---METADATA---
VENDOR: Authentik Security
PRODUCT: authentik
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in authentik, an open-source identity provider, potentially impacting authentication integrity.

Executive Summary:
The authentik identity provider is affected by a high-severity vulnerability that could jeopardize the security of organizational authentication and authorization flows.

Vulnerability Details

CVE-ID: CVE-2026-25748

Affected Software: Authentik Security authentik

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This entry identifies a high-severity vulnerability within the authentik identity provider platform. While the specific technical mechanism (e.g., bypass or injection) is not detailed in the summary, the vulnerability directly impacts the software responsible for managing user identities and access controls.

Business Impact

As an identity provider, authentik serves as the gatekeeper for an organization's applications and data. A vulnerability with a CVSS score of 8.6 indicates a High severity risk where a successful exploit could lead to unauthorized access to multiple integrated services. This poses a severe risk of data exfiltration, identity theft, and significant reputational damage if the authentication chain is compromised.

Remediation Plan

Immediate Action: Update the authentik instance to the latest stable version immediately to address the identified security flaw.

Proactive Monitoring: Review authentication logs for anomalous login patterns, unauthorized administrative changes, or failed attempts to bypass multi-factor authentication.

Compensating Controls: Ensure that authentik is deployed behind a secure reverse proxy and restrict administrative interface access to known, trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, because identity providers are high-value targets for attackers seeking broad access, the urgency for patching remains critical.

Analyst Recommendation

Given the central role authentik plays in the security perimeter, this vulnerability must be treated with the highest priority. We recommend that security teams validate their current version and apply the vendor-provided patch within the next 24-48 hours. Maintaining the integrity of the identity provider is essential for the overall security posture of the enterprise.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Platform
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the Budibase low-code platform, potentially allowing unauthorized access or manipulation of internal tools and workflows.

Executive Summary:
The Budibase platform is affected by a high-severity vulnerability that could allow attackers to compromise internal administrative panels and automated workflows.

Vulnerability Details

CVE-ID: CVE-2026-25737

Affected Software: Budibase

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited in the current summary, this CVE identifies a high-severity flaw within the Budibase platform, which is used for creating internal tools and admin panels.

Business Impact

Given the CVSS score of 8.9, a successful exploit could lead to significant unauthorized access to internal business data and automation logic. This poses a high risk to organizational operations, especially if Budibase is used to manage sensitive databases or critical business workflows.

Remediation Plan

Immediate Action: Apply the latest security updates from the Budibase vendor immediately to mitigate the risk associated with this high-severity flaw.

Proactive Monitoring: Monitor for anomalous activity within the Budibase environment, such as unauthorized changes to workflows or unexpected data export requests.

Compensating Controls: Restrict access to the Budibase instance to known IP addresses and enforce multi-factor authentication (MFA) for all users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation. The high CVSS score suggests that the vulnerability likely involves a significant bypass of security controls or a high-impact data exposure.

Analyst Recommendation

Due to the critical role low-code platforms play in internal business operations, this vulnerability must be addressed urgently. Apply all available patches immediately to maintain the security of your internal application ecosystem.

---METADATA---
VENDOR: NiceGUI
PRODUCT: NiceGUI Python-based UI framework
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the NiceGUI Python-based UI framework could allow attackers to compromise the integrity of web-based user interfaces.

Executive Summary:
The NiceGUI Python framework is affected by a high-severity vulnerability that could lead to unauthorized system manipulation or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-25732

Affected Software: NiceGUI

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited, the flaw resides within the NiceGUI UI framework core. Based on the CVSS score of 7.5, the vulnerability likely involves a mechanism where an attacker can influence the UI state or execute unauthorized actions within the context of the application.

Business Impact

Exploitation of this vulnerability could lead to the exposure of internal application data or the manipulation of the user interface to deceive end-users. With a CVSS score of 7.5, this is considered a high-severity risk that could impact business operations and user trust. Organizations relying on NiceGUI for internal tools or customer-facing dashboards face a significant risk of data leakage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the NiceGUI maintainers immediately. Ensure that the Python environment is updated to use the most recent version of the library.

Proactive Monitoring: Monitor application logs for anomalous UI interactions or unexpected input patterns that deviate from standard user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming traffic and use Content Security Policy (CSP) headers to limit the impact of potential UI-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, the popularity of Python-based UI frameworks makes this an attractive target for researchers and malicious actors alike.

Analyst Recommendation

Organizations should treat this as a high-priority patching event. Given that NiceGUI is often used to build interfaces for data-heavy applications, the risk of unauthorized data access is substantial. Ensure all developers using this framework are alerted and have updated their local and production environments.

---METADATA---
VENDOR: Cloudreve
PRODUCT: Cloudreve
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Cloudreve, a self-hosted file management system, is affected by a security vulnerability that could lead to unauthorized file access or administrative compromise.

Executive Summary:
Cloudreve file management software contains a high-severity vulnerability that could allow attackers to gain unauthorized access to stored files or take control of the management system.

Vulnerability Details

CVE-ID: CVE-2026-25726

Affected Software: Cloudreve

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security flaw exists in the Cloudreve self-hosted file management system. Given the nature of the software, the vulnerability likely involves improper access control or a bypass of authentication mechanisms, potentially allowing an attacker to access files belonging to other users.

Business Impact

The impact of this vulnerability is significant, as Cloudreve is used for file sharing and management. An attacker could exfiltrate sensitive documents, delete critical data, or compromise the entire file-sharing infrastructure. The CVSS score of 8.1 indicates a High severity and a substantial risk to data confidentiality and availability.

Remediation Plan

Immediate Action: Update Cloudreve to the latest version immediately to mitigate the identified security risks.

Proactive Monitoring: Audit file access logs for unusual download activity or unauthorized attempts to access restricted directories.

Compensating Controls: Implement strong network-level access controls and ensure that the Cloudreve instance is protected by a robust authentication provider and a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, with a CVSS score of 8.1, this vulnerability is a prime candidate for exploitation.

Analyst Recommendation

Due to the high CVSS score and the sensitive nature of file management systems, this vulnerability should be addressed with the highest urgency. Applying the vendor-provided patch is critical to securing the data stored within the Cloudreve platform.

---METADATA---
VENDOR: Unknown (Network Device)
PRODUCT: Web Management Interface
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The web management interface of an unidentified network device allows administrators to set blank passwords, enabling unauthenticated administrative access via web and Telnet.

Executive Summary:
A critical configuration flaw allows for the use of empty administrative credentials, granting network-adjacent attackers full control over the device's management channels.

Vulnerability Details

CVE-ID: CVE-2026-25715

Affected Software: Unknown Network Device

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device's web management interface fails to enforce password complexity, specifically allowing the administrator username and password to be set to blank values. Once configured this way, an attacker can authenticate without credentials over both the web interface and Telnet services.

Business Impact

This vulnerability effectively removes all security barriers for the device, allowing an attacker to modify network configurations, intercept traffic, or disable the device entirely. With a CVSS score of 9.8, the risk is critical as it facilitates unauthorized administrative access with minimal effort from a network-adjacent position.

Remediation Plan

Immediate Action: Immediately configure a strong, non-blank administrative password for both the web management interface and any associated CLI services like Telnet.

Proactive Monitoring: Audit device configurations to ensure no accounts possess empty or default credentials and monitor for unauthorized logins on management ports.

Compensating Controls: Disable the Telnet service in favor of SSH and restrict access to the web management interface to a dedicated management VLAN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is primarily a result of poor configuration enforcement rather than a traditional code bug.

Analyst Recommendation

The ability to maintain administrative accounts with no password is a significant security failure. It is imperative that administrators immediately enforce password policies and update the device firmware if a patch is available to prevent the setting of blank credentials in the future.

---METADATA---
VENDOR: libzypp
PRODUCT: libzypp
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A relative path traversal vulnerability in libzypp allows attackers to manipulate repository metadata processing.

Executive Summary:
The libzypp package contains a relative path traversal vulnerability that could allow attackers to bypass file system restrictions and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-25707

Affected Software: libzypp libzypp

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a relative path traversal flaw triggered during the processing of repository metadata. An attacker could exploit this to access or overwrite files outside of the intended directory, assuming they can influence the repository metadata content.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a high risk to organizational security. Successful exploitation could lead to unauthorized file access or system-level configuration changes, potentially resulting in full system compromise or the introduction of malicious packages into the software update lifecycle.

Remediation Plan

Immediate Action: Update the libzypp package to version 17 or higher as specified by the vendor.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected modifications to repository configuration files.

Compensating Controls: Ensure that repository sources are sourced only from trusted, authenticated mirrors and utilize signed repository metadata where available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of package management software, the potential for exploitation remains high.

Analyst Recommendation

Given the central role of libzypp in system package management, the risk of supply chain-style attacks is significant. Administrators must prioritize the application of vendor-provided security patches immediately to mitigate the risk of arbitrary file manipulation.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-NU516U1
AFFECTED_VERSIONS: 20251208
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Wavlink WL-NU516U1 firmware version 20251208, posing a risk to device integrity.

Executive Summary:
The Wavlink WL-NU516U1 device running firmware version 20251208 contains a high-severity vulnerability that could allow attackers to compromise the device.

Vulnerability Details

CVE-ID: CVE-2026-2567

Affected Software: Wavlink WL-NU516U1

Affected Versions: 20251208

Vulnerability: This flaw specifically affects the 20251208 build of the Wavlink WL-NU516U1 firmware. With a CVSS score of 7.2, the vulnerability likely allows for unauthorized administrative actions or information disclosure through the device's management protocols.

Business Impact

A successful exploit could allow an attacker to gain control over the network device, leading to potential data breaches or denial-of-service conditions. This high-severity risk necessitates immediate action to maintain the security of the network perimeter and internal segments where these devices reside.

Remediation Plan

Immediate Action: Update the firmware to the newest available secure version beyond 20251208 immediately.

Proactive Monitoring: Review administrative logs for any login attempts from unknown IP addresses and monitor for unusual traffic patterns originating from the device.

Compensating Controls: Implement strong password policies for device management and use network segmentation to isolate the device from critical assets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no evidence of active exploitation. However, the high CVSS score indicates that the flaw is serious enough to be targeted by sophisticated actors.

Analyst Recommendation

The 7.2 CVSS score highlights a significant security gap. It is recommended that administrators replace or update the firmware on all affected Wavlink devices to prevent unauthorized access and potential lateral movement within the network.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-NU516U1
AFFECTED_VERSIONS: Up to 130/260
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been detected in Wavlink WL-NU516U1 devices, affecting firmware versions up to 130 and 260.

Executive Summary:
Wavlink WL-NU516U1 network devices are vulnerable to a high-severity flaw that could lead to unauthorized access or control of the network hardware.

Vulnerability Details

CVE-ID: CVE-2026-2566

Affected Software: Wavlink WL-NU516U1

Affected Versions: Up to 130/260

Vulnerability: The vulnerability in the Wavlink WL-NU516U1 involves a security flaw in the device's firmware. While the specific CWE is not listed, a CVSS score of 7.2 suggests a significant impact, likely related to improper authentication or input handling in the management interface.

Business Impact

Compromise of network hardware can lead to traffic interception, unauthorized network access, and disruption of connectivity. Given the CVSS score of 7.2, the risk to business operations is substantial, especially if these devices are used to bridge or manage sensitive network segments.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Wavlink for the WL-NU516U1 model immediately.

Proactive Monitoring: Monitor network logs for unauthorized access to the device's administrative web interface and check for unexpected configuration changes.

Compensating Controls: Disable the web management interface on the WAN side and ensure that any local management is performed over a secure, encrypted connection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, no active exploitation has been reported. Users should remain vigilant as network devices are frequent targets for botnet recruitment.

Analyst Recommendation

Organizations should immediately identify any Wavlink WL-NU516U1 devices within their environment and verify their firmware status. Applying the vendor's security updates is essential to mitigate the risk of unauthorized access to the network infrastructure.

---METADATA---
VENDOR: DataHub
PRODUCT: DataHub open-source metadata platform
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the DataHub open-source metadata platform could allow for unauthorized access to sensitive metadata or system functions.

Executive Summary:
The DataHub metadata platform is susceptible to a high-severity vulnerability that could lead to the compromise of critical metadata and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-25644

Affected Software: DataHub

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is located within the DataHub platform, which serves as a central repository for an organization's metadata. With a CVSS score of 7.5, the flaw likely allows for unauthorized data access or manipulation, potentially due to an issue with authentication or authorization controls.

Business Impact

A compromise of DataHub could lead to the exposure of sensitive information about an organization's data assets, including their location, structure, and ownership. The CVSS score of 7.5 reflects a high-severity risk to data governance and privacy. This could result in unauthorized data access across the entire organization and a significant breach of data security policies.

Remediation Plan

Immediate Action: Apply the latest security patches for DataHub immediately. Ensure that the DataHub instance and all its components are updated to the most recent version.

Proactive Monitoring: Audit access logs for the DataHub platform to identify any unauthorized or suspicious metadata queries or modifications.

Compensating Controls: Implement strong authentication (e.g., OIDC, SAML) and role-based access control (RBAC) to restrict access to the DataHub platform to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. As organizations increasingly rely on metadata platforms for data management, these platforms become high-value targets for attackers.

Analyst Recommendation

Promptly updating the DataHub platform is essential for protecting the integrity and confidentiality of your organization's metadata. Given its role as a central data hub, a compromise here could have far-reaching consequences. Prioritize this update and review your data governance security practices.

---METADATA---
VENDOR: Frigate
PRODUCT: Frigate NVR
AFFECTED_VERSIONS: Prior to 0.16.4
---END_METADATA---

Description Summary:
Critical RCE in Frigate NVR via unsanitized input in the go2rtc video stream configuration allows command injection via the exec: directive.

Executive Summary:
A critical command injection vulnerability in Frigate NVR allows authenticated administrators or unauthenticated remote attackers to execute arbitrary system commands via the go2rtc integration.

Vulnerability Details

CVE-ID: CVE-2026-25643

Affected Software: Frigate Frigate NVR

Affected Versions: Prior to 0.16.4

Vulnerability: This vulnerability is a Remote Command Execution (RCE) flaw residing in the integration between Frigate and go2rtc. The application fails to sanitize user input within the config.yaml file, specifically allowing the exec: directive to facilitate direct system command injection by an authenticated administrator or an unauthenticated attacker if the instance is exposed to the internet.

Business Impact

A successful exploit allows an attacker to gain full control over the underlying host system, leading to total compromise of the NVR surveillance data and potential lateral movement within the network. The CVSS score of 9.1 reflects the critical nature of this flaw, as it grants unauthorized individuals the ability to execute code with the same privileges as the go2rtc service.

Remediation Plan

Immediate Action: Administrators must immediately update Frigate to version 0.16.4 or later to patch the unsanitized input vulnerability.

Proactive Monitoring: Review the config.yaml file for unauthorized exec: directives and monitor system logs for unusual process spawning from the Frigate or go2rtc services.

Compensating Controls: Ensure the Frigate instance is not exposed to the public internet without a robust authentication layer or VPN, and implement a Web Application Firewall (WAF) to inspect configuration traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of command injection, the potential for exploitation is high for any internet-facing installations.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, particularly for organizations relying on Frigate for physical security. It is highly recommended to apply the 0.16.4 patch immediately and audit all configuration files for signs of tampering.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
SandboxJS is vulnerable to an escape due to a key validation mismatch. Attackers can use malicious objects that coerce to different strings during sanitation versus actual property access.

Executive Summary:
A critical logic flaw in SandboxJS property validation allows unauthenticated attackers to escape the sandbox and execute arbitrary commands on the host.

Vulnerability Details

CVE-ID: CVE-2026-25641

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: The sandbox fails to enforce string types for property keys. An unauthenticated attacker can pass objects that return one value during the hasOwnProperty check and a different value during actual access, bypassing security sanitization.

Business Impact

This vulnerability allows an attacker to bypass all property-based security restrictions, leading to a full sandbox escape. The CVSS score of 10.0 highlights the extreme risk of host-level exploitation, data theft, and total loss of system integrity.

Remediation Plan

Immediate Action: Upgrade SandboxJS to version 0.8.29 to ensure strict type enforcement and consistent key validation during property access.

Proactive Monitoring: Monitor for the use of complex objects as property keys within scripts processed by the sandbox.

Compensating Controls: Implement a secondary layer of validation at the application level to sanitize all inputs before they are passed to the SandboxJS library.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. This "time-of-check to time-of-use" style coercion flaw is a classic and effective escape technique.

Analyst Recommendation

Due to the critical nature of this escape mechanism, immediate patching is mandatory. Organizations should update to version 0.8.29 to close this logic gap and maintain the security of their sandboxed operations.

---METADATA---
VENDOR: Intelbras
PRODUCT: VIP 3260 Z IA 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security flaw has been identified in the Intelbras VIP 3260 Z IA 2 camera, which could permit unauthorized access or system interference.

Executive Summary:
The Intelbras VIP 3260 Z IA 2 camera contains a significant security vulnerability that could allow attackers to compromise the device's integrity and access sensitive video feeds.

Vulnerability Details

CVE-ID: CVE-2026-2564

Affected Software: Intelbras VIP 3260 Z IA 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the initial disclosure, the flaw is classified as high-severity (CVSS 8.1) and affects the core operations of the Intelbras VIP 3260 Z IA 2 hardware, likely involving improper access controls or input validation.

Business Impact

A compromise of physical security infrastructure can lead to unauthorized surveillance, loss of privacy, and the potential use of the device as a pivot point for broader network attacks. The CVSS score of 8.1 indicates a high risk to organizational security, particularly for facilities relying on these cameras for safety and monitoring.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Intelbras for the VIP 3260 Z IA 2 model immediately.

Proactive Monitoring: Review device access logs for unauthorized login attempts and monitor network traffic for unusual data outbound from the camera's IP address.

Compensating Controls: Isolate security cameras on a dedicated VLAN with strict ingress and egress filtering to prevent unauthorized access from the primary corporate network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. However, hardware vulnerabilities in IoT devices are frequently targeted by automated scanners once a CVE is assigned.

Analyst Recommendation

It is critical to treat this high-severity vulnerability as a priority for the physical security team. Immediately verify current firmware versions and apply vendor-supplied patches to mitigate the risk of unauthorized access to the surveillance network.

---METADATA---
VENDOR: iccDEV
PRODUCT: iccDEV libraries and tools
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the iccDEV libraries and tools for ICC color management could lead to unauthorized system manipulation or data compromise.

Executive Summary:
The iccDEV color management libraries are affected by a high-severity vulnerability that could allow for unauthorized actions or data exposure in applications using these tools.

Vulnerability Details

CVE-ID: CVE-2026-25634

Affected Software: iccDEV libraries and tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides within the iccDEV libraries, which are used for processing ICC color management profiles. A CVSS score of 7.8 suggests that the flaw could be exploited through a specially crafted ICC profile, potentially leading to a buffer overflow or other memory corruption issues.

Business Impact

Exploitation could allow an attacker to execute arbitrary code or cause a denial of service in any application that uses the vulnerable iccDEV libraries. The CVSS score of 7.8 reflects a high-severity risk to system stability and security. Organizations in the digital imaging, printing, and design industries are particularly at risk.

Remediation Plan

Immediate Action: Update all applications and systems that use the iccDEV libraries to the latest version. Developers should recompile their software with the patched version of the library.

Proactive Monitoring: Monitor systems for unexpected crashes or anomalous behavior when processing image or color profile files.

Compensating Controls: Use sandboxing or containerization to isolate applications that process external ICC profiles, limiting the potential impact of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. Vulnerabilities in image and color processing libraries are a common vector for remote code execution.

Analyst Recommendation

Immediate patching of these libraries is crucial for maintaining the security of applications that handle color management. Given the potential for remote code execution, this should be treated as a high-priority update. Ensure that all third-party software using these libraries is also identified and updated.

---METADATA---
VENDOR: EPyT-Flow
PRODUCT: EPyT-Flow
AFFECTED_VERSIONS: Prior to 0.16.1
---END_METADATA---

Description Summary:
EPyT-Flow’s REST API custom deserializer allows dynamic instantiation of attacker-specified classes. This leads to OS command execution via dangerous classes like subprocess.Popen.

Executive Summary:
EPyT-Flow is vulnerable to unauthenticated remote code execution (RCE) through a flawed JSON deserialization process that permits arbitrary OS command execution.

Vulnerability Details

CVE-ID: CVE-2026-25632

Affected Software: EPyT-Flow

Affected Versions: Prior to 0.16.1

Vulnerability: The custom deserializer my_load_from_json processes attacker-controlled JSON bodies. By providing a specific "type" field, an unauthenticated attacker can force the application to import and instantiate dangerous Python classes, such as subprocess.Popen, with arbitrary arguments.

Business Impact

With a CVSS score of 10.0, this vulnerability allows for complete system takeover. Attackers can execute arbitrary OS commands, potentially leading to the compromise of critical infrastructure data related to water distribution networks and lateral movement into internal systems.

Remediation Plan

Immediate Action: Update EPyT-Flow to version 0.16.1 immediately to replace the insecure deserialization logic with a safe alternative.

Proactive Monitoring: Review REST API logs for JSON requests containing "type" fields that reference unexpected or dangerous Python modules and classes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming JSON payloads for suspicious keywords like "subprocess", "os", or "Popen".

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. However, the ability to trigger RCE via standard REST API calls makes this an extremely attractive target for attackers.

Analyst Recommendation

This is a critical RCE vulnerability that requires immediate attention. Organizations using EPyT-Flow for hydraulic modeling must prioritize the update to version 0.16.1 to prevent unauthorized access to sensitive infrastructure controls.

---METADATA---
VENDOR: Blesta
PRODUCT: Blesta
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in Blesta 3 could allow for unauthorized access or administrative compromise within the billing and management platform.

Executive Summary:
Blesta 3 is affected by a high-severity vulnerability that could allow attackers to compromise the billing platform, leading to potential financial data exposure.

Vulnerability Details

CVE-ID: CVE-2026-25615

Affected Software: Blesta Blesta

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the core components of Blesta 3. Given the CVSS score of 7.2, the flaw likely involves an authentication bypass or an elevation of privilege that allows an attacker to perform unauthorized administrative actions.

Business Impact

Blesta is a critical billing and client management tool; a compromise here could lead to the theft of customer PII, financial records, and service credentials. The business impact includes severe reputational damage, regulatory fines due to data breaches, and the potential for attackers to manipulate billing cycles or client accounts.

Remediation Plan

Immediate Action: Upgrade Blesta to the most recent secure version provided by the vendor to close the identified security gap.

Proactive Monitoring: Review administrative audit logs for any unauthorized logins or changes to system configurations and billing settings.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts and restrict access to the Blesta management interface to trusted IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Because Blesta handles sensitive financial data, the urgency for patching is elevated despite the lack of a public exploit.

Analyst Recommendation

It is critical to apply the primary remediation update immediately. Because this software manages financial transactions and sensitive client data, the 7.2 CVSS score represents a significant risk that must be addressed to maintain compliance and data security.

---METADATA---
VENDOR: Blesta
PRODUCT: Blesta
AFFECTED_VERSIONS: Version 3
---END_METADATA---

Description Summary:
A security vulnerability has been identified in version 3 of the Blesta billing and management platform. The flaw affects the core application logic used for managing client accounts and financial data.

Executive Summary:
A high-severity vulnerability in Blesta 3 could allow an attacker to compromise sensitive billing information or gain unauthorized access to the management platform.

Vulnerability Details

CVE-ID: CVE-2026-25614

Affected Software: Blesta Blesta

Affected Versions: Version 3

Vulnerability: This vulnerability affects Blesta 3, a platform used primarily for automated billing and client management. While specific details are limited, the CVSS score suggests a significant flaw that could be exploited by an unauthenticated attacker to bypass security controls or access sensitive data within the application database.

Business Impact

Blesta handles critical business functions, including payment processing and customer PII. A CVSS score of 7.5 indicates a High severity risk where an exploit could lead to financial fraud, theft of sensitive customer data, and severe reputational damage to service providers relying on the platform.

Remediation Plan

Immediate Action: Administrators should immediately update their Blesta installations to the latest version to patch the vulnerability in the version 3 branch.

Proactive Monitoring: Audit application logs for unusual administrative activity, failed login attempts, or unauthorized changes to billing configurations and client accounts.

Compensating Controls: Ensure the Blesta installation is hardened following the vendor's security best practices, including the use of strong multi-factor authentication (MFA) for all administrative users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Because Blesta is a billing platform, it is a high-priority target for attackers interested in financial gain or data theft.

Analyst Recommendation

The High severity of this vulnerability necessitates immediate patching. Organizations using Blesta 3 must prioritize this update to protect their financial operations and maintain the trust of their client base.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw personal AI assistant
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the OpenClaw personal AI assistant could allow attackers to gain unauthorized access to personal data or system functions.

Executive Summary:
The OpenClaw personal AI assistant is vulnerable to a high-severity exploit that could lead to the exposure of sensitive personal information and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-25593

Affected Software: OpenClaw

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the OpenClaw AI assistant, a platform that likely handles significant amounts of personal and sensitive data. With a CVSS score of 8.4, the flaw could involve a breakdown in authentication or a vulnerability that allows for the execution of unauthorized commands within the AI's environment.

Business Impact

A successful exploit could result in the leakage of sensitive user data and the potential for an attacker to manipulate the AI's behavior or access the underlying host system. The CVSS score of 8.4 indicates a high level of risk, particularly concerning data privacy and system integrity. This could lead to significant privacy violations and loss of user confidence in the AI platform.

Remediation Plan

Immediate Action: Apply the latest security updates for OpenClaw immediately. Ensure that the application and all its dependencies are updated to their most secure versions.

Proactive Monitoring: Monitor for unusual patterns in AI interactions or unauthorized access to the data repositories used by OpenClaw.

Compensating Controls: Implement strong encryption for all data at rest and in transit, and use strict access controls to limit the AI assistant's permissions on the host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. As AI assistants become more integrated into daily life, they are becoming increasingly attractive targets for cyberattacks.

Analyst Recommendation

Users and organizations using OpenClaw should prioritize this update to protect sensitive information. The high severity of this vulnerability highlights the need for robust security in AI applications. Continuous monitoring and a proactive approach to patching are essential for mitigating the risks associated with this and future vulnerabilities.

---METADATA---
VENDOR: Microsoft
PRODUCT: Semantic Kernel .NET SDK
AFFECTED_VERSIONS: Versions prior to 1.70.0
---END_METADATA---

Description Summary:
Microsoft Semantic Kernel .NET SDK contains an arbitrary file write flaw in the SessionsPythonPlugin. Attackers can exploit DownloadFileAsync or UploadFileAsync to write files to restricted paths.

Executive Summary:
A critical arbitrary file write vulnerability in Microsoft Semantic Kernel .NET SDK could allow attackers to overwrite sensitive system files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-25592

Affected Software: Microsoft Semantic Kernel .NET SDK

Affected Versions: Prior to 1.70.0

Vulnerability: This vulnerability exists within the SessionsPythonPlugin component of the SDK. An attacker can manipulate the localFilePath argument in the DownloadFileAsync or UploadFileAsync functions to perform arbitrary file writes, likely without requiring high-level authentication depending on the implementation's exposure.

Business Impact

A successful exploit allows an attacker to overwrite critical application files or configuration data, leading to a complete compromise of the host system. Given the CVSS score of 9.9, this represents a near-maximum risk to data integrity and system availability, potentially facilitating persistent access within AI-orchestrated environments.

Remediation Plan

Immediate Action: Administrators must update Microsoft.SemanticKernel.Core to version 1.70.0 or later immediately to patch the vulnerable plugin logic.

Proactive Monitoring: Implement logging for all file system interactions initiated by the Semantic Kernel and review arguments passed to the SessionsPythonPlugin for suspicious path traversal patterns.

Compensating Controls: As a temporary measure, developers can implement a Function Invocation Filter to validate and allow-list localFilePath arguments before they reach the vulnerable functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its 9.9 CVSS rating, the potential for rapid exploit development is extremely high.

Analyst Recommendation

The severity of this arbitrary file write flaw necessitates immediate remediation. Organizations utilizing the Semantic Kernel .NET SDK for AI agent orchestration should prioritize the update to version 1.70.0 to prevent total system compromise.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
A flaw in SandboxJS allows attackers to escape the sandbox by overwriting Map.prototype.has. Since Map is included in SAFE_PROTOTYPES, its prototype is accessible for malicious modification.

Executive Summary:
An unauthenticated attacker can escape the SandboxJS environment by exploiting insecure access to the Map prototype, leading to full host system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25587

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: Because the Map object is categorized under SAFE_PROTOTYPES, its prototype is exposed within the sandbox. An unauthenticated attacker can overwrite Map.prototype.has to bypass internal logic and escape the restricted execution environment.

Business Impact

Successful exploitation results in an escape to the host environment, allowing for arbitrary code execution. The CVSS score of 10.0 indicates that this vulnerability poses a maximum threat to the organization, as it allows for complete unauthorized control over the application server.

Remediation Plan

Immediate Action: Update SandboxJS to version 0.8.29 immediately to secure the SAFE_PROTOTYPES definitions and prevent prototype overwriting.

Proactive Monitoring: Review and log all modifications to global object prototypes within the sandboxed environment to detect early signs of escape attempts.

Compensating Controls: Utilize runtime monitoring tools that can detect and block unauthorized system calls or suspicious process spawning from the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. The vulnerability is highly critical as it leverages a trusted component (Map) to break isolation.

Analyst Recommendation

The reliance on a trusted prototype for sandbox escape makes this a high-priority fix. Organizations must apply the 0.8.29 update immediately to ensure that sandboxed code cannot interfere with the host's execution flow.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
SandboxJS allows sandbox escape via shadowing of the hasOwnProperty method. This disables prototype whitelist enforcement, enabling host Object.prototype pollution and persistent cross-sandbox impact.

Executive Summary:
SandboxJS is vulnerable to a critical escape and prototype pollution flaw that allows unauthenticated attackers to gain persistent control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-25586

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: By shadowing hasOwnProperty on a sandboxed object, an unauthenticated attacker can disable security checks in the property-access path. This grants direct access to blocked properties like proto, leading to host-level Object.prototype pollution.

Business Impact

The ability to pollute the host's Object.prototype allows for persistent attacks that can affect all subsequent sandboxes and the main application logic. The CVSS score of 10.0 reflects the total loss of confidentiality, integrity, and availability once the sandbox is escaped.

Remediation Plan

Immediate Action: Immediately upgrade SandboxJS to version 0.8.29 to patch the property-access validation logic.

Proactive Monitoring: Audit sandboxed scripts for attempts to redefine core JavaScript methods or access sensitive prototype properties.

Compensating Controls: Employ strict Content Security Policies (CSP) and minimize the permissions of the environment hosting the JavaScript engine to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is highly critical due to the persistent nature of prototype pollution.

Analyst Recommendation

This vulnerability represents a fundamental failure of the sandbox's isolation mechanisms. We recommend an immediate transition to version 0.8.29 to mitigate the risk of host-level compromise and persistent cross-session attacks.

---METADATA---
VENDOR: International Color Consortium
PRODUCT: iccDEV
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical flaw in the iccDEV libraries and tools allows for potential exploitation during the manipulation and application of ICC color management profiles.

Executive Summary:
The iccDEV color management toolkit is susceptible to a high-severity vulnerability that could be exploited when processing maliciously crafted ICC profiles.

Vulnerability Details

CVE-ID: CVE-2026-25585

Affected Software: International Color Consortium iccDEV

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core libraries of iccDEV used for interacting with ICC color profiles. An attacker could potentially achieve code execution or system instability by forcing the library to process a malformed profile, likely requiring no authentication beyond the delivery of the file.

Business Impact

Successful exploitation could lead to unauthorized access to systems that handle digital imagery or printing workflows. The CVSS score of 7.8 reflects a high severity, indicating that the flaw could result in significant data integrity issues or the compromise of systems within specialized design and production environments.

Remediation Plan

Immediate Action: Update the iccDEV libraries and tools to the latest version provided by the vendor to address flaws in the ICC profile parser.

Proactive Monitoring: Monitor system logs for crashes or unexpected behavior in applications that utilize the iccDEV libraries for color management.

Compensating Controls: Use network-level filtering to block the transmission of ICC profiles from untrusted sources and employ sandboxing for applications that process external media files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in media parsing libraries are frequently targeted for initial access.

Analyst Recommendation

IT administrators should identify all internal tools and applications that rely on the iccDEV toolkit and apply the necessary patches immediately. Ensuring that these libraries are up to date is essential for maintaining the security of the broader media processing infrastructure.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the iccDEV color management libraries could allow an attacker to execute arbitrary code by processing a specially crafted ICC profile.

Executive Summary:
The iccDEV libraries are affected by a high-severity vulnerability that enables arbitrary code execution through the manipulation of ICC color management profiles.

Vulnerability Details

CVE-ID: CVE-2026-25584

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the iccDEV libraries' handling of ICC color management profiles. An unauthenticated attacker can exploit this by delivering a malicious profile to an application, triggering an internal error that allows for memory corruption and subsequent code execution.

Business Impact

The compromise of a core library used for image processing can lead to the widespread exposure of corporate assets. If exploited, this could result in the loss of sensitive data, unauthorized system access, and significant operational disruption. The CVSS score of 7.8 highlights the High severity and the urgent need for remediation to protect the software supply chain.

Remediation Plan

Immediate Action: Update all iccDEV libraries and tools to the latest version immediately to patch the profile parsing logic.

Proactive Monitoring: Monitor for unusual application behavior when processing images and review security logs for signs of memory corruption exploits.

Compensating Controls: Employ application whitelisting and use modern operating systems with advanced memory protections to mitigate the impact of potential exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as long as vulnerable versions of the library are in use across various software ecosystems.

Analyst Recommendation

The primary recommendation is to apply the vendor's patch without delay. Security administrators should conduct a thorough audit of their software inventory to identify and update any third-party applications that utilize the iccDEV libraries.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The iccDEV color management libraries contain a high-severity vulnerability that could be triggered by malformed ICC profiles, leading to system instability or code execution.

Executive Summary:
The iccDEV libraries are susceptible to a vulnerability when parsing ICC profiles, which could allow an attacker to execute arbitrary code on systems using the affected software.

Vulnerability Details

CVE-ID: CVE-2026-25583

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the iccDEV suite of tools during the interaction and manipulation of ICC color management profiles. By crafting a malicious profile, an attacker can exploit an unauthenticated parsing flaw to corrupt memory and potentially take control of the host application.

Business Impact

The risk is substantial for organizations that process large volumes of third-party media. A successful exploit could lead to unauthorized access, data theft, or the introduction of malware into the environment. With a CVSS score of 7.8, the High severity is justified by the potential for widespread impact across various software products that integrate these libraries.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the iccDEV project and update all dependent software.

Proactive Monitoring: Inspect system logs for segmentation faults or other errors in image-processing applications that might indicate exploitation attempts.

Compensating Controls: Implement file-scanning solutions that can detect and block malformed ICC profiles at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of ICC profile parsing makes it a frequent source of security vulnerabilities.

Analyst Recommendation

We recommend that all users of iccDEV-based tools prioritize this update. Maintaining the security of shared libraries is a critical component of a robust vulnerability management program.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The iccDEV color management libraries are vulnerable to a flaw during the processing of ICC profiles, which could lead to memory corruption or arbitrary code execution.

Executive Summary:
A vulnerability in the iccDEV libraries allows for potential code execution when processing malicious ICC color profiles, posing a risk to applications using these tools.

Vulnerability Details

CVE-ID: CVE-2026-25582

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: The iccDEV libraries, used for manipulating ICC color profiles, contain a vulnerability in how they handle profile data. An attacker can provide a malformed ICC profile to an application using these libraries, triggering a memory-related flaw that could allow for unauthorized code execution.

Business Impact

Because these libraries are often integrated into larger software suites (such as image editors or web browsers), the impact can be widespread. A successful exploit could lead to the compromise of any system processing a malicious image. The CVSS score of 7.8 reflects a High severity due to the potential for remote exploitation and the impact on system confidentiality and integrity.

Remediation Plan

Immediate Action: Developers using iccDEV libraries should update to the latest version and recompile their applications; end-users should apply updates for any software that utilizes these libraries.

Proactive Monitoring: Monitor for application crashes when handling image files and use memory protection features like ASLR and DEP.

Compensating Controls: Use sandboxing for image processing tasks and implement strict input validation for all ICC profiles before they are parsed by the library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Library-level vulnerabilities are significant as they represent a supply-chain risk to multiple downstream products.

Analyst Recommendation

Immediate patching is essential for both developers and end-users. Organizations should identify all software in their environment that relies on iccDEV for color management and ensure that these applications are updated to the latest patched versions.

---METADATA---
VENDOR: OpenBullet
PRODUCT: OpenBullet2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
OpenBullet2 contains a high-severity vulnerability that could expose users to unauthorized access or system manipulation.

Executive Summary:
A critical security vulnerability in OpenBullet2 necessitates immediate attention to prevent unauthorized access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25559

Affected Software: OpenBullet2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the OpenBullet2 application. While the specific entry point is not fully detailed, the high CVSS score suggests a significant flaw that may allow unauthorized access or remote command execution.

Business Impact

OpenBullet2 is often used in automated testing and configuration contexts, and its compromise could result in the exposure of sensitive credentials or the use of the platform for malicious automation. The CVSS score of 8.8 indicates a high risk of severe impact to the host environment.

Remediation Plan

Immediate Action: Update OpenBullet2 to the latest patched version provided by the vendor.

Proactive Monitoring: Review all configuration files and user access logs for signs of unauthorized modifications or suspicious activity.

Compensating Controls: Restrict access to the OpenBullet2 interface behind a VPN or IP-based access control list.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of OpenBullet2 should verify their current version and update immediately. Given the high CVSS score, the risk of exploitation is substantial; therefore, administrative vigilance and prompt patching are required to maintain a secure posture.