---METADATA---
VENDOR: Funnelforms LLC
PRODUCT: FunnelFormsPro
AFFECTED_VERSIONS: up to and including 3.8.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The FunnelFormsPro WordPress plugin contains a code injection vulnerability, enabling authenticated users to achieve Remote Code Execution (RCE) on the host server.

Executive Summary:
The FunnelFormsPro plugin for WordPress is susceptible to a critical code injection vulnerability, permitting authenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-39440

Affected Software: Funnelforms LLC FunnelFormsPro

Affected Versions: up to and including 3.8.1

Vulnerability: This is a Code Injection (CWE-94) vulnerability. The plugin fails to properly sanitize inputs, allowing an attacker with low-level privileges to inject and execute arbitrary code on the server.

Business Impact

Successful exploitation grants an attacker full control over the web server, leading to potential data exfiltration, total system compromise, and the ability to pivot into the internal network. With a CVSS score of 9.9, this vulnerability represents a critical risk to any organization hosting this plugin, as it facilitates full administrative control via remote code execution.

Remediation Plan

Immediate Action: Immediately deactivate and remove the FunnelFormsPro plugin from the production environment until a security patch is released by the vendor.

Proactive Monitoring: Review web server logs for suspicious file modifications, unusual PHP execution patterns, or unauthorized access to sensitive system files.

Compensating Controls: Ensure the web server process runs with the least privilege necessary and utilize a WAF with rules configured to detect and block common code injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently highly exploitable, as code injection in a web plugin provides a direct path to server compromise.

Analyst Recommendation

Due to the critical nature of this RCE vulnerability and the lack of a verified patch, the most effective remediation is the complete removal of the vulnerable plugin. Security teams should audit their WordPress environments to confirm the removal of the affected version and monitor for indicators of compromise.

---METADATA---
VENDOR: Arraytics
PRODUCT: Timetics
AFFECTED_VERSIONS: up to and including 1.0.53
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the Timetics WordPress plugin allows unauthorized users to manipulate access control security levels.

Executive Summary:
A missing authorization vulnerability in the Timetics WordPress plugin allows attackers to bypass security controls, potentially leading to unauthorized access and configuration changes.

Vulnerability Details

CVE-ID: CVE-2026-39432

Affected Software: Arraytics Timetics (WordPress Plugin)

Affected Versions: Up to and including 1.0.53

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862), which allows unauthenticated attackers to exploit incorrectly configured access controls and perform actions that should be restricted.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to the security of the WordPress instance. An attacker could potentially gain unauthorized access to appointment data, customer information, or administrative functions, leading to data breaches or service disruption.

Remediation Plan

Immediate Action: Update the Timetics plugin to version 1.0.54 or later immediately.

Proactive Monitoring: Monitor WordPress audit logs for unexpected administrative actions or configuration changes originating from unauthenticated sessions.

Compensating Controls: If an immediate update is not feasible, consider deactivating the plugin until a patch can be applied, or deploy a Web Application Firewall (WAF) rule to block unauthorized access to plugin-specific endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an access control bypass, which is a common target for automated exploitation in the WordPress ecosystem.

Analyst Recommendation

Administrators must update the Timetics plugin to the latest version immediately to close the authorization gap. Failure to do so leaves the application vulnerable to unauthorized access and potential data exposure.

---METADATA---
VENDOR: NuGet
PRODUCT: NuGetGallery
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: versions
---END_METADATA---

Description Summary:
A cross-package metadata injection vulnerability in NuGetGallery allows for arbitrary blob writes and potential remote code execution via crafted .nuspec files.

Executive Summary:
A critical vulnerability in the NuGetGallery backend allows attackers to achieve remote code execution and arbitrary file manipulation through malicious metadata injection.

Vulnerability Details

CVE-ID: CVE-2026-39399

Affected Software: NuGet NuGetGallery

Affected Versions: See vendor advisory

Vulnerability: The vulnerability arises from insufficient input validation of .nuspec files and URI fragment injection. This allows an attacker to control resolved blob paths, resulting in RCE or unauthorized modification of repository content.

Business Impact

With a CVSS score of 9.6, this flaw poses a severe risk to the integrity of the software supply chain. Attackers could potentially inject malicious code into software packages, leading to widespread downstream compromise and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Ensure the NuGetGallery environment is updated to include the fix provided in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

Proactive Monitoring: Monitor repository logs for irregular package metadata patterns or unauthorized attempts to access or modify storage blobs.

Compensating Controls: Implement strict input validation and sandboxing for all package processing pipelines to restrict access to underlying storage containers.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate package metadata is a high-impact risk for any development environment. Administrators must verify the integrity of their NuGetGallery deployments and apply the necessary code patches immediately to mitigate the risk of supply chain attacks.

---METADATA---
VENDOR: Delmare Digital
PRODUCT: Payload-Puck Plugin
AFFECTED_VERSIONS: Prior to 0.6.23
---END_METADATA---

Description Summary:
The @delmaredigital/payload-puck plugin for PayloadCMS bypasses collection-level access controls, allowing unauthorized API access.

Executive Summary:
An access control bypass in the Payload-Puck plugin for PayloadCMS allows unauthorized users to manipulate data via API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-39397

Affected Software: @delmaredigital/payload-puck

Affected Versions: Prior to 0.6.23

Vulnerability: The createPuckPlugin() function incorrectly calls the Payload local API with overrideAccess: true, which ignores all defined collection-level access rules. This effectively disables security for the affected API endpoints, allowing any user to interact with the data.

Business Impact

This vulnerability (CVSS 9.4) allows unauthorized access to data managed by the Puck visual page builder. The business impact includes potential unauthorized modification or deletion of content, and exposure of sensitive data, which could lead to significant data integrity loss.

Remediation Plan

Immediate Action: Update the @delmaredigital/payload-puck plugin to version 0.6.23 or later.

Proactive Monitoring: Review API access logs for unauthorized CRUD operations directed toward the /api/puck/* endpoints.

Compensating Controls: Implement external API gateway restrictions to enforce authorization rules if the plugin cannot be updated immediately.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin updates should be applied immediately to restore proper access control. Administrators should also conduct an audit of data touched by the Puck plugin to ensure no unauthorized changes were made while the vulnerability was active.

---METADATA---
VENDOR: Genealogy
PRODUCT: Genealogy
AFFECTED_VERSIONS: Prior to 5.9.1
---END_METADATA---

Description Summary:
A broken access control flaw in the Genealogy PHP application allows authenticated users to transfer ownership of arbitrary non-personal team workspaces to their own accounts.

Executive Summary:
A critical access control vulnerability in Genealogy permits authenticated users to perform unauthorized team ownership takeovers.

Vulnerability Details

CVE-ID: CVE-2026-39355

Affected Software: Genealogy

Affected Versions: Prior to 5.9.1

Vulnerability: The application fails to properly validate permissions when transferring team ownership. This allows any authenticated user to escalate their privileges by claiming ownership of teams they do not manage.

Business Impact

This vulnerability presents a significant risk of data exfiltration and unauthorized administrative control over team workspaces. With a CVSS score of 9.9, the impact on organizational data privacy is extreme, as attackers can gain access to all data associated with compromised teams.

Remediation Plan

Immediate Action: Update the Genealogy application to version 5.9.1 or later to remediate the access control logic.

Proactive Monitoring: Audit ownership change logs to identify any unauthorized transfers of team workspaces that occurred prior to patching.

Compensating Controls: Restrict access to the application to trusted internal networks and implement strict session monitoring for unusual account activity.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a standard user to seize control of arbitrary workspaces is a critical security failure. Organizations should prioritize updating to version 5.9.1 to ensure that authorization checks are correctly enforced across all team management functions.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in ChurchCRM's API middleware allows unauthenticated attackers to access protected API endpoints, exposing sensitive member data and system information.

Executive Summary:
A critical authentication bypass in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to gain unauthorized access to restricted API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-39339

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is an authentication bypass vulnerability located in the ChurchCRM/Slim/Middleware/AuthMiddleware.php file. Unauthenticated attackers can circumvent security controls by injecting "api/public" into the request URL.

Business Impact

The vulnerability poses a severe risk to data confidentiality and integrity, as it allows unauthorized access to church member databases and internal system metadata. With a CVSS score of 9.1, this flaw could lead to mass data exfiltration and potential regulatory non-compliance regarding sensitive personal information.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.1.0 or later immediately to apply the necessary middleware security patch.

Proactive Monitoring: Review web server and application access logs for unusual patterns, specifically monitoring for requests containing "api/public" strings targeting protected endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing "api/public" in the URL path until the patch can be deployed.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the sensitivity of the data involved, the potential for exploitation is high.

Analyst Recommendation

The severity of this authentication bypass cannot be overstated, as it provides a direct path to sensitive internal data without requiring credentials. Organizations must prioritize the update to version 7.1.0 to eliminate this exposure and prevent unauthorized access to their management systems.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to inject arbitrary PHP code, resulting in full server compromise.

Executive Summary:
A critical pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to achieve full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-39337

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is a pre-authentication remote code execution vulnerability originating from improper sanitization of the "$dbPassword" variable during the installation process. It serves as an incomplete remediation for a previous vulnerability (CVE-2025-62521).

Business Impact

Successful exploitation grants an attacker complete control over the underlying server, enabling data theft, lateral movement, and the installation of persistent backdoors. Given the critical CVSS score of 10, this vulnerability represents an existential threat to the integrity and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update ChurchCRM to version 7.1.0 immediately; if installation is currently in progress, ensure the environment is isolated until the patch is applied.

Proactive Monitoring: Audit server logs for unexpected execution of PHP files or anomalous processes initiated during or after the installation phase.

Compensating Controls: Ensure the installation directory is protected by strict file system permissions and restrict public access to the setup wizard interface.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents the highest level of risk, allowing for total server takeover. It is imperative that administrators verify their ChurchCRM installations are updated to 7.1.0 to prevent remote command execution and maintain the security of the host environment.

---METADATA---
VENDOR: TriliumNext
PRODUCT: Trilium
AFFECTED_VERSIONS: < 0.102.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in Trilium Notes, involving improper access control and missing authentication, allows unauthorized users to access and manipulate critical application functions.

Executive Summary:
Improper access control in Trilium Notes allows unauthenticated users to access critical functions, necessitating an immediate update to version 0.102.2.

Vulnerability Details

CVE-ID: CVE-2026-39310

Affected Software: TriliumNext Trilium

Affected Versions: All versions prior to 0.102.2

Vulnerability: This vulnerability encompasses improper access control (CWE-284) and missing authentication for critical functions (CWE-306). The vulnerability is remotely exploitable without authentication, allowing attackers to perform actions that should be restricted to authenticated users.

Business Impact

Successful exploitation poses a significant risk to personal knowledge bases stored within the application, as unauthorized users could read, modify, or delete sensitive notes. With a CVSS score of 8.6, this vulnerability represents a major security failure for any organization relying on Trilium for documentation or personal data storage.

Remediation Plan

Immediate Action: Update Trilium to version 0.102.2 or later to ensure proper authentication controls are enforced.

Proactive Monitoring: Audit application access logs for any unauthorized access attempts or unexpected modifications to notes or configuration settings.

Compensating Controls: If the application must remain exposed, place it behind a secure VPN or an authenticated proxy that enforces strict access control before reaching the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning by threat actors.

Analyst Recommendation

The existence of a proof-of-concept combined with the ease of exploitation makes this a high-priority item for remediation. All users of Trilium Notes should apply the patch immediately to prevent unauthorized access to their knowledge bases.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 1.5.113
---END_METADATA---

Description Summary:
A Path Traversal vulnerability in the PraisonAI Action Orchestrator allows attackers to read or write arbitrary files on the host system.

Executive Summary:
A critical Path Traversal flaw in PraisonAI enables attackers to overwrite sensitive files or execute payloads via the Action Orchestrator.

Vulnerability Details

CVE-ID: CVE-2026-39305

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.113

Vulnerability: The Action Orchestrator fails to sanitize input paths, permitting the use of directory traversal sequences (../). This allows an attacker to escape the designated workspace directory and perform unauthorized file system operations.

Business Impact

With a CVSS score of 9.0, this vulnerability allows for significant system-level impact. Attackers can gain persistence, modify configuration files, or overwrite binaries, leading to total compromise of the PraisonAI host.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.113 or later to patch the path validation logic.

Proactive Monitoring: Monitor file system activity logs for unauthorized modifications to sensitive directories and binary files.

Compensating Controls: Run the application within a containerized environment with a read-only root file system and strictly limited volume mounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities in orchestration systems are extremely dangerous. Organizations must upgrade to version 1.5.113 immediately to prevent potential remote code execution or system file tampering.

---METADATA---
VENDOR: Pivotal
PRODUCT: CRM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in Pivotal CRM that may allow unauthorized access or impact system integrity.

Executive Summary:
A high-severity vulnerability in Pivotal CRM poses a significant risk to organizational data integrity and system access control.

Vulnerability Details

CVE-ID: CVE-2026-39253

Affected Software: Pivotal CRM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within Pivotal CRM. Based on the CVSS score of 8.1, this flaw likely allows for unauthorized actions that could compromise the confidentiality or integrity of the CRM environment.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive customer data, potentially resulting in regulatory non-compliance and significant reputational harm. With a CVSS score of 8.1, the vulnerability is classified as High, indicating that successful exploitation could lead to a substantial compromise of the CRM's core functionality.

Remediation Plan

Immediate Action: Apply all vendor-supplied security patches for Pivotal CRM immediately upon release.

Proactive Monitoring: Monitor system and application access logs for unusual patterns or unauthorized administrative activity.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter malicious traffic targeting the CRM interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, organizations should treat this vulnerability with urgency. Administrators must verify their current version against the vendor's security documentation and prioritize patching to mitigate the risk of unauthorized system access.