---METADATA---
VENDOR: Hackage
PRODUCT: hackage-server
AFFECTED_VERSIONS: 0.1 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The hackage-server application lacks Cross-Site Request Forgery (CSRF) protection, allowing unauthorized actions such as package uploads or account creation via malicious scripts on foreign sites.

Executive Summary:
The hackage-server application is vulnerable to Cross-Site Request Forgery (CSRF), which could allow remote attackers to perform unauthorized administrative actions or modify user accounts.

Vulnerability Details

CVE-ID: CVE-2026-40471

Affected Software: Hackage hackage-server

Affected Versions: 0.1 and later

Vulnerability: This is a Cross-Site Request Forgery (CWE-352) vulnerability. The application fails to validate requests, allowing an attacker to trigger actions on behalf of an authenticated user or, in some cases, perform unauthenticated actions like account creation.

Business Impact

The lack of CSRF protection poses a significant risk to the integrity and availability of the package repository. A successful exploit could lead to unauthorized code execution through malicious package uploads or the compromise of administrative functions, resulting in severe reputational damage and supply chain risk. With a CVSS score of 9.6, this vulnerability is critical due to the potential for total impact on system confidentiality and integrity.

Remediation Plan

Immediate Action: Review the official OSV advisory (HSEC-2026-0002) for specific security guidance or configuration changes, as a direct patch version may not be explicitly listed.

Proactive Monitoring: Monitor server logs for suspicious POST requests originating from unexpected referrers or unusual patterns of administrative activity.

Compensating Controls: Implement strict SameSite cookie attributes and consider deploying a Web Application Firewall (WAF) to inspect and block suspicious cross-origin requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it leverages the trust a server has in a user's browser, making it a high-priority target for automated cross-site attacks.

Analyst Recommendation

Given the critical CVSS severity, administrators should prioritize implementing site-wide CSRF protections immediately. If a software update is not yet available, verify that your deployment configuration follows the latest security hardening guidelines provided by the vendor to minimize the attack surface.

---METADATA---
VENDOR: Haskell.org
PRODUCT: Hackage Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Cross-Site Scripting (XSS) vulnerability in the Hackage server allows an attacker to hijack user sessions by serving malicious JavaScript via uploaded documentation or source packages.

Executive Summary:
A critical XSS vulnerability in the Hackage server allows attackers to hijack active user sessions, potentially leading to unauthorized package management and metadata alteration.

Vulnerability Details

CVE-ID: CVE-2026-40470

Affected Software: Haskell.org Hackage Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The server incorrectly handles HTML and JavaScript files within uploaded packages. A malicious maintainer can upload content that executes in the browser of a user with active credentials, resulting in full session hijacking.

Business Impact

The CVSS score of 9.9 represents a critical threat to the supply chain integrity of the Haskell ecosystem. Hijacking sessions allows attackers to inject malicious code into packages or alter project metadata, potentially poisoning downstream software consumers.

Remediation Plan

Immediate Action: Update the Hackage server software to the latest version provided by the Haskell community.

Proactive Monitoring: Monitor for unexpected changes to package metadata or suspicious package upload activities.

Compensating Controls: Users should clear browser sessions after interacting with the platform and maintain strict control over maintainer credentials.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a significant risk to the integrity of the software supply chain. Administrators of Hackage instances must apply the security patches immediately to prevent unauthorized session access and maintain the trust of the development community.

---METADATA---
VENDOR: GNU
PRODUCT: C Library (glibc)
AFFECTED_VERSIONS: Version 2 (See vendor advisory for specific sub-versions)
---END_METADATA---

Description Summary:
A vulnerability exists in the iconv() function of the GNU C Library (glibc) version 2. This flaw can lead to unexpected behavior or potential security bypasses during character set conversion.

Executive Summary:
A high-severity vulnerability in the GNU C Library (glibc) iconv() function poses a significant risk to Linux-based systems, potentially allowing for memory corruption or unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-4046

Affected Software: GNU C Library (glibc)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is located within the iconv() function, which is responsible for converting strings between different character encodings. While the specific exploit vector is not detailed in the summary, flaws in this function typically involve unauthenticated attackers providing specially crafted input to an application that utilizes glibc for encoding tasks.

Business Impact

The GNU C Library is a core component of nearly all Linux distributions. A flaw in iconv() can impact a wide range of applications, including web servers, mail servers, and database engines. The CVSS score of 7.5 indicates a high severity, as successful exploitation could lead to application crashes (denial of service) or potentially arbitrary code execution depending on how the affected application handles character conversion.

Remediation Plan

Immediate Action: Apply security updates provided by your Linux distribution vendor (e.g., Red Hat, Debian, Ubuntu) to update the glibc package to a patched version.

Proactive Monitoring: Review application logs for crashes or segmentation faults that occur during data processing or character encoding tasks.

Compensating Controls: Ensure applications use robust input validation before passing data to character conversion libraries and utilize memory protection features like ASLR and DEP.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the ubiquity of glibc, this vulnerability should be treated as a high-priority patching item.

Analyst Recommendation

System administrators should treat this as a critical infrastructure update. Because glibc is a foundational library, a patch will require a system reboot or a restart of all services utilizing the library to ensure the fix is fully implemented across the environment.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache IoTDB C++ client
AFFECTED_VERSIONS: 1.3.5 up to 1.3.8, 2.0.5 up to 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the Apache IoTDB C++ client TsBlock deserializer causes client crashes when processing malformed server data.

Executive Summary:
A high-severity input validation vulnerability in the Apache IoTDB C++ client allows unauthenticated attackers to trigger denial-of-service conditions via malformed data.

Vulnerability Details

CVE-ID: CVE-2026-40454

Affected Software: Apache Software Foundation Apache IoTDB C++ client

Affected Versions: 1.3.5 up to (excluding) 1.3.8, 2.0.5 up to (excluding) 2.0.10

Vulnerability: This vulnerability (CWE-125/CWE-20) involves improper input validation within the TsBlock deserializer. An unauthenticated attacker can send specially crafted, malformed requests that, when processed by the C++ client, cause an out-of-bounds memory read and a subsequent crash of the client process.

Business Impact

The primary impact of this vulnerability is a Denial of Service (DoS) against the IoTDB C++ client. For critical infrastructure or industrial monitoring systems relying on this client, a crash can lead to operational downtime, loss of telemetry, and potential interruption of automated control processes. The CVSS score of 7.5 reflects the high impact on system availability.

Remediation Plan

Immediate Action: Update the Apache IoTDB C++ client to version 1.3.8 or 2.0.10 (or later) to secure the deserialization process.

Proactive Monitoring: Monitor client system logs for process crashes or unexpected termination events that may coincide with network activity.

Compensating Controls: Employ network intrusion detection systems (NIDS) to identify and block malformed packets directed at the client-side communication ports.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to be triggered by unauthenticated network input.

Analyst Recommendation

Because this vulnerability allows remote, unauthenticated actors to disrupt client services, it should be treated with urgency. Administrators must ensure that all instances of the IoTDB C++ client are updated to the latest secure versions to prevent potential service disruptions.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 3.0.0 before 4.14.6, 4.15.0 before 4.18.2, 4.19.0 before 4.20.0
---END_METADATA---

Description Summary:
Improper header filtering in Apache Camel allows attackers to inject case-variant headers, leading to remote code execution and arbitrary file writes.

Executive Summary:
A critical vulnerability in Apache Camel allows remote attackers to achieve code execution and file system access by bypassing header filtering mechanisms.

Vulnerability Details

CVE-ID: CVE-2026-40453

Affected Software: Apache Camel

Affected Versions: 3.0.0 before 4.14.6, 4.15.0 before 4.18.2, 4.19.0 before 4.20.0

Vulnerability: This is a header injection vulnerability occurring due to inconsistent case-sensitive filtering in specific Camel components (JMS, CoAP, Google Pubsub). An attacker with producer access to the message broker can inject malicious headers that are processed by downstream components.

Business Impact

Successful exploitation results in full remote code execution and arbitrary file write capabilities, posing a catastrophic risk to data integrity and system availability. With a CVSS score of 9.9, this vulnerability represents an extreme threat level, enabling attackers to take complete control of the affected application server.

Remediation Plan

Immediate Action: Upgrade to the patched versions provided by the vendor (4.20.0, 4.14.6, or 4.18.2) immediately.

Proactive Monitoring: Monitor message broker traffic for anomalous header patterns and review application logs for unauthorized file system operations or execution commands.

Compensating Controls: Implement strict input validation on message brokers and restrict producer access to trusted entities only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of triggering it via message injection, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for full system compromise, organizations must prioritize patching these Apache Camel components. Administrators should treat this as a high-priority update to prevent unauthorized code execution.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache IoTDB
AFFECTED_VERSIONS: 1.3.5 up to 1.3.8, 2.0.5 up to 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass in the Apache IoTDB /rest/v2/fastLastQuery endpoint allows authenticated users to access unauthorized last-value data.

Executive Summary:
A high-severity authorization bypass in Apache IoTDB allows authenticated users to access sensitive data they are not permitted to view.

Vulnerability Details

CVE-ID: CVE-2026-40452

Affected Software: Apache Software Foundation Apache IoTDB

Affected Versions: 1.3.5 up to (excluding) 1.3.8, 2.0.5 up to (excluding) 2.0.10

Vulnerability: This is an incorrect authorization and improper access control vulnerability (CWE-863/CWE-284). The flaw resides in the /rest/v2/fastLastQuery endpoint, where the system fails to correctly validate the permissions of an authenticated user, enabling unauthorized access to last-value data.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive industrial or time-series data managed by IoTDB. With a CVSS score of 7.5, this high-severity issue poses a significant risk to data confidentiality, potentially leading to operational intelligence leakage or violation of regulatory compliance requirements.

Remediation Plan

Immediate Action: Upgrade to Apache IoTDB version 1.3.8 or 2.0.10 (or later) immediately to resolve the authorization logic error.

Proactive Monitoring: Review database access logs for anomalous patterns in requests to the /rest/v2/fastLastQuery endpoint, particularly from users with limited roles.

Compensating Controls: If immediate patching is not feasible, implement strict network-level access controls to restrict access to the REST API to known, trusted internal management segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is accessible via the network, it requires existing authentication, which serves as a baseline barrier to entry.

Analyst Recommendation

Given the potential for unauthorized data access and the high CVSS severity, organizations should prioritize upgrading their IoTDB deployments to the patched versions. The risk is elevated by the ease with which an authenticated attacker can leverage this bypass; therefore, applying the vendor-provided security update is the only definitive mitigation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+); Office 2019 (19.0.0+); Office LTSC 2021 (16.0.1+); Office LTSC 2024 (16.0.0+)
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Microsoft Office allows authorized local attackers to elevate privileges.

Executive Summary:
A high-severity use-after-free vulnerability in Microsoft Office enables authorized local attackers to achieve privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-40420

Affected Software: Microsoft Office

Affected Versions: Microsoft 365 Apps for Enterprise (16.0.1+); Office 2019 (19.0.0+); Office LTSC 2021 (16.0.1+); Office LTSC 2024 (16.0.0+)

Vulnerability: This is an improper access control vulnerability in Microsoft Office Click-To-Run (C2R) that allows an authorized local attacker to elevate privileges on an affected host.

Business Impact

With a CVSS score of 8.8, this vulnerability allows a local attacker to escalate their privileges, potentially gaining full control over the workstation. This could lead to unauthorized access to sensitive user data and provide a foothold for further malicious activities on the local system.

Remediation Plan

Immediate Action: Apply the Microsoft security update referenced in the Microsoft CVE-2026-40420 Advisory immediately.

Proactive Monitoring: Monitor for unusual system behaviors or unauthorized privilege elevation attempts on workstations where Microsoft Office is installed.

Compensating Controls: Enforce strict user permission policies to minimize the potential impact of local privilege escalation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild.

Analyst Recommendation

Security teams must prioritize the deployment of these updates. Patching is critical to neutralize the threat of privilege escalation and protect organizational endpoints from unauthorized local exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1809, 21H2, 22H2; Windows 11 Version 23H2, 24H2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Windows TCP/IP stack allows an unauthorized attacker to execute arbitrary code over the network.

Executive Summary:
A critical use-after-free vulnerability in the Windows TCP/IP stack could allow a remote attacker to achieve arbitrary code execution on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-40415

Affected Software: Microsoft Windows 10, Windows 11

Affected Versions: Microsoft Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2) - see enrichment data for specific build ranges.

Vulnerability: This is a CWE-416 use-after-free vulnerability within the Windows TCP/IP driver. It allows an unauthenticated, remote attacker to trigger memory corruption and potentially execute code in the context of the kernel.

Business Impact

Successful exploitation could result in full system compromise, allowing attackers to install programs, view or delete data, and create new accounts with full user rights. Given the CVSS score of 8.1 and the potential for remote, unauthenticated exploitation, this vulnerability poses a severe risk to any organization running vulnerable Windows versions.

Remediation Plan

Immediate Action: Apply the latest monthly security updates from Microsoft for all affected Windows 10 and 11 environments.

Proactive Monitoring: Monitor network traffic for anomalous TCP/IP patterns and utilize EDR solutions to detect suspicious child process creation originating from system services.

Compensating Controls: Ensure Host-based firewalls are configured to block unnecessary inbound traffic and keep Windows Defender or equivalent endpoint protection active to detect exploitation attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of memory corruption exploits typically requires significant research to weaponize.

Analyst Recommendation

This vulnerability is highly critical due to its reach and the potential for remote code execution. Security teams should expedite the deployment of Microsoft security updates across all production endpoints to mitigate the risk of remote compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 Version 23H2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Windows Win32K - GRFX component allows an authorized attacker to execute code locally.

Executive Summary:
A heap-based buffer overflow in the Windows graphics subsystem allows a local, authorized attacker to escalate privileges and execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-40403

Affected Software: Microsoft Windows 10, Windows 11

Affected Versions: Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2) - see enrichment data for specific build ranges.

Vulnerability: This is a CWE-122 heap-based buffer overflow in the Win32K graphics component. The vulnerability requires the attacker to have local access and low privileges to trigger the overflow, which can lead to code execution in a higher-privileged context.

Business Impact

Exploitation of this flaw allows an attacker to move from a standard user account to system-level access, effectively bypassing operating system security boundaries. With a CVSS score of 8.8, this vulnerability is a primary target for lateral movement within a network once an initial foothold has been established.

Remediation Plan

Immediate Action: Apply the latest Microsoft cumulative security updates to all affected Windows workstations and servers.

Proactive Monitoring: Monitor for suspicious elevation of privilege events or unexpected crashes of graphics-related system processes.

Compensating Controls: Enforce the principle of least privilege by removing unnecessary local administrative rights from standard user accounts to limit the potential impact of local exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Heap-based overflows in kernel-mode drivers like Win32K are common vectors for privilege escalation.

Analyst Recommendation

While this exploit requires local access, its ability to grant system-level control makes it a high priority for patching. Organizations should prioritize updating all multi-user systems and workstations to prevent local privilege escalation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Hyper-V
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Windows Hyper-V allows an unauthorized attacker to elevate privileges on the local system.

Executive Summary:
A critical use-after-free vulnerability in Windows Hyper-V allows local attackers to achieve privilege escalation, potentially resulting in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40402

Affected Software: Microsoft Windows Hyper-V

Affected Versions: See vendor advisory

Vulnerability: This is a use-after-free memory corruption issue within the Windows Hyper-V hypervisor. An unauthorized attacker can leverage this flaw to elevate their privileges to a higher level of system access.

Business Impact

The ability to escalate privileges within a hypervisor environment is a significant security risk, as it may allow an attacker to escape the guest virtual machine and gain control over the host system. With a CVSS score of 9.3, this flaw threatens the integrity of virtualized workloads and the underlying host infrastructure.

Remediation Plan

Immediate Action: Update the host operating system and Hyper-V components to the latest version provided by Microsoft.

Proactive Monitoring: Monitor host system logs for unexpected privilege escalation events or system crashes related to the hypervisor.

Compensating Controls: Restrict local user access on systems running Hyper-V to prevent non-privileged users from attempting to interact with the hypervisor interface.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing virtualization should treat this update with high priority. Securing the hypervisor is essential to maintaining the isolation of virtual machines and preventing unauthorized escalation that could lead to host-level compromise.

---METADATA---
VENDOR: Aimogen
PRODUCT: Aimogen Pro (WordPress Plugin)
AFFECTED_VERSIONS: All versions up to, and including, 2.7.5
---END_METADATA---

Description Summary:
The Aimogen Pro plugin for WordPress allows unauthenticated arbitrary function calls. Attackers can exploit this to change the default user role to administrator and gain full site control.

Executive Summary:
A critical arbitrary function call vulnerability in the Aimogen Pro WordPress plugin allows unauthenticated attackers to escalate privileges and gain full administrative access to the website.

Vulnerability Details

CVE-ID: CVE-2026-4038

Affected Software: Aimogen Pro (WordPress Plugin)

Affected Versions: All versions up to, and including, 2.7.5

Vulnerability: The plugin lacks a capability check on the aiomatic_call_ai_function_realtime function. This allows an unauthenticated attacker to call arbitrary WordPress functions, such as update_option, to modify the site's default user role to "administrator" and enable open registration, facilitating an immediate administrative takeover.

Business Impact

The CVSS score of 9.8 reflects the extreme risk of total site compromise. An attacker can gain full control over the WordPress dashboard, allowing them to delete content, steal user data, install malware, or use the site for further phishing campaigns. This results in a complete loss of integrity and confidentiality for the affected WordPress installation.

Remediation Plan

Immediate Action: Update the Aimogen Pro plugin to the latest version (2.7.6 or higher) immediately. If an update is not available, deactivate and remove the plugin.

Proactive Monitoring: Check the WordPress users list for unauthorized administrator accounts and review the users_can_register and default_role options in the database for unauthorized changes.

Compensating Controls: Utilize a WordPress-specific Web Application Firewall (WAF) to block unauthorized requests to the admin-ajax.php or rest-api endpoints associated with the plugin.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the ability to gain administrative access without authentication makes this a high-value target for automated exploit scripts.

Analyst Recommendation

Site administrators must prioritize updating the Aimogen Pro plugin. The ease with which an unauthenticated attacker can achieve privilege escalation makes this vulnerability highly critical. After patching, a thorough audit of all administrative accounts is recommended to ensure no persistence has been established.

---METADATA---
VENDOR: Microsoft
PRODUCT: Entra ID
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An information exposure vulnerability in Microsoft Entra ID allows an unauthorized attacker to perform spoofing attacks over the network.

Executive Summary:
This critical vulnerability in Microsoft Entra ID allows unauthorized remote attackers to perform spoofing attacks, potentially leading to identity compromise.

Vulnerability Details

CVE-ID: CVE-2026-40379

Affected Software: Microsoft Entra ID

Affected Versions: See vendor advisory.

Vulnerability: This is an information exposure vulnerability (CWE-200) that permits an unauthorized attacker to view sensitive data. The CVSS vector indicates that while the attack is network-based and requires no authentication, it does involve user interaction (UI:R) and impacts the scope (S:C).

Business Impact

With a CVSS score of 9.3, this issue poses a significant risk to organizational identity security. Spoofing capabilities within Entra ID can be leveraged to bypass authentication controls, impersonate users, or gain unauthorized access to cloud-based resources, resulting in severe data loss or unauthorized access.

Remediation Plan

Immediate Action: Review the Microsoft Security Response Center (MSRC) update guide for the latest patches or configuration changes required for Entra ID.

Proactive Monitoring: Audit Entra ID sign-in logs and monitor for unusual account activity or unexpected modifications to identity configurations.

Compensating Controls: Enforce strict Conditional Access policies and multi-factor authentication (MFA) to limit the impact of potential identity spoofing.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Organizations should immediately consult the official Microsoft Security Update Guide for remediation steps regarding this Entra ID vulnerability. Because identity systems are central to modern security, applying vendor guidance promptly is essential to preventing credential theft or unauthorized access.

---METADATA---
VENDOR: Microsoft
PRODUCT: ASP.NET Core and Visual Studio 2026
AFFECTED_VERSIONS: Microsoft ASP.NET Core 10.0 (up to 10.0.7), Microsoft Visual Studio 2026 version 18.5 (up to 18.5.2)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper verification of cryptographic signatures in Microsoft ASP.NET Core allows unauthorized attackers to achieve privilege escalation over the network.

Executive Summary:
A critical cryptographic signature verification flaw in Microsoft ASP.NET Core and Visual Studio 2026 permits unauthorized network-based privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-40372

Affected Software: Microsoft ASP.NET Core and Microsoft Visual Studio 2026

Affected Versions: Microsoft ASP.NET Core 10.0 (up to 10.0.7); Microsoft Visual Studio 2026 version 18.5 (up to 18.5.2)

Vulnerability: The vulnerability stems from CWE-347, where the software fails to properly verify cryptographic signatures, allowing an unauthorized attacker to bypass security controls and elevate privileges.

Business Impact

The ability for an unauthorized remote attacker to elevate privileges carries a CVSS score of 9.1, indicating a high risk of total system compromise. This exposure can result in unauthorized access to sensitive data, modification of system configurations, and complete loss of control over the affected environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft to update ASP.NET Core to version 10.0.7 or later and Visual Studio 2026 to version 18.5.2 or later.

Proactive Monitoring: Monitor authentication logs and system access records for anomalous privilege escalation patterns or unexpected administrative actions.

Compensating Controls: Restrict network access to vulnerable services using firewall rules and implement robust identity and access management (IAM) policies to limit the potential blast radius of an unauthorized account.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitability and the high impact of privilege escalation, this vulnerability must be treated as a priority for immediate patching. Organizations should identify all instances of ASP.NET Core and Visual Studio within their infrastructure and verify that the latest patches have been applied across all production environments.

---METADATA---
VENDOR: Microsoft
PRODUCT: Dynamics 365
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate their permissions over a network.

Executive Summary:
A critical privilege escalation vulnerability in Microsoft Dynamics 365 (on-premises) allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-40371

Affected Software: Microsoft Dynamics 365

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw stems from improper handling of permissions and privileges. An authorized attacker can exploit this to bypass standard access controls and elevate their account status within the Dynamics 365 environment.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a high risk to data confidentiality and integrity. If an attacker elevates their privileges to administrative levels, they could gain full control over the CRM data, potentially leading to unauthorized data exfiltration or system-wide disruption.

Remediation Plan

Immediate Action: Apply the latest security patches for Microsoft Dynamics 365 (on-premises) as soon as they are made available by the vendor.

Proactive Monitoring: Monitor Dynamics 365 access logs for anomalous activity, specifically looking for users performing actions outside their defined roles.

Compensating Controls: Restrict network access to the Dynamics 365 server to trusted segments only, reducing the opportunity for an attacker to reach the vulnerable service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in core business applications like Dynamics 365 are high-priority targets. Organizations should prioritize patching these systems immediately to prevent unauthorized administrative escalation and subsequent data compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: SQL Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in Microsoft SQL Server allows an authorized attacker to execute arbitrary code over the network.

Executive Summary:
A critical path traversal vulnerability in Microsoft SQL Server permits authorized attackers to achieve remote code execution, posing a significant risk to database integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-40370

Affected Software: Microsoft SQL Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves external control of file names or paths within the database engine. This flaw allows an authenticated attacker with sufficient privileges to manipulate file operations, leading to arbitrary code execution across the network.

Business Impact

Successful exploitation of this vulnerability could lead to a total compromise of the database server, resulting in unauthorized data access, modification, or complete system takeover. With a CVSS score of 8.8, this flaw represents a high-severity risk that could cause significant operational downtime and severe reputational damage if sensitive business data is exfiltrated.

Remediation Plan

Immediate Action: Identify and apply the latest security patches provided by Microsoft to the affected SQL Server instances.

Proactive Monitoring: Review SQL Server error logs and audit trails for suspicious file path activities or unauthorized attempts to access system-level files.

Compensating Controls: Implement strict network segmentation and ensure that the service account running SQL Server operates under the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be treated as a priority for all database administrators. Organizations must verify their current patch levels against the vendor's security bulletins and apply updates immediately to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office Word
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An untrusted pointer dereference vulnerability in Microsoft Office Word allows an unauthorized attacker to execute arbitrary code locally.

Executive Summary:
An untrusted pointer dereference vulnerability in Microsoft Office Word poses a severe risk of local code execution for users on multiple versions of the software.

Vulnerability Details

CVE-ID: CVE-2026-40367

Affected Software: Microsoft Office Word

Affected Versions: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)

Vulnerability: This vulnerability involves an untrusted pointer dereference, which can be triggered by an attacker to achieve local code execution. The vulnerability is exploitable by an unauthenticated local user.

Business Impact

The vulnerability carries a CVSS score of 8.4, indicating a high level of risk. Successful exploitation could lead to full system compromise, unauthorized data access, and potential lateral movement within the enterprise environment.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft via the official update guide at https://aka.ms/OfficeSecurityReleases.

Proactive Monitoring: Monitor endpoint security logs for unusual process spawning behavior or unexpected crashes in Microsoft Office applications.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are active and configured to detect malicious document behavior.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for arbitrary code execution.

Analyst Recommendation

Given the high CVSS score and the critical nature of code execution vulnerabilities in productivity software, organizations must prioritize the deployment of the vendor-supplied patches. Administrators should verify that all affected systems are updated to the latest build versions immediately to eliminate the attack surface.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office Word
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Microsoft Office Word allows an unauthorized attacker to execute arbitrary code locally.

Executive Summary:
A use-after-free vulnerability in Microsoft Office Word presents a critical risk, allowing unauthorized local code execution.

Vulnerability Details

CVE-ID: CVE-2026-40366

Affected Software: Microsoft Office Word

Affected Versions: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)

Vulnerability: The software contains a use-after-free defect in memory management, which an unauthenticated attacker can leverage to execute arbitrary code.

Business Impact

With a CVSS score of 8.4, this vulnerability represents a significant threat to organizational security. Successful exploitation grants the attacker the ability to execute code with the privileges of the logged-in user, potentially resulting in data loss, theft, or complete system takeover.

Remediation Plan

Immediate Action: Apply the required security updates provided by Microsoft as detailed in the official advisory at https://aka.ms/OfficeSecurityReleases.

Proactive Monitoring: Monitor for suspicious document-handling activity and ensure that security patches are applied across all workstations running affected versions.

Compensating Controls: Utilize EDR/XDR tools to block suspicious execution chains commonly associated with Office document exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free flaws are frequently targeted by threat actors due to their reliability in code execution chains.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. IT teams should deploy the available patches across the environment to mitigate the risk of local code execution and ensure that security policies are strictly enforced for Office applications.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint Server
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016 (16.0.0+); SharePoint Server 2019 (16.0.0+); SharePoint Server Subscription Edition (16.0.0+)
---END_METADATA---

Description Summary:
A deserialization vulnerability in Microsoft SharePoint Server allows authenticated attackers to execute arbitrary code.

Executive Summary:
An authenticated remote code execution vulnerability in Microsoft SharePoint Server poses a critical risk to organizational network security.

Vulnerability Details

CVE-ID: CVE-2026-40365

Affected Software: Microsoft SharePoint Server

Affected Versions: SharePoint Enterprise Server 2016 (16.0.0+); SharePoint Server 2019 (16.0.0+); SharePoint Server Subscription Edition (16.0.0+)

Vulnerability: This is a remote code execution vulnerability caused by insufficient granularity of access control, allowing an authenticated attacker with low privileges to execute arbitrary code over a network.

Business Impact

The CVSS score of 8.8 reflects the high risk posed by this vulnerability. Successful exploitation could allow an attacker to gain full control over the SharePoint server, potentially leading to widespread data exfiltration, service disruption, and lateral movement within the corporate network.

Remediation Plan

Immediate Action: Install the cumulative updates referenced in the Microsoft Security Update CVE-2026-40365 guide.

Proactive Monitoring: Monitor SharePoint logs for suspicious activity, particularly requests involving deserialization patterns or unexpected execution of code.

Compensating Controls: Utilize a WAF to inspect incoming traffic for malicious payloads and restrict access to the SharePoint management interface from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild.

Analyst Recommendation

Immediate application of the provided cumulative updates is required. Because this vulnerability allows remote code execution, it represents a significant threat to the integrity of the SharePoint environment and should be addressed as a top priority.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office Word
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion vulnerability in Microsoft Office Word allows an unauthorized attacker to execute arbitrary code locally.

Executive Summary:
A critical type confusion vulnerability in Microsoft Office Word allows for local code execution, necessitating immediate patching.

Vulnerability Details

CVE-ID: CVE-2026-40364

Affected Software: Microsoft Office Word

Affected Versions: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021/2024 (16.0.0/16.0.1+)

Vulnerability: The software fails to correctly handle object types, leading to a type confusion vulnerability that can be exploited by an unauthenticated attacker to achieve local code execution.

Business Impact

The CVSS score of 8.4 highlights the high severity of this issue. Exploitation could allow an attacker to bypass security controls and execute arbitrary code, leading to total system compromise and potential impact on business confidentiality and integrity.

Remediation Plan

Immediate Action: Apply the vendor security updates immediately as outlined in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364.

Proactive Monitoring: Review system logs for anomalous activity and ensure that all Office software is kept up to date with the latest security baseline.

Compensating Controls: Use application control policies to restrict the execution of untrusted macros or Office add-ins that might facilitate the delivery of such exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Type confusion vulnerabilities often provide a robust path for attackers to bypass memory protections.

Analyst Recommendation

Given the high impact and the potential for code execution, it is imperative that organizations apply the provided patches immediately. Proactive patching remains the most effective defense against this class of vulnerability.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2016 (16.0.0+), Office 2019 (19.0.0+), Office for Android (16.0.1+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability in Microsoft Office allows a local, unauthenticated attacker to execute arbitrary code.

Executive Summary:
A critical heap-based buffer overflow in various Microsoft Office products may allow an unauthorized local attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-40363

Affected Software: Microsoft Office

Affected Versions: See metadata for specific version ranges.

Vulnerability: This is a heap-based buffer overflow (CWE-122) occurring within Microsoft Office components. The CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates that an unauthenticated local attacker can trigger this vulnerability without user interaction.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve code execution on the local system with the privileges of the victim. Given the CVSS score of 8.4, this poses a high risk of total system compromise, potentially leading to unauthorized data access, lateral movement within the network, and significant operational disruption.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft via the official Microsoft Security Update Guide (https://aka.ms/OfficeSecurityReleases).

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning or unexpected memory-related crashes within Office applications.

Compensating Controls: Ensure endpoint detection and response (EDR) solutions are configured to detect and block abnormal memory allocation patterns or unauthorized code execution attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its potential for arbitrary code execution, but it currently lacks known weaponization.

Analyst Recommendation

Due to the severity of a heap-based buffer overflow allowing remote code execution, organizations should prioritize patching all affected Microsoft Office installations. Ensure automated update mechanisms are functioning correctly to mitigate this risk across the environment.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office
AFFECTED_VERSIONS: Microsoft Office LTSC for Mac 2021 (16.0.1 < 16.109.26051019), Microsoft Office LTSC for Mac 2024 (16.0.0 < 16.109.26051019), Microsoft Word 2016 (16.0.1 < 16.0.5552.1000), Microsoft 365 Apps All versions, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024.
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Microsoft Office allows unauthorized attackers to achieve local code execution.

Executive Summary:
A critical use-after-free vulnerability in Microsoft Office permits unauthorized remote code execution, with potential for zero-click exploitation via email preview.

Vulnerability Details

CVE-ID: CVE-2026-40361

Affected Software: Microsoft Office

Affected Versions: Microsoft Office LTSC for Mac 2021 (16.0.1 < 16.109.26051019), Microsoft Office LTSC for Mac 2024 (16.0.0 < 16.109.26051019), Microsoft Word 2016 (16.0.1 < 16.0.5552.1000), Microsoft 365 Apps All versions, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024.

Vulnerability: This is a use-after-free vulnerability residing in a shared DLL used by Word and Outlook. An unauthenticated attacker could trigger this flaw, potentially leading to remote code execution through manipulated content, such as an email preview.

Business Impact

The vulnerability carries a CVSS score of 8.4, classifying it as High severity due to the potential for full system compromise. Successful exploitation grants attackers the ability to execute arbitrary code, which could lead to data exfiltration, ransomware deployment, or unauthorized access to sensitive internal communications.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft immediately, ensuring all Office builds are updated to the versions specified in the vendor advisory.

Proactive Monitoring: Review Outlook and Word access logs for anomalous behavior or unexpected process execution patterns that may indicate exploit attempts.

Compensating Controls: Disable the automatic preview pane in Outlook as a temporary measure to reduce the attack surface for potential zero-click vectors.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, public exploit code is available for this vulnerability. Given the risk of zero-click execution, the urgency for patching is extreme.

Analyst Recommendation

Due to the availability of public exploits and the high-severity nature of the use-after-free flaw, immediate patching is required. Organizations should prioritize updates across all workstations and servers running the affected Microsoft Office versions to prevent potential system compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1+), Office 2016 (16.0.0+), Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Office LTSC for Mac 2021 (16.0.1+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Microsoft Office allows an unauthorized local attacker to execute arbitrary code.

Executive Summary:
A critical use-after-free vulnerability in Microsoft Office could allow an unauthorized local attacker to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-40358

Affected Software: Microsoft Office

Affected Versions: See metadata for specific version ranges.

Vulnerability: This vulnerability is a use-after-free (CWE-416) flaw in Microsoft Office. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms that an unauthenticated local attacker can trigger this condition, leading to memory corruption and potential code execution.

Business Impact

The ability to execute arbitrary code via a use-after-free vulnerability presents a severe risk to organizational security, potentially resulting in full system compromise. With a CVSS score of 8.4, the vulnerability is highly dangerous, as it allows attackers to bypass standard security controls and gain unauthorized access to sensitive information.

Remediation Plan

Immediate Action: Update all affected Microsoft Office instances to the latest patched versions as outlined in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358).

Proactive Monitoring: Review system and application logs for unusual crashes or instability in Office applications, which may indicate exploitation attempts.

Compensating Controls: Utilize EDR tools to monitor for suspicious child processes initiated by Office applications, which is a common indicator of exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable as it involves memory management errors, but no public exploit code is currently confirmed.

Analyst Recommendation

The risk of arbitrary code execution makes this vulnerability a priority for remediation. Administrators should verify that all clients receive the necessary security patches promptly to prevent potential exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office SharePoint
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016 (16.0.0+), SharePoint Server 2019 (16.0.0+), SharePoint Server Subscription Edition (16.0.0+)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An insecure deserialization vulnerability in Microsoft Office SharePoint allows an authenticated attacker to execute arbitrary code over the network.

Executive Summary:
A critical deserialization vulnerability in Microsoft Office SharePoint allows an authenticated attacker to execute arbitrary code remotely.

Vulnerability Details

CVE-ID: CVE-2026-40357

Affected Software: Microsoft Office SharePoint

Affected Versions: See metadata for specific version ranges.

Vulnerability: This is a deserialization of untrusted data (CWE-502) vulnerability. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker with low-level privileges (authenticated user) can exploit this vulnerability over the network to gain unauthorized code execution.

Business Impact

Successful exploitation allows an authenticated attacker to execute code with the permissions of the SharePoint service, which often has high-level system access. Given the CVSS score of 8.8, this vulnerability poses a significant threat to data integrity, confidentiality, and system availability, potentially leading to a full compromise of the SharePoint environment.

Remediation Plan

Immediate Action: Apply the latest security patches for Microsoft SharePoint Server as specified in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357).

Proactive Monitoring: Monitor SharePoint server logs for unusual deserialization activities or unauthorized network requests targeting server-side interfaces.

Compensating Controls: Implement strict network segmentation and ensure that the SharePoint service account is running with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While authenticated, the high CVSS score reflects the significant impact of arbitrary code execution in a server environment.

Analyst Recommendation

Organizations running SharePoint must treat this vulnerability with high urgency. Patching is critical to prevent authenticated attackers from elevating their privileges and gaining control over the SharePoint server infrastructure.

---METADATA---
VENDOR: FastGPT
PRODUCT: AI Agent building platform
AFFECTED_VERSIONS: Prior to 4.14.9.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FastGPT versions prior to 4.14.9.5 are vulnerable to NoSQL injection in the login endpoint, allowing unauthenticated attackers to bypass authentication and gain administrative access.

Executive Summary:
A critical NoSQL injection vulnerability in FastGPT prior to version 4.14.9.5 allows unauthenticated attackers to bypass password validation and gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-40351

Affected Software: FastGPT AI Agent building platform

Affected Versions: Prior to 4.14.9.5

Vulnerability: The login endpoint utilizes insecure TypeScript type assertion, enabling an unauthenticated attacker to inject a MongoDB query operator (e.g., "$ne") into the password field. This forces the database to return a successful authentication result without a valid password.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the ease of exploit and the catastrophic impact of unauthorized administrative access. Successful exploitation could lead to full platform takeover, data exfiltration, and the manipulation of AI agents, causing severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: Update FastGPT to version 4.14.9.5 or higher to implement proper runtime validation of user input.

Proactive Monitoring: Inspect authentication logs for anomalous login attempts, specifically looking for JSON-like syntax or MongoDB query operators in password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common NoSQL injection patterns in request bodies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by this authentication bypass is extreme. Administrators must apply the provided patch immediately and conduct a thorough audit of account activity to ensure no unauthorized administrative actions were performed during the vulnerable period.

---METADATA---
VENDOR: Firebird
PRODUCT: Relational Database Management System (RDBMS)
AFFECTED_VERSIONS: Prior to 5.0.4, 4.0.7, and 3.0.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Firebird versions prior to 5.0.4, 4.0.7, and 3.0.14 are susceptible to arbitrary code execution via path traversal in the external engine plugin loader.

Executive Summary:
An authenticated user with specific privileges can achieve arbitrary code execution in Firebird databases by exploiting a path traversal vulnerability in the plugin loader.

Vulnerability Details

CVE-ID: CVE-2026-40342

Affected Software: Firebird RDBMS

Affected Versions: Prior to 5.0.4, 4.0.7, and 3.0.14

Vulnerability: The external engine plugin loader fails to sanitize user-supplied engine names, allowing an authenticated attacker with CREATE FUNCTION privileges to perform path traversal. This allows the loading of arbitrary shared libraries, which execute during initialization with the permissions of the database server process.

Business Impact

With a CVSS score of 9.9, this vulnerability represents an critical risk to the underlying host server. An attacker capable of executing arbitrary code with the privileges of the database service can fully compromise the host operating system, access all stored data, and potentially pivot into the internal network.

Remediation Plan

Immediate Action: Update Firebird to versions 5.0.4, 4.0.7, or 3.0.14 as appropriate for your deployment.

Proactive Monitoring: Audit database privileges to ensure that only trusted users are granted CREATE FUNCTION rights and monitor for unexpected shared library loading activities.

Compensating Controls: Restrict the service account permissions of the Firebird database process to the minimum level necessary, following the principle of least privilege.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete system compromise, immediate patching is required. Organizations should also review existing user roles to ensure that administrative privileges are strictly limited to authorized personnel to mitigate the impact of internal threats.

---METADATA---
VENDOR: Hot Chocolate
PRODUCT: Hot Chocolate GraphQL Server
AFFECTED_VERSIONS: Prior to 12.22.7, 13.9.16, 14.3.1, and 15.1.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Hot Chocolate's parser lacks recursion depth limits, allowing specially crafted GraphQL payloads to trigger a fatal StackOverflowException and crash the host process.

Executive Summary:
A critical denial-of-service vulnerability in the Hot Chocolate GraphQL server allows unauthenticated attackers to crash host processes via small, deeply nested payloads.

Vulnerability Details

CVE-ID: CVE-2026-40324

Affected Software: Hot Chocolate GraphQL Server

Affected Versions: Prior to 12.22.7, 13.9.16, 14.3.1, and 15.1.14

Vulnerability: The Utf8GraphQLParser performs no recursion depth validation, allowing an unauthenticated attacker to send crafted GraphQL documents that trigger an uncatchable StackOverflowException in .NET, effectively terminating the worker process.

Business Impact

This vulnerability allows for easy and repeatable denial-of-service (DoS) attacks against the GraphQL infrastructure. With a CVSS score of 9.1, the impact is significant, as it can cause widespread service outages, drop in-flight background tasks, and force frequent process restarts, severely disrupting application availability.

Remediation Plan

Immediate Action: Upgrade the Hot Chocolate package to version 12.22.7, 13.9.16, 14.3.1, or 15.1.14 as appropriate for your environment.

Proactive Monitoring: Monitor server logs for unexpected process terminations and investigate high frequencies of StackOverflowException errors.

Compensating Controls: While application-level workarounds are ineffective, administrators may attempt to limit request body sizes at the reverse proxy level, though this provides only limited protection against highly compressed payloads.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of triggering this crash and the lack of catchable exceptions in the affected code, immediate patching is required. Organizations relying on Hot Chocolate must transition to the updated versions to introduce necessary recursion depth limits and prevent service instability.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.3 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.3 and below are vulnerable to stored XSS in Mermaid diagrams, which can be escalated to arbitrary code execution on Electron-based desktop builds.

Executive Summary:
A critical vulnerability in SiYuan allows unauthenticated attackers to achieve arbitrary code execution via malicious Mermaid diagram injections.

Vulnerability Details

CVE-ID: CVE-2026-40322

Affected Software: SiYuan SiYuan

Affected Versions: 3.6.3 and below

Vulnerability: This vulnerability involves an improper rendering of Mermaid diagrams where "loose" security settings allow JavaScript injection. When processed within an Electron environment lacking context isolation, this stored XSS is escalated to arbitrary code execution.

Business Impact

The ability to execute arbitrary code on a user's machine poses a severe risk to confidentiality, integrity, and availability. With a CVSS score of 9.0, this flaw allows an attacker to compromise local data, install persistence, or pivot into the internal network.

Remediation Plan

Immediate Action: Upgrade the SiYuan application to version 3.6.4 or later immediately.

Proactive Monitoring: Review audit logs for suspicious activity involving note creation or unexpected external network connections originating from the application.

Compensating Controls: Restrict the use of untrusted Mermaid diagrams within the workspace until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize the update to version 3.6.4 across all desktop instances. Failure to patch leaves the local environment exposed to malicious code execution.

---METADATA---
VENDOR: NovumOS
PRODUCT: NovumOS
AFFECTED_VERSIONS: Prior to 0.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
NovumOS Syscall 12 allows unprivileged user-space processes to jump to kernel addresses, resulting in local privilege escalation to Ring 0.

Executive Summary:
A critical local privilege escalation vulnerability in NovumOS allows unprivileged users to execute arbitrary code in the kernel context.

Vulnerability Details

CVE-ID: CVE-2026-40317

Affected Software: NovumOS NovumOS

Affected Versions: Prior to 0.24

Vulnerability: The kernel fails to validate the entry point address provided to Syscall 12 (JumpToUser), enabling a Ring 3 user-mode process to redirect execution flow into Ring 0 kernel space.

Business Impact

With a CVSS score of 9.3, this flaw enables complete system compromise by any local user. An attacker gaining low-level access can escalate privileges to the highest level, resulting in total control over the operating system, potential data exfiltration, and the ability to disable security controls.

Remediation Plan

Immediate Action: Update the NovumOS operating system to version 0.24 or later to implement proper syscall validation.

Proactive Monitoring: Monitor system logs for unauthorized attempts to invoke Syscall 12 or suspicious execution patterns originating from standard user processes.

Compensating Controls: If patching is delayed, restrict system access to single-user mode or disable support for user-mode processes to eliminate the attack surface for this syscall.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical due to the direct path it provides for full system takeover. Organizations using NovumOS must treat the upgrade to version 0.24 as a high-priority security action to remediate this kernel-level privilege escalation risk.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: 4.5.139 and below
---END_METADATA---

Description Summary:
PraisonAI GitHub Actions workflows are vulnerable to credential leakage via the ArtiPACKED attack, allowing unauthorized access to repository secrets and supply chain compromise.

Executive Summary:
A critical credential leakage vulnerability in PraisonAI GitHub Actions allows attackers to steal tokens and execute a full supply chain compromise.

Vulnerability Details

CVE-ID: CVE-2026-40313

Affected Software: PraisonAI

Affected Versions: 4.5.139 and below

Vulnerability: The vulnerability stems from improper configuration of the actions/checkout step, where persist-credentials is not set to false, causing sensitive authentication tokens to be written to .git/config and subsequently leaked through build artifacts.

Business Impact

The exposure of GITHUB_TOKEN and other secrets allows an attacker to perform unauthorized repository actions, including code injection, poisoning of software releases, and theft of sensitive intellectual property. Given the 9.1 CVSS score, this represents a major risk to the integrity of the software supply chain and downstream users.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.5.140 and ensure all GitHub Actions workflows set persist-credentials: false in actions/checkout steps.

Proactive Monitoring: Audit existing repository secrets and rotate all tokens that were potentially exposed within artifacts generated by affected workflow versions.

Compensating Controls: Implement strict artifact access controls and scan build outputs for leaked credentials using automated secret scanning tools.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using PraisonAI must treat this as a high-priority supply chain security incident. Updating the software is mandatory, but security teams must also assume that any credentials used in previous CI/CD runs are compromised and initiate a full rotation of those secrets.

---METADATA---
VENDOR: wpengine
PRODUCT: Database Backup for WordPress
AFFECTED_VERSIONS: 0 through 2.5.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Database Backup for WordPress plugin is vulnerable to unauthorized arbitrary file read and deletion due to a missing authorization check.

Executive Summary:
A critical vulnerability in the Database Backup for WordPress plugin allows unauthenticated attackers to read or delete arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2026-4030

Affected Software: wpengine Database Backup for WordPress

Affected Versions: 0 through 2.5.2

Vulnerability: This is a missing authorization vulnerability (CWE-862) within the plugin, allowing unauthenticated remote attackers to perform unauthorized file operations, including reading sensitive configuration files or deleting critical system data.

Business Impact

Successful exploitation allows an attacker to compromise the integrity and confidentiality of the WordPress installation. With the ability to read arbitrary files, attackers may exfiltrate database credentials or sensitive configuration files, while file deletion capabilities can lead to a complete denial-of-service or system instability. The CVSS score of 8.1 reflects the high severity of potential impact on system availability and data integrity.

Remediation Plan

Immediate Action: Update the "Database Backup for WordPress" plugin to version 2.5.3 or later immediately.

Proactive Monitoring: Review web server access logs for anomalous requests targeting plugin-specific PHP files or directories, particularly those involving unexpected file system paths.

Compensating Controls: If immediate patching is not possible, disable the plugin entirely until an update can be applied to prevent unauthorized access.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication, making it a high-priority target for automated scanning.

Analyst Recommendation

The vulnerability represents a significant risk to site integrity. Administrators should prioritize the update to version 2.5.3 immediately to close the authorization gap and prevent potential file system manipulation by unauthorized parties.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI and praisonaiagents
AFFECTED_VERSIONS: PraisonAI below 4.5.139, praisonaiagents below 1.5.140
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PraisonAI and praisonaiagents are vulnerable to unauthenticated remote session hijacking via the /ws WebSocket endpoint.

Executive Summary:
Unauthenticated remote session hijacking in PraisonAI allows attackers to take control of browser automation sessions and leak sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-40289

Affected Software: PraisonAI and praisonaiagents

Affected Versions: PraisonAI below 4.5.139, praisonaiagents below 1.5.140

Vulnerability: The browser bridge is vulnerable to session hijacking due to missing authentication and a bypassable origin check on the /ws WebSocket endpoint. An unauthenticated attacker can route automation actions to their own control, effectively hijacking active browser sessions.

Business Impact

The CVSS score of 9.1 highlights the danger of this vulnerability, which allows an attacker to remotely control browser automation sessions. This can result in the leakage of sensitive page context, unauthorized execution of model-backed browser actions, and potential compromise of any automation results. The lack of authentication makes this an attractive target for network-adjacent attackers.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 4.5.139 or higher and praisonaiagents to version 1.5.140 or higher immediately.

Proactive Monitoring: Inspect network traffic for unauthorized connections to the WebSocket endpoint and review automation logs for unexpected session initiation commands.

Compensating Controls: Ensure the browser bridge is not exposed to the public internet and use network-level controls to restrict access to the WebSocket service to authorized management IPs only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability allows for complete session hijacking, posing a significant risk to data privacy and automation integrity. Organizations using these tools must apply the specified updates immediately to ensure session security and prevent unauthorized remote control.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI Workflow Engine
AFFECTED_VERSIONS: PraisonAI below 4.5.139, praisonaiagents below 1.5.140
---END_METADATA---

Description Summary:
The PraisonAI workflow engine is vulnerable to arbitrary command and code execution via untrusted YAML configuration files.

Executive Summary:
A critical code execution vulnerability in the PraisonAI workflow engine allows attackers to achieve full control over the host system using malicious YAML files.

Vulnerability Details

CVE-ID: CVE-2026-40288

Affected Software: PraisonAI / Praisonaiagents

Affected Versions: PraisonAI < 4.5.139, praisonaiagents < 1.5.140

Vulnerability: The workflow engine fails to validate or sandbox YAML inputs, allowing an attacker to execute arbitrary shell commands or Python scripts via the job definition processing functions.

Business Impact

With a CVSS score of 9.8, this flaw allows for total system takeover. An attacker influencing a workflow file can execute arbitrary code on the host, leading to full data compromise, lateral movement within the network, and the potential for persistent backdoors.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.5.139 and praisonaiagents to 1.5.140 immediately.

Proactive Monitoring: Monitor workflow execution logs for unusual shell commands or unexpected Python script invocations originating from the workflow engine.

Compensating Controls: Restrict access to YAML configuration files and ensure they are only editable by authorized personnel within a secure, non-public context.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical due to the lack of any sandboxing for user-provided configuration. Immediate patching is required. Furthermore, teams should conduct a forensic review of any workflow files that were modified by untrusted sources to ensure no malicious persistence mechanisms were established prior to patching.