---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the REST WebServices component of Oracle Identity Manager may allow for unauthorized manipulation of API-based identity services.

Executive Summary:
Oracle Identity Manager contains a high-severity vulnerability in its REST WebServices component, creating risks for API-based identity operations.

Vulnerability Details

CVE-ID: CVE-2026-35267

Affected Software: Oracle Identity Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the REST WebServices interface of the Identity Manager. The flaw potentially allows for improper input handling or authentication bypass within the API layer, which could be leveraged to interact with the service in an unauthorized manner.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a severe threat to the integrity of automated identity processes. An attacker could potentially disrupt identity workflows, exfiltrate user data, or perform unauthorized administrative actions through the exposed API endpoints.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Oracle to the affected Identity Manager environment.

Proactive Monitoring: Analyze API access logs for anomalous requests, unexpected HTTP status codes, or patterns indicative of fuzzing or injection attempts.

Compensating Controls: Utilize an API Gateway to enforce strict schema validation and rate limiting on all REST WebServices endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

API-based vulnerabilities are increasingly common and often overlooked. It is imperative to patch the Identity Manager promptly to prevent attackers from exploiting the REST interface to bypass core security controls.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Identity Manager component of Oracle Fusion Middleware could be exploited to compromise identity management processes.

Executive Summary:
A high-severity vulnerability in Oracle Identity Manager could lead to the compromise of sensitive identity-related security controls.

Vulnerability Details

CVE-ID: CVE-2026-35265

Affected Software: Oracle Identity Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Security component of the Identity Manager. It represents a significant flaw in how the software manages or enforces security policies, potentially allowing for privilege escalation or identity-based attacks.

Business Impact

The CVSS score of 8.8 underscores the criticality of this vulnerability, as Identity Manager is a central component for access control. Successful exploitation could grant attackers the ability to manipulate user identities, escalate privileges, or bypass authentication mechanisms across the enterprise.

Remediation Plan

Immediate Action: Apply the relevant vendor security updates to all Oracle Identity Manager instances immediately.

Proactive Monitoring: Audit logs for unusual identity provisioning or modification activities that deviate from standard operational patterns.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and ensure all administrative actions within the Identity Manager are logged and reviewed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize patching this vulnerability, as it directly impacts the foundation of organizational access control. Failure to remediate could allow attackers to gain persistent, elevated access to sensitive corporate resources.

---METADATA---
VENDOR: Oracle
PRODUCT: Fusion Middleware
AFFECTED_VERSIONS: 14.1.2.0.0 and 15.1.1.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebLogic Server allows low-privileged attackers to gain full system control via HTTP.

Executive Summary:
A critical vulnerability in Oracle WebLogic Server permits low-privileged users to achieve full system takeover, requiring urgent mitigation.

Vulnerability Details

CVE-ID: CVE-2026-35263

Affected Software: Oracle Fusion Middleware (WebLogic Server)

Affected Versions: 14.1.2.0.0 and 15.1.1.0.0

Vulnerability: This vulnerability resides in the Core component of WebLogic Server and is accessible to low-privileged attackers via HTTP. Exploitation can lead to a full system takeover and may impact other products due to scope change.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely severe. An attacker with minimal access can escalate their privileges to take over the WebLogic Server, which often serves as a critical infrastructure component. This could lead to a total breakdown of internal services and unauthorized data access.

Remediation Plan

Immediate Action: Apply the Oracle June 2026 Critical Security Patch Update to all affected WebLogic Server environments.

Proactive Monitoring: Audit user privileges and monitor for unusual activity originating from low-privileged accounts or unexpected service calls.

Compensating Controls: Use network-level controls to restrict access to WebLogic Server administrative interfaces and implement WAF rules to filter potentially malicious requests.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability, combined with its potential for full system takeover, necessitates immediate action. Organizations must prioritize applying the June 2026 Critical Security Patch to all WebLogic Server instances to prevent exploitation by malicious actors.

---METADATA---
VENDOR: Oracle
PRODUCT: Data Integrator
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Oracle Data Integrator contains a vulnerability in its Market Place component that may allow for unauthorized system interaction or compromise.

Executive Summary:
A high-severity vulnerability in the Oracle Data Integrator component of Fusion Middleware poses a risk of unauthorized access and potential system exploitation.

Vulnerability Details

CVE-ID: CVE-2026-35262

Affected Software: Oracle Data Integrator

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Market Place component of the Oracle Data Integrator product within the Fusion Middleware suite. The nature of the flaw suggests potential weaknesses in component integration that could be leveraged for unauthorized operations.

Business Impact

The CVSS score of 8.3 underscores the criticality of this vulnerability, as it affects a core data integration tool. A successful exploit could lead to data manipulation, unauthorized access to sensitive integration pipelines, or broader compromise of the middleware environment, leading to significant operational downtime.

Remediation Plan

Immediate Action: Apply the latest security patches for Oracle Data Integrator and the associated Fusion Middleware stack as provided by the vendor.

Proactive Monitoring: Audit logs related to the Data Integrator Market Place for signs of unauthorized deployment or unexpected execution of integration workflows.

Compensating Controls: Implement strict network segmentation and egress filtering to ensure that the Data Integrator instance cannot be reached by unauthorized internal or external actors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the sensitive nature of data integration tools, immediate patching is required. Security teams should prioritize this update to ensure the security of their data pipelines and the overall integrity of their Fusion Middleware ecosystem.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unspecified vulnerability exists in the Console component of Oracle WebLogic Server, which may allow for unauthorized access or system impact.

Executive Summary:
Oracle WebLogic Server contains a high-severity vulnerability in the Console component that could lead to unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-35259

Affected Software: Oracle WebLogic Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the administrative Console component of WebLogic Server. While specific authentication requirements are not detailed, vulnerabilities in this component often impact the management interface and may be reachable by authenticated attackers or via misconfigured environments.

Business Impact

With a CVSS score of 8.8, this flaw presents a substantial risk to critical infrastructure. Exploitation could allow an attacker to bypass security controls, potentially resulting in unauthorized administrative access, service disruption, or data breach within the application server environment.

Remediation Plan

Immediate Action: Apply the latest Critical Patch Update (CPU) provided by Oracle to address this vulnerability.

Proactive Monitoring: Review WebLogic administrative access logs for unauthorized login attempts or unusual configuration changes performed via the Console.

Compensating Controls: Restrict access to the WebLogic Console to trusted administrative IP ranges and ensure the interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Oracle Fusion Middleware products are frequent targets for enterprise-level attacks. Organizations should verify their current versioning and apply the necessary security patches to ensure that the administrative console remains protected against unauthorized manipulation.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server (Fusion Middleware)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Console component of the WebLogic Server product within Oracle Fusion Middleware.

Executive Summary:
A high-severity vulnerability in Oracle WebLogic Server could allow an authenticated attacker to gain unauthorized control over the server's management console.

Vulnerability Details

CVE-ID: CVE-2026-35258

Affected Software: Oracle WebLogic Server (Fusion Middleware)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the WebLogic Console component. It requires an attacker to have authenticated access, which may be misused to escalate privileges or perform unauthorized administrative actions on the middleware server.

Business Impact

With a CVSS score of 8.7, this vulnerability presents a significant risk to the integrity of the application server environment. Successful exploitation could allow an attacker to disrupt services, access sensitive configuration data, or deploy malicious applications within the middleware stack, leading to widespread system compromise.

Remediation Plan

Immediate Action: Apply the latest Oracle Critical Patch Update (CPU) for WebLogic Server to remediate the vulnerability in the Console component.

Proactive Monitoring: Review WebLogic administrative access logs for unauthorized or unexpected configuration changes and monitor for unusual login patterns.

Compensating Controls: Restrict access to the WebLogic Administration Console to authorized administrative IP addresses using network-level access control lists (ACLs).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity of the flaw makes it an attractive target for attackers seeking to gain control over middleware infrastructure.

Analyst Recommendation

WebLogic servers are critical infrastructure components. It is imperative that administrators apply the relevant vendor patches immediately and ensure that the administrative console is not exposed to untrusted networks.

---METADATA---
VENDOR: Mattermost
PRODUCT: Plugin Legal Hold
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Mattermost Plugin Legal Hold allows for potential security bypasses in version 1 and earlier.

Executive Summary:
The Mattermost Plugin Legal Hold is affected by a high-severity vulnerability that could facilitate unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3524

Affected Software: Mattermost Plugin Legal Hold

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Legal Hold plugin for Mattermost, potentially allowing an attacker to bypass intended security controls. The flaw may allow unauthorized access to sensitive legal hold data depending on the authentication context.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive legal records stored within the Mattermost environment. With a CVSS score of 8.8, this poses a substantial risk to legal compliance and organizational confidentiality.

Remediation Plan

Immediate Action: Update the Legal Hold plugin to the latest available version provided by Mattermost.

Proactive Monitoring: Review audit logs for unauthorized access to the Legal Hold plugin or export functions.

Compensating Controls: Limit access to the Legal Hold plugin functionality to a restricted set of authorized users using role-based access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates immediate attention to ensure sensitive legal data remains protected.

Analyst Recommendation

Organizations utilizing the Mattermost Legal Hold plugin must update to the latest version immediately to mitigate this high-risk vulnerability. Ensuring that security patches are applied promptly is critical for maintaining data integrity.

---METADATA---
VENDOR: Oracle
PRODUCT: MCP Server Helper Tool
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Oracle MCP Server Helper Tool component of Oracle Open Source Projects.

Executive Summary:
A high-severity vulnerability in the Oracle MCP Server Helper Tool may allow for unauthorized system interaction, necessitating immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-35228

Affected Software: Oracle MCP Server Helper Tool

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the helper tool component of the Oracle MCP Server. The specific nature of the flaw requires further technical disclosure from the vendor, but users should assume the potential for unauthorized access or execution within the environment.

Business Impact

With a CVSS score of 8.7, this vulnerability is classified as High. Successful exploitation could lead to unauthorized system access, potential data compromise, or service disruption, significantly impacting operational continuity and security posture.

Remediation Plan

Immediate Action: Review the official Oracle security advisory for patch availability and apply all recommended updates to the MCP Server environment.

Proactive Monitoring: Monitor server access logs for anomalous behavior or unauthorized process execution originating from the helper tool.

Compensating Controls: Restrict network access to the affected service using internal firewalls to limit the attack surface while awaiting patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Given the High severity rating, organizations should treat this as a priority update. Ensure that all instances of the Oracle MCP Server Helper Tool are identified and patched as soon as the vendor releases the necessary security updates.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Budibase platform could allow for unauthorized actions, potentially leading to a breach of the application environment.

Executive Summary:
The Budibase low-code platform contains a high-severity flaw that may allow attackers to bypass security controls and access sensitive application data.

Vulnerability Details

CVE-ID: CVE-2026-35218

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the Budibase open-source platform. Based on the high CVSS score of 8.7, it is likely that the flaw permits an attacker to perform high-impact actions, such as bypassing capability checks or executing unauthorized commands within the application context.

Business Impact

A breach of a Budibase instance could result in the loss of critical business data and the disruption of automated workflows. Because these platforms often integrate with multiple third-party services, an attacker could potentially use this vulnerability to move laterally into other connected systems. The high CVSS score underscores the urgent need for remediation.

Remediation Plan

Immediate Action: Update Budibase to the latest version provided by the vendor to address this security vulnerability.

Proactive Monitoring: Monitor database query logs and API request patterns for any signs of anomalous behavior or unauthorized data extraction.

Compensating Controls: Implement strong multi-factor authentication (MFA) for all Budibase users and restrict administrative privileges to the minimum necessary personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, the risk remains high due to the functional power of the affected platform.

Analyst Recommendation

It is critical to apply the vendor's security updates immediately. Given the potential for high-impact data compromise, security teams should verify the update across all Budibase deployments to ensure the environment is fully protected against this flaw.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to version 3.33.4
---END_METADATA---

Description Summary:
Budibase versions prior to 3.33.4 contain an unauthenticated Remote Code Execution (RCE) flaw. Attackers can trigger Bash-based automations via a public webhook to execute commands as root.

Executive Summary:
Budibase is vulnerable to a critical unauthenticated remote code execution flaw that allows attackers to execute arbitrary commands as the root user via public webhooks.

Vulnerability Details

CVE-ID: CVE-2026-35216

Affected Software: Budibase Budibase

Affected Versions: Prior to version 3.33.4

Vulnerability: This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution (RCE) by triggering a specific automation containing a Bash step through the public webhook endpoint. The exploit requires no authentication and executes with root privileges within the server container.

Business Impact

A successful exploit results in the total compromise of the Budibase server, allowing attackers to steal sensitive data, modify applications, or move laterally within the network. The CVSS score of 9.0 reflects the critical nature of unauthenticated root-level access. Organizations may face significant data breaches and operational downtime if this vulnerability is exploited.

Remediation Plan

Immediate Action: Update Budibase to version 3.33.4 or later immediately to patch the vulnerable automation logic.

Proactive Monitoring: Monitor access logs for unusual requests to the public webhook endpoint and review container logs for unexpected Bash execution.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to webhook endpoints to known, trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—specifically the lack of authentication and root execution—the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, as it grants full system control to unauthenticated remote actors. IT teams must prioritize the update to Budibase version 3.33.4 immediately. Failure to patch leaves the entire low-code environment and its underlying data exposed to complete takeover.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Budibase open-source low-code platform that could lead to unauthorized access or system compromise.

Executive Summary:
Budibase is affected by a high-severity vulnerability that could allow attackers to compromise the low-code application environment and its associated data.

Vulnerability Details

CVE-ID: CVE-2026-35214

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Budibase platform, though the specific technical mechanism is not detailed in the summary. Given the CVSS score of 8.7, it likely involves a flaw in authentication, access control, or remote code execution within the application framework.

Business Impact

As a low-code platform, Budibase often handles sensitive business logic and data integrations. A compromise could lead to the exposure of proprietary application data, unauthorized modification of business workflows, and potential access to connected databases. The CVSS score of 8.7 indicates a high risk to the confidentiality and integrity of the platform.

Remediation Plan

Immediate Action: Administrators should update their Budibase instances to the latest secure version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review application access logs for unusual login activity or unauthorized changes to application schemas and configurations.

Compensating Controls: Ensure that Budibase is deployed behind a robust Web Application Firewall (WAF) and that network access is restricted to authorized IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the popularity of Budibase in corporate environments makes it an attractive target for attackers.

Analyst Recommendation

Apply the primary remediation patch immediately. Organizations utilizing Budibase for critical business functions should prioritize this update to prevent unauthorized access to their low-code applications and underlying data sources.

---METADATA---
VENDOR: Apache
PRODUCT: Flink
AFFECTED_VERSIONS: 1.15.0 up to (excluding) 1.20.4, 2.0.2, 2.1.2, 2.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache Flink is vulnerable to code injection during SQL code generation, which can be exploited by authenticated users to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in Apache Flink allows authenticated attackers to execute arbitrary code via the SQL interface.

Vulnerability Details

CVE-ID: CVE-2026-35194

Affected Software: Apache Flink

Affected Versions: 1.15.0 up to (excluding) 1.20.4, 2.0.2, 2.1.2, 2.2.1

Vulnerability: This is a code injection vulnerability (CWE-94) in the SQL code generation component of Apache Flink. It requires an attacker to have authenticated access to the system to trigger the injection through specially crafted SQL queries.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary code within the context of the Flink service, potentially leading to full system compromise, data theft, or lateral movement within the network. Given the CVSS score of 8.1, the impact is severe, particularly in environments where Flink processes sensitive data or has high-level system permissions.

Remediation Plan

Immediate Action: Upgrade to Apache Flink versions 1.20.4, 2.0.2, 2.1.2, or 2.2.1 to resolve the code generation flaw.

Proactive Monitoring: Monitor SQL query logs for unusual syntax or patterns that may indicate attempts to inject code into the generation process.

Compensating Controls: Restrict access to the Flink SQL interface to trusted users only and implement strict network segmentation to limit the reach of a potential compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication reduces the attack surface but does not eliminate the risk from malicious or compromised internal accounts.

Analyst Recommendation

Given the potential for remote code execution, organizations using Apache Flink must apply the provided security updates as a matter of urgency. Ensure that internal access controls are strictly enforced to minimize the risk of exploitation by unauthorized or compromised users.

---METADATA---
VENDOR: Chyrp Lite
PRODUCT: Chyrp Lite
AFFECTED_VERSIONS: Prior to 2026.01
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Chyrp Lite administration console allows authenticated users to access arbitrary files and achieve remote code execution.

Executive Summary:
Chyrp Lite is vulnerable to a critical path traversal flaw that allows authenticated users to overwrite system files and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-35174

Affected Software: Chyrp Lite

Affected Versions: Prior to 2026.01

Vulnerability: The administration console contains a path traversal vulnerability that permits users with 'Change Settings' permissions to modify the uploads path. This can be abused to read sensitive files, such as config.json.php, to extract database credentials, or to overwrite system files to achieve remote code execution.

Business Impact

Given the CVSS score of 9.1, this vulnerability is critical. An attacker with minimal administrative access can escalate their privileges to full system compromise, resulting in complete data exposure and loss of control over the blogging engine.

Remediation Plan

Immediate Action: Update Chyrp Lite to version 2026.01 or later immediately.

Proactive Monitoring: Review file integrity logs for unauthorized modifications to core system files and monitor access logs for attempts to traverse directories in the configuration path.

Compensating Controls: Restrict administrative access to the blogging engine to trusted internal IP addresses and enforce the principle of least privilege for all user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for total system compromise makes it a high-risk issue.

Analyst Recommendation

All administrators of Chyrp Lite must upgrade to the latest version immediately. The ability to achieve remote code execution via this flaw makes it a primary target for attackers, and rapid patching is necessary to maintain system security.

---METADATA---
VENDOR: Kedro
PRODUCT: Kedro
AFFECTED_VERSIONS: Prior to 1.3.0
---END_METADATA---

Description Summary:
Kedro is vulnerable to remote code execution due to unvalidated logging configuration paths that permit arbitrary callable instantiation.

Executive Summary:
A critical remote code execution vulnerability in Kedro allows attackers to execute arbitrary system commands via maliciously crafted logging configurations.

Vulnerability Details

CVE-ID: CVE-2026-35171

Affected Software: Kedro

Affected Versions: Prior to 1.3.0

Vulnerability: The application loads logging configurations from a user-controlled environment variable (KEDRO_LOGGING_CONFIG) without validation. The configuration schema allows for arbitrary callable instantiation, which an attacker can exploit to execute system commands.

Business Impact

Exploitation of this vulnerability grants the attacker the ability to execute code with the permissions of the Kedro process. This can lead to total system takeover, data exfiltration, and lateral movement within the production environment, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Upgrade Kedro to version 1.3.0 or later to ensure logging configurations are properly validated.

Proactive Monitoring: Monitor system logs and process execution for unexpected child processes spawned by the Kedro application.

Compensating Controls: Restrict the ability of external users to set environment variables on systems running Kedro and implement OS-level hardening.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to achieve remote code execution makes this a high-priority risk. Administrators must update to the patched version of Kedro immediately to close this execution vector and protect the integrity of the data science environment.

---METADATA---
VENDOR: OpenSTAManager
PRODUCT: OpenSTAManager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the OpenSTAManager technical assistance and invoicing software.

Executive Summary:
Security teams must address a critical vulnerability in OpenSTAManager to prevent potential unauthorized access to sensitive invoicing and support data.

Vulnerability Details

CVE-ID: CVE-2026-35168

Affected Software: OpenSTAManager OpenSTAManager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the OpenSTAManager platform. The flaw, rated at 8.8 on the CVSS scale, likely involves a lack of proper validation or authorization checks, potentially allowing an attacker to manipulate core system functions or access restricted data.

Business Impact

The exploitation of this vulnerability could result in unauthorized access to sensitive business records, including technical support logs and invoicing data. Given the 8.8 CVSS score, the risk to the confidentiality and integrity of business operations is substantial, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update OpenSTAManager to the latest version released by the vendor to address the identified security flaw.

Proactive Monitoring: Review audit logs for unauthorized attempts to access or modify invoicing records and monitor for unusual spikes in traffic.

Compensating Controls: Deploy WAF rules to detect and block malicious payloads that attempt to bypass application-level access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability dictates that it should be treated as a high-priority task. IT administrators should verify the status of their OpenSTAManager installation and apply all vendor-recommended security updates to mitigate the risk of compromise.

---METADATA---
VENDOR: Apache
PRODUCT: Fineract
AFFECTED_VERSIONS: 0 through 1.14.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Apache Fineract Report Execution API (runreports endpoint) allows authenticated users to execute arbitrary SQL commands.

Executive Summary:
A high-severity SQL injection vulnerability in Apache Fineract allows authenticated attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-35152

Affected Software: Apache Fineract

Affected Versions: 0 through 1.14.0

Vulnerability: The application fails to properly sanitize user-supplied input within the Report Execution API. This flaw allows an authenticated attacker to perform SQL injection, potentially leading to unauthorized data access or modification.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, which may contain sensitive financial or user data. Given the CVSS score of 8.8, the potential for unauthorized data exfiltration or corruption poses a significant risk to organizational data integrity and compliance requirements.

Remediation Plan

Immediate Action: Upgrade to the latest version of Apache Fineract as specified by the vendor's security advisory and ensure that the report execution functionality is properly restricted.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax or queries originating from the runreports endpoint that deviate from standard operational behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application APIs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full database access by an authenticated attacker.

Analyst Recommendation

Given the high CVSS score and the direct impact on database security, administrators should prioritize patching this vulnerability immediately. Ensure all authenticated users are audited and that database permissions follow the principle of least privilege to minimize potential damage.

---METADATA---
VENDOR: HCL Software
PRODUCT: DFXServer
AFFECTED_VERSIONS: 2.5 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HCL DFXServer is susceptible to an authentication bypass vulnerability, enabling remote attackers to manipulate server responses to gain unauthorized access.

Executive Summary:
An authentication bypass vulnerability in HCL DFXServer allows remote attackers to compromise system access via server response manipulation.

Vulnerability Details

CVE-ID: CVE-2026-35149

Affected Software: HCL Software DFXServer

Affected Versions: 2.5 and below

Vulnerability: This is an authentication bypass by capture-replay (CWE-294) vulnerability. It allows an unauthenticated remote attacker to bypass security checks by manipulating server responses.

Business Impact

An attacker successfully exploiting this vulnerability can gain unauthorized access to the DFXServer, potentially leading to the compromise of sensitive data or the manipulation of application logic. Given the CVSS score of 8.2, this vulnerability poses a severe risk to the confidentiality and integrity of the application environment.

Remediation Plan

Immediate Action: Update the HCL DFXServer to the latest patched version recommended by the vendor.

Proactive Monitoring: Monitor network traffic and server response logs for anomalous patterns that suggest tampering or replay attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate server responses and block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: No (no weaponized exploit confirmed).

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to its remote, unauthenticated nature.

Analyst Recommendation

The ability for an unauthenticated attacker to bypass authentication makes this a high-priority issue. Administrators should ensure that the HCL DFXServer is updated to the latest version immediately to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: HCL
PRODUCT: DFXServer
AFFECTED_VERSIONS: Version 2.5 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HCL DFXServer is vulnerable to a broken authentication flaw, allowing unauthenticated attackers to bypass security controls via direct API access.

Executive Summary:
An unauthenticated authorization bypass vulnerability in HCL DFXServer permits unauthorized API access, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-35147

Affected Software: HCL DFXServer

Affected Versions: Version 2.5 and below

Vulnerability: This vulnerability is an authorization bypass (CWE-639) occurring within the API management interface. The flaw allows unauthenticated remote attackers to interact with protected API endpoints by manipulating user-controlled keys.

Business Impact

The ability for an unauthenticated actor to interact with the API can lead to unauthorized data exposure and potential manipulation of internal server functions. Given the CVSS score of 8.2, this vulnerability represents a high risk to business operations, as it could facilitate the exfiltration of sensitive information or the unauthorized modification of system data.

Remediation Plan

Immediate Action: Upgrade to a version of HCL DFXServer that addresses this vulnerability, as specified in the HCL support documentation.

Proactive Monitoring: Review API access logs for anomalous request patterns or unauthorized authentication attempts directed at sensitive endpoints.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict direct API access to known, trusted IP addresses until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and high impact on confidentiality.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation over the network without requiring authentication. Organizations using HCL DFXServer must prioritize upgrading to the latest secure version immediately to close this authorization gap and prevent unauthorized system access.

---METADATA---
VENDOR: GDV
PRODUCT: serverconfig
AFFECTED_VERSIONS: Prior to version 6_0_0_7
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the gdv-serverconfig component allows a remote, authenticated user to achieve full system compromise with root-level privileges.

Executive Summary:
A critical stack-based buffer overflow in gdv-serverconfig permits remote attackers with user privileges to execute arbitrary code with root-level access.

Vulnerability Details

CVE-ID: CVE-2026-35085

Affected Software: GDV serverconfig

Affected Versions: Prior to version 6_0_0_7

Vulnerability: This vulnerability, classified as CWE-121, involves a stack-based buffer overflow within the gdv-serverconfig utility. It allows a remote attacker who has already obtained standard user privileges to trigger a memory corruption event, ultimately leading to unauthorized full system access as the root user.

Business Impact

The exploitation of this vulnerability poses a severe threat to system integrity and confidentiality. With a CVSS score of 8.8, this high-severity flaw enables an attacker to bypass standard security boundaries, potentially resulting in complete system takeover, data exfiltration, and the installation of persistent malicious backdoors.

Remediation Plan

Immediate Action: Update the gdv-serverconfig component to version 6_0_0_7 or later as specified in the vendor advisory (certvde.com/VDE-2026-039).

Proactive Monitoring: Audit system logs for unauthorized configuration changes or attempts to invoke root-level processes by standard user accounts.

Compensating Controls: Implement strict access control lists (ACLs) to limit which users can interact with the serverconfig service, reducing the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability to escalate privileges to root, this vulnerability represents a significant risk to organizational infrastructure. Administrators should prioritize patching affected systems to version 6_0_0_7 immediately to prevent potential privilege escalation.

---METADATA---
VENDOR: Unknown
PRODUCT: dali-devconfig
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack buffer overflow in the dali-devconfig utility allows authenticated users to execute arbitrary code with root privileges.

Executive Summary:
A critical stack buffer overflow in the dali-devconfig utility allows an authenticated attacker to manipulate input parameters and execute arbitrary code with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-35084

Affected Software: dali-devconfig

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack buffer overflow occurring within the dali-devconfig utility. By providing specially crafted input parameters, an authenticated user can trigger the overflow to execute arbitrary code with root privileges.

Business Impact

The CVSS score of 8.8 indicates a severe risk. Exploitation allows an authenticated user to completely compromise the underlying system, leading to unauthorized control, data theft, and potential disruption of services managed by the affected utility.

Remediation Plan

Immediate Action: Apply security updates provided by the vendor as outlined in the official advisory (VDE-2026-039).

Proactive Monitoring: Review system access logs for suspicious input provided to the dali-devconfig utility and monitor for unexpected service restarts or unauthorized code execution.

Compensating Controls: Restrict access to the dali-devconfig utility to authorized administrators only, and use host-based intrusion prevention systems to detect buffer overflow attempts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for arbitrary code execution with root privileges, it presents a significant threat. Administrators must review the vendor advisory (VDE-2026-039) and apply the recommended patches immediately to mitigate the risk of system-level compromise.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack buffer overflow vulnerability exists that allows a remote attacker with existing user privileges to elevate their access to full system root privileges.

Executive Summary:
A stack buffer overflow vulnerability allows a remote attacker with user-level access to escalate their permissions to full system root access.

Vulnerability Details

CVE-ID: CVE-2026-35083

Affected Software: Multiple Products (See vendor advisory)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a stack buffer overflow vulnerability. It requires an attacker to already possess authenticated user privileges, which they then exploit to gain full system-level access as root.

Business Impact

The CVSS score of 8.8 reflects the high risk of complete system takeover. While the vulnerability requires initial user access, the ability to escalate to root privileges allows an attacker to bypass all system security controls, access sensitive data, and maintain long-term persistence within the environment.

Remediation Plan

Immediate Action: Identify affected products in your environment and apply vendor-provided security patches immediately.

Proactive Monitoring: Monitor system logs for signs of unauthorized privilege escalation or unusual crashes of system services that may indicate exploit attempts.

Compensating Controls: Implement the principle of least privilege to ensure that standard user accounts have the minimum access necessary, thereby reducing the impact of a potential escalation attempt.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to gain root access makes this a high-priority vulnerability. Organizations should conduct a thorough inventory of their software to determine if any products are impacted and coordinate with vendors to apply the necessary security updates to prevent privilege escalation.

---METADATA---
VENDOR: Unknown
PRODUCT: ugw-logread
AFFECTED_VERSIONS: Prior to version 6_0_0_7
---END_METADATA---

Description Summary:
The ugw-logread method contains a path traversal vulnerability that allows authenticated remote attackers to access arbitrary local files.

Executive Summary:
An authenticated remote attacker can exploit a path traversal vulnerability in the ugw-logread method to access sensitive local system files.

Vulnerability Details

CVE-ID: CVE-2026-35082

Affected Software: ugw-logread

Affected Versions: Prior to version 6_0_0_7

Vulnerability: This vulnerability is classified as a Path Traversal (CWE-22) flaw occurring in the ugw-logread method. By failing to sufficiently validate user-supplied input, the application allows an attacker with user privileges to escape intended directory boundaries and read sensitive files from the underlying filesystem.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a significant risk of data exposure. An attacker could leverage this access to retrieve configuration files, credentials, or other sensitive system data, which could facilitate further lateral movement or complete system compromise.

Remediation Plan

Immediate Action: Update the affected component to version 6_0_0_7 or later as outlined in the vendor advisory (certvde.com/VDE-2026-036).

Proactive Monitoring: Review application logs for suspicious input patterns, particularly those containing directory traversal sequences (e.g., "../").

Compensating Controls: Use a Web Application Firewall (WAF) configured to inspect and block inputs containing path traversal characters directed at the logread utility.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to read arbitrary files is a critical security failure. Administrators must apply the vendor-supplied patch to version 6_0_0_7 immediately to prevent unauthorized access to sensitive local system data.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can recover a hardcoded password from a firmware image to gain full device access.

Executive Summary:
A critical security flaw allows unauthenticated remote attackers to extract hardcoded credentials from firmware images, granting full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-35075

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves the presence of hardcoded, default credentials within firmware images. An unauthenticated attacker can retrieve these credentials remotely, bypassing authentication mechanisms and gaining full access to the affected hardware devices.

Business Impact

The CVSS score of 9.8 reflects the high risk of unauthorized administrative access. This can lead to total system takeover, unauthorized configuration changes, and the potential for the device to be used as a pivot point for further attacks within the internal network.

Remediation Plan

Immediate Action: Update the affected device firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized administrative login attempts or anomalous behavior originating from devices known to be susceptible to this issue.

Compensating Controls: Isolate vulnerable devices in a restricted network segment and ensure administrative interfaces are not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Firmware-level vulnerabilities are particularly dangerous as they often bypass standard application-layer security. Administrators must verify device firmware versions and apply patches immediately to eliminate the risk of hardcoded credential extraction.

---METADATA---
VENDOR: Dell
PRODUCT: PowerScale InsightIQ
AFFECTED_VERSIONS: 0 up to (excluding) 6.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dell PowerScale InsightIQ is susceptible to an OS Command Injection vulnerability, allowing an authenticated attacker with high privileges to execute arbitrary commands on the underlying system.

Executive Summary:
An OS Command Injection vulnerability in Dell PowerScale InsightIQ allows authenticated attackers with high privileges to execute arbitrary commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35071

Affected Software: Dell PowerScale InsightIQ

Affected Versions: 0 up to (excluding) 6.3.0

Vulnerability: The application is vulnerable to OS Command Injection (CWE-78) due to improper neutralization of special elements. Based on the CVSS vector (PR:H), this requires an authenticated user with high-level administrative privileges to trigger.

Business Impact

The ability to execute arbitrary OS commands poses a critical risk to the confidentiality, integrity, and availability of the PowerScale environment. Given the CVSS score of 8.2, a successful exploit could allow an attacker to gain full control over the management appliance, leading to unauthorized data access, system disruption, and lateral movement within the network.

Remediation Plan

Immediate Action: Update Dell PowerScale InsightIQ to version 6.3.0 or later as specified in the vendor security advisory.

Proactive Monitoring: Review system and audit logs for unexpected process execution or unusual command-line activity originating from the InsightIQ service account.

Compensating Controls: Ensure that access to the InsightIQ management interface is restricted to authorized administrative personnel only, utilizing network-level access controls to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is 8.2, the requirement for high privileges mitigates the risk from external, unauthenticated attackers.

Analyst Recommendation

Organizations utilizing Dell PowerScale InsightIQ should prioritize patching to version 6.3.0. Although the vulnerability requires high privileges, the potential for total system impact necessitates prompt remediation to prevent unauthorized administrative escalation.

---METADATA---
VENDOR: Dell
PRODUCT: PowerFlex Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Dell PowerFlex Manager is affected by a missing authentication vulnerability that allows unauthenticated attackers to perform critical functions.

Executive Summary:
Dell PowerFlex Manager contains a critical missing authentication vulnerability that permits unauthenticated remote attackers to execute sensitive operations, risking total system control.

Vulnerability Details

CVE-ID: CVE-2026-35065

Affected Software: Dell PowerFlex Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a missing authentication for critical function vulnerability. It allows an unauthenticated attacker to interact with sensitive system functions that should otherwise require valid administrative credentials.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for unauthorized access to management functions without authentication. This could lead to complete administrative takeover of the PowerFlex environment, resulting in data loss, hardware manipulation, and severe operational downtime for enterprise storage infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware or software updates for PowerFlex Manager as soon as they become available.

Proactive Monitoring: Implement strict network segmentation to isolate the management interface and monitor for unauthorized connection attempts or unusual administrative activity.

Compensating Controls: Utilize a VPN or jump host to restrict access to the PowerFlex management interface, ensuring it is not exposed to the public internet or untrusted network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of missing authentication in infrastructure management software, immediate remediation is required. Administrators must ensure that PowerFlex Manager instances are not accessible from untrusted networks and apply all relevant security patches immediately upon release by Dell.