---METADATA---
VENDOR: NLnet Labs
PRODUCT: Unbound
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A resource exhaustion vulnerability in NLnet Labs Unbound allows for denial-of-service via inefficient algorithmic complexity and improper resource throttling.

Executive Summary:
A denial-of-service vulnerability in NLnet Labs Unbound allows remote, unauthenticated attackers to cause resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-41292

Affected Software: NLnet Labs Unbound

Affected Versions: 0 up to (excluding) 1.25.1

Vulnerability: The software is susceptible to resource exhaustion (CWE-407/CWE-770) due to inefficient algorithmic complexity, allowing an unauthenticated remote attacker to trigger excessive resource consumption.

Business Impact

Successful exploitation results in a denial-of-service, rendering the DNS resolver unresponsive. With a CVSS score of 7.5 and the ability to be triggered remotely by unauthenticated attackers, this represents a high risk to network availability and service continuity for any infrastructure relying on Unbound for DNS resolution.

Remediation Plan

Immediate Action: Update NLnet Labs Unbound to version 1.25.1 or later to implement the necessary resource limits and algorithmic fixes.

Proactive Monitoring: Monitor DNS resolver performance metrics, specifically CPU and memory utilization, for spikes that could indicate an ongoing denial-of-service attempt.

Compensating Controls: Use rate-limiting at the network perimeter to throttle excessive incoming DNS traffic, potentially reducing the impact of a DoS attempt while patching is underway.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Due to the critical role of DNS in network operations and the remote exploitability of this flaw, immediate patching is required. Organizations should prioritize updating all instances of Unbound to version 1.25.1 to ensure continued service availability and to mitigate the risk of remote service disruption.

---METADATA---
VENDOR: OpenStack
PRODUCT: Mistral
AFFECTED_VERSIONS: OpenStack Mistral through 22.0.0.
---END_METADATA---

Description Summary:
OpenStack Mistral allows arbitrary remote code execution via exposed API endpoints, potentially leading to the exfiltration of sensitive service credentials.

Executive Summary:
A critical remote code execution vulnerability in OpenStack Mistral allows unauthenticated attackers to execute arbitrary commands and exfiltrate sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-41283

Affected Software: OpenStack Mistral

Affected Versions: OpenStack Mistral through 22.0.0.

Vulnerability: The vulnerability exists in the API endpoints of OpenStack Mistral, which do not properly sanitize input or restrict execution, allowing an unauthenticated remote attacker to execute arbitrary code. This flaw provides a vector for attackers to compromise service credentials and gain broader control over the OpenStack environment.

Business Impact

With a CVSS score of 9.9, this vulnerability represents an extremely high risk. Successful exploitation can lead to a complete compromise of the OpenStack environment, resulting in data breaches, unauthorized access to cloud resources, and catastrophic loss of service integrity.

Remediation Plan

Immediate Action: Upgrade OpenStack Mistral to version 23.0.0 or later immediately to resolve the vulnerable API endpoints.

Proactive Monitoring: Review API access logs for unusual activity or requests directed at sensitive Mistral endpoints that could indicate exploitation.

Compensating Controls: Restrict access to the Mistral API service to trusted internal networks only, using firewalls or VPNs, until the patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE and its potential impact on cloud infrastructure, immediate patching is required. Organizations running OpenStack Mistral should prioritize this update to prevent unauthorized administrative access to their cloud platforms.

---METADATA---
VENDOR: OpenMRS
PRODUCT: OpenMRS Core
AFFECTED_VERSIONS: 2.7.0 to 2.7.8, and 2.8.0 to 2.8.5
---END_METADATA---

Description Summary:
OpenMRS Core fails to properly sandbox Apache Velocity templates, allowing authenticated users with specific privileges to achieve arbitrary Java reflection and code execution.

Executive Summary:
An authenticated remote code execution vulnerability in OpenMRS Core allows users with Manage Concepts privileges to execute arbitrary Java code via malicious Velocity template expressions.

Vulnerability Details

CVE-ID: CVE-2026-41258

Affected Software: OpenMRS Core

Affected Versions: 2.7.0 to 2.7.8, and 2.8.0 to 2.8.5

Vulnerability: The application evaluates database-stored criteria as Velocity templates without adequate sandboxing; an authenticated user with "Manage Concepts" privileges can inject and execute arbitrary code.

Business Impact

An attacker with modest privileges can escalate to full system access, potentially exposing highly sensitive electronic medical records. A CVSS score of 9.1 underlines the severity of this privilege escalation and execution risk.

Remediation Plan

Immediate Action: Upgrade to OpenMRS Core version 2.7.9 or 2.8.6 to address the template evaluation flaw.

Proactive Monitoring: Audit recent changes to concept reference ranges and monitor for unusual Java object instantiation or unauthorized service layer calls.

Compensating Controls: Restrict administrative privileges to a minimal set of trusted users and implement strict code review processes for any configuration changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the sensitivity of data handled by OpenMRS, this vulnerability must be remediated immediately. Administrators should upgrade to the specified versions to prevent unauthorized code execution.

---METADATA---
VENDOR: neutrinolabs
PRODUCT: xrdp
AFFECTED_VERSIONS: < 0.10.6.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in xrdp, occurring in vnc-any mode, allows remote, unauthenticated attackers to cause a denial of service or potentially achieve remote code execution.

Executive Summary:
An unauthenticated, remote heap-based buffer overflow in xrdp allows attackers to crash the service or potentially gain code execution.

Vulnerability Details

CVE-ID: CVE-2026-41252

Affected Software: neutrinolabs xrdp

Affected Versions: < 0.10.6.1

Vulnerability: The vulnerability is caused by a missing bounds check on RFB protocol color map messages when xrdp is operating in vnc-any mode. An attacker can supply malformed data to trigger an out-of-bounds write on the heap, leading to service disruption or arbitrary code execution.

Business Impact

This flaw carries a CVSS score of 9.8, reflecting its potential for total system compromise via remote code execution. If exploited, an attacker could gain unauthorized control over the server, leading to severe data breaches or complete infrastructure takeover, especially in environments where xrdp is exposed to the internet.

Remediation Plan

Immediate Action: Update xrdp to version 0.10.6.1 or later to resolve the memory corruption issue.

Proactive Monitoring: Review system logs for unusual xrdp process behavior and monitor for patterns of malformed RFB traffic.

Compensating Controls: If upgrading is not immediately possible, disable vnc-any mode or restrict access to the xrdp service using firewall rules to limit exposure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it allows interaction with the service before the authentication stage.

Analyst Recommendation

Administrators must treat this vulnerability with the highest urgency due to its potential for remote code execution. Applying the update to version 0.10.6.1 is the only reliable method to mitigate the risk of memory corruption and unauthorized access.

---METADATA---
VENDOR: Pimcore
PRODUCT: CoreShop
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
CoreShop, a Pimcore enhanced eCommerce solution, contains a vulnerability that requires immediate attention.

Executive Summary:
A high-severity vulnerability in the CoreShop eCommerce solution for Pimcore poses a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-41249

Affected Software: Pimcore CoreShop

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw within the CoreShop framework. While specific authentication requirements are not detailed, such flaws often allow attackers to manipulate core eCommerce functionality.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive eCommerce data, potential order manipulation, or full compromise of the application backend. With a CVSS score of 8.2, this vulnerability is classified as High and requires prioritized remediation to prevent business disruption and financial loss.

Remediation Plan

Immediate Action: Apply all security updates provided by the vendor immediately upon release.

Proactive Monitoring: Monitor application logs for anomalous traffic patterns or unauthorized attempts to access administrative functions.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the eCommerce platform.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, administrators must prioritize the assessment of their CoreShop environment. Apply vendor-supplied patches immediately to mitigate the risk of unauthorized access or data compromise.

---METADATA---
VENDOR: Clerk
PRODUCT: Clerk JavaScript (Next.js, Nuxt, Astro)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A bypass vulnerability in Clerk's createRouteMatcher allows unauthenticated requests to skip middleware gating and reach downstream handlers.

Executive Summary:
A critical authentication bypass vulnerability in Clerk JavaScript libraries allows attackers to circumvent middleware security controls and access protected routes.

Vulnerability Details

CVE-ID: CVE-2026-41248

Affected Software: Clerk Clerk JavaScript

Affected Versions: @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, 7.2.1; @clerk/nuxt 1.13.28, 2.2.2; @clerk/shared 2.22.1, 3.47.4, 4.8.1

Vulnerability: The createRouteMatcher function in various Clerk integration packages fails to properly validate certain crafted requests. This allows an attacker to bypass authentication middleware, effectively reaching application handlers that were intended to be protected by Clerk authentication.

Business Impact

This vulnerability undermines the fundamental authentication logic of applications using Clerk, potentially exposing private user data and administrative functions. With a CVSS score of 9.1, the risk of unauthorized access is severe, as attackers can bypass security checks designed to guard sensitive business logic and backend services.

Remediation Plan

Immediate Action: Update all affected Clerk packages (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and @clerk/shared) to the versions specified in the vendor security advisory.

Proactive Monitoring: Monitor application logs for unexpected access patterns where users are reaching routes that should be restricted by middleware.

Compensating Controls: While no direct WAF rule can fully replace the middleware logic, ensuring that backend handlers also perform secondary authorization checks provides a vital layer of defense-in-depth.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers must treat this as a high-priority update. Because this vulnerability affects the core security gating mechanism of the application, failure to patch will leave protected routes and downstream handlers completely exposed to unauthenticated access.

---METADATA---
VENDOR: Froxlor
PRODUCT: Server Administration Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Froxlor open source server administration software contains a vulnerability related to improper access control or authorization mechanisms.

Executive Summary:
A critical vulnerability in Froxlor server administration software could allow unauthorized access, jeopardizing the security of managed server environments.

Vulnerability Details

CVE-ID: CVE-2026-41236

Affected Software: Froxlor, Server Administration Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the administrative functions of the platform. Based on the CVSS score, this flaw likely involves a failure to properly enforce security constraints, allowing unauthorized actors to perform actions reserved for administrators.

Business Impact

As an administration tool, Froxlor has privileged access to the server environment. A successful exploit, rated at 8.8, could result in full server compromise, unauthorized modification of configurations, and total loss of administrative control over hosted services.

Remediation Plan

Immediate Action: Update the Froxlor installation to the latest stable release as soon as the vendor provides a security patch.

Proactive Monitoring: Inspect server logs for unusual administrative logins, unexpected configuration changes, or unauthorized access attempts to the management interface.

Compensating Controls: Limit access to the Froxlor management interface to authorized IP addresses only, utilizing VPNs or firewall rules to restrict exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Froxlor manages server configurations, the risk associated with this vulnerability is severe. Administrators must treat this as a top-priority update and ensure that the management interface is not exposed to untrusted networks.

---METADATA---
VENDOR: Froxlor
PRODUCT: Froxlor
AFFECTED_VERSIONS: Prior to 2.3.6
---END_METADATA---

Description Summary:
An injection vulnerability in Froxlor's PhpHelper allows administrators to inject and execute arbitrary PHP code via unescaped string literals.

Executive Summary:
A critical injection vulnerability in Froxlor prior to version 2.3.6 allows an authenticated administrator to execute arbitrary PHP code by injecting malicious strings into configuration files.

Vulnerability Details

CVE-ID: CVE-2026-41229

Affected Software: Froxlor Froxlor

Affected Versions: Prior to 2.3.6

Vulnerability: This is a code injection vulnerability where the PhpHelper::parseArrayToString() function fails to escape single quotes, allowing an administrator to inject malicious PHP code into lib/userdata.inc.php.

Business Impact

By exploiting this flaw, an attacker with change_serversettings permission can gain persistent remote code execution, which executes on every page load. This grants the attacker ongoing control over the server environment, risking total data compromise and system integrity. The CVSS score of 9.1 underlines the severe risk to organizational infrastructure.

Remediation Plan

Immediate Action: Upgrade to Froxlor version 2.3.6 or later to ensure proper escaping of configuration strings.

Proactive Monitoring: Audit the lib/userdata.inc.php file for any unauthorized modifications or embedded PHP code blocks.

Compensating Controls: Limit access to administrative functions and strictly enforce the principle of least privilege for all administrative accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for persistent code execution, making it a high-priority concern for any administrator. Immediate patching to version 2.3.6 is required to neutralize the injection vector and secure the server configuration.

---METADATA---
VENDOR: Froxlor
PRODUCT: Froxlor
AFFECTED_VERSIONS: Prior to 2.3.6
---END_METADATA---

Description Summary:
A path traversal flaw in the Froxlor API allows authenticated customers to execute arbitrary PHP code via the def_language parameter.

Executive Summary:
An authenticated path traversal vulnerability in Froxlor prior to version 2.3.6 allows attackers to execute arbitrary PHP code on the server with web service privileges.

Vulnerability Details

CVE-ID: CVE-2026-41228

Affected Software: Froxlor Froxlor

Affected Versions: Prior to 2.3.6

Vulnerability: This is a path traversal and arbitrary code execution vulnerability where an authenticated customer can inject a malicious path into the def_language parameter, which is then executed via require.

Business Impact

Successful exploitation allows an attacker to achieve remote code execution, granting them the ability to run arbitrary commands as the web server user. This could lead to a total server compromise, unauthorized access to sensitive customer data, and potential lateral movement within the network. The CVSS score of 9.9 highlights the extreme severity of this flaw.

Remediation Plan

Immediate Action: Upgrade all Froxlor instances to version 2.3.6 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious file system access patterns or unauthorized calls to the require function.

Compensating Controls: Restrict API access to trusted IP addresses and utilize a WAF to block requests containing path traversal sequences (e.g., ../).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical risk to the integrity of the server environment. Administrators must verify their current version of Froxlor and apply the 2.3.6 update as a high-priority task to prevent full system compromise.

---METADATA---
VENDOR: Arch
PRODUCT: CI4MS
AFFECTED_VERSIONS: 0.31.4.0
---END_METADATA---

Description Summary:
CI4MS contains a stored DOM-based XSS vulnerability in the backup module that can be leveraged for full account takeover.

Executive Summary:
A stored DOM XSS vulnerability in CI4MS allows attackers to perform full account takeover and privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-41201

Affected Software: Arch CI4MS

Affected Versions: 0.31.4.0

Vulnerability: An attacker can upload a crafted SQL file containing a malicious filename that triggers stored DOM XSS when processed by the backup module. This allows for the execution of arbitrary JavaScript in the context of an administrator's session.

Business Impact

The ability to execute JavaScript in an administrator's browser leads directly to account takeover and full control over the CMS. Given the 9.1 CVSS score, this is a critical threat to the integrity and availability of the managed content and infrastructure.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.5.0 immediately.

Proactive Monitoring: Monitor application logs for suspicious file uploads or unusual backup module activity.

Compensating Controls: Implement strict file type and name validation on the server side and utilize a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must update to the patched version immediately. Additionally, verify that all existing backup files are clean and that no malicious payloads have already been stored.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Prior to 1.8.215
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
FreeScout before 1.8.215 contains an arbitrary file write vulnerability in the module installation feature due to improper validation of ZIP archive file paths.

Executive Summary:
An authenticated administrative vulnerability in FreeScout allows arbitrary file writes on the server, posing a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-41193

Affected Software: FreeScout

Affected Versions: Prior to 1.8.215

Vulnerability: The vulnerability exists in the module installation feature, which fails to validate file paths when extracting ZIP archives. An authenticated administrator can leverage this to write malicious files to arbitrary locations on the server filesystem.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the underlying server infrastructure. An attacker with administrative access could achieve remote code execution, leading to full server compromise, persistent backdoors, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.215 or later to resolve the archive extraction flaw.

Proactive Monitoring: Inspect the server's web directories and sensitive system paths for the presence of unauthorized or unexpected files created during module installation tasks.

Compensating Controls: Restrict administrative access to the module installation interface to trusted personnel only and ensure the web server service account has minimal filesystem write permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for self-hosted FreeScout instances. Administrators must prioritize the update to version 1.8.215 to prevent potential remote code execution via arbitrary file writes.

---METADATA---
VENDOR: Create DB Tables
PRODUCT: Create DB Tables for WordPress
AFFECTED_VERSIONS: Up to and including 1.2.1
---END_METADATA---

Description Summary:
The Create DB Tables plugin for WordPress is vulnerable to authorization bypass, allowing authenticated attackers to drop or create database tables.

Executive Summary:
Authenticated attackers with Subscriber-level access can destroy the entire WordPress database due to missing authorization checks in the Create DB Tables plugin.

Vulnerability Details

CVE-ID: CVE-2026-4119

Affected Software: Create DB Tables

Affected Versions: Up to and including 1.2.1

Vulnerability: The plugin fails to perform capability checks or nonce verification on administrative actions, allowing any authenticated user to execute DROP TABLE or CREATE TABLE commands.

Business Impact

An attacker can delete critical WordPress tables, leading to permanent data loss and total site failure. With a CVSS score of 9.1, this represents a major threat to the availability and integrity of the site's data.

Remediation Plan

Immediate Action: Update the Create DB Tables plugin to the latest version.

Proactive Monitoring: Monitor database logs for unusual DROP or CREATE table queries performed by standard user accounts.

Compensating Controls: Use a WAF to restrict access to administrative admin-post.php actions for non-privileged users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Update the plugin immediately. Furthermore, audit user roles to ensure that only trusted administrators have access to potentially destructive administrative functions.

---METADATA---
VENDOR: Jellystat
PRODUCT: Jellystat
AFFECTED_VERSIONS: Prior to 1.1.10
---END_METADATA---

Description Summary:
Jellystat is vulnerable to SQL injection and subsequent remote code execution due to improper sanitization of user-supplied data in API endpoints.

Executive Summary:
An authenticated attacker can perform SQL injection in Jellystat, enabling full database access and arbitrary command execution on the PostgreSQL server.

Vulnerability Details

CVE-ID: CVE-2026-41167

Affected Software: Jellystat

Affected Versions: Prior to 1.1.10

Vulnerability: The application fails to sanitize inputs in multiple API endpoints, allowing an authenticated user to inject SQL commands. Because the database role often has superuser privileges, this can be escalated to RCE via the COPY ... TO PROGRAM command.

Business Impact

This vulnerability allows for the total compromise of the database and the underlying server. Attackers can steal sensitive configuration data, including API keys and credentials, and gain complete control of the host system. The CVSS score of 9.1 reflects the extreme risk of total system takeover.

Remediation Plan

Immediate Action: Update Jellystat to version 1.1.10 or later immediately.

Proactive Monitoring: Review PostgreSQL logs for suspicious COPY commands or unexpected shell execution attempts originating from the application user.

Compensating Controls: Implement strict database role permissions (Principle of Least Privilege) to ensure the application user cannot execute system commands like COPY ... TO PROGRAM.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of SQL injection and RCE makes this a critical priority. Administrators must update the application immediately and re-evaluate the database permissions used by the service to minimize the impact of potential future vulnerabilities.