---METADATA---
VENDOR: Xpro
PRODUCT: Xpro Addons — 140+ Widgets for Elementor
AFFECTED_VERSIONS: 0 through 1.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability in the Xpro Addons plugin for WordPress allows authenticated attackers to manipulate database queries.

Executive Summary:
A Blind SQL Injection vulnerability in Xpro Addons for Elementor allows authenticated attackers to potentially extract sensitive information from the underlying WordPress database.

Vulnerability Details

CVE-ID: CVE-2026-45214

Affected Software: Xpro Xpro Addons — 140+ Widgets for Elementor

Affected Versions: 0 through 1.5.1

Vulnerability: This vulnerability is a SQL Injection (CWE-89) flaw originating from improper input sanitization. Per the CVSS vector (PR:L), this attack requires an authenticated user with at least low-level privileges to successfully trigger the injection.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive data stored within the WordPress database, including user credentials or configuration details. While the base CVSS score is 8.5, the requirement for authenticated access slightly lowers the immediate risk to unauthenticated external threats. However, if an attacker compromises a low-privileged account, they could leverage this flaw to escalate their impact significantly.

Remediation Plan

Immediate Action: Update the Xpro Addons plugin to version 1.5.2 or later immediately to incorporate the vendor's security patch.

Proactive Monitoring: Monitor database query logs for anomalous, high-frequency, or suspicious SQL syntax patterns that may indicate automated injection attempts.

Compensating Controls: Ensure a Web Application Firewall (WAF) is configured with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a high-severity risk due to the potential for full database compromise if the underlying application uses an overly privileged database user.

Analyst Recommendation

Given the potential for data exfiltration, organizations utilizing this plugin must prioritize the update to version 1.5.2. Failure to patch may allow authenticated users to perform unauthorized database operations, placing the confidentiality and integrity of the application environment at risk.

---METADATA---
VENDOR: Saad Iqbal APIExperts
PRODUCT: WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
AFFECTED_VERSIONS: 0 through 4.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability in the WC Shop Sync plugin for WooCommerce allows authenticated attackers to execute unauthorized database queries.

Executive Summary:
A Blind SQL Injection vulnerability in the WC Shop Sync plugin for WooCommerce allows authenticated attackers to potentially compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-45211

Affected Software: Saad Iqbal APIExperts WC Shop Sync (woosquare)

Affected Versions: 0 through 4.7.1

Vulnerability: This is a SQL Injection vulnerability (CWE-89) that permits an attacker to interfere with the queries made to the database. The CVSS vector indicates that this attack requires an authenticated user (PR:L) to interact with the vulnerable plugin function.

Business Impact

The exploitation of this flaw could result in the exfiltration of sensitive e-commerce data, such as product details or customer information, depending on the database permissions. Although the CVSS score is 8.5, the necessity of an authenticated session limits the attack surface; nevertheless, the risk to business data integrity remains critical.

Remediation Plan

Immediate Action: Update the WC Shop Sync plugin to version 4.7.2 or later as soon as possible.

Proactive Monitoring: Review database access logs for unusual query patterns and unexpected errors that may signify an ongoing injection attempt.

Compensating Controls: Deploy or update WAF rules to filter malicious SQL syntax and restrict access to the administrative/plugin settings that interact with the database.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows attackers to bypass standard application logic to interact directly with the database engine.

Analyst Recommendation

Security teams should treat this vulnerability with high urgency. Patching the plugin is the only definitive way to eliminate the underlying code flaw. Ensure all WordPress plugin updates are managed through a centralized process to maintain a consistent security posture.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A TOCTOU race condition in the TrendAI Apex One agent allows a local attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in the TrendAI Apex One agent poses a significant security risk by allowing attackers to gain elevated system permissions.

Vulnerability Details

CVE-ID: CVE-2026-45208

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: This vulnerability is a time-of-check time-of-use (TOCTOU) race condition in the agent's processing. It requires the attacker to have local access and low privileges on the host system to successfully trigger the escalation.

Business Impact

Successful exploitation of this flaw allows a local user to escalate privileges to a higher level, potentially gaining administrative control over the host. Given the CVSS score of 7.8, this represents a High severity risk, as it could lead to full system compromise, data theft, or the disabling of security software on the endpoint.

Remediation Plan

Immediate Action: Update on-premises installations of TrendAI Apex One to version 14.0.0.17079 or later; SaaS users should ensure their agents are updated to 14.0.20731.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution patterns or unexpected changes to local system configuration files.

Compensating Controls: Restrict local user access and ensure that standard user accounts do not have unnecessary permissions that could facilitate the exploitation of local race conditions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TOCTOU vulnerabilities typically require precise timing, making them moderately difficult to weaponize reliably.

Analyst Recommendation

This vulnerability is a significant threat to endpoint integrity. Organizations should prioritize patching TrendAI Apex One agents across their environment to eliminate the potential for local privilege escalation.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An origin validation error in the TrendAI Apex One agent allows a local attacker to escalate privileges.

Executive Summary:
A critical origin validation flaw in the TrendAI Apex One agent enables local attackers to escalate privileges on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-45207

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: The vulnerability stems from an origin validation error within the agent, which can be exploited by a local attacker with low privileges to perform unauthorized actions and escalate their system privileges.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a high risk to organizational security. An attacker who has already gained a foothold on a system with limited access could use this flaw to gain full control, potentially leading to unauthorized data access or widespread system disruption.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates: upgrade on-premises agents to 14.0.0.17079 and SaaS agents to 14.0.20731.

Proactive Monitoring: Review system audit logs for unauthorized attempts to interface with the Apex One agent or unexpected privilege escalation events.

Compensating Controls: Implement strict endpoint hardening and limit local user permissions to reduce the attack surface available to a local actor.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access inherently limits the scope of the threat to already compromised endpoints.

Analyst Recommendation

The severity of this issue necessitates prompt remediation. IT administrators should verify that all managed endpoints running TrendAI Apex One are updated to the specified versions to prevent privilege escalation.

---METADATA---
VENDOR: Trend Micro
PRODUCT: TrendAI Apex One
AFFECTED_VERSIONS: 2019 (14.0) up to 14.0.0.17079; SaaS up to 14.0.20731
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An origin validation vulnerability in the TrendAI Apex One agent allows for local privilege escalation.

Executive Summary:
A privilege escalation vulnerability in the TrendAI Apex One agent, caused by improper origin validation, requires immediate patching to prevent unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-45206

Affected Software: Trend Micro TrendAI Apex One

Affected Versions: TrendAI Apex One 2019 (14.0) up to 14.0.0.17079; TrendAI Apex One as a Service (SaaS) up to 14.0.20731

Vulnerability: This vulnerability involves an origin validation error that allows an authenticated local user to perform actions outside of their intended privilege level, resulting in successful privilege escalation.

Business Impact

The CVSS score of 7.8 underscores the high business impact of this vulnerability. If left unpatched, an attacker with local access can bypass security controls to gain elevated privileges, significantly increasing the risk of data breaches and persistent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Update all affected TrendAI Apex One agents to version 14.0.0.17079 for on-premises or 14.0.20731 for SaaS deployments.

Proactive Monitoring: Monitor for unusual activity involving agent-related processes or indicators of local privilege escalation attempts.

Compensating Controls: Ensure that systems are configured with the principle of least privilege to minimize the potential impact should an attacker attempt to exploit local vulnerabilities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the potential for privilege escalation makes this a high-priority patch.

Analyst Recommendation

Administrators must prioritize the deployment of the identified updates. Given the nature of the flaw, failing to patch leaves endpoints vulnerable to local attackers seeking to gain administrative control.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:19:23.203Z
---END_METADATA---

Description Summary:
A Time-of-Check Time-of-Use race condition in the Imagination Graphics DDK allows a local authenticated attacker to achieve high privileges.

Executive Summary:
A time-of-check time-of-use race condition vulnerability in Imagination Technologies Graphics DDK allows a low-privileged local user to compromise host kernel memory and achieve total system impact.

Vulnerability Details

CVE-ID: CVE-2026-45203

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: This is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability (CWE-367) occurring within the GPU firmware interaction handling. An authenticated local attacker requires low privileges and no user interaction to trigger the flaw by modifying values in memory after firmware validation but before use.

Business Impact

A successful exploit allows a malicious driver running inside a Host VM to post improper commands to the GPU firmware, resulting in out-of-bounds memory writes in the host kernel. This can lead to total system compromise, data confidentiality breaches, integrity loss, and severe downtime. The CVSS score of 7.8 reflects a high severity level due to the complete compromise of the host kernel scope.

Remediation Plan

Immediate Action: Update the Imagination Technologies Graphics DDK to version 26.1 RTM2 or later where the TOCTOU race condition is resolved.

Proactive Monitoring: Monitor host system logs for unexpected kernel crashes, anomalous driver behavior, or unauthorized resource access attempts within virtual machines.

Compensating Controls: Restrict local user access and virtual machine privileges to minimize the pool of actors capable of executing low-privileged kernel interactions.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The local attack vector requires prior execution access inside a Host VM, but the severity of kernel memory corruption warrants immediate patching.

Analyst Recommendation

Security teams must prioritize updating the Imagination Technologies Graphics DDK to version 26.1 RTM2 or later. Given the potential for total host kernel compromise, applying the vendor patch immediately is critical to eliminate local privilege escalation and memory corruption risks.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: 1.17 RTM2, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A trust boundary violation in the Imagination Technologies Graphics DDK allows a local attacker to corrupt GPU firmware data by manipulating pointers stored in non-secure memory.

Executive Summary:
A high-severity trust boundary vulnerability in Imagination Technologies Graphics DDK could allow an attacker with local kernel access to compromise GPU firmware integrity.

Vulnerability Details

CVE-ID: CVE-2026-45198

Affected Software: Imagination Technologies Graphics DDK

Affected Versions: 1.17 RTM2, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: This flaw involves an untrusted pointer dereference and a trust boundary violation where the GPU firmware consumes pointers from the Rich Execution Environment without validation. An attacker with privileged access to the local kernel can modify these pointers to corrupt internal GPU data.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk to system integrity and confidentiality. Successful exploitation allows a local attacker to bypass security boundaries, potentially leading to unauthorized data access, privilege escalation, or permanent denial of service through firmware corruption. This poses significant risk to environments relying on Trusted Execution Environments for secure processing.

Remediation Plan

Immediate Action: Update the Imagination Technologies Graphics DDK to version 26.1 RTM2 or later to apply the necessary pointer validation fixes.

Proactive Monitoring: Monitor system logs for unusual kernel activity or unauthorized attempts to access GPU memory regions.

Compensating Controls: Ensure that access to the Rich Execution Environment kernel is strictly restricted to authorized administrators and processes to prevent the initial exploitation vector.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on firmware security, but it requires the attacker to already possess significant control over the host kernel to trigger the corruption.

Analyst Recommendation

Given the potential for complete compromise of the GPU firmware and the bypass of hardware-backed security boundaries, this vulnerability should be addressed as a high priority. Organizations utilizing affected Imagination Technologies drivers must schedule an update to the patched version, 26.1 RTM2, during the next available maintenance window to neutralize the risk of local kernel-based attacks.

---METADATA---
VENDOR: Imagination
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: Imagination Technologies Graphics DDK: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:19:30.823Z
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Imagination Graphics DDK allows a low-privileged local user inside a Host VM to trigger improper GPU register access.

Executive Summary:
An improper permission handling vulnerability in Imagination Technologies Graphics DDK allows local users to achieve privilege escalation via the GPU firmware.

Vulnerability Details

CVE-ID: CVE-2026-45196

Affected Software: Imagination Graphics DDK

Affected Versions: Imagination Technologies Graphics DDK: 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, 26.1 RTM1

Vulnerability: This issue is an improper permission handling vulnerability, classified under CWE-280, where kernel software in a Host VM posts improper commands to the GPU firmware. The CVSS vector indicates a local attack vector requiring low privileges and no user interaction.

Business Impact

A successful exploit allows a low-privileged local user to escalate privileges and obtain complete control over the affected system. This introduces significant risks of unauthorized data access, system manipulation, and service disruption. The high CVSS score of 7.8 reflects the severity of potential total compromise for virtualized environments utilizing vulnerable driver versions.

Remediation Plan

Immediate Action: Update Imagination Technologies Graphics DDK to version 26.1 RTM2 or later to resolve the underlying permission handling flaw.

Proactive Monitoring: Monitor system logs for unusual local execution patterns or unauthorized attempts to access GPU registers within virtual machines.

Compensating Controls: Restrict local user access levels within virtual machine environments and enforce the principle of least privilege to minimize exposure.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in the available data).

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA SSVC assessment classifies exploitation as none, meaning the risk is primarily theoretical until an exploit materializes.

Analyst Recommendation

Given the high severity score and the potential for full system compromise, administrators should treat this vulnerability with urgency. Apply the vendor-provided update to version 26.1 RTM2 or later across all affected virtualized environments as soon as possible to eliminate the privilege escalation vector.

---METADATA---
VENDOR: Imagination
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical memory vulnerability in the Imagination Graphics DDK allows improper GPU commands to trigger out-of-bounds memory access.

Executive Summary:
A high-severity vulnerability in the Imagination Graphics DDK enables a guest VM to perform unauthorized memory reads or writes on the host kernel.

Vulnerability Details

CVE-ID: CVE-2026-45195

Affected Software: Imagination Graphics DDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the interface between the virtual machine and GPU firmware, where improper command validation allows a malicious actor to perform out-of-bounds memory operations. This represents a significant security boundary violation between the guest VM and the host kernel.

Business Impact

The CVSS score of 7.8 underscores the severity of this vulnerability, as it allows for potential guest-to-host breakout. Successful exploitation could lead to full system compromise, data exfiltration, or complete loss of control over the affected virtualization host, posing a severe threat to multi-tenant environments.

Remediation Plan

Immediate Action: Identify all systems utilizing Imagination Graphics DDK and apply the latest vendor-provided security patches to the GPU firmware and driver stack.

Proactive Monitoring: Monitor virtual machine hypervisor logs for unexpected GPU firmware interactions or unauthorized attempts to access restricted memory regions.

Compensating Controls: Where patching is delayed, limit the exposure of sensitive virtualized workloads by isolating systems that rely on affected GPU drivers until the remediation is complete.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the nature of this vulnerability involving kernel-level memory access, immediate patching is essential to prevent VM escape scenarios. System administrators should prioritize this update in all virtualized environments utilizing Imagination graphics hardware.

---METADATA---
VENDOR: Exim
PRODUCT: Exim
AFFECTED_VERSIONS: 4.97 up to (excluding) 4.99.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Exim versions before 4.99.3 contain a use-after-free vulnerability in the BDAT body parsing path, allowing unauthenticated remote code execution via specifically crafted TLS close_notify sequences.

Executive Summary:
A critical use-after-free vulnerability in Exim allows unauthenticated remote attackers to achieve arbitrary code execution, posing a severe risk to mail infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-45185

Affected Software: Exim

Affected Versions: 4.97 up to (excluding) 4.99.3

Vulnerability: This vulnerability is a use-after-free flaw triggered during BDAT body parsing when a client sends a TLS close_notify mid-transfer. An unauthenticated attacker can exploit this memory corruption to execute arbitrary code on the affected server.

Business Impact

The exploitation of this vulnerability results in full system compromise, allowing attackers to gain complete control over the mail transfer agent. Given the CVSS score of 9.8, this poses an extreme risk of data exfiltration, service disruption, and potential lateral movement into the internal network.

Remediation Plan

Immediate Action: Upgrade Exim to version 4.99.3 or later immediately to resolve the memory corruption vulnerability.

Proactive Monitoring: Monitor server logs for unusual BDAT traffic patterns and unexpected segmentation faults or crashes in the Exim process.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection system configured to drop malformed TLS chunks or suspicious SMTP traffic patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which allows for unauthenticated remote code execution, the potential for exploitation is high.

Analyst Recommendation

Organizations running Exim must prioritize patching to version 4.99.3 or above. Given the critical severity and the ease of exploitation, failure to update will leave the infrastructure vulnerable to complete compromise by remote, unauthenticated actors.

---METADATA---
VENDOR: Pimcore
PRODUCT: Pimcore
AFFECTED_VERSIONS: < 11.5.17, >= 12.0.0, < 12.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pimcore is vulnerable to insecure deserialization of untrusted data, which can be leveraged by an authenticated user with high privileges to achieve remote code execution.

Executive Summary:
An insecure deserialization vulnerability in Pimcore allows a high-privileged attacker to compromise the entire system, necessitating urgent patching.

Vulnerability Details

CVE-ID: CVE-2026-45162

Affected Software: Pimcore Pimcore

Affected Versions: < 11.5.17, >= 12.0.0, < 12.3.7

Vulnerability: The application improperly deserializes untrusted data, which an authenticated attacker with high privileges can exploit to execute arbitrary code.

Business Impact

Successful exploitation allows for complete control over the application server, potentially leading to full system compromise and total loss of confidentiality, integrity, and availability. Given the CVSS score of 8.0, the potential for catastrophic business impact is high.

Remediation Plan

Immediate Action: Update the Pimcore installation to version 11.5.17, 12.3.7, or 2026.1.3 to mitigate the deserialization risk.

Proactive Monitoring: Inspect server logs for anomalous execution patterns or unexpected system calls that may indicate an attempt to exploit deserialization routines.

Compensating Controls: Ensure the application runs with the least privilege necessary to limit the potential reach of a successful code execution exploit.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Insecure deserialization is a critical security flaw that often leads to remote code execution.

Analyst Recommendation

Due to the severity of insecure deserialization, immediate patching is required. Organizations must treat this as a high-priority update to prevent potential full-system compromise by malicious actors.

---METADATA---
VENDOR: Solana Foundation
PRODUCT: Anchor
AFFECTED_VERSIONS: >= 1.0.0, < 1.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Anchor framework for Solana contains an improper input validation vulnerability that can lead to unauthorized state changes.

Executive Summary:
A critical input validation flaw in the Anchor framework could allow unauthenticated remote attackers to perform unauthorized operations on Solana programs.

Vulnerability Details

CVE-ID: CVE-2026-45137

Affected Software: Solana Foundation Anchor

Affected Versions: >= 1.0.0, < 1.0.2

Vulnerability: This vulnerability involves improper input validation (CWE-20) within the Anchor framework. It allows unauthenticated attackers to provide malicious input that may lead to unintended program execution or state manipulation.

Business Impact

Exploitation of this vulnerability poses a severe risk to the integrity of Solana-based programs. An attacker could potentially bypass security checks, leading to unauthorized asset transfers or data corruption. The CVSS score of 8.2 reflects the high impact on system integrity.

Remediation Plan

Immediate Action: Update the anchor-lang crate to version 1.0.2 immediately. Developers should audit existing programs to identify any suspicious state changes or transactions.

Proactive Monitoring: Monitor blockchain transaction logs for anomalous patterns or unauthorized calls to sensitive program instructions.

Compensating Controls: Implement rigorous input sanitization and schema validation at the application level to ensure all incoming data conforms to expected formats.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, making rapid remediation essential.

Analyst Recommendation

The integrity of decentralized applications depends on the security of the underlying framework. Developers must prioritize the update to version 1.0.2 to prevent potential exploitation of the input validation flaw, as the risk of unauthorized state manipulation is significant.

---METADATA---
VENDOR: Caddy
PRODUCT: Caddy Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Caddy server platform. The specific technical details regarding the nature of the flaw remain under investigation.

Executive Summary:
The Caddy server platform is affected by a high-severity vulnerability that could potentially expose the system to unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-45135

Affected Software: Caddy Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Caddy server platform. Due to limited disclosure at this time, the exact vector and authentication requirements remain pending further vendor clarification.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a significant risk to the availability and integrity of web services. Successful exploitation could lead to unauthorized system access or the compromise of sensitive data handled by the Caddy server, potentially resulting in severe operational downtime and reputational damage.

Remediation Plan

Immediate Action: Administrators should monitor the official Caddy security advisory page and apply the latest security patches as soon as they are released.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unauthorized administrative attempts that deviate from established traffic baselines.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict ingress filtering to mitigate potential exploitation attempts while awaiting official vendor patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation remains a critical concern for organizations relying on this software.

Analyst Recommendation

Given the high severity rating, it is imperative that security teams prioritize this issue within their vulnerability management lifecycle. Immediately review the vendor's security bulletins and prepare for an emergency patching cycle to ensure the integrity of your network perimeter.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts exposes Personal Access Tokens and SSH signing keys to untrusted code.

Executive Summary:
Unsafe credential handling in CloudPirates Helm Charts exposes sensitive signing and access keys, creating an immediate risk of repository compromise.

Vulnerability Details

CVE-ID: CVE-2026-45132

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The generate-schema.yaml workflow uses unsafe checkout practices that allow fork-controlled code to access and exfiltrate Personal Access Tokens and SSH signing keys.

Business Impact

The theft of signing keys and access tokens allows an attacker to impersonate the project maintainers and push malicious code or sign fraudulent commits. With a CVSS score of 10.0, this represents a critical threat to the integrity of the entire software lifecycle.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to correct the workflow checkout and credential management practices.

Proactive Monitoring: Review repository logs for unauthorized commit activity or unusual use of the compromised SSH signing keys.

Compensating Controls: Immediately revoke and rotate all Personal Access Tokens and SSH keys that were configured for use within this workflow.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of secret exposure, users must treat this as a high-urgency remediation. Beyond updating the workflow, a full rotation of all exposed secrets is required to ensure the security of the repository and its associated assets.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts executes attacker-controlled code from forks, exposing repository secrets.

Executive Summary:
A critical configuration flaw in CloudPirates Helm Charts exposes sensitive repository credentials to unauthorized actors via GitHub Actions.

Vulnerability Details

CVE-ID: CVE-2026-45131

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The pull-request.yaml GitHub Actions workflow runs code from untrusted forks in a privileged context, exposing Docker Hub credentials and other repository secrets without requiring approval.

Business Impact

Exposure of credentials allows attackers to access private container registries and potentially inject malicious code into the software supply chain. With a CVSS score of 10.0, this vulnerability presents a catastrophic risk to the security of the build pipeline and downstream software users.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to secure the GitHub Actions workflow and isolate untrusted code execution.

Proactive Monitoring: Audit repository secret usage logs and verify if any credentials have been accessed or used by unauthorized parties.

Compensating Controls: Rotate all secrets (Docker Hub credentials, tokens) that were exposed or potentially accessible during the vulnerable period.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant supply chain risk. Organizations using these Helm charts must update to the patched version and treat all previously stored secrets as compromised, necessitating a mandatory rotation of all affected credentials.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Entra / Himmelblau
AFFECTED_VERSIONS: >= 2.0.0, < 2.3.11, >= 3.0.0-alpha, < 3.1.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Himmelblau interoperability suite for Microsoft Azure Entra ID contains an incorrect authorization vulnerability.

Executive Summary:
An authorization vulnerability in the Himmelblau suite for Azure Entra ID could allow authenticated users to escalate privileges and access unauthorized resources.

Vulnerability Details

CVE-ID: CVE-2026-45108

Affected Software: Himmelblau-idm Himmelblau

Affected Versions: >= 2.0.0, < 2.3.11, >= 3.0.0-alpha, < 3.1.5

Vulnerability: This vulnerability is caused by incorrect authorization (CWE-863). It requires low-privileged authenticated access to exploit, allowing an attacker to bypass intended access controls and perform actions they are not authorized to execute.

Business Impact

Successful exploitation can lead to full compromise of the integrated identity management systems. With a CVSS score of 8.4, the ability for an attacker to escalate privileges within Azure Entra ID or Intune represents a severe risk to organizational security, potentially resulting in unauthorized administrative access.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to the Himmelblau suite. Review the security advisory for specific upgrade paths based on the current deployment version.

Proactive Monitoring: Audit logs for unauthorized access attempts or unusual administrative actions performed by low-privileged service accounts.

Compensating Controls: Enforce strict Conditional Access policies in Azure Entra ID to limit the impact of potential unauthorized access.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the potential for privilege escalation makes this a high-priority item for identity management security.

Analyst Recommendation

Identity management suites are high-value targets for attackers. Given the potential for privilege escalation, security teams should prioritize the deployment of the necessary patches to ensure that authorization controls are correctly enforced within the Azure Entra environment.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to 10.0.98
---END_METADATA---

Description Summary:
OneUptime is vulnerable to a sandbox escape in its Node.js environment due to the improper use of the vm module.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows for remote code execution by bypassing the Node.js vm module isolation.

Vulnerability Details

CVE-ID: CVE-2026-45102

Affected Software: OneUptime OneUptime

Affected Versions: Prior to 10.0.98

Vulnerability: The application utilizes the Node.js vm module for code isolation, which is not designed for security; attackers can escape this sandbox via error objects and recursion.

Business Impact

With a CVSS score of 9.9, this vulnerability permits an attacker to escape the intended execution environment and perform arbitrary code execution on the host. This poses a critical threat to the security and stability of the OneUptime platform.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.98 or later to remediate the sandbox escape vulnerability.

Proactive Monitoring: Monitor for abnormal system calls or unauthorized filesystem access originating from the OneUptime application process.

Compensating Controls: Run the application with restricted OS-level permissions (e.g., using containers or sandboxing technologies) to mitigate the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The use of the vm module for security isolation is inherently flawed. Administrators must update to the latest version immediately to ensure that more robust security primitives are in place.

---METADATA---
VENDOR: sealed-env
PRODUCT: sealed-env
AFFECTED_VERSIONS: 0.1.0-alpha.1 through 0.1.0-alpha.3
---END_METADATA---

Description Summary:
The sealed-env library incorrectly embeds literal TOTP secrets in unencrypted JWS payloads, allowing unauthorized parties to extract sensitive credentials.

Executive Summary:
A critical security flaw in the sealed-env library exposes TOTP secrets in plaintext, allowing unauthorized access to sensitive authentication tokens.

Vulnerability Details

CVE-ID: CVE-2026-45091

Affected Software: sealed-env

Affected Versions: 0.1.0-alpha.1 through 0.1.0-alpha.3

Vulnerability: The library embeds the operator's TOTP secret within a base64-encoded JWS payload that is not encrypted. Any entity with access to the minted tokens, such as log aggregators or CI/CD systems, can extract the secret in plaintext.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk of credential compromise. Exposure of TOTP secrets effectively invalidates the multi-factor authentication mechanism for the affected environment, potentially granting attackers persistent access to critical systems and data.

Remediation Plan

Immediate Action: Update the sealed-env library to version 0.1.0-alpha.4 or later immediately.

Proactive Monitoring: Review CI/CD logs, container logs, and monitoring tools for the presence of leaked TOTP secrets and rotate all affected secrets immediately.

Compensating Controls: Implement secret scanning and log sanitization procedures to prevent sensitive tokens from being stored in cleartext in logs or environment variables.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant failure in secure secret management. It is imperative that affected organizations upgrade to the latest version of the library and immediately rotate any TOTP secrets that may have been exposed through logs or build environments.

---METADATA---
VENDOR: hahwul
PRODUCT: dalfox
AFFECTED_VERSIONS: < 2.13.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dalfox contains vulnerabilities including improper file path control, missing authentication for critical functions, and unrestricted file uploads.

Executive Summary:
The Dalfox XSS scanner is vulnerable to multiple security flaws, including unauthenticated file upload and path traversal, posing a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45089

Affected Software: hahwul dalfox

Affected Versions: < 2.13.0

Vulnerability: This vulnerability involves a combination of CWE-73, CWE-306, and CWE-434. An unauthenticated attacker can leverage these flaws to perform unauthorized file uploads and path manipulation, bypassing standard security controls.

Business Impact

The CVSS score of 8.2 (High) reflects the potential for severe impact, including the compromise of system integrity and availability. An attacker could upload malicious files to the server, potentially leading to full system compromise, unauthorized data access, or the deployment of persistent backdoors.

Remediation Plan

Immediate Action: Update the hahwul dalfox package to version 2.13.0 or later immediately.

Proactive Monitoring: Monitor server logs for unusual file upload activity or unexpected access to sensitive system paths.

Compensating Controls: Ensure the application is deployed within a restricted, non-privileged container environment to limit the impact of a potential file system breakout.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of missing authentication and unrestricted file upload makes this a high-value target for automated exploitation.

Analyst Recommendation

Given the severity of the identified flaws and the presence of a proof-of-concept, users must prioritize upgrading to version 2.13.0. The ability for unauthenticated actors to interact with critical file functions necessitates immediate patching to prevent potential remote code execution.

---METADATA---
VENDOR: Dalfox
PRODUCT: Dalfox
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
Dalfox contains an unauthenticated remote code execution vulnerability in its REST API server mode due to insecure deserialization of scan options.

Executive Summary:
An unauthenticated remote code execution vulnerability in Dalfox allows attackers to execute arbitrary shell commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-45087

Affected Software: Dalfox Dalfox

Affected Versions: Prior to 2.13.0

Vulnerability: The server mode deserializes attacker-supplied JSON directly into scan options, allowing an unauthenticated user to inject arbitrary shell commands that the Dalfox process will execute.

Business Impact

With a CVSS score of 10, this is a critical vulnerability that allows an unauthenticated attacker to gain full control over the host running the Dalfox server. This could lead to complete system compromise, data exfiltration, or the use of the host as a pivot point for further attacks.

Remediation Plan

Immediate Action: Update Dalfox to version 2.13.0 or later to ensure proper validation and stripping of scan options.

Proactive Monitoring: Monitor for unauthorized requests to the Dalfox API and check for unexpected child processes spawned by the Dalfox service.

Compensating Controls: If the Dalfox server must be exposed, implement strong authentication via an API key and restrict access to the service port (6664) using network-level controls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and trivial to exploit if the service is exposed to a network. Immediate updates are required, and the service should not be exposed without authentication.

---METADATA---
VENDOR: OpenSIPS
PRODUCT: opensips
AFFECTED_VERSIONS: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A NULL pointer dereference vulnerability in OpenSIPS allows unauthenticated remote attackers to trigger a denial of service by sending specifically crafted SIP requests.

Executive Summary:
A critical NULL pointer dereference vulnerability in OpenSIPS permits unauthenticated remote attackers to crash the service, resulting in a denial of service for critical communications.

Vulnerability Details

CVE-ID: CVE-2026-45084

Affected Software: OpenSIPS opensips

Affected Versions: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1

Vulnerability: This vulnerability is a NULL pointer dereference (CWE-476) occurring during the parsing or handling of SIP messages. It is accessible to unauthenticated remote attackers, as confirmed by the CVSS vector AV:N/AC:L/AT:N/PR:N.

Business Impact

The ability for a remote attacker to crash a core SIP server with a single crafted request poses a severe threat to organizations relying on OpenSIPS for telephony or messaging. The CVSS score of 8.7 reflects the high impact on availability, which could lead to significant operational downtime and loss of communication capabilities across the enterprise.

Remediation Plan

Immediate Action: Upgrade to OpenSIPS versions 3.6.6 or 4.0.0-rc1 to resolve the underlying pointer handling flaw.

Proactive Monitoring: Monitor server uptime and process health, specifically tracking restarts of the OpenSIPS daemon which may indicate successful exploitation of this vulnerability.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System capable of identifying and blocking malformed SIP traffic patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. NULL pointer dereferences in networking code are frequently discovered and exploited to force service outages.

Analyst Recommendation

Organizations should treat this vulnerability with high priority. Given the ease of exploitation, applying the vendor-recommended update is the only effective way to prevent potential service instability caused by malicious remote actors.

---METADATA---
VENDOR: PbootCMS
PRODUCT: PbootCMS
AFFECTED_VERSIONS: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, up to 3.2.12
CONFIDENCE: high
MISSING: patch
CREDITS: zmjjkk (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352074","name":"VDB-352074 | PbootCMS Member Login MemberController.php checkUsername sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352074","name":"VDB-352074 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773900","name":"Submit #773900 | 翱云科技 PbootCMS 3.2.12 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the PbootCMS member login function allows unauthenticated remote attackers to bypass authentication and access arbitrary user accounts.

Executive Summary:
PbootCMS is vulnerable to an unauthenticated SQL injection attack in the member login module, which allows remote attackers to bypass authentication and compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-4508

Affected Software: PbootCMS

Affected Versions: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, up to 3.2.12

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by the improper neutralization of the username parameter within the checkUsername function. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious SQL commands to manipulate database queries.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms, granting them unauthorized access to any frontend member account. This poses a severe risk of data exposure, potential account takeover, and unauthorized access to member-restricted content, which may lead to significant reputational damage and loss of user trust. While the CVSS score is 7.3, the ability for unauthenticated remote code execution or authentication bypass often carries higher operational risk than the score suggests.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should implement strict input validation on the login endpoint and consider disabling member registration or login functions if they are not business-critical until a vendor-supplied update is released.

Proactive Monitoring: Review web server and application logs for anomalous POST requests to the /member/login endpoint, specifically looking for SQL-related characters such as single quotes, dashes, or SQL keywords like UNION and OR in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing common SQL injection patterns in the username parameter to prevent exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the security researcher in the referenced GitHub repository.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from the direct concatenation of user-supplied input into SQL queries within the application model, which is a highly reliable vector for exploitation.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the ease of exploitation, this vulnerability should be treated with high urgency. Organizations using PbootCMS should immediately implement WAF protections and monitor for suspicious login attempts while actively tracking the vendor for a security update to address the underlying code flaw.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An XML External Entity (XXE) vulnerability in the Symfony DomCrawler component allows unauthenticated attackers to potentially read sensitive local files.

Executive Summary:
A High severity XML External Entity injection vulnerability in the Symfony DomCrawler component could allow unauthenticated attackers to access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-45071

Affected Software: Symfony Symfony and DomCrawler

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This is an XML External Entity (XXE) injection vulnerability (CWE-611) triggered when the DomCrawler component improperly handles XML input. The flaw is exploitable by unauthenticated remote actors.

Business Impact

Successful exploitation allows an attacker to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, or sensitive application data. With a CVSS score of 8.7, the impact on confidentiality is severe, posing a direct threat to the security of the hosting environment.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12.

Proactive Monitoring: Audit application logs for XML-based requests containing suspicious entity definitions or attempts to access local file paths.

Compensating Controls: Ensure that XML parsers are configured to disable the resolution of external entities and DTDs as a defense-in-depth measure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. XXE vulnerabilities remain a common target for data exfiltration.

Analyst Recommendation

The risk posed by this XXE vulnerability is significant. Administrators must ensure that the DomCrawler component is updated to the patched versions immediately to prevent unauthorized information disclosure.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Symfony components are vulnerable to insufficient verification of data authenticity and improper input validation, potentially allowing unauthorized data access.

Executive Summary:
The Symfony PHP framework and its security-http component are affected by critical input validation flaws that allow unauthenticated attackers to compromise data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-45069

Affected Software: Symfony Symfony/security-http

Affected Versions: >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

Vulnerability: This vulnerability involves the insufficient verification of data authenticity and improper input validation, which can be exploited by an unauthenticated remote attacker to gain unauthorized access to sensitive information.

Business Impact

Successful exploitation poses a significant risk to application integrity and data privacy. Given the CVSS score of 8.8, this high severity vulnerability allows attackers to bypass security controls without authentication, potentially leading to widespread data exposure or unauthorized manipulation of application state.

Remediation Plan

Immediate Action: Upgrade the Symfony framework and security-http component to version 6.4.40, 7.4.12, or 8.0.12 immediately to incorporate the necessary security patches.

Proactive Monitoring: Inspect web server access logs for anomalous request patterns or unexpected inputs directed at authentication-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter out malicious payloads that attempt to exploit input validation weaknesses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, which increases the necessity for a rapid patch cycle.

Analyst Recommendation

Organizations utilizing the Symfony framework must prioritize this update, as the absence of required authentication makes this an attractive target for automated exploitation. Apply the provided vendor patches to the affected versions immediately to neutralize the risk of unauthorized data access.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Symfony framework and Mailer component allows for argument injection due to improper neutralization of argument delimiters.

Executive Summary:
An argument injection vulnerability in the Symfony framework and Mailer component, rated as High severity, poses a significant risk of unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2026-45068

Affected Software: Symfony Symfony and Mailer

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This vulnerability is an argument injection flaw (CWE-88) occurring when the framework improperly handles argument delimiters in commands. It is exploitable by unauthenticated remote attackers.

Business Impact

The ability to inject arbitrary arguments into command execution can lead to severe system compromise, including unauthorized code execution or manipulation of application behavior. Given the CVSS score of 8.7, this flaw represents a high risk to data integrity and system availability, necessitating immediate attention to prevent potential exploitation.

Remediation Plan

Immediate Action: Update the Symfony framework and Mailer component to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 as appropriate for your branch.

Proactive Monitoring: Monitor server logs for unexpected command-line invocations or unusual process execution patterns that may indicate attempts to leverage this vulnerability.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied data that is passed to system commands, and utilize a Web Application Firewall to block suspicious request patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for direct command manipulation.

Analyst Recommendation

This vulnerability presents a high risk to the application ecosystem. Security teams should prioritize patching the affected Symfony components across all environments immediately to mitigate the risk of remote command injection.

---METADATA---
VENDOR: ClipBucket
PRODUCT: ClipBucket
AFFECTED_VERSIONS: Prior to version 5.5.3 - #129
---END_METADATA---

Description Summary:
The ClipBucket video sharing platform is vulnerable to unauthenticated blind SQL injection, allowing attackers to execute unauthorized database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in ClipBucket allows remote attackers to exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-45060

Affected Software: ClipBucket

Affected Versions: Prior to version 5.5.3 - #129

Vulnerability: The actions/progress_video.php endpoint fails to properly sanitize the ids parameter, leading to a blind SQL injection vulnerability. This flaw allows an unauthenticated attacker to inject malicious SQL queries to interact with the database.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it requires no authentication to execute. Successful exploitation could result in the full exfiltration of user databases, administrative credentials, or proprietary video content, leading to significant data breaches and potential loss of platform integrity.

Remediation Plan

Immediate Action: Update ClipBucket to version 5.5.3 - #129 or higher to patch the SQL injection vulnerability.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected UNION operations, or high volumes of suspicious requests targeting the progress_video.php endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block SQL injection patterns in incoming HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, it presents a significant risk to data confidentiality. Organizations running ClipBucket must apply the provided update immediately to prevent unauthorized database access and potential data exfiltration.

---METADATA---
VENDOR: Eosphoros-AI
PRODUCT: DB-GPT
AFFECTED_VERSIONS: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5
CONFIDENCE: high
MISSING: patch
CREDITS: Goku (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352070","name":"VDB-352070 | eosphoros-ai db-gpt Incomplete Fix editor sql injection","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.352070","name":"VDB-352070 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773891","name":"Submit #773891 | eosphoros-ai DB-GPT <=0.7.5 Remote command execution","tags":["third-party-advisory"]},{"url":"https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
An SQL injection vulnerability exists in the /api/v1/editor/ endpoint of Eosphoros-AI DB-GPT, allowing unauthenticated remote attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Eosphoros-AI DB-GPT allows unauthenticated remote attackers to compromise the underlying database, posing a severe risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-4504

Affected Software: Eosphoros-AI DB-GPT

Affected Versions: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /api/v1/editor/ component. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector (AV:N/PR:N).

Business Impact

Successful exploitation permits unauthorized access to the application database, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to business continuity and regulatory compliance, as the application fails to safely handle user-supplied input in a critical API path.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /api/v1/editor/ endpoint immediately.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from the API service account.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to inspect and block malicious SQL injection payloads targeting the /api/v1/editor/ URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced huntr.com bounty report.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability requires immediate attention. Security teams must prioritize isolating the vulnerable component and applying network-level filtering to prevent unauthorized exploitation while awaiting a formal fix from the project maintainers.

---METADATA---
VENDOR: RustFS
PRODUCT: Distributed Object Storage System
AFFECTED_VERSIONS: Prior to 1.0.0-beta.2
---END_METADATA---

Description Summary:
RustFS uses a hardcoded default secret key for internode RPC authentication, allowing attackers to bypass security if the environment is not explicitly configured.

Executive Summary:
A hardcoded secret key in the RustFS distributed storage system enables unauthorized internode communication and potential data access if default configurations are not overridden.

Vulnerability Details

CVE-ID: CVE-2026-45039

Affected Software: RustFS

Affected Versions: Prior to 1.0.0-beta.2

Vulnerability: The application utilizes a hardcoded DEFAULT_SECRET_KEY ("rustfsadmin") for HMAC-SHA256 signature validation in the internode RPC layer. This key is used when the RUSTFS_RPC_SECRET environment variable or the global S3 secret key is not explicitly set, effectively allowing an unauthenticated attacker to forge valid authentication requests.

Business Impact

With a CVSS score of 9.8, this is a critical vulnerability. An attacker capable of communicating with the internode RPC port could authenticate as a trusted node, potentially accessing, modifying, or deleting stored objects. This results in a severe breach of data confidentiality and integrity within the storage cluster.

Remediation Plan

Immediate Action: Upgrade RustFS to version 1.0.0-beta.2 or later, and ensure that a strong, unique secret key is configured via the RUSTFS_RPC_SECRET environment variable.

Proactive Monitoring: Audit RPC traffic for unauthorized authentication attempts or communication from nodes not belonging to the trusted cluster.

Compensating Controls: Use network-level segmentation or mTLS to ensure that only authorized internal nodes can communicate over the RPC port, effectively isolating the service from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the flaw makes it an attractive target for internal or network-adjacent threat actors.

Analyst Recommendation

The reliance on a hardcoded secret key is a significant security oversight. Organizations must upgrade to the patched version and immediately rotate any secrets that may have been exposed by relying on the default configuration.

---METADATA---
VENDOR: Eugeny
PRODUCT: Tabby
AFFECTED_VERSIONS: < 1.0.232
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Tabby terminal emulator is susceptible to open redirection and input validation flaws, which could be leveraged to redirect users to malicious, untrusted websites.

Executive Summary:
The Tabby terminal emulator before version 1.0.232 contains an open redirect vulnerability that can be exploited to facilitate phishing or malicious site redirection.

Vulnerability Details

CVE-ID: CVE-2026-45037

Affected Software: Eugeny Tabby

Affected Versions: < 1.0.232

Vulnerability: This issue involves an Incomplete List of Disallowed Inputs (CWE-184) leading to an Open Redirect (CWE-601). The vulnerability is exploitable by an unauthenticated attacker, though it requires user interaction (UI:R).

Business Impact

The ability to perform open redirects can be weaponized to bypass security filters and deceive users into visiting malicious domains. While the CVSS score of 7.1 reflects a high-severity risk, the primary impact is the potential for credential theft or malware delivery through social engineering, which can compromise both user and organizational security.

Remediation Plan

Immediate Action: Update the Tabby terminal emulator to version 1.0.232 or the latest available release.

Proactive Monitoring: Review web proxy logs or browser history for unexpected redirects originating from the terminal application context.

Compensating Controls: Utilize endpoint protection software and web filtering solutions to block access to known malicious domains and prevent users from navigating to untrusted sites.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dependent on social engineering and user interaction to be effective.

Analyst Recommendation

Users of the Tabby terminal emulator should update their software to version 1.0.232 immediately to eliminate the risk of open redirection. Organizations should educate users on the risks of clicking suspicious links, even when they appear to originate from trusted, locally installed applications.

---METADATA---
VENDOR: Eugeny
PRODUCT: Tabby
AFFECTED_VERSIONS: < 1.0.233
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Tabby terminal emulator is affected by an OS command injection vulnerability, allowing for potential arbitrary command execution on the host system.

Executive Summary:
Tabby terminal emulator versions prior to 1.0.233 are vulnerable to OS command injection, which could allow a local attacker to execute arbitrary commands with the privileges of the application.

Vulnerability Details

CVE-ID: CVE-2026-45036

Affected Software: Eugeny Tabby

Affected Versions: < 1.0.233

Vulnerability: This vulnerability is caused by the improper neutralization of special elements used in an OS command (CWE-78), resulting in command injection. The attack requires local access and specific conditions (AC:H) to trigger, but could lead to a total compromise of the application's environment.

Business Impact

Successful command injection grants an attacker the ability to execute arbitrary code on the underlying system, leading to full system compromise. With a CVSS score of 7.0, this vulnerability poses a severe risk to the integrity and availability of the host machine, potentially allowing for data theft, lateral movement, or the installation of persistent backdoors.

Remediation Plan

Immediate Action: Update the Tabby terminal emulator to version 1.0.233 or the latest available release.

Proactive Monitoring: Monitor system processes for unusual child processes spawned by the Tabby application, particularly those executing shell commands.

Compensating Controls: Apply strict OS-level permissions to the user account running Tabby to limit the potential blast radius of a successful command injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and high complexity significantly limits the immediate threat surface, but the potential for total system compromise necessitates prompt patching.

Analyst Recommendation

Given the potential for arbitrary code execution, updating to version 1.0.233 is critical for all users of the Tabby terminal. Administrators should enforce standard security hygiene, such as minimizing user privileges and maintaining up-to-date application software, to mitigate the risk of local exploitation.

---METADATA---
VENDOR: PHPOffice
PRODUCT: PhpSpreadsheet
AFFECTED_VERSIONS: Prior to 1.30.5
---END_METADATA---

Description Summary:
An input validation flaw in PhpSpreadsheet allows attackers to bypass wrapper protections, leading to potential Remote Code Execution (RCE) via phar deserialization.

Executive Summary:
A critical input validation vulnerability in PHPOffice PhpSpreadsheet allows unauthenticated attackers to achieve Remote Code Execution through malicious spreadsheet files.

Vulnerability Details

CVE-ID: CVE-2026-45034

Affected Software: PHPOffice PhpSpreadsheet

Affected Versions: Prior to 1.30.5

Vulnerability: The library fails to correctly sanitize file paths containing phar wrappers when provided with specific malformed input. This allows an unauthenticated attacker to bypass the File::prohibitWrappers check and trigger deserialization of phar metadata, leading to RCE on PHP 7.x environments.

Business Impact

This vulnerability carries a CVSS score of 9.2, reflecting its potential for full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the web server user, leading to complete data exfiltration, unauthorized system access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade the PHPOffice PhpSpreadsheet library to version 1.30.5 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious file access patterns or attempts to load unconventional file schemes such as phar://, php://, or data://.

Compensating Controls: Implement strict file upload validation policies that restrict file types and prohibit the use of external wrappers or remote file inclusion in application logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this RCE vulnerability, organizations using PhpSpreadsheet must prioritize updating to version 1.30.5. Failure to patch allows trivial exploitation paths for attackers to gain persistent access to the underlying infrastructure.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow Desktop
AFFECTED_VERSIONS: 1.0.0 through 1.8.4
CONFIDENCE: high
MISSING: none
CREDITS: The vulnerability was reported to IBM by Akshat Sinha, Senior SRE Rubrik (https://www.linkedin.com/in/akshat-sinha-56876 (reporter)
SOURCES_JSON: [{"url":"https://www.ibm.com/support/pages/node/7271099","name":null,"tags":["vendor-advisory","patch"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.639Z
---END_METADATA---

Description Summary:
IBM Langflow Desktop 1.0.0 through 1.8.4 contains an authorization bypass vulnerability that allows unauthenticated users to access other users' images via an insecure object reference.

Executive Summary:
A critical authorization flaw in IBM Langflow Desktop versions 1.0.0 through 1.8.4 allows unauthenticated attackers to access unauthorized image data, potentially leading to significant information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-4503

Affected Software: IBM Langflow Desktop

Affected Versions: 1.0.0 through 1.8.4

Vulnerability: This vulnerability, identified as CWE-639, arises from an insecure direct object reference where user-controlled keys are not properly validated. An unauthenticated attacker can manipulate these keys to retrieve private images belonging to other users.

Business Impact

The ability for unauthenticated parties to access sensitive user data poses a severe risk to data confidentiality and regulatory compliance. With a CVSS score of 7.5, this high-severity vulnerability could lead to the unauthorized exposure of proprietary or personal imagery stored within the application, resulting in potential reputational damage and loss of user trust.

Remediation Plan

Immediate Action: Upgrade to IBM Langflow Desktop version 1.9.0 or newer immediately by utilizing the in-application update mechanism or downloading the latest installer from the official Langflow website.

Proactive Monitoring: Review application access logs for unusual patterns, such as sequential or high-frequency requests for image resources that do not correspond to standard user activity.

Compensating Controls: Deploy a Web Application Firewall to monitor and block abnormal HTTP requests containing suspicious object identifiers or unexpected parameter values.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements, which makes it highly automatable for external attackers.

Analyst Recommendation

Given the ease of exploitation and the potential for unauthorized data access, administrators must prioritize this update. Applying the patch to version 1.9.0 is the only effective way to remediate the underlying authorization logic failure and secure the application against potential data exposure incidents.

---METADATA---
VENDOR: Chainlit
PRODUCT: chainlit
AFFECTED_VERSIONS: >= 2.4.0rc0, < 2.12.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Chainlit versions 2.4.0rc0 through 2.11.x are vulnerable to unauthenticated OS command injection via the MCP endpoint when features.mcp.enabled is true.

Executive Summary:
A critical OS command injection vulnerability in Chainlit allows unauthenticated attackers to execute arbitrary code on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-45018

Affected Software: Chainlit chainlit

Affected Versions: >= 2.4.0rc0, < 2.12.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring in the backend/chainlit/mcp.py file. An unauthenticated attacker can supply a crafted command string to the POST /mcp endpoint, which is then improperly sanitized and executed by the system shell.

Business Impact

Successful exploitation grants an attacker full control over the server process, potentially leading to total system compromise, data exfiltration, and lateral movement within the network. Given the CVSS score of 9.8, this vulnerability represents an extreme risk to confidentiality, integrity, and availability that requires immediate remediation.

Remediation Plan

Immediate Action: Upgrade to Chainlit version 2.12.0 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the /mcp endpoint, particularly those containing shell metacharacters such as pipes or semicolons.

Compensating Controls: If patching is delayed, disable the MCP feature by setting features.mcp.enabled to false in the .chainlit/config.toml file and restrict network access to the application via a Web Application Firewall.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the direct path to shell execution.

Analyst Recommendation

This is a critical vulnerability that poses an immediate threat to any organization running affected versions of Chainlit. Security teams must prioritize upgrading to version 2.12.0 across all environments to eliminate this exposure.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: ApostropheCMS
AFFECTED_VERSIONS: ApostropheCMS versions up to and including 4.29.0
---END_METADATA---

Description Summary:
ApostropheCMS contains a password reset vulnerability where an unauthenticated attacker can manipulate the Host header to redirect password reset emails to an attacker-controlled domain.

Executive Summary:
ApostropheCMS is vulnerable to an unauthenticated account takeover flaw that allows attackers to redirect password reset links to malicious domains.

Vulnerability Details

CVE-ID: CVE-2026-45013

Affected Software: ApostropheCMS

Affected Versions: ApostropheCMS versions up to and including 4.29.0

Vulnerability: This is a Host header manipulation vulnerability within the password reset flow. An unauthenticated attacker can trigger a password reset for a known email address, causing the application to send a reset link that directs the victim to an attacker-controlled domain, facilitating full account takeover.

Business Impact

With a CVSS score of 8.1 (High), this vulnerability poses a severe risk to organizational security. Successful exploitation allows unauthorized parties to gain full control over user accounts, potentially leading to unauthorized data access, intellectual property theft, and loss of administrative control over the CMS platform.

Remediation Plan

Immediate Action: Manually configure the "apos.baseUrl" setting within the application configuration to explicitly define the expected domain and prevent Host header manipulation.

Proactive Monitoring: Review application logs for anomalous password reset requests or unexpected patterns in outgoing email traffic.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and sanitize incoming HTTP Host headers, blocking requests that do not match the expected environment domain.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for account takeover is high.

Analyst Recommendation

Given the high impact of account takeover, administrators must prioritize hardening the CMS configuration immediately. While no vendor patch is currently available, setting the "apos.baseUrl" is a critical security control to mitigate this risk.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: Prior to 4.1.2
---END_METADATA---

Description Summary:
phpMyFAQ lacks rate limiting on its TOTP authentication endpoint, allowing unauthenticated attackers to brute-force two-factor authentication tokens.

Executive Summary:
A lack of rate limiting in the phpMyFAQ administrative login endpoint allows unauthenticated attackers to brute-force TOTP tokens and bypass two-factor authentication.

Vulnerability Details

CVE-ID: CVE-2026-45010

Affected Software: phpMyFAQ

Affected Versions: Prior to 4.1.2

Vulnerability: The application fails to bind TOTP verification to a session or implement rate limiting on the /admin/check endpoint, permitting automated brute-force attacks against six-digit tokens.

Business Impact

Bypassing two-factor authentication grants an attacker full administrative access, potentially leading to total system compromise and data loss. This vulnerability is rated 9.1, reflecting the high risk to administrative security.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.2 or later to implement necessary rate limiting and session binding.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts or sequential token submissions targeting the administrative interface.

Compensating Controls: Restrict access to the /admin/ path via IP allowlisting or VPN-only access to prevent public exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrative access is the highest security tier; failing to protect this endpoint renders all other security measures ineffective. Update the software immediately to enforce robust authentication controls.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in OpenClaw allows for unsafe configuration mutation via a gateway tool denylist bypass, enabling unauthorized system changes.

Executive Summary:
An unsafe configuration mutation flaw in OpenClaw allows authenticated attackers to bypass security filters and compromise system settings.

Vulnerability Details

CVE-ID: CVE-2026-45006

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.23

Vulnerability: This is an Incomplete List of Disallowed Inputs (CWE-184) vulnerability. It allows an authenticated user to bypass input validation filters, leading to unauthorized configuration mutations via the gateway tool.

Business Impact

By bypassing denylist filters, an attacker can modify system configurations that should be restricted, leading to significant security degradation. A CVSS score of 8.8 indicates a high-severity risk, where successful exploitation could lead to full loss of control over the application's operational parameters.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.4.23 to resolve the input validation bypass.

Proactive Monitoring: Audit system configuration changes and logs for any modifications made via the gateway tool that deviate from established operational baselines.

Compensating Controls: Restrict access to the affected gateway tool to only authorized personnel and implement strict egress filtering to prevent unauthorized configuration pushes.

Exploitation Status

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB).

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on system configuration integrity.

Analyst Recommendation

This vulnerability represents a significant risk to system stability and security. It is recommended that all users of OpenClaw update their instances to the 2026.4.23 release immediately to ensure input validation mechanisms are correctly enforced.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to arbitrary code execution due to an uncontrolled search path element.

Executive Summary:
An uncontrolled search path vulnerability in OpenClaw could allow an attacker to execute arbitrary code, potentially leading to a total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-45004

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.23

Vulnerability: This vulnerability (CWE-427) involves an uncontrolled search path element where the application may load malicious files from the current working directory. The vulnerability requires user interaction to facilitate the loading of untrusted components.

Business Impact

The ability for an attacker to achieve arbitrary code execution represents a significant security risk, potentially leading to full system compromise, data exfiltration, or installation of persistent backdoors. With a CVSS score of 7.8, this vulnerability poses a high risk to business operations and data security.

Remediation Plan

Immediate Action: Update the OpenClaw npm package to version 2026.4.23 immediately.

Proactive Monitoring: Scan for anomalous processes or unexpected execution of scripts initiated by the OpenClaw service.

Compensating Controls: Restrict the permissions of the directory where the application is executed to prevent unauthorized modification of local files.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data).

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it allows for code execution if an attacker can place a malicious file in the working directory.

Analyst Recommendation

The severity of this arbitrary code execution flaw necessitates immediate patching. Organizations should ensure all instances of the OpenClaw package are updated to version 2026.4.23 to eliminate this critical attack vector.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is affected by a missing authorization vulnerability in the gateway configuration.

Executive Summary:
A missing authorization flaw in OpenClaw allows authenticated users to mutate gateway configurations, potentially disrupting service availability.

Vulnerability Details

CVE-ID: CVE-2026-45001

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.20

Vulnerability: This is a missing authorization vulnerability (CWE-862) occurring within the agent tool access mechanism. An authenticated user can bypass configuration guards to modify gateway settings without proper permission checks.

Business Impact

An attacker exploiting this vulnerability could unauthorizedly alter system configurations, which may result in service disruption or the exposure of sensitive gateway parameters. With a CVSS score of 7.1, this flaw presents a substantial risk to service availability and configuration integrity.

Remediation Plan

Immediate Action: Update the OpenClaw npm package to version 2026.4.20 to enforce proper authorization checks.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or suspicious activity related to agent tool access.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users who can interact with sensitive gateway configuration tools.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data).

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on the attacker having valid user credentials to interact with the gateway tools.

Analyst Recommendation

To maintain the security and stability of your infrastructure, please apply the update to version 2026.4.20 as soon as possible. Restricting access to sensitive configuration tools remains a critical layer of defense against this vulnerability.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to arbitrary code execution via insecure handling of environment variables, allowing attackers to leverage functionality from an untrusted control sphere.

Executive Summary:
A vulnerability in OpenClaw allows for arbitrary code execution, posing a high risk of total system compromise to affected environments.

Vulnerability Details

CVE-ID: CVE-2026-44995

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.20

Vulnerability: This vulnerability (CWE-829) arises from the inclusion of functionality from an untrusted control sphere. An authenticated local attacker with low privileges can leverage this flaw to achieve arbitrary code execution.

Business Impact

The CVSS score of 7.3 reflects a high severity due to the potential for total impact on confidentiality, integrity, and availability of the affected system. Successful exploitation could allow an attacker to execute arbitrary commands, potentially leading to a complete takeover of the host or unauthorized access to sensitive application data.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.4.20 or later.

Proactive Monitoring: Audit environment variables and system logs for unexpected process execution or modifications to application configuration files.

Compensating Controls: Implement strict file system permissions and restrict user access to the environment where OpenClaw is running to mitigate the risk of local exploitation.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires local access, the impact is severe, necessitating prompt patching.

Analyst Recommendation

Given the potential for arbitrary code execution, organizations should prioritize upgrading to version 2026.4.20 immediately. Although local access is required, the severity of the potential impact warrants an expedited patch cycle to prevent unauthorized system control.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: sanitize-html
AFFECTED_VERSIONS: sanitize-html prior to 2.17.4
---END_METADATA---

Description Summary:
The sanitize-html library contains a sanitizer bypass vulnerability that can lead to stored XSS in applications rendering user-controlled content.

Executive Summary:
A sanitizer bypass in the sanitize-html library allows attackers to inject malicious HTML or JavaScript, leading to stored cross-site scripting (XSS) in dependent applications.

Vulnerability Details

CVE-ID: CVE-2026-44990

Affected Software: ApostropheCMS sanitize-html

Affected Versions: sanitize-html prior to 2.17.4

Vulnerability: This is a sanitizer bypass vulnerability where content inside a disallowed xmp element is incorrectly processed as live HTML or JavaScript. This occurs in the default disallowedTagsMode: 'discard' path, allowing an attacker to inject malicious code.

Business Impact

With a CVSS score of 9.3, this vulnerability is critical for web applications relying on sanitize-html. Successful exploitation allows for stored XSS, which can be used to hijack user sessions, steal sensitive session cookies, or perform unauthorized actions on behalf of authenticated administrators.

Remediation Plan

Immediate Action: Update the sanitize-html library dependency to version 2.17.4 or later in all affected project environments.

Proactive Monitoring: Audit application logs for suspicious script injection patterns in user-submitted content fields and monitor for unexpected client-side script execution.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts if an immediate library update is not feasible.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 12, 2026, there is public information confirming the vulnerability. Given the widespread use of this library in Node.js applications, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of this library in web application stacks, developers should prioritize updating to version 2.17.4. Failure to patch leaves applications vulnerable to persistent XSS attacks that can compromise user security.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-820LW
AFFECTED_VERSIONS: 2.03
CONFIDENCE: high
MISSING: none
CREDITS: junqi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352055","name":"VDB-352055 | D-Link DIR-820LW SSDP ssdpcgi_main os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352055","name":"VDB-352055 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773883","name":"Submit #773883 | D-Link DIR-820LW B2.03 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/yunleeeee/cve/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/25790888/OS.Command.Injection.in.D-Link.DIR-820LW.B2.03.via.the.HTTP_ST.environment.variable.in.ssdpcgi_main.function.zip","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the D-Link DIR-820LW 2.03 firmware due to improper input validation in the ssdpcgi_main function of the SSDP component.

Executive Summary:
An unauthenticated remote OS command injection vulnerability in D-Link DIR-820LW firmware version 2.03 poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4499

Affected Software: D-Link DIR-820LW

Affected Versions: 2.03

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered via the HTTP_ST environment variable within the ssdpcgi_main function of the SSDP component. An unauthenticated remote attacker can exploit this by sending specially crafted packets to the affected device.

Business Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands with elevated privileges on the router. This can lead to complete device takeover, interception of network traffic, persistence within the local network, and potential pivot points for further attacks against internal systems. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet immediately and check the official D-Link support portal for firmware updates or security patches. If no patch is available, replace the device as it is currently vulnerable to remote exploitation.

Proactive Monitoring: Review firewall and router logs for anomalous traffic patterns, specifically looking for unusual HTTP requests or unexpected inbound SSDP traffic. Monitor for signs of unauthorized configuration changes or unexpected process execution on the device if management interfaces are accessible.

Compensating Controls: Disable UPnP and SSDP services on the router if they are not strictly required for network functionality to reduce the attack surface. Utilize a perimeter firewall to block inbound access to the router management and discovery ports from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a proof of concept and technical details are available via the research documentation referenced in the CVE record.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the nature of the SSDP service.

Analyst Recommendation

The presence of a public proof of concept combined with the ease of remote exploitation makes this a high priority for remediation. Administrators should prioritize the decommissioning or patching of these legacy devices, as they are likely to remain targets for automated exploitation attempts. If patching is not feasible, the device must be isolated from the public internet to prevent unauthorized remote command execution.

---METADATA---
VENDOR: LibVNC
PRODUCT: LibVNCServer
AFFECTED_VERSIONS: <= 0.9.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
LibVNCServer is vulnerable to an out-of-bounds write, which may allow a remote attacker to execute arbitrary code or cause a crash.

Executive Summary:
A critical out-of-bounds write vulnerability in LibVNCServer could allow a remote attacker to execute arbitrary code or crash the affected application.

Vulnerability Details

CVE-ID: CVE-2026-44988

Affected Software: LibVNC LibVNCServer

Affected Versions: <= 0.9.15

Vulnerability: This is an out-of-bounds write vulnerability (CWE-787) triggered by improper handling of data within the VNC client library. The vulnerability is exploitable by an unauthenticated attacker, although it typically requires user interaction.

Business Impact

The ability to perform an out-of-bounds write poses a severe risk, as it can lead to remote code execution (RCE) on the host system. With a CVSS score of 8.8, this vulnerability poses a significant threat to system availability and security, potentially allowing attackers to gain full control over the affected client or server.

Remediation Plan

Immediate Action: Audit systems to identify instances of LibVNCServer and prepare for updates; monitor official project repositories for the release of a patched version.

Proactive Monitoring: Monitor network traffic to and from VNC endpoints for malformed packets or anomalous connection attempts.

Compensating Controls: Restrict access to VNC services to trusted networks via VPN or firewall rules to minimize exposure to untrusted remote attackers.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive due to the potential for memory corruption and arbitrary code execution.

Analyst Recommendation

Users and administrators should monitor the LibVNCServer GitHub repository for the official patch. Until a fix is available, isolate VNC instances from external exposure and restrict access to authorized personnel only to mitigate the risk of exploitation.

---METADATA---
VENDOR: Penpot
PRODUCT: Penpot
AFFECTED_VERSIONS: < 2.14.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Penpot contains an authentication bypass vulnerability that allows registered users to hijack arbitrary accounts by manipulating invitation flows and profile registration processes.

Executive Summary:
A critical authentication bypass in Penpot enables authenticated users to perform unauthorized account takeovers, potentially leading to full administrative compromise.

Vulnerability Details

CVE-ID: CVE-2026-44986

Affected Software: Penpot Penpot

Affected Versions: < 2.14.5

Vulnerability: The vulnerability stems from flaws in the team invitation and profile registration logic, where session creation is improperly linked to email matching without validating password credentials. This allows a user with existing access to impersonate other profiles by manipulating the registration sequence.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to any non-blocked user account, including those with elevated privileges. With a CVSS score of 9.9, the impact includes unauthorized data access, potential intellectual property theft within design projects, and total loss of account integrity.

Remediation Plan

Immediate Action: Upgrade Penpot to version 2.14.5 or later to resolve the authentication logic flaws.

Proactive Monitoring: Monitor user registration and invitation logs for anomalous activity, specifically frequent profile creation or suspicious associations between email addresses and user IDs.

Compensating Controls: Implement strict network-level access controls for the registration and invitation endpoints while the upgrade is being prepared.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly concerning due to its impact on user identity and access management.

Analyst Recommendation

The risk of account takeover necessitates urgent action. Organizations currently running Penpot should apply the 2.14.5 update immediately to secure their user base and prevent unauthorized access to sensitive collaborative design data.

---METADATA---
VENDOR: CrowdSecurity
PRODUCT: CrowdSec
AFFECTED_VERSIONS: 1.7.0 up to 1.7.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CrowdSec contains a vulnerability related to the improper handling of highly compressed data, which can lead to resource exhaustion.

Executive Summary:
A vulnerability in CrowdSec involving the improper handling of highly compressed data creates a risk of service disruption through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-44981

Affected Software: CrowdSecurity CrowdSec

Affected Versions: 1.7.0 up to 1.7.8

Vulnerability: This vulnerability involves the improper handling of highly compressed data (CWE-409), which allows an unauthenticated attacker to trigger excessive resource consumption through data amplification.

Business Impact

Successful exploitation of this vulnerability results in a denial-of-service condition, rendering the CrowdSec security service unavailable. With a CVSS score of 8.2, this represents a high risk to the availability of security infrastructure that relies on CrowdSec to block malicious traffic.

Remediation Plan

Immediate Action: Update CrowdSec to the version containing the fix (1.7.8 or later) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory, to detect spikes that may indicate a data amplification attack.

Compensating Controls: Utilize a Web Application Firewall (WAF) or rate-limiting features at the network edge to inspect and drop malformed or excessively compressed requests before they reach the CrowdSec service.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the available data.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The vulnerability poses a direct threat to the availability of the CrowdSec security stack. Organizations should schedule an immediate update to the patched version to prevent potential denial-of-service attacks that could leave the network exposed to other threats.

---METADATA---
VENDOR: Elastic
PRODUCT: Kibana
AFFECTED_VERSIONS: 8.0.0 through 8.19.13
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.947Z
---END_METADATA---

Description Summary:
An execution with unnecessary privileges vulnerability exists in the Kibana Fleet plugin, allowing authenticated users to read index data outside their authorized Elasticsearch RBAC scope.

Executive Summary:
An authenticated privilege abuse vulnerability in Elastic Kibana allows users with Fleet sub-feature permissions to access unauthorized Elasticsearch index data, posing a significant data exposure risk.

Vulnerability Details

CVE-ID: CVE-2026-4498

Affected Software: Elastic Kibana

Affected Versions: 8.0.0 through 8.19.13

Vulnerability: The vulnerability involves an execution with unnecessary privileges (CWE-250) within the Fleet plugin debug route handlers. An authenticated user possessing specific Fleet sub-feature privileges can exploit this flaw to bypass RBAC controls and access restricted Elasticsearch index data.

Business Impact

Successful exploitation permits unauthorized access to sensitive index data, potentially leading to the compromise of confidential information stored within the Elasticsearch environment. With a CVSS score of 7.7, this is classified as a High severity issue, as it undermines the integrity of access control policies and could lead to significant data breaches or regulatory non-compliance.

Remediation Plan

Immediate Action: Update Elastic Kibana to version 8.19.14 or later, as specified in the official Elastic security advisory (ESA-2026-21).

Proactive Monitoring: Review Kibana access logs for anomalous requests directed at Fleet plugin debug endpoints and monitor for unauthorized attempts to query indices outside of standard user scopes.

Compensating Controls: Restrict access to the Fleet management features to only the most trusted administrative accounts until the patch is applied, and verify that existing RBAC policies are strictly enforced for all service accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires authenticated access, the ability to escalate data access beyond intended boundaries makes it a high-priority item for environments relying on granular RBAC.

Analyst Recommendation

Given the High severity of this privilege abuse vulnerability, administrators should prioritize the deployment of the vendor-provided patch. Organizations using Elastic Kibana versions 8.0.0 through 8.19.13 must verify their current version and upgrade to 8.19.14 immediately to ensure that RBAC enforcement is restored and sensitive data remains protected from unauthorized access.

---METADATA---
VENDOR: hapijs
PRODUCT: content
AFFECTED_VERSIONS: < 6.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @hapi/content package is susceptible to interpretation conflicts when parsing HTTP Content headers, potentially allowing for unexpected application behavior.

Executive Summary:
An interpretation conflict in the @hapi/content library may lead to security bypasses or data processing errors in applications relying on this parser.

Vulnerability Details

CVE-ID: CVE-2026-44974

Affected Software: hapijs content

Affected Versions: < 6.0.2

Vulnerability: The library contains an interpretation conflict (CWE-436) when processing HTTP Content headers. An unauthenticated attacker can supply crafted headers that are interpreted differently by the library than by other system components.

Business Impact

With a CVSS score of 7.7, this vulnerability poses a high risk of integrity compromise. If the application logic relies on these headers for security decisions, the conflict could allow attackers to bypass filters or access features they are not authorized to use, potentially leading to unauthorized data modification.

Remediation Plan

Immediate Action: Update the @hapi/content package to version 6.0.2 or higher within the project dependency tree.

Proactive Monitoring: Watch for application errors or unexpected behaviors related to request processing and header validation.

Compensating Controls: Ensure that downstream applications do not trust header information implicitly and perform secondary validation of all incoming content metadata.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation typically requires specific application implementation patterns that rely on the affected library's output.

Analyst Recommendation

Development teams should audit their package manifests and update @hapi/content to version 6.0.2 immediately. Securing the dependency chain is critical to preventing exploitation of this interpretation flaw.

---METADATA---
VENDOR: DataDog
PRODUCT: guarddog
AFFECTED_VERSIONS: >= 1.0.0, <= 2.9.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DataDog GuardDog is susceptible to Server-Side Request Forgery (SSRF) due to improper handling of network requests during the analysis of PyPI packages.

Executive Summary:
DataDog GuardDog contains a Server-Side Request Forgery (SSRF) vulnerability that could allow unauthenticated attackers to probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-44971

Affected Software: DataDog guarddog

Affected Versions: >= 1.0.0, <= 2.9.0

Vulnerability: The software is vulnerable to CWE-918 (SSRF), allowing an unauthenticated attacker to induce the application to make unauthorized requests to internal network segments or unauthorized services.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to internal infrastructure. Attackers may use this flaw to bypass firewalls, access internal metadata services, or perform reconnaissance on private network assets, potentially leading to deeper compromise of the environment.

Remediation Plan

Immediate Action: There is currently no fixed version available; users should monitor the official DataDog/guarddog GitHub repository for security updates and consider restricting the tool's network access.

Proactive Monitoring: Monitor egress traffic from the environment where GuardDog is running to identify attempts to reach internal endpoints that should not be accessible.

Compensating Controls: Implement strict egress filtering (e.g., via network security groups or firewall rules) to ensure the application cannot communicate with internal IP ranges or sensitive internal services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. SSRF vulnerabilities in network security tools are particularly dangerous as they can be used to pivot deeper into the network.

Analyst Recommendation

Until a patch is released, users must implement network-level egress controls to mitigate the SSRF risk. Organizations should treat this vulnerability as urgent due to the potential for internal network exposure and the existence of a proof-of-concept.

---METADATA---
VENDOR: Totolink
PRODUCT: WA300
AFFECTED_VERSIONS: 5.2cu.7112_B20190227
CONFIDENCE: high
MISSING: patch
CREDITS: junqi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352046","name":"VDB-352046 | Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352046","name":"VDB-352046 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773875","name":"Submit #773875 | Totolink WA300 V5.2cu.7112_B20190227 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/hellonestor/killallbug/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/25790616/Unauthenticated.Remote.Code.Execution.in.TOTOLINK.WA300.via.Command.Injection.in.recvUpgradeNewFw.zip","name":null,"tags":["exploit","patch"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
Totolink WA300 firmware version 5.2cu.7112_B20190227 contains an OS command injection vulnerability in the recvUpgradeNewFw function, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in Totolink WA300 allows attackers to inject and execute arbitrary OS commands via the device firmware upgrade process.

Vulnerability Details

CVE-ID: CVE-2026-4497

Affected Software: Totolink WA300

Affected Versions: 5.2cu.7112_B20190227

Vulnerability: The flaw resides in the recvUpgradeNewFw function within the /cgi-bin/cstecgi.cgi file, which fails to properly sanitize input before passing it to a system shell. This vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of sensitive data, and the ability to pivot into the local network, creating significant security and operational risks. Given the CVSS score of 7.3, this represents a high-severity risk that demands immediate attention.

Remediation Plan

Immediate Action: Since no official patch is currently available, immediately isolate affected devices from the public internet and restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the management interface or unexpected spikes in CPU usage related to CGI processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized or malformed requests targeting the /cgi-bin/cstecgi.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research materials linked to the CVE record.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of opportunistic attacks against exposed Totolink WA300 devices. Organizations should prioritize the isolation of these devices from external networks until a vendor-supplied firmware update is verified and applied. Continuous monitoring of device logs for signs of unauthorized command execution is essential until permanent remediation is achieved.

---METADATA---
VENDOR: Shepherdwind
PRODUCT: Velocity.js
AFFECTED_VERSIONS: Velocity.js versions 2.1.5 and earlier
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in Velocity.js allows attackers to modify Object.prototype, potentially leading to Denial of Service or Remote Code Execution.

Executive Summary:
A critical prototype pollution vulnerability in Velocity.js versions 2.1.5 and earlier exposes applications to potential Remote Code Execution and Denial of Service attacks.

Vulnerability Details

CVE-ID: CVE-2026-44966

Affected Software: Shepherdwind Velocity.js

Affected Versions: Velocity.js versions 2.1.5 and earlier

Vulnerability: This vulnerability occurs during the processing of #set directives in Velocity templates. It allows an unauthenticated remote attacker to inject malicious payloads into templates, potentially compromising the underlying server environment.

Business Impact

With a CVSS score of 8.3, this high-severity vulnerability poses a significant risk to organizational infrastructure. Successful exploitation could result in full system compromise, unauthorized data access, or persistent service disruption, severely impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest version of Velocity.js as specified by the vendor advisory to resolve the underlying prototype pollution flaw.

Proactive Monitoring: Audit application logs for suspicious #set directive patterns or unexpected Object.prototype modifications that may indicate exploit attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) and input validation routines to sanitize template-bound data before rendering.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, there is public information confirming the availability of exploit code for this vulnerability. Given the ease of exploitation, immediate patching is mandatory.

Analyst Recommendation

The presence of a public exploit combined with the potential for Remote Code Execution makes this a high-priority remediation task. Security teams should prioritize patching affected applications immediately to prevent unauthorized access and potential system-wide compromise.

---METADATA---
VENDOR: WebPros
PRODUCT: Plesk
AFFECTED_VERSIONS: 18.0.75.1, 18.0.76.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Plesk contains an XPath injection vulnerability in the APS Application Catalog, allowing authenticated users to execute arbitrary OS commands as a low-privileged user.

Executive Summary:
An authenticated XPath injection vulnerability in the Plesk APS Application Catalog enables command execution and local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-44962

Affected Software: WebPros Plesk

Affected Versions: 18.0.75.1, 18.0.76.2

Vulnerability: The application fails to properly sanitize user-supplied input before passing it into XPath queries (CWE-643). An authenticated, low-privileged user can exploit this to perform XPath injection, leading to arbitrary command execution on the underlying server.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a critical risk to hosting environments. Successful exploitation allows an authenticated attacker to escalate privileges, potentially leading to a full server compromise, unauthorized access to hosted data, and disruption of all services managed by the Plesk instance.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Plesk as specified in the vendor security advisory.

Proactive Monitoring: Audit server logs for suspicious command execution patterns or abnormal XPath query strings originating from the APS Application Catalog search functionality.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious XPath injection payloads directed at the catalog search.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve command execution makes this a high-priority update. Organizations should apply the vendor-provided patches immediately to prevent privilege escalation and maintain the integrity of the hosting server.