---METADATA---
VENDOR: Microsoft
PRODUCT: Bing
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A deserialization vulnerability in Microsoft Bing allows an unauthorized remote attacker to execute arbitrary code via the network.

Executive Summary:
A critical deserialization flaw in Microsoft Bing permits unauthenticated remote attackers to execute arbitrary code, creating a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33819

Affected Software: Microsoft Bing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from insecure deserialization of untrusted data handled by the application. This allows an unauthorized attacker to inject malicious payloads that execute code within the context of the service.

Business Impact

A CVSS score of 10.0 reflects the maximum severity, indicating that this vulnerability could lead to a total breach of the affected infrastructure. Successful exploitation may result in complete loss of data confidentiality, integrity, and system availability.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft for the Bing service immediately.

Proactive Monitoring: Review network traffic and server logs for unusual deserialization patterns or unexpected process execution following data ingestion.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input and restrict network access to the affected service components.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and its 10.0 CVSS score, immediate patching is required to prevent remote code execution. Security teams should verify that all instances of the affected software are updated to the vendor-recommended versions without delay.

---METADATA---
VENDOR: Perl (CPAN)
PRODUCT: Compress::Raw::Zlib
AFFECTED_VERSIONS: Versions through 2.219
---END_METADATA---

Description Summary:
Compress::Raw::Zlib for Perl bundles an insecure version of the zlib library (CVE-2026-27171). Updating to version 2.220 resolves these underlying security issues.

Executive Summary:
A critical vulnerability in the bundled zlib library within Compress::Raw::Zlib exposes Perl applications to memory corruption and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3381

Affected Software: Compress::Raw::Zlib (Perl)

Affected Versions: Versions through 2.219

Vulnerability: This module includes a static copy of the zlib library that is susceptible to CVE-2026-27171. An unauthenticated attacker could provide specially crafted compressed data to an application using this module, triggering a vulnerability within the underlying library to achieve code execution or system denial.

Business Impact

Since many Perl applications rely on this module for data compression, the attack surface is broad. Exploitation could lead to arbitrary code execution, allowing attackers to compromise the underlying server hosting the Perl application. The CVSS score of 9.8 reflects the high risk associated with vulnerabilities in fundamental data processing libraries.

Remediation Plan

Immediate Action: Update the Compress::Raw::Zlib Perl module to version 2.220 or later, which includes the patched zlib 1.3.2 library.

Proactive Monitoring: Monitor for application crashes or unexpected memory usage spikes when processing compressed files or network streams.

Compensating Controls: Implement input validation to limit the size and type of compressed data processed by the application, and run applications in sandboxed environments to contain potential exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this specific Perl wrapper. However, the underlying zlib vulnerability is well-documented and targeted by researchers.

Analyst Recommendation

Supply chain vulnerabilities in core libraries like zlib are highly dangerous. Organizations must inventory their Perl environments and ensure that all instances of Compress::Raw::Zlib are updated. Failure to patch leaves applications vulnerable to reliable exploitation via malformed data inputs.

---METADATA---
VENDOR: Fastify
PRODUCT: @fastify/express
AFFECTED_VERSIONS: 4.0.4 and earlier
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A path handling error in @fastify/express causes middleware security controls to be bypassed for child plugins, leaving routes exposed to unauthorized requests.

Executive Summary:
A path handling bug in @fastify/express versions 4.0.4 and earlier causes critical middleware, such as authentication and authorization, to be bypassed for affected child plugin routes.

Vulnerability Details

CVE-ID: CVE-2026-33807

Affected Software: @fastify/express

Affected Versions: 4.0.4 and earlier

Vulnerability: A logic error in the onRegister function causes middleware paths to be incorrectly prefixed when inherited by child plugins, resulting in the middleware failing to match and execute for those routes.

Business Impact

This flaw effectively disables security layers such as authentication, authorization, and rate limiting for specific application routes. Given the CVSS score of 9.1, this creates a high risk of unauthorized data access and denial-of-service, as attackers can reach protected endpoints without satisfying security requirements.

Remediation Plan

Immediate Action: Upgrade the @fastify/express package to version 4.0.5 or later.

Proactive Monitoring: Review application routes to identify those that rely on middleware and monitor server logs for unexpected access to protected endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to enforce access control policies at the edge, providing a layer of protection while internal application code is being updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The bypass of core security controls represents a critical failure in the application's defense-in-depth posture. Development and security teams should prioritize the update to version 4.0.5 to restore intended security restrictions across all plugin routes.

---METADATA---
VENDOR: Fastify
PRODUCT: @fastify/reply-from and @fastify/http-proxy
AFFECTED_VERSIONS: @fastify/reply-from v12.6.1 and earlier; @fastify/http-proxy v11.4.3 and earlier
---END_METADATA---

Description Summary:
A vulnerability in Fastify proxy plugins allows attackers to strip proxy-added headers by manipulating the Connection header.

Executive Summary:
A high-severity vulnerability in Fastify proxy plugins enables attackers to bypass security mechanisms via header manipulation.

Vulnerability Details

CVE-ID: CVE-2026-33805

Affected Software: @fastify/reply-from, @fastify/http-proxy

Affected Versions: @fastify/reply-from v12.6.1 and earlier; @fastify/http-proxy v11.4.3 and earlier

Vulnerability: This vulnerability allows attackers to retroactively strip proxy-added headers from upstream requests by manipulating the client's Connection header, potentially bypassing security mechanisms or gaining unauthorized access.

Business Impact

With a CVSS score of 8.6, this flaw poses a significant risk to applications relying on these proxy plugins for security header injection. Bypassing these headers could lead to unauthorized access to downstream services, potentially exposing sensitive data.

Remediation Plan

Immediate Action: Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Proactive Monitoring: Monitor logs for requests with irregular Connection headers or signs of header stripping in proxy traffic.

Compensating Controls: Use a WAF to validate and sanitize the Connection header of incoming requests before they reach the proxy.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 2, 2026, a public exploit is available for this vulnerability. The risk is elevated, and immediate patching is required to prevent potential exploitation.

Analyst Recommendation

Because a public exploit is available, this vulnerability should be treated with extreme urgency. Developers must update their Fastify dependencies to the latest versions to mitigate the risk of header-based security bypasses.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability found in the Tenda F453 router could allow for unauthorized access or execution of arbitrary actions by an attacker.

Executive Summary:
A high-severity vulnerability in the Tenda F453 router introduces a critical risk of unauthorized device access and potential data exfiltration from the network.

Vulnerability Details

CVE-ID: CVE-2026-3380

Affected Software: Tenda F453

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability has been discovered in the Tenda F453 router software. Based on the high CVSS score, the flaw likely allows for an attacker to interact with the device at a high privilege level, potentially bypassing standard authentication mechanisms.

Business Impact

The CVSS score of 8.8 places this vulnerability in the High severity category. Exploitation could lead to a complete loss of control over the router, enabling an attacker to monitor all unencrypted traffic, gain access to local network resources, and severely impact the confidentiality of organizational data.

Remediation Plan

Immediate Action: Apply the manufacturer's recommended security updates to the Tenda F453 router to address the underlying vulnerability.

Proactive Monitoring: Monitor device logs for signs of brute-force attacks or access from unusual geographic locations that may indicate an attempted compromise.

Compensating Controls: Segment the network to limit the router's exposure and use internal firewalls to protect sensitive assets from a potentially compromised gateway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity score suggests that the vulnerability is highly reliable if an exploit were developed.

Analyst Recommendation

Given the central role of the Tenda F453 in network connectivity, this vulnerability must be addressed with urgency. Applying the vendor-provided update is the only effective way to mitigate the risk and protect the organizational perimeter.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Tenda F453 router has been identified that could permit unauthorized actors to interfere with device operations or gain elevated privileges.

Executive Summary:
The Tenda F453 router contains a high-severity vulnerability that poses a substantial risk of unauthorized access and potential disruption of network services.

Vulnerability Details

CVE-ID: CVE-2026-3379

Affected Software: Tenda F453

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is identified as a high-impact flaw within the Tenda F453 router. The CVSS score indicates that an attacker could likely target the device's control plane or management functions to achieve unauthorized objectives.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful compromise of the router allows an attacker to act as a "man-in-the-middle," potentially capturing sensitive credentials, redirecting user traffic to malicious sites, and causing significant business disruption through network instability.

Remediation Plan

Immediate Action: Deploy the latest security patches or firmware updates provided by Tenda to all affected F453 devices immediately.

Proactive Monitoring: Regularly audit the router's configuration for unauthorized changes and monitor for unexpected reboots or service interruptions that could indicate exploitation.

Compensating Controls: Enforce strong authentication for all administrative accounts and ensure that the management interface is only accessible via a secure, encrypted VPN connection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. Given the high impact, organizations should remain vigilant for any emerging proof-of-concept code.

Analyst Recommendation

The risk associated with this router vulnerability is significant due to its position as a gateway device. It is imperative that administrators prioritize the application of the vendor’s remediation steps to prevent potential network-wide compromise.

---METADATA---
VENDOR: Juniper
PRODUCT: Support Insights (JSI) Virtual Lightweight Collector (vLWC)
AFFECTED_VERSIONS: All versions before 3.0.94
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Juniper Networks vLWC ships with a default password for a high-privileged account that is not enforced to be changed, allowing unauthenticated remote access.

Executive Summary:
A default password vulnerability in Juniper vLWC allows unauthenticated attackers to gain full administrative control over the appliance.

Vulnerability Details

CVE-ID: CVE-2026-33784

Affected Software: Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC)

Affected Versions: All versions before 3.0.94

Vulnerability: The vLWC software utilizes a hardcoded or default password for a highly privileged account. Because the system does not mandate a password change during the initial provisioning process, unauthenticated network-based attackers can gain full control of the device.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme security risk. A successful exploit grants the attacker total control over the appliance, which can be used as a pivot point for further lateral movement within the network or to intercept and manipulate management traffic.

Remediation Plan

Immediate Action: Upgrade the vLWC software to version 3.0.94 or later immediately to enforce secure password policies.

Proactive Monitoring: Monitor for unauthorized login attempts and unusual administrative activity originating from unknown or unauthorized IP addresses.

Compensating Controls: Isolate the vLWC management interface within a restricted network segment (VLAN) and ensure access is limited to trusted administrators via VPN or jump hosts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the ease of unauthorized access, immediate action is required. Administrators must update the affected software and ensure that all administrative passwords are changed from their default state.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical flaw has been discovered in the Tenda F453 router that could lead to unauthorized system manipulation or a complete compromise of the device.

Executive Summary:
A high-severity security flaw in the Tenda F453 router could allow an attacker to compromise the device, leading to a loss of confidentiality and network control.

Vulnerability Details

CVE-ID: CVE-2026-3378

Affected Software: Tenda F453

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is characterized as a significant flaw in the Tenda F453 device software. While specific technical details are withheld, the high CVSS score suggests an attacker could potentially bypass security controls or execute arbitrary code on the router.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a High-level risk to the organization's infrastructure. If exploited, an attacker could gain a persistent foothold on the network, manipulate traffic routing, and expose internal resources to further exploitation, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Tenda F453 firmware to the most recent version available from the manufacturer's official support site immediately.

Proactive Monitoring: Implement automated log analysis to detect unusual configuration changes or unauthorized administrative access to the router’s management console.

Compensating Controls: Utilize a Web Application Firewall (WAF) or a dedicated security gateway to filter traffic to the device and ensure that administrative services are not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity level suggests that once details are released, exploitation attempts may follow quickly.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from security administrators. To ensure the continued protection of the network environment, the primary firmware update must be applied without delay to close the vulnerability.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Tenda F453 router, which may allow an attacker to compromise the device's integrity and gain unauthorized access.

Executive Summary:
A high-severity vulnerability in the Tenda F453 router poses a significant risk to network security, potentially allowing for unauthorized system access or control.

Vulnerability Details

CVE-ID: CVE-2026-3377

Affected Software: Tenda F453

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a high-impact flaw within the Tenda F453 firmware. Given the CVSS score, the issue likely resides in the web management interface or a core system service, potentially accessible to an attacker to execute unauthorized commands.

Business Impact

The CVSS score of 8.8 classifies this vulnerability as High severity, indicating a significant risk to business operations. A successful exploit could lead to the total compromise of the network gateway, allowing attackers to intercept sensitive data, perform lateral movement within the internal network, or cause sustained downtime for internet services.

Remediation Plan

Immediate Action: Administrators should immediately apply the latest firmware updates provided by Tenda to remediate this flaw and secure the device.

Proactive Monitoring: Review router access logs for unauthorized login attempts and monitor network traffic for anomalous outbound connections originating from the gateway.

Compensating Controls: Disable remote management features on the router and implement strict Access Control Lists (ACLs) to ensure the management interface is only reachable from trusted internal IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its high severity score, the potential for exploitation by sophisticated actors is high.

Analyst Recommendation

This vulnerability represents a critical threat to the perimeter security of any environment utilizing the Tenda F453. It is highly recommended that IT teams treat this as a priority and apply the necessary vendor patches immediately to mitigate the risk of unauthorized network intrusion.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Langflow contains a critical vulnerability related to the deployment of AI-powered agents and workflows that may allow for unauthorized system interaction.

Executive Summary:
A high-severity vulnerability in Langflow poses a significant risk to the integrity and confidentiality of AI-powered agent workflows and underlying system resources.

Vulnerability Details

CVE-ID: CVE-2026-33760

Affected Software: Langflow Langflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the insecure handling of AI workflow configurations, potentially allowing an attacker to manipulate agent behavior or access restricted system resources. Authentication requirements remain dependent on specific deployment configurations, but the flaw typically impacts the integrity of the workflow execution environment.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized execution of AI-driven commands, potentially resulting in data exfiltration or the poisoning of automated business processes. With a CVSS score of 8.8, this flaw represents a high risk to organizational security, as it directly targets the core functionality of the Langflow platform.

Remediation Plan

Immediate Action: Audit the Langflow deployment for vendor-supplied security patches and apply them immediately to the affected environment.

Proactive Monitoring: Monitor application access logs and workflow execution logs for anomalous patterns, specifically looking for unauthorized configuration changes or unexpected agent activity.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential impact of an agent that may have been compromised or manipulated via this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the increasing integration of AI workflows in production environments, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should treat this vulnerability with urgency. Prioritize the identification of all Langflow instances within your infrastructure and apply the latest vendor updates to close this security gap and prevent potential unauthorized agent manipulation.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the Tenda F453 router, version 1, potentially allowing for remote device compromise.

Executive Summary:
The Tenda F453 router is affected by a high-severity vulnerability that could allow attackers to gain unauthorized access to the device or network traffic.

Vulnerability Details

CVE-ID: CVE-2026-3376

Affected Software: Tenda F453

Affected Versions: Version 1

Vulnerability: A security vulnerability has been detected in the Tenda F453 router. For networking hardware, this often relates to vulnerabilities in the web management interface or exposed services that allow for remote command execution or unauthorized configuration changes.

Business Impact

A compromised router allows an attacker to intercept network traffic, launch man-in-the-middle (MitM) attacks, or use the device as a pivot point into the local network. The CVSS score of 8.8 reflects a High severity level, indicating a significant threat to network security and data privacy.

Remediation Plan

Immediate Action: Update the Tenda F453 router firmware to the latest secure version provided by the manufacturer.

Proactive Monitoring: Monitor the router for unauthorized configuration changes and review logs for unusual login attempts from external IP addresses.

Compensating Controls: Disable remote management of the router from the internet and ensure that the management interface is only accessible via a secure, local connection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. Networking equipment is a high-value target for botnet operators and persistent attackers.

Analyst Recommendation

Users of the Tenda F453 router should immediately check for and apply firmware updates. Ensuring that network infrastructure remains secure is a critical component of overall cybersecurity posture.

---METADATA---
VENDOR: OpenBao
PRODUCT: OpenBao
AFFECTED_VERSIONS: < 2.5.2
---END_METADATA---

Description Summary:
OpenBao fails to require user confirmation during OIDC/JWT logins in direct mode, enabling unauthenticated remote phishing and session hijacking.

Executive Summary:
An unauthenticated attacker can hijack victim sessions in OpenBao by exploiting a lack of user confirmation in the OIDC login flow, leading to unauthorized access to secrets.

Vulnerability Details

CVE-ID: CVE-2026-33757

Affected Software: OpenBao OpenBao

Affected Versions: Versions prior to 2.5.2

Vulnerability: When using JWT/OIDC with callback_mode set to direct, OpenBao does not prompt for user confirmation. An unauthenticated attacker can initiate an authentication request and trick a victim into visiting a URL, which automatically logs the victim into the attacker's session, allowing the attacker to poll for and obtain the resulting token.

Business Impact

This vulnerability allows for the unauthorized acquisition of OpenBao tokens, which are used to access sensitive secrets and credentials. Compromise of a secrets management system can lead to a catastrophic breach of the entire infrastructure. The CVSS score of 9.6 reflects the ease of exploitation and the critical nature of the compromised data.

Remediation Plan

Immediate Action: Upgrade OpenBao to version 2.5.2 or later, which introduces a mandatory confirmation screen for direct type logins.

Proactive Monitoring: Audit access logs for any OIDC login attempts using callback_mode: direct and review session creation patterns for anomalies.

Compensating Controls: As a workaround, administrators can remove any roles configured with callback_mode=direct or enforce confirmation on the identity provider (OIDC issuer) side.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. This flaw is a significant logic error in the authentication handshake that simplifies "remote phishing" attacks.

Analyst Recommendation

The primary remediation is to update OpenBao to version 2.5.2 immediately. Given that this affects the core security of a secrets management platform, the update should be treated as high priority. If patching is delayed, the suggested workaround of disabling direct callback mode must be implemented immediately.

---METADATA---
VENDOR: Docker
PRODUCT: BuildKit
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Docker BuildKit contains a vulnerability that could affect the efficiency and repeatability of build artifacts, potentially leading to unauthorized access or build-time exploits.

Executive Summary:
A high-severity vulnerability in Docker BuildKit could allow attackers to compromise the container build process, potentially leading to the injection of malicious code or unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-33747

Affected Software: Docker BuildKit

Affected Versions: See vendor advisory for affected versions

Vulnerability: BuildKit is a critical component for converting source code into build artifacts. The vulnerability likely involves improper handling of build instructions or environment isolation, which could allow an attacker with control over the build configuration to execute unauthorized actions or access sensitive information from the host or other build stages.

Business Impact

With a CVSS score of 8.4, this vulnerability represents a High-severity risk to the software supply chain. Successful exploitation could result in "poisoned" container images being deployed into production, leading to widespread compromise. Additionally, it could allow for the theft of build secrets, such as API keys or credentials, stored within the build environment.

Remediation Plan

Immediate Action: Update Docker and BuildKit to the latest versions immediately to incorporate the necessary security fixes for the build engine.

Proactive Monitoring: Audit build logs for unusual activity, such as unexpected network connections during the build phase or modifications to sensitive system files within the build container.

Compensating Controls: Implement build-time security scanning and use "rootless" mode for Docker builds to limit the potential impact of a build-stage escape or compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation. However, supply chain vulnerabilities are increasingly targeted by sophisticated actors, making this a high-priority concern for DevOps teams.

Analyst Recommendation

Securing the build pipeline is essential for modern software development. Organizations should treat this BuildKit update as a critical priority to ensure that container images remain untainted and that the build environment remains isolated from potential attackers.

---METADATA---
VENDOR: Convoy
PRODUCT: Convoy Panel
AFFECTED_VERSIONS: 3.9.0-beta to before 4.5.1
---END_METADATA---

Description Summary:
A critical JWT signature verification failure in Convoy allows unauthenticated attackers to forge tokens and bypass SSO authentication to log in as any user.

Executive Summary:
Convoy Panel versions 3.9.0-beta through 4.5.0 fail to verify JWT signatures, allowing attackers to impersonate any user and gain full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-33746

Affected Software: Convoy KVM Server Management Panel

Affected Versions: 3.9.0-beta to before 4.5.1

Vulnerability: The JWTService::decode() method fails to include the SignedWith constraint during validation. While it checks time-based claims, it does not verify the cryptographic signature. An unauthenticated attacker can forge a JWT with an arbitrary user_uuid to bypass the SSO flow and authenticate as any user.

Business Impact

This flaw allows for a complete bypass of authentication. An attacker can gain administrative control over the KVM management panel, allowing them to manage, delete, or access any virtual machine on the system. With a CVSS score of 9.8, this represents a catastrophic risk to hosting businesses and their clients' data.

Remediation Plan

Immediate Action: Upgrade Convoy to version 4.5.1 immediately to enable proper JWT signature verification.

Proactive Monitoring: Review authentication logs for unusual logins or logins from unexpected IP addresses, specifically looking for administrative access patterns.

Compensating Controls: Implement IP whitelisting for the management panel and consider adding a secondary layer of authentication (e.g., hardware-based MFA) that does not rely solely on JWTs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation. However, the technical nature of this flaw (missing signature check) makes it trivial to exploit once the vulnerable code path is identified.

Analyst Recommendation

This is an emergency-level vulnerability for any organization using Convoy. The ability for an unauthenticated attacker to forge an identity and gain access to a server management panel is a "game-over" scenario. The patch to version 4.5.1 must be applied immediately.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
WWBN AVideo contains an authentication bypass in the Live plugin's standalone control endpoint. Attackers can redirect token verification to a malicious server to gain control over live streams.

Executive Summary:
A critical authentication bypass vulnerability in WWBN AVideo allows unauthenticated remote attackers to hijack and manipulate any active live stream on the platform.

Vulnerability Details

CVE-ID: CVE-2026-33716

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: This is an authentication bypass vulnerability located in the plugin/Live/standAloneFiles/control.json.php endpoint. An unauthenticated attacker can supply a malicious streamerURL parameter, forcing the server to validate tokens against an attacker-controlled server that always returns a success response.

Business Impact

A successful exploit grants an attacker full unauthorized control over the platform's live streaming functionality. This includes the ability to terminate active broadcasts, start or stop recordings, and probe the system for private stream metadata. Given the CVSS score of 9.4, this represents a critical risk to data integrity and service availability, potentially leading to significant reputational damage for media organizations.

Remediation Plan

Immediate Action: Administrators must immediately apply the patch identified in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 or update to a version beyond 26.0.

Proactive Monitoring: Review web server access logs for unusual requests to control.json.php, specifically looking for external or unrecognized IP addresses in the streamerURL parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests to the standAloneFiles directory that contain external URLs in the query parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease with which the authentication bypass can be executed, the potential for exploitation is extremely high.

Analyst Recommendation

This vulnerability represents a severe security failure in the platform's authentication logic. Because it allows unauthenticated control over core business functions, it must be treated as a top priority. Organizations using AVideo for live broadcasting should apply the available patch immediately to prevent unauthorized stream hijacking.

---METADATA---
VENDOR: Chamilo
PRODUCT: LMS
AFFECTED_VERSIONS: Prior to 1.11.38 and 2.0.0-RC.3
---END_METADATA---

Description Summary:
Chamilo LMS uses a predictable, non-random token generation mechanism for password resets, allowing unauthenticated attackers to hijack user accounts.

Executive Summary:
A critical vulnerability in the Chamilo LMS password reset mechanism allows unauthenticated attackers to easily compute reset tokens and hijack any user account.

Vulnerability Details

CVE-ID: CVE-2026-33707

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is a cryptographic flaw where password reset tokens are generated using a static, predictable sha1($email) hash. There is no randomness, expiration, or rate limiting, enabling attackers to reset any user's password without authentication.

Business Impact

With a CVSS score of 9.4, this vulnerability is critical. Attackers can gain unauthorized access to any account, including administrative accounts, leading to full platform takeover, student and staff data exposure, and potential malicious content injection.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later.

Proactive Monitoring: Monitor for high volumes of password reset requests or suspicious account modification activity.

Compensating Controls: If immediate patching is not possible, disable the password reset feature or implement a temporary WAF rule to rate-limit reset requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly exploitable and allows for mass account takeover. Organizations must update their Chamilo instances immediately to secure their user base and administrative integrity.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Versions prior to 3.6.2
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.6.2 allow unauthenticated directory traversal and filename retrieval via the /api/file/readDir interface, exposing the structure of user notebooks.

Executive Summary:
A critical information disclosure vulnerability in SiYuan allows unauthenticated attackers to map and retrieve the names of all documents within a notebook by abusing the file directory API.

Vulnerability Details

CVE-ID: CVE-2026-33670

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The /api/file/readDir interface lacks sufficient authorization checks, allowing an unauthenticated attacker to traverse the file structure and retrieve the names of all documents. This serves as a reconnaissance vector for further data theft.

Business Impact

While this specific CVE focuses on filename retrieval, it provides the necessary metadata for an attacker to target specific sensitive documents for exfiltration. The CVSS score of 9.8 reflects the high risk of data exposure and the lack of authentication required to perform the traversal.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.6.2 or higher immediately.

Proactive Monitoring: Review application logs for unauthorized calls to the /api/file/readDir endpoint.

Compensating Controls: Restrict access to the SiYuan API via firewall rules or host-level access control lists (ACLs) to ensure only trusted devices can interact with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability, combined with CVE-2026-33669, allows for the complete automated harvesting of a user's knowledge base. Immediate patching is the only effective way to secure the application against unauthenticated discovery.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Versions prior to 3.6.2
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.6.2 are vulnerable to unauthorized data access where document IDs and content can be retrieved through the /api/file/readDir and /api/block/getChildBlocks interfaces.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical information disclosure flaw that allows unauthenticated attackers to view the full content of all stored documents via API abuse.

Vulnerability Details

CVE-ID: CVE-2026-33669

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The vulnerability stems from insecure API endpoints that do not properly restrict access to document identifiers and content. An unauthenticated attacker can first list document IDs and then programmatically retrieve the full text of those documents using the /api/block/getChildBlocks interface.

Business Impact

For a personal knowledge management system, this vulnerability represents a total loss of confidentiality for all stored data. The CVSS score of 9.8 is justified by the fact that sensitive personal or corporate information can be harvested remotely without any authentication.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.2 or later to secure the affected API endpoints.

Proactive Monitoring: Monitor network traffic for excessive requests to the /api/block/ and /api/file/ endpoints, especially from unrecognized IP addresses.

Compensating Controls: If the application is hosted on a network, use an authentication proxy or VPN to restrict access to the SiYuan web interface to authorized users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because SiYuan is often used to store highly sensitive personal or organizational data, this unauthenticated access flaw is critical. Users should update immediately and ensure their instances are not exposed to the public internet without additional layers of authentication.

---METADATA---
VENDOR: Zserio
PRODUCT: Zserio Framework
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Zserio data serialization framework is susceptible to a security vulnerability that may impact data integrity or process execution.

Executive Summary:
A high-severity vulnerability in the Zserio framework poses a significant risk to the integrity of serialized data structures within affected environments.

Vulnerability Details

CVE-ID: CVE-2026-33666

Affected Software: Zserio Zserio Framework

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified security flaw within the Zserio serialization framework. While specific attack vectors are currently limited, the nature of serialization frameworks often suggests risks related to improper input handling or memory corruption.

Business Impact

The exploitation of this vulnerability could lead to unauthorized data manipulation or potential application crashes, causing significant operational downtime. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent the compromise of data pipelines that rely on the Zserio framework for structured data exchange.

Remediation Plan

Immediate Action: Review the official Zserio project documentation and apply all security patches or version upgrades provided by the maintainers.

Proactive Monitoring: Monitor application logs for abnormal serialization exceptions or unexpected memory usage patterns.

Compensating Controls: Implement strict input validation at the application layer to ensure that serialized data conforms to expected schemas before processing.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, organizations utilizing Zserio must prioritize an audit of their software dependencies. We recommend applying the latest vendor patches immediately to mitigate the risk of data corruption or unauthorized code execution.

---METADATA---
VENDOR: EspoCRM
PRODUCT: EspoCRM
AFFECTED_VERSIONS: Prior to 9.3.4
---END_METADATA---

Description Summary:
A path traversal vulnerability in EspoCRM's formula scripting engine allows authenticated administrators to read or write arbitrary files on the server.

Executive Summary:
An authenticated administrator can exploit a file path manipulation flaw in EspoCRM to read or write arbitrary files on the underlying web server.

Vulnerability Details

CVE-ID: CVE-2026-33656

Affected Software: EspoCRM

Affected Versions: Prior to 9.3.4

Vulnerability: The vulnerability resides in the EspoUploadDir::getFilePath() method, where unsanitized sourceId parameters allow an authenticated administrator to escape intended directory constraints.

Business Impact

While the attack requires administrative authentication, the ability to overwrite or read arbitrary files can lead to full application compromise or sensitive data theft, including configuration files and credentials. With a CVSS score of 9.1, this flaw poses a severe threat to the integrity and confidentiality of the CRM data and the host server.

Remediation Plan

Immediate Action: Update EspoCRM to version 9.3.4 or later.

Proactive Monitoring: Audit logs for suspicious file system operations, specifically those involving unexpected paths or attempts to access system-level files.

Compensating Controls: Ensure the web server process runs with the least privilege necessary, strictly adhering to open_basedir restrictions to limit the scope of potential file access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should apply the security update immediately. Given that this vulnerability allows for file system manipulation, internal security teams should also audit administrative accounts for unauthorized activity or signs of privilege abuse.

---METADATA---
VENDOR: QuantumNous
PRODUCT: new-api
AFFECTED_VERSIONS: < 0.12.0-alpha.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
QuantumNous new-api is susceptible to Server-Side Request Forgery (SSRF), allowing an authenticated attacker to perform unauthorized requests from the application server.

Executive Summary:
A high-severity Server-Side Request Forgery vulnerability in the QuantumNous new-api LLM gateway poses a significant risk of unauthorized internal network interaction.

Vulnerability Details

CVE-ID: CVE-2026-33655

Affected Software: QuantumNous new-api

Affected Versions: < 0.12.0-alpha.1

Vulnerability: This SSRF vulnerability exists within the application's request handling logic, which fails to properly validate user-supplied input. An authenticated user can leverage this flaw to force the server to interact with internal resources or unintended external destinations.

Business Impact

The CVSS score of 7.7 highlights a significant risk, particularly due to the potential for bypassing network segmentation. Successful exploitation could allow an attacker to probe internal services, access sensitive cloud metadata, or interact with private APIs, potentially leading to a broader compromise of the organizational infrastructure.

Remediation Plan

Immediate Action: Upgrade to version 0.12.0-alpha.1 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review application and network logs for unusual outbound requests originating from the server hosting the new-api service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with egress filtering rules to restrict the server's ability to communicate with unauthorized internal or external endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that SSRF vulnerabilities in management systems can lead to full environmental compromise, immediate patching is required. Administrators should prioritize upgrading to version 0.12.0-alpha.1 to neutralize the attack vector.