute malicious JavaScript in the victim's browser via crafted emails.

Executive Summary:
AliasVault Web Client is vulnerable to a critical stored cross-site scripting attack that enables unauthenticated attackers to execute malicious code in the context of a user's session.

Vulnerability Details

CVE-ID: CVE-2026-26266

Affected Software: AliasVault Web Client

Affected Versions: 0.25.3 and lower

Vulnerability: The email rendering feature fails to properly sanitize HTML content or provide origin isolation when using the srcdoc attribute in iframes. An unauthenticated attacker can send a crafted email containing malicious JavaScript that executes when viewed by the victim.

Business Impact

This vulnerability carries a CVSS score of 9.3, signifying High/Critical severity. Successful exploitation allows for session hijacking, theft of sensitive password manager data, and unauthorized actions performed on behalf of the user. Because AliasVault is a privacy-focused tool, this flaw directly undermines the core security promise of the product.

Remediation Plan

Immediate Action: Administrators and users must upgrade the AliasVault Web Client to version 0.26.0 or higher immediately.

Proactive Monitoring: Monitor web application logs for suspicious script injection patterns or unusual client-side behavior reported by users.

Compensating Controls: Employ a Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and external resources within the web client.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of sanitization makes this a highly reliable attack vector for targeting password manager users.

Analyst Recommendation

The ability to execute arbitrary scripts within a password management interface is a catastrophic security failure. Immediate migration to version 0.26.0 is mandatory to protect user credentials and maintain organizational privacy.

---METADATA---
VENDOR: QNAP Systems Inc.
PRODUCT: File Station 5
AFFECTED_VERSIONS: File Station 5 version 5.5.0
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in QNAP File Station 5 allows authenticated remote attackers to modify memory or crash system processes.

Executive Summary:
A buffer overflow vulnerability in QNAP File Station 5 could allow an authenticated attacker to compromise system stability or manipulate memory.

Vulnerability Details

CVE-ID: CVE-2026-26239

Affected Software: QNAP Systems Inc. File Station 5

Affected Versions: File Station 5 version 5.5.0

Vulnerability: This is a buffer overflow vulnerability triggered within the File Station 5 application. It requires an attacker to possess a valid user account to successfully exploit the flaw, which can lead to unauthorized memory modification or process termination.

Business Impact

The CVSS score of 8.1 (High) reflects the potential for significant disruption to QNAP storage services. Successful exploitation allows an attacker to cause a denial-of-service condition or potentially execute arbitrary code, which could lead to unauthorized access to sensitive files stored on the NAS, resulting in data loss or reputational damage.

Remediation Plan

Immediate Action: Update File Station 5 to version 5.5.6.5208 or later as specified in the vendor advisory.

Proactive Monitoring: Review system access logs for unusual account activity or repeated process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the QNAP management interface to trusted IP ranges and ensure that user privileges are strictly managed according to the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this memory-based vulnerability, administrators should prioritize updating to the patched version immediately. Ensuring that only authorized users have access to File Station services is critical to preventing exploitation of this flaw.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions prior to 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea is susceptible to an authorization bypass where authenticated low-privilege users can push unauthorized commits to repositories by abusing the pull request maintainer edit flag.

Executive Summary:
A critical authorization bypass vulnerability in Gitea allows authenticated low-privileged users to perform unauthorized write operations on repositories.

Vulnerability Details

CVE-ID: CVE-2026-26231

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions prior to 1.26.2

Vulnerability: This is an authorization bypass vulnerability affecting the "Allow edits from maintainers" feature. An authenticated user with read-only access can exploit this by using reverse-fork pull requests to push commits to an upstream repository without proper write-access validation.

Business Impact

The ability for unauthorized users to push arbitrary code to repositories poses a severe risk to software supply chain integrity. With a CVSS score of 8.5, this vulnerability could lead to the injection of malicious code, backdoors, or the corruption of production-ready source code, resulting in significant reputational damage and potential system compromise.

Remediation Plan

Immediate Action: Upgrade all Gitea instances to version 1.26.2 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review repository commit logs for suspicious activity or unexpected contributions from users who do not hold write permissions.

Compensating Controls: Strictly enforce branch protection rules and require signed commits to ensure that only authorized changes are merged into critical branches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.5, this vulnerability represents a significant risk to development environments. Organizations should prioritize the update to Gitea 1.26.2 immediately to prevent unauthorized code injection and maintain the integrity of their Git workflows.

---METADATA---
VENDOR: newbee-mall
PRODUCT: newbee-mall
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The newbee-mall application uses unsalted MD5 hashing for password storage, allowing attackers who obtain the database to rapidly recover plaintext credentials via offline attacks.

Executive Summary:
Weak password hashing in newbee-mall exposes user credentials to rapid offline cracking, significantly increasing the risk of account takeover following a data breach.

Vulnerability Details

CVE-ID: CVE-2026-26219

Affected Software: newbee-mall

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application stores passwords using the MD5 algorithm without per-user salts or computational cost controls. This makes the stored hashes highly susceptible to rapid recovery through rainbow tables or brute-force attacks if the database is compromised.

Business Impact

A CVSS score of 9.1 indicates a critical risk. If attackers gain access to database backups or exports, they can quickly decrypt administrative and user passwords, leading to widespread account takeovers and the potential compromise of other systems where users have reused their passwords.

Remediation Plan

Immediate Action: Update the application to a version that implements secure password hashing (e.g., Argon2 or bcrypt) and force a password reset for all users upon the next login.

Proactive Monitoring: Monitor for suspicious database access or unauthorized attempts to export user tables.

Compensating Controls: Implement database-at-rest encryption and strict access controls to prevent unauthorized personnel from obtaining the password hashes in the first place.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation. This vulnerability is typically exploited post-compromise to maximize the impact of a data breach.

Analyst Recommendation

Modern security standards require robust, salted hashing algorithms. Organizations should update newbee-mall immediately to a version that supports secure credential storage and educate users on the importance of unique passwords to mitigate the impact of hash disclosure.

---METADATA---
VENDOR: newbee-mall
PRODUCT: newbee-mall
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The newbee-mall application utilizes pre-seeded administrator accounts with predictable default passwords, allowing unauthenticated attackers to gain full administrative control upon deployment.

Executive Summary:
The presence of hardcoded, predictable administrative credentials in newbee-mall poses a critical risk, potentially allowing unauthenticated attackers to seize complete control of the application.

Vulnerability Details

CVE-ID: CVE-2026-26218

Affected Software: newbee-mall

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the use of hardcoded, pre-seeded administrator accounts within the database initialization script. Unauthenticated attackers can leverage these predictable default credentials to bypass security controls and access the administrative interface.

Business Impact

A successful exploit grants an attacker full administrative privileges, leading to a total compromise of the application's integrity, confidentiality, and availability. With a CVSS score of 9.8, the impact is categorized as Critical, potentially resulting in the theft of customer data, financial fraud, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Change all default administrative passwords immediately and remove any unnecessary pre-seeded accounts from the database.

Proactive Monitoring: Monitor authentication logs for successful logins to administrative accounts from unrecognized IP addresses or at unusual times.

Compensating Controls: Implement multi-factor authentication (MFA) for all administrative accounts and restrict access to the admin panel to trusted network ranges via an IP allowlist.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the credentials are predictable and included in public scripts, the potential for exploitation is extremely high.

Analyst Recommendation

The reliance on default credentials is a severe security oversight that must be addressed immediately. It is highly recommended that administrators audit their database initialization processes to ensure all default accounts are secured or disabled before the application is exposed to any network.

---METADATA---
VENDOR: Crawl4AI
PRODUCT: Docker API deployment
AFFECTED_VERSIONS: Versions prior to 0.8.0
---END_METADATA---

Description Summary:
Crawl4AI versions prior to 0.8.0 allow unauthenticated remote code execution via the /crawl endpoint by exploiting the hooks parameter to import arbitrary Python modules.

Executive Summary:
An unauthenticated remote code execution vulnerability in Crawl4AI's Docker API allows attackers to achieve full server compromise, including data exfiltration and lateral movement.

Vulnerability Details

CVE-ID: CVE-2026-26216

Affected Software: Crawl4AI

Affected Versions: Versions prior to 0.8.0

Vulnerability: The /crawl endpoint accepts a hooks parameter containing Python code executed via exec(). Because the __import__ builtin was not restricted, unauthenticated attackers can import arbitrary modules and execute system commands on the host.

Business Impact

This vulnerability carries a CVSS score of 10, the highest possible severity. Successful exploitation allows for complete system takeover, sensitive data theft, and the ability for attackers to pivot into internal networks, resulting in catastrophic operational and financial damage.

Remediation Plan

Immediate Action: Update the Crawl4AI Docker API deployment to version 0.8.0 or later immediately to remove the vulnerable code execution path.

Proactive Monitoring: Review API logs for requests to the /crawl endpoint that include suspicious Python code or attempts to use the hooks parameter.

Compensating Controls: Place the Docker API behind a Web Application Firewall (WAF) with rules designed to block Python-style injection and restrict API access to authenticated users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation. However, the technical nature of the flaw makes it trivial to exploit once the endpoint is identified.

Analyst Recommendation

A CVSS 10.0 vulnerability requires immediate, out-of-band patching. Organizations must ensure that no Crawl4AI instances are exposed to the public internet without authentication and that all instances are updated to version 0.8.0 or higher.

---METADATA---
VENDOR: KTransformers
PRODUCT: KTransformers
AFFECTED_VERSIONS: through 0.5.3
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
KTransformers contains an unsafe deserialization vulnerability in its ZMQ-based scheduler RPC server, allowing unauthenticated remote code execution via crafted pickle payloads.

Executive Summary:
An unsafe deserialization flaw in the KTransformers scheduler RPC server allows unauthenticated attackers to execute arbitrary code with the privileges of the service process.

Vulnerability Details

CVE-ID: CVE-2026-26210

Affected Software: KTransformers

Affected Versions: through 0.5.3

Vulnerability: The application binds a ZMQ ROUTER socket to all interfaces without authentication and uses the insecure pickle.loads() function to deserialize incoming messages, permitting arbitrary code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to the host system. An attacker can achieve remote code execution (RCE) with the privileges of the KTransformers service, leading to total system compromise, data exfiltration, and potential persistence within the host environment.

Remediation Plan

Immediate Action: Update KTransformers to the latest version. If immediate patching is not possible, restrict access to the ZMQ socket to authorized hosts using host-based firewalls or network access control lists.

Proactive Monitoring: Monitor network traffic for unauthorized connections to the ZMQ socket port and inspect logs for abnormal pickle-related error messages.

Compensating Controls: Ensure the application is running with the least privilege necessary and deploy network segmentation to isolate the KTransformers backend from untrusted segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on insecure deserialization in an unauthenticated network service makes this a high-priority vulnerability. Users must update the software immediately and ensure that network-facing services are properly hardened against unauthorized access.

---METADATA---
VENDOR: ADB Explorer
PRODUCT: ADB Explorer
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
ADB Explorer, a fluent UI for ADB on Windows, contains a high-severity vulnerability that could lead to unauthorized system access or data manipulation.

Executive Summary:
ADB Explorer for Windows is affected by a high-severity vulnerability that could allow for unauthorized access to connected devices or the host system.

Vulnerability Details

CVE-ID: CVE-2026-26208

Affected Software: ADB Explorer

Affected Versions: See vendor advisory for affected versions

Vulnerability: The specific nature of this vulnerability is currently undisclosed, but the CVSS score of 7.8 indicates a high-risk security flaw. Given the application's function, it likely involves insecure handling of ADB commands or local privilege escalation.

Business Impact

A successful exploit could allow an attacker to gain unauthorized access to Android devices connected to the Windows host or potentially escalate privileges on the host machine itself. This poses a risk to sensitive data stored on mobile devices and the security of the developer workstation.

Remediation Plan

Immediate Action: Update ADB Explorer to the most recent version available and limit the use of the tool to trusted administrative users.

Proactive Monitoring: Monitor for unusual ADB traffic or unauthorized attempts to access the ADB daemon on Windows workstations.

Compensating Controls: Ensure that "USB Debugging" is disabled on mobile devices when not actively in use to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, no active exploitation has been reported. Users should remain vigilant and apply updates as they become available from the project maintainers.

Analyst Recommendation

Due to the high severity score, users of ADB Explorer should prioritize updating the software. Until a patch is confirmed, exercise caution when connecting devices to workstations running this software.

---METADATA---
VENDOR: Ormar
PRODUCT: Ormar ORM
AFFECTED_VERSIONS: 0.9.9 through 0.22.0
---END_METADATA---

Description Summary:
Ormar ORM aggregate queries lack sanitization in min() and max() methods, allowing unauthenticated attackers to inject raw SQL and extract entire database contents via subqueries.

Executive Summary:
A critical SQL injection vulnerability in the Ormar ORM for Python allows unauthenticated attackers to exfiltrate sensitive database contents by manipulating aggregate query parameters.

Vulnerability Details

CVE-ID: CVE-2026-26198

Affected Software: Ormar ORM

Affected Versions: 0.9.9 through 0.22.0

Vulnerability: This SQL injection flaw occurs because user-supplied column names are passed directly into sqlalchemy.text() without validation. An unauthenticated attacker can exploit the min() and max() methods to embed raw SQL subqueries into aggregate function calls.

Business Impact

Successful exploitation allows an unauthorized actor to read the entire database, including tables completely unrelated to the application's models. Given the CVSS score of 9.8, this represents a near-total loss of data confidentiality and could lead to significant regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Administrators must upgrade the Ormar package to version 0.23.0 or later immediately to resolve the unsanitized SQL construction.

Proactive Monitoring: Review database logs for unusual subqueries within aggregate functions and monitor for unexpected data egress patterns.

Compensating Controls: Implement strict input validation at the application layer to ensure only known-good column names are passed to aggregate methods.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of injecting SQL via standard ORM methods, the potential for exploitation is extremely high for any application exposing these aggregate functions to user input.

Analyst Recommendation

This vulnerability is categorized as Critical due to the lack of authentication required and the high impact on data confidentiality. Organizations using affected versions of Ormar must prioritize the update to version 0.23.0 to mitigate the risk of full database compromise.