---METADATA---
VENDOR: Revive
PRODUCT: Adserver
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Revive Adserver 6 is susceptible to a vulnerability involving improper validation of user input when saving delivery limitations, potentially allowing for unauthorized system modifications.

Executive Summary:
A high-severity input validation flaw in Revive Adserver 6 could allow authenticated users to compromise the integrity of ad delivery configurations.

Vulnerability Details

CVE-ID: CVE-2026-44959

Affected Software: Revive Adserver

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs due to a failure to properly sanitize input when managing delivery limitations within the application. An authenticated user may exploit this failure to inject malicious data, potentially affecting the logic of the ad server.

Business Impact

The impact of this vulnerability includes the potential for unauthorized data modification and the disruption of legitimate advertising services. With a CVSS score of 8.8, this flaw represents a high risk to business continuity and data integrity, as it allows for the manipulation of critical ad-serving parameters.

Remediation Plan

Immediate Action: Apply the latest security patches released by the vendor to remediate the input validation vulnerability.

Proactive Monitoring: Continuously monitor the application for suspicious administrative activity and audit configuration changes made to delivery limitations for anomalies.

Compensating Controls: Utilize WAF rules to sanitize or block potentially malicious input payloads directed at the application's configuration endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploitation reports, the high severity of the flaw warrants immediate attention and patching.

Analyst Recommendation

Security teams should ensure that all Revive Adserver instances are updated to the current secure version immediately. Restrict administrative privileges to the minimum required level to mitigate the risk of an authenticated user leveraging this vulnerability to compromise the system.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: 2.14.0 before 2.14.3
---END_METADATA---

Description Summary:
Rancher's SAML Assertion Consumer Service handler is vulnerable to authentication replay attacks due to a failure to enforce one-time use of SAML assertions.

Executive Summary:
A critical authentication replay vulnerability in SUSE Rancher allows attackers to perform man-in-the-middle attacks, potentially leading to unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-44946

Affected Software: SUSE Rancher

Affected Versions: 2.14.0 before 2.14.3

Vulnerability: The vulnerability stems from a flaw in the SAML Assertion Consumer Service (ACS) handler, which fails to validate the single-use nature of SAML assertions. This allows an attacker to intercept and replay a valid assertion to gain unauthorized access to the Rancher management interface.

Business Impact

With a CVSS score of 9.5, this flaw poses a critical threat to the security of the container management infrastructure. Successful exploitation allows an attacker to impersonate legitimate users and gain administrative control over the Rancher environment, leading to potential data compromise and full system takeover.

Remediation Plan

Immediate Action: Upgrade all instances of Rancher to version 2.14.3 or later to ensure SAML assertion replay protection is correctly enforced.

Proactive Monitoring: Review authentication logs for suspicious or duplicate SAML login attempts that may indicate replay activity.

Compensating Controls: Ensure that SAML configurations enforce strict transport security (TLS) and session duration limits to minimize the window of opportunity for intercepted assertions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk associated with this SAML replay vulnerability is extreme for organizations relying on centralized authentication. Security teams must prioritize patching Rancher to the recommended version to maintain the integrity of their authentication and authorization processes.

---METADATA---
VENDOR: open-iscsi
PRODUCT: open-iscsi
AFFECTED_VERSIONS: open-iscsi open-iscsi: ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in open-iscsi allows unprivileged local users to interact with the iscsiuio control socket, potentially leading to unauthorized operations.

Executive Summary:
A high-severity authorization flaw in open-iscsi allows unprivileged local users to gain unauthorized access to the iscsiuio control socket, risking system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44944

Affected Software: open-iscsi open-iscsi

Affected Versions: open-iscsi open-iscsi: ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) that occurs because the iscsiuio control socket does not properly validate the permissions of the calling user. The vulnerability allows an unprivileged local user to perform actions that should be restricted.

Business Impact

The CVSS score of 8.5 emphasizes the risk to local system security. By interacting with the control socket, a malicious local user could potentially disrupt storage connectivity or perform unauthorized configuration changes, which could lead to system instability or data unavailability.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates or pull the fix from the official repository commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Proactive Monitoring: Monitor system authorization and audit logs for unauthorized attempts to access or manipulate the iscsiuio daemon or its associated control sockets.

Compensating Controls: Implement strict file system permissions on the control socket and limit the set of users who have shell access to the host system.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which significantly limits the attack surface to malicious insiders or compromised user accounts.

Analyst Recommendation

System administrators should prioritize patching open-iscsi on all Linux hosts. Ensuring that users have the principle of least privilege applied to their accounts will serve as a strong defense against this local authorization flaw.

---METADATA---
VENDOR: SUSE
PRODUCT: libzypp
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A relative path traversal vulnerability exists within the "keyhint" option of the repomd functionality in the SUSE libzypp library.

Executive Summary:
A relative path traversal vulnerability in the SUSE libzypp library could potentially allow for unauthorized file access or manipulation during repository metadata processing.

Vulnerability Details

CVE-ID: CVE-2026-44941

Affected Software: SUSE libzypp

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw occurs in the keyhint option handling within repomd processing. It allows for relative path traversal, which may permit an attacker to influence file operations performed by the library.

Business Impact

With a CVSS score of 8.4, this vulnerability is significant, as libzypp is a core component for package management in SUSE-based systems. Successful exploitation could lead to arbitrary file access or potentially malicious code execution during system updates, undermining the integrity of the entire software distribution and management process.

Remediation Plan

Immediate Action: Apply security updates for the libzypp package as released by the SUSE distribution maintainers.

Proactive Monitoring: Monitor package management logs for unusual repository synchronization errors or unexpected file access patterns during update cycles.

Compensating Controls: Ensure that package repositories are accessed via trusted, secure, and authenticated channels to minimize the risk of interacting with malicious metadata.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The integrity of package management is critical for system security. Administrators of SUSE-based environments must ensure that the libzypp library is updated as soon as the patch is available to protect the system against malicious repository metadata manipulation.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: SUSE Rancher: 0.15.0 up to (excluding) 0.15.2, 0.14.0 up to (excluding) 0.14.6, 0.13.0 up to (excluding) 0.13.11, 0.12.0 up to (excluding) 0.12.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the SUSE Rancher Fleet agent-side deployer fails to filter sensitive security keys from namespaceLabels, potentially leading to unauthorized information disclosure.

Executive Summary:
A high-severity vulnerability in the SUSE Rancher Fleet agent-side deployer allows authenticated users to access sensitive security keys, posing a significant risk to cluster integrity.

Vulnerability Details

CVE-ID: CVE-2026-44938

Affected Software: SUSE Rancher

Affected Versions: SUSE Rancher: 0.15.0 up to (excluding) 0.15.2, 0.14.0 up to (excluding) 0.14.6, 0.13.0 up to (excluding) 0.13.11, 0.12.0 up to (excluding) 0.12.15

Vulnerability: This is an improper protection of credentials (CWE-522) flaw where the agent-side deployer fails to sanitize namespaceLabels. An authenticated attacker with low-level access can potentially intercept or view sensitive keys used within the Fleet deployment process.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized exposure of sensitive credentials, potentially allowing an attacker to escalate privileges or gain full control over the affected Kubernetes clusters. With a CVSS score of 8.8, this represents a high risk to organizational data confidentiality and system availability. Successful exploitation may result in significant operational disruption and compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of the Fleet agent as specified in the official SUSE vendor advisory to ensure security-sensitive keys are properly filtered.

Proactive Monitoring: Review Kubernetes audit logs for suspicious activity involving namespace label modifications or unauthorized attempts to access secret resources.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the number of users who can modify namespace labels or deployment configurations within the cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this vulnerability, administrators should prioritize updating the Fleet agent across all affected Rancher environments. Failure to address this flaw could allow attackers to harvest critical credentials, leading to total compromise of the management plane.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher Fleet
AFFECTED_VERSIONS: 0.15.0 up to 0.15.2, 0.14.0 up to 0.14.6, 0.13.0 up to 0.13.11, 0.12.0 up to 0.12.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in SUSE Rancher Fleet allows for the forgery of unauthenticated webhook requests.

Executive Summary:
A high-severity SSRF vulnerability in SUSE Rancher Fleet enables unauthenticated attackers to forge webhook requests, potentially leading to unauthorized internal actions.

Vulnerability Details

CVE-ID: CVE-2026-44937

Affected Software: SUSE Rancher Fleet

Affected Versions: 0.15.0 up to 0.15.2, 0.14.0 up to 0.14.6, 0.13.0 up to 0.13.11, 0.12.0 up to 0.12.15

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the webhook handling component. The flaw allows unauthenticated remote actors to trigger forged requests, which may result in unauthorized resource interaction within the internal network.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk to organizational infrastructure. Successful exploitation could allow attackers to bypass network perimeters, interact with internal services that are not exposed to the public internet, or perform unauthorized operations within the Rancher environment, leading to significant system compromise.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of the Rancher Fleet component as specified in the vendor security advisory.

Proactive Monitoring: Monitor incoming webhook traffic and server access logs for anomalous request patterns or unexpected destination endpoints originating from the Rancher Fleet service.

Compensating Controls: Implement strict network egress filtering on the Rancher Fleet host to prevent unauthorized outbound requests to sensitive internal or external resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized internal network access, this vulnerability should be prioritized for remediation. Administrators must verify their current version against the affected releases and apply the provided security updates immediately to mitigate the risk of SSRF-based attacks.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, 0.12 before 0.12.15
---END_METADATA---

Description Summary:
A missing validation vulnerability in the SUSE Rancher Fleet Helm Deployer allows authenticated tenants to access the fleet credentials of other tenants.

Executive Summary:
A critical vulnerability in the SUSE Rancher Fleet component allows authenticated tenant users to perform cross-tenant credential theft, jeopardizing the security of managed Kubernetes clusters.

Vulnerability Details

CVE-ID: CVE-2026-44935

Affected Software: SUSE Rancher

Affected Versions: Fleet 0.15 < 0.15.2, 0.14 < 0.14.6, 0.13 < 0.13.11, 0.12 < 0.12.15

Vulnerability: The vulnerability exists due to missing validation of "valuesFrom" references in the Helm Deployer. This allows a malicious tenant to reference and access sensitive fleet credentials belonging to other tenants within the same Rancher environment.

Business Impact

The CVSS score of 9.9 underscores the catastrophic risk to multi-tenant container environments. Unauthorized access to fleet credentials can lead to a total compromise of managed downstream Kubernetes clusters, data leakage, and the potential for an attacker to execute arbitrary code across the entire infrastructure managed by the affected Rancher installation.

Remediation Plan

Immediate Action: Upgrade the SUSE Rancher Fleet component to the patched versions (0.15.2, 0.14.6, 0.13.11, or 0.12.15) as specified in the vendor security advisory.

Proactive Monitoring: Audit existing Helm deployments and review access logs for any unauthorized "valuesFrom" reference attempts or unexpected credential access requests.

Compensating Controls: Temporarily restrict the ability of untrusted users to deploy Helm charts until the patching process is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical for organizations utilizing SUSE Rancher in multi-tenant configurations. It is imperative that administrators verify their current Fleet version and apply the recommended updates immediately to prevent cross-tenant credential exposure and cluster-wide compromise.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher AI Agent
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
SUSE Rancher AI Agent inadvertently exposes sensitive information in logs when the debug log level is enabled.

Executive Summary:
A high-severity information disclosure vulnerability in SUSE Rancher AI Agent allows privileged users to access sensitive data when debug logging is active.

Vulnerability Details

CVE-ID: CVE-2026-44934

Affected Software: SUSE Rancher AI Agent

Affected Versions: 1.0.0 up to (excluding) 1.0.2

Vulnerability: This issue stems from the insertion of sensitive information into debugging code (CWE-215). It requires a privileged user (High level) to have already configured the system to a DEBUG log level, at which point sensitive data is logged in plain text.

Business Impact

With a CVSS score of 7.0, this vulnerability presents a risk of unauthorized data exposure. If logs are stored in insecure locations or accessible to unauthorized personnel, sensitive information could be compromised, potentially leading to further system exploitation or identity theft.

Remediation Plan

Immediate Action: Upgrade to version 1.0.2 or later, or disable DEBUG log levels immediately if an upgrade is not immediately feasible.

Proactive Monitoring: Audit existing log files for exposed sensitive data and restrict access to log storage locations to authorized personnel only.

Compensating Controls: Ensure that log management systems are encrypted at rest and that log access is strictly controlled via Role-Based Access Control (RBAC).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the SUSE Rancher AI Agent must treat this as a priority update. Immediate transition to the patched version is required to prevent inadvertent exposure of sensitive data through system logs.

---METADATA---
VENDOR: SUSE
PRODUCT: SUSE Linux Enterprise / openSUSE
AFFECTED_VERSIONS: 17.38.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PluginScript fails to correctly restrict chroot operations, allowing for path traversal vulnerabilities when the repoManagerRoot is configured to the system root.

Executive Summary:
A path traversal vulnerability in SUSE Linux PluginScript could allow an attacker with local access to escape intended directory restrictions and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44933

Affected Software: SUSE Linux Enterprise and openSUSE

Affected Versions: 17.38.8 (fixed in 17.38.9)

Vulnerability: This is a CWE-35 path traversal vulnerability occurring within the PluginScript component. The flaw allows unauthorized file system access when the repository manager root is set to the system root, requiring local access and user interaction to trigger.

Business Impact

Successful exploitation of this path traversal flaw could lead to unauthorized access to sensitive system files, potentially resulting in full system compromise. With a CVSS score of 7.8, this represents a significant risk to the confidentiality and integrity of the host system, necessitating prompt attention despite the requirement for local access.

Remediation Plan

Immediate Action: Update SUSE Linux Enterprise and openSUSE installations to version 17.38.9 or later to resolve the directory restriction flaw.

Proactive Monitoring: Monitor system logs for unusual file access patterns or attempts to traverse directories outside of expected plugin execution paths.

Compensating Controls: Ensure that the repoManagerRoot is configured to a non-root, restricted directory path to limit the scope of potential traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is high, but it is constrained by the requirement for local access and specific configuration parameters.

Analyst Recommendation

Given the potential for total technical impact, administrators should prioritize updating the PluginScript component on all affected SUSE systems. Applying the vendor-provided patch is the only definitive way to remediate the underlying path traversal mechanism.

---METADATA---
VENDOR: SUSE
PRODUCT: wicked dhcp client
AFFECTED_VERSIONS: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1
---END_METADATA---

Description Summary:
The wicked DHCP client is vulnerable to the processing of unsanitized strings from DHCP replies, potentially leading to system compromise.

Executive Summary:
The wicked DHCP client is susceptible to an easily exploitable vulnerability involving the processing of unsanitized strings from network replies.

Vulnerability Details

CVE-ID: CVE-2026-44932

Affected Software: wicked dhcp client

Affected Versions: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1

Vulnerability: This vulnerability involves the passing of unsanitized strings from DHCP replies into the wicked dhcp client. Exploitation is considered easy and requires local network access to inject malicious DHCP responses.

Business Impact

With a CVSS score of 8.8, this flaw represents a major security risk for any system utilizing the wicked DHCP client. An attacker on the local network can exploit this to perform actions with the privileges of the DHCP client process. This could lead to full system compromise, particularly if the client runs with elevated permissions during network configuration.

Remediation Plan

Immediate Action: Apply vendor security updates to wicked version 0.6.79-1.1 or higher (or 0.6.79-150700.3.3.1 for specific distributions) immediately.

Proactive Monitoring: Monitor network traffic for anomalous DHCP traffic or unexpected network configuration changes on critical systems.

Compensating Controls: Use network segmentation to limit the exposure of sensitive systems to potentially untrusted DHCP servers and verify the integrity of DHCP responses where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it targets fundamental network configuration processes. Given the ease of exploitation, system administrators should prioritize patching all affected Linux systems to prevent potential network-based attacks and subsequent system compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: patch
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352019","name":"VDB-352019 | Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub_423B50 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352019","name":"VDB-352019 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773727","name":"Submit #773727 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/5","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router firmware, allowing remote attackers to potentially achieve arbitrary code execution or cause a denial of service via the deviceList parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda A18 Pro firmware version V02.03.02.28 poses a significant risk of remote code execution or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4493

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the sub_423B50 function within the /goform/setMacFilterCfg endpoint, where insufficient bounds checking on the deviceList parameter leads to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements, the flaw allows remote manipulation of memory, which can be leveraged to overwrite the return address.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the web server or cause a complete denial of service of the networking device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized network access, interception of traffic, or complete takeover of the affected router, resulting in significant operational downtime or data breach.

Remediation Plan

Immediate Action: As no official patch is currently available, immediately restrict access to the web management interface of the Tenda A18 Pro to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repetitive or malformed POST requests to the /goform/setMacFilterCfg endpoint, which may indicate attempts to trigger the buffer overflow.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) rule to block or sanitize input to the /goform/setMacFilterCfg endpoint, specifically filtering for excessively long strings in the deviceList parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept Python script is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation in the processing of MAC filtering rules.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing Tenda A18 Pro routers should isolate these devices from the public internet immediately and monitor for anomalous traffic patterns until the vendor provides a firmware update. Failure to mitigate this risk leaves the infrastructure vulnerable to remote exploitation.

---METADATA---
VENDOR: Veritas
PRODUCT: InfoScale CmdServer
AFFECTED_VERSIONS: Before 7
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A security vulnerability exists in Veritas InfoScale CmdServer versions prior to 7, which may lead to unauthorized system access.

Executive Summary:
A critical security vulnerability in Veritas InfoScale CmdServer versions prior to 7 poses a high risk of unauthorized access and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44926

Affected Software: Veritas InfoScale CmdServer

Affected Versions: All versions prior to 7

Vulnerability: This vulnerability affects the CmdServer component of InfoScale. The CVSS vector (PR:L) indicates that an authenticated user with low privileges can achieve high levels of impact across confidentiality, integrity, and availability.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, which allows for the compromise of critical enterprise data and system services. Unauthorized access at this level could lead to a complete takeover of the InfoScale management layer, causing significant operational downtime and potential data loss.

Remediation Plan

Immediate Action: Upgrade Veritas InfoScale CmdServer to version 7 or higher as specified in the official vendor security bulletin.

Proactive Monitoring: Review InfoScale CmdServer access and audit logs for suspicious activity or unauthorized commands executed by low-privileged user accounts.

Compensating Controls: Restrict network access to the CmdServer management interface to known, trusted management workstations via firewall rules or VPNs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the potential for total technical impact, even if exploitation requires prior authentication.

Analyst Recommendation

Veritas InfoScale is a core infrastructure component; therefore, patching this vulnerability is critical to maintaining organizational security. Organizations should verify their current version and schedule an upgrade to version 7 immediately to eliminate the exposure.

---METADATA---
VENDOR: Veritas
PRODUCT: InfoScale
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability exists in Veritas InfoScale, which could allow an attacker to perform unauthorized actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Veritas InfoScale could allow attackers to execute unauthorized commands, potentially leading to a total compromise of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-44925

Affected Software: Veritas InfoScale

Affected Versions: See vendor advisory

Vulnerability: This is a CSRF vulnerability. The CVSS vector indicates the attack is possible from an adjacent network (AV:A) and does not require user interaction (UI:N), which is atypical for standard CSRF and suggests a highly accessible attack surface.

Business Impact

With a CVSS score of 8.8, this CSRF flaw poses a severe threat, allowing for unauthorized state-changing operations within the InfoScale management environment. This could result in unauthorized configuration changes or data manipulation, severely impacting the security posture and operational stability of the enterprise storage environment.

Remediation Plan

Immediate Action: Consult the official Veritas support portal to identify the specific patched version for your deployment of InfoScale and apply the update immediately.

Proactive Monitoring: Implement strict session management and ensure that all administrative interfaces are protected by strong authentication and anti-CSRF tokens.

Compensating Controls: Use a Web Application Firewall (WAF) or network access controls to restrict access to the InfoScale management interface to trusted, internal network segments only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score suggests that the vulnerability should be treated as a priority, despite the lack of specific versioning details provided in the current data.

Analyst Recommendation

Due to the high severity and the nature of CSRF attacks against administrative interfaces, organizations must treat this as a priority update. Administrators should verify their InfoScale version against the latest vendor security guidance and apply all recommended patches to prevent unauthorized system manipulation.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352018","name":"VDB-352018 | Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352018","name":"VDB-352018 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773682","name":"Submit #773682 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda A18 Pro router allows authenticated attackers to achieve remote code execution or a denial of service via the /goform/formSetQosBand endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda A18 Pro router could allow a remote authenticated attacker to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-4492

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the set_qosMib_list function within the /goform/formSetQosBand endpoint, where unsanitized user input is copied into a fixed-size stack buffer using the unsafe strcpy function. Exploitation requires the attacker to have low-level authenticated access to the management interface.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected router, facilitating unauthorized access to internal network traffic or the ability to pivot into the local network. Given the CVSS score of 8.8, this poses a significant risk to data confidentiality and network integrity, potentially leading to total system compromise and operational downtime.

Remediation Plan

Immediate Action: Update the Tenda A18 Pro firmware to the latest available version provided by the manufacturer that addresses this buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetQosBand endpoint and audit router access logs for suspicious administrative activity.

Compensating Controls: Restrict access to the router management interface to trusted IP addresses only and disable remote management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept exists, which significantly lowers the barrier for potential attackers. The vulnerability is inherently dangerous due to the lack of bounds checking on user-supplied parameters, allowing for memory corruption.

Analyst Recommendation

This vulnerability represents a high-severity risk to network infrastructure. Administrators must prioritize updating the firmware on all affected Tenda A18 Pro devices immediately. If an update is not currently feasible, isolate the management interface from untrusted networks to prevent exploitation by unauthorized actors.

---METADATA---
VENDOR: Apache
PRODUCT: NiFi
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Apache NiFi 1 contains an unspecified vulnerability requiring immediate vendor-provided security updates for mitigation.

Executive Summary:
A high-severity vulnerability in Apache NiFi 1 requires immediate attention to prevent potential exploitation of the platform's data processing pipelines.

Vulnerability Details

CVE-ID: CVE-2026-44914

Affected Software: Apache NiFi

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability pertains to the Apache NiFi 1 series. Due to limited technical disclosure, the specific attack vector is currently categorized as requiring investigation via official vendor security advisories.

Business Impact

With a CVSS score of 7.5, this vulnerability is considered high risk, potentially enabling unauthorized access or disruption to data flows managed by NiFi. Successful exploitation could lead to significant data exposure or service outages within critical data ingestion pipelines, impacting overall business operations.

Remediation Plan

Immediate Action: Consult the official Apache NiFi security advisory page to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Review system access logs for anomalous behavior or unauthorized access patterns specifically targeting the NiFi management interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated signatures to filter potentially malicious requests aimed at the NiFi application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Apache NiFi 1 must treat this advisory with high urgency. Monitor the Apache security mailing lists and vendor documentation for the release of specific patches and apply them to all production environments upon verification.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352017","name":"VDB-352017 | Tenda A18 Pro SetIpMacBind fromSetIpMacBind stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352017","name":"VDB-352017 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773671","name":"Submit #773671 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router firmware, allowing remote attackers to execute arbitrary code via the /goform/SetIpMacBind endpoint.

Executive Summary:
A critical stack-based buffer overflow in Tenda A18 Pro firmware enables remote code execution, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-4491

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability is a stack-based buffer overflow located in the fromSetIpMacBind function within the /goform/SetIpMacBind endpoint. By sending a maliciously crafted list parameter, an authenticated attacker can trigger an unsafe strcpy operation that overwrites the stack frame and allows for arbitrary code execution or a denial of service.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected router with root privileges. This grants the attacker full control over the network gateway, potentially leading to unauthorized data interception, internal network pivoting, or complete loss of service. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security.

Remediation Plan

Immediate Action: Users should immediately update the Tenda A18 Pro firmware to a version beyond V02.03.02.28 that addresses this buffer overflow. If no patch is available, restrict access to the web management interface to trusted administrative networks only.

Proactive Monitoring: Monitor device logs for unexpected crashes of the httpd process or recurrent timeouts when accessing the IP-MAC binding configuration page.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /goform/SetIpMacBind endpoint that contain excessively long strings in the list parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue linked by the researcher.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

This vulnerability presents a significant risk to the security of the Tenda A18 Pro router. Administrators must prioritize updating the firmware to the latest available version to remediate the buffer overflow. Given the availability of a public proof-of-concept, the likelihood of exploitation by threat actors is elevated, making timely patching or network-level isolation mandatory.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352016","name":"VDB-352016 | Tenda A18 Pro openSchedWifi setSchedWifi stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352016","name":"VDB-352016 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773670","name":"Submit #773670 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router within the setSchedWifi function, allowing authenticated attackers to cause a denial of service or execute arbitrary code.

Executive Summary:
A heap-based buffer overflow vulnerability in the Tenda A18 Pro router, specifically within the Wi-Fi scheduling configuration, poses a significant risk of remote code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-4490

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the /goform/openSchedWifi endpoint due to the use of the unsafe strcpy function. An authenticated attacker can supply oversized parameters to the schedStartTime or schedEndTime fields, causing memory corruption that may lead to service crashes or arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability could result in a complete loss of availability for the affected Tenda networking device, disrupting network connectivity for all dependent users and systems. Given the CVSS score of 8.8, the potential for arbitrary code execution creates a critical risk, as an attacker could gain persistent control over the networking infrastructure to facilitate further lateral movement or data interception within the internal network.

Remediation Plan

Immediate Action: Administrators should immediately restrict access to the web management interface and check the Tenda support portal for firmware updates that address this buffer overflow.

Proactive Monitoring: Monitor system logs for repeated crashes of the httpd service or unusual request patterns targeting the /goform/openSchedWifi endpoint.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure the management interface is only accessible from trusted administrative IP addresses, effectively mitigating the risk from unauthorized users.

Exploitation Status

Public Exploit Available: Yes — a functional proof-of-concept exploit is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on common configuration parameters.

Analyst Recommendation

The severity of this flaw, combined with the availability of a public proof-of-concept, necessitates immediate attention. Administrators must prioritize the application of vendor patches or, at a minimum, isolate the management interface from the network to prevent unauthorized access and potential code execution.

---METADATA---
VENDOR: Netty Project
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Netty network framework may allow for exploitation of protocol-based communication channels.

Executive Summary:
A critical high-severity vulnerability within the Netty framework exposes protocol servers and clients to potential security risks.

Vulnerability Details

CVE-ID: CVE-2026-44894

Affected Software: Netty Project Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Netty framework, impacting its ability to safely process network protocols. It is essential to ensure that applications using this framework are updated to maintain the integrity of communication sessions.

Business Impact

The CVSS 7.5 rating indicates a high level of risk, as exploitation could lead to data compromise or unauthorized service interruption. For organizations leveraging Netty for high-performance networking, this vulnerability could result in severe business impact, including loss of data integrity and system availability.

Remediation Plan

Immediate Action: Apply vendor-provided security patches immediately upon availability to mitigate potential risks to network infrastructure.

Proactive Monitoring: Review application logs for irregular traffic patterns or evidence of unauthorized access to protocol-based service endpoints.

Compensating Controls: Implement virtual patching via a WAF or restrict network access to affected ports to reduce the likelihood of remote exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must move quickly to assess their exposure to this vulnerability. Updating the Netty library is the only definitive way to remediate the underlying flaw and ensure the continued security of the network communication layer.

---METADATA---
VENDOR: Netty Project
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Netty framework, impacting the integrity of protocol-based network communications.

Executive Summary:
The Netty network application framework is susceptible to a high-severity vulnerability that threatens the security of protocol server and client implementations.

Vulnerability Details

CVE-ID: CVE-2026-44893

Affected Software: Netty Project Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Netty framework, potentially allowing for unauthorized manipulation or disruption of network traffic. Given the framework's architecture, this could impact various protocol implementations depending on how the library is integrated into the host application.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to enterprise infrastructure. Exploitation could result in unauthorized data access or service outages, severely impacting business continuity and the security posture of systems that rely on Netty for critical network communications.

Remediation Plan

Immediate Action: Audit all systems to locate dependencies on the Netty framework and prioritize the application of security updates once released by the vendor.

Proactive Monitoring: Increase surveillance of server logs to identify unusual traffic spikes or protocol-specific anomalies that may indicate an exploitation attempt.

Compensating Controls: Utilize network-level security controls and firewalls to restrict access to services using Netty, minimizing the attack surface until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize the identification of affected Netty components within their environment. The high severity of this flaw necessitates a rapid response; stakeholders should monitor the official Netty security advisories to ensure prompt deployment of necessary patches.

---METADATA---
VENDOR: Netty Project
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Netty network application framework that could potentially impact protocol server and client security.

Executive Summary:
The Netty network application framework contains a high-severity vulnerability that may expose protocol servers and clients to unauthorized exploitation.

Vulnerability Details

CVE-ID: CVE-2026-44892

Affected Software: Netty Project Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Netty framework, which is utilized for building high-performance protocol servers and clients. While specific technical triggers are pending further disclosure, such flaws in network frameworks often involve improper input validation or memory handling.

Business Impact

Successful exploitation of this high-severity (CVSS 7.5) vulnerability could allow remote attackers to compromise the integrity and availability of services relying on the Netty framework. This poses a significant risk to data confidentiality and could lead to unauthorized service disruption, causing potential operational downtime and reputational damage.

Remediation Plan

Immediate Action: Identify all internal applications utilizing the Netty framework and apply the latest vendor-supplied security patches as soon as they become available.

Proactive Monitoring: Implement enhanced logging for network traffic and monitor for anomalous behavior or unexpected connection patterns originating from external sources.

Compensating Controls: Deploy Web Application Firewalls (WAF) or Network Intrusion Detection Systems (NIDS) with updated rulesets to detect and block traffic patterns associated with common protocol manipulation attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role Netty plays in network infrastructure, administrators should treat this vulnerability with high priority. Organizations must conduct a thorough inventory of their software stack to identify instances of Netty and ensure that patching procedures are executed immediately upon the release of vendor updates.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netty is susceptible to uncontrolled resource consumption, allowing unauthenticated remote attackers to cause a denial of service via resource exhaustion.

Executive Summary:
A high severity vulnerability in the Netty framework allows unauthenticated remote attackers to trigger denial of service conditions through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-44891

Affected Software: Netty Netty

Affected Versions: < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Vulnerability: This vulnerability involves uncontrolled resource consumption and allocation without limits (CWE-400, CWE-770). The attack vector is network based and requires no authentication or user interaction to exploit.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high risk to service availability. Successful exploitation allows remote actors to crash services or render them unresponsive, leading to significant downtime for dependent applications and potential disruption of critical business operations.

Remediation Plan

Immediate Action: Update the Netty framework to version 4.1.136.Final or 4.2.16.Final, as specified in the official vendor release notes.

Proactive Monitoring: Monitor server metrics for sudden spikes in memory or CPU usage that correlate with network traffic patterns.

Compensating Controls: Implement rate limiting at the network boundary or Web Application Firewall level to restrict the volume of incoming requests that may trigger resource exhaustion.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of triggering resource exhaustion from an unauthenticated network position.

Analyst Recommendation

Given the high CVSS score and the nature of resource exhaustion attacks, immediate patching is recommended to maintain system stability. Organizations should prioritize upgrading their Netty dependencies to the fixed versions to eliminate this denial of service vector.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security flaw in the Netty network application framework potentially allows for remote exploitation of protocol-handling services.

Executive Summary:
A critical vulnerability in the Netty framework requires prompt remediation to protect protocol-based services from remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-44890

Affected Software: Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core protocol handling logic within Netty. Depending on the configuration, an attacker may be able to trigger the flaw remotely to disrupt services or bypass existing security constraints within the application.

Business Impact

The CVSS score of 7.5 reflects the high risk posed to any infrastructure relying on Netty. Successful exploitation could result in full-service compromise or unauthorized manipulation of data transmitted through the affected protocol servers, leading to severe reputational and financial consequences.

Remediation Plan

Immediate Action: Upgrade to the latest version of Netty as specified by the project maintainers to resolve the underlying protocol handling flaw.

Proactive Monitoring: Review ingress/egress traffic patterns and application-level logs for signs of protocol manipulation or unexpected connection behavior.

Compensating Controls: Employ robust ingress validation and rate limiting at the network boundary to mitigate the impact of potentially malicious traffic directed at Netty-based services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the widespread use of Netty in enterprise Java environments, organizations must treat this vulnerability with high urgency. Patching should be performed as part of an emergency update cycle to ensure that all internet-facing and internal protocol services are protected from exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352015","name":"VDB-352015 | Tenda A18 Pro fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352015","name":"VDB-352015 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773619","name":"Submit #773619 | Tenda A18pro V02.03.02.28 stack","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda A18 Pro router allows authenticated attackers to cause a denial of service or achieve remote code execution via the /goform/fast_setting_wifi_set endpoint.

Executive Summary:
A critical stack-based buffer overflow in Tenda A18 Pro firmware V02.03.02.28 allows authenticated attackers to execute arbitrary code or crash the device management interface.

Vulnerability Details

CVE-ID: CVE-2026-4489

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the form_fast_setting_wifi_set function, where the device processes the ssid parameter using an unsafe sprintf call. An authenticated attacker can provide an overly long string to overflow the stack buffer, leading to memory corruption, potential code execution, or service disruption.

Business Impact

Successful exploitation of this vulnerability could result in a complete loss of confidentiality, integrity, and availability of the affected router. Because the vulnerability allows for remote code execution with root privileges, an attacker could gain persistent access to the network, intercept traffic, or pivot to internal assets, creating a significant security risk for the organization. Given the CVSS score of 8.8, this flaw is categorized as High severity and requires immediate attention to prevent unauthorized system control.

Remediation Plan

Immediate Action: Administrators should check the Tenda support portal for firmware updates that address this buffer overflow and apply them as soon as they are available.

Proactive Monitoring: Security teams should monitor network logs for unusual HTTP POST or GET requests directed toward the /goform/fast_setting_wifi_set endpoint, particularly those containing abnormally long parameters.

Compensating Controls: Restrict access to the router management interface to trusted administrative IP addresses and ensure the device is not exposed directly to the public internet.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up on GitHub.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the ssid parameter, which allows for direct control over the return address on the stack.

Analyst Recommendation

This vulnerability represents a significant risk to network infrastructure due to the potential for remote code execution. Administrators must prioritize applying the latest firmware updates provided by Tenda to remediate the underlying memory corruption flaw. Until a patch is applied, ensure the management interface is strictly isolated from external access to minimize the attack surface.

---METADATA---
VENDOR: Pi.Alert
PRODUCT: Pi.Alert
AFFECTED_VERSIONS: Prior to 2026-05-07
---END_METADATA---

Description Summary:
Pi.Alert is vulnerable to unauthenticated remote code execution through the configuration save endpoint, allowing arbitrary Python code injection.

Executive Summary:
An unauthenticated remote code execution vulnerability in Pi.Alert allows attackers to execute arbitrary commands by injecting code into the application configuration.

Vulnerability Details

CVE-ID: CVE-2026-44888

Affected Software: Pi.Alert Pi.Alert

Affected Versions: Prior to 2026-05-07

Vulnerability: The configuration saving function fails to sanitize user-provided values before writing them to the configuration file, which is then executed by the system cron process.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for full system compromise by an unauthenticated attacker. The ability to inject code that is executed periodically by the system daemon ensures persistent control and high impact on the host environment.

Remediation Plan

Immediate Action: Upgrade to Pi.Alert version 2026-05-07 or later to implement strict input validation for configuration values.

Proactive Monitoring: Audit the pialert.conf file for unauthorized modifications and monitor cron process activity for suspicious execution paths.

Compensating Controls: Enable web protection and restrict network access to the Pi.Alert web interface to prevent unauthenticated configuration changes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that must be addressed immediately. Users should update the software and ensure that the web interface is not exposed to untrusted networks.

---METADATA---
VENDOR: Pi.Alert
PRODUCT: Pi.Alert
AFFECTED_VERSIONS: Prior to 2026-05-07
---END_METADATA---

Description Summary:
Pi.Alert is vulnerable to unauthenticated remote code execution due to improper validation of configuration files, allowing arbitrary Python code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in Pi.Alert allows attackers to execute arbitrary commands by injecting malicious code into the configuration file.

Vulnerability Details

CVE-ID: CVE-2026-44887

Affected Software: Pi.Alert Pi.Alert

Affected Versions: Prior to 2026-05-07

Vulnerability: The web-based configuration editor fails to sanitize user input, allowing an attacker to inject Python code into pialert.conf, which is subsequently executed by the background daemon with elevated privileges.

Business Impact

With a CVSS score of 9.8, this flaw allows for complete system compromise by an unauthenticated attacker. The ability to execute arbitrary code as the daemon process grants the attacker full control over the host system, leading to data theft, persistent backdoors, and lateral movement.

Remediation Plan

Immediate Action: Upgrade to Pi.Alert version 2026-05-07 or later immediately to implement proper input validation.

Proactive Monitoring: Inspect pialert.conf for any unexpected or obfuscated Python code segments and review system logs for unauthorized daemon activity.

Compensating Controls: Ensure web protection is enabled and strictly limit access to the web interface via VPN or IP-based access control lists (ACLs).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is extremely severe due to the ease of exploitation and the resulting full system compromise. Immediate patching is non-negotiable for any publicly accessible Pi.Alert instance.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: <= 3.2.7-210907-180535
CONFIDENCE: high
MISSING: patch
CREDITS: kunlun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352011","name":"VDB-352011 | UTT HiPER 1250GW setSysAdm strcpy buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352011","name":"VDB-352011 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773565","name":"Submit #773565 | UTT HiPER 1250GW <=v3.2.7-210907-180535 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/hmKunlun/UTTHiPER/blob/main/HiPER%201250GW.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the UTT HiPER 1250GW router, specifically within the /goform/setSysAdm endpoint, allows authenticated attackers to trigger memory corruption.

Executive Summary:
A buffer overflow vulnerability in the UTT HiPER 1250GW router allows authenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-4488

Affected Software: UTT HiPER 1250GW

Affected Versions: <= 3.2.7-210907-180535

Vulnerability: The device contains a buffer overflow vulnerability in the strcpy function within the /goform/setSysAdm file. By providing a specially crafted input to the GroupName or Passwd1 parameters, an authenticated attacker can overwrite memory, leading to potential system compromise or service disruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. As the device functions as a router, compromise can facilitate unauthorized access to internal network traffic, lead to complete device failure, or allow for persistent control over the gateway. With a CVSS score of 8.8, this flaw is categorized as High severity, necessitating immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain firmware updates that address this buffer overflow. If no patch is available, ensure the management interface is not accessible from untrusted networks.

Proactive Monitoring: Review device access logs for unusual POST requests to the /goform/setSysAdm endpoint, specifically looking for abnormally long string parameters that may indicate overflow attempts.

Compensating Controls: Implement strict access control lists (ACLs) to limit administrative interface access to known, trusted management IP addresses to prevent exploitation by non-authorized users.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the research write-up provided by the vulnerability reporter.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published proof-of-concept demonstrating the overflow mechanism significantly lowers the barrier for potential attackers.

Analyst Recommendation

Given the availability of a published proof-of-concept and the critical nature of the affected device as a network gateway, organizations must prioritize the mitigation of this vulnerability. Administrators should restrict access to the web management interface immediately and apply vendor-supplied firmware updates as soon as they become available to eliminate the underlying memory corruption flaw.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1200GW
AFFECTED_VERSIONS: <= 2.5.3-170306
CONFIDENCE: high
MISSING: patch
CREDITS: kunlun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352010","name":"VDB-352010 | UTT HiPER 1200GW websHostFilter strcpy buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352010","name":"VDB-352010 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773538","name":"Submit #773538 | UTT HiPER 1200GW <=v2.5.3-170306 buffer overflow","tags":["third-party-advisory"]},{"url":"https://github.com/hmKunlun/UTTHiPER/blob/main/HiPER%201200GW.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the UTT HiPER 1200GW router due to improper boundary checking in the /goform/websHostFilter endpoint, allowing for potential remote code execution.

Executive Summary:
A critical buffer overflow vulnerability in UTT HiPER 1200GW routers allows authenticated attackers to trigger memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4487

Affected Software: UTT HiPER 1200GW

Affected Versions: <= 2.5.3-170306

Vulnerability: The device is susceptible to a buffer overflow via the strcpy function within the /goform/websHostFilter endpoint. Successful exploitation requires the attacker to possess authenticated access to the administrative interface.

Business Impact

The exploitation of this vulnerability can lead to a complete compromise of the affected routing hardware, potentially resulting in unauthorized network access, data interception, or sustained denial of service. With a CVSS score of 8.8, this flaw represents a high risk to organizational infrastructure, as the router is a critical edge device that serves as a gateway for internal traffic.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the administrative interface to trusted management networks only and disable remote management if not required.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/websHostFilter endpoint and investigate any unexpected router reboots or service instability.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long input strings sent to the /goform/websHostFilter URI.

Exploitation Status

Public Exploit Available: Yes — a public proof of concept is available via the researcher write-up on GitHub.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it involves a classic memory corruption flaw that can be triggered through a standard HTTP POST request.

Analyst Recommendation

Given the availability of a public proof of concept and the high severity of memory corruption vulnerabilities, this issue should be prioritized for remediation. Administrators must isolate the management interface of the UTT HiPER 1200GW from the public internet immediately and contact the vendor for guidance on firmware updates or security mitigations to protect the integrity of the network perimeter.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: 1.10
CONFIDENCE: high
MISSING: patch
CREDITS: AttackingLin (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352009","name":"VDB-352009 | D-Link DIR-513 Web Service formEasySetPassword stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352009","name":"VDB-352009 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773537","name":"Submit #773537 | D-Link DIR-513 1.10 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.773566","name":"Submit #773566 | D-Link DIR-513 1.10 Buffer Overflow (Duplicate)","tags":["third-party-advisory"]},{"url":"https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/formEasySetPassword.md","name":null,"tags":["related"]},{"url":"https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/poc.py","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-513 web service allows remote authenticated attackers to trigger memory corruption via the curTime parameter.

Executive Summary:
A remote stack-based buffer overflow vulnerability in D-Link DIR-513 firmware version 1.10 poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4486

Affected Software: D-Link DIR-513

Affected Versions: 1.10

Vulnerability: The flaw exists in the formEasySetPassword function within the /goform/formEasySetPassword endpoint. An authenticated attacker can send a crafted HTTP POST request containing a malicious curTime argument to trigger a stack-based buffer overflow, resulting in memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to a complete compromise of the affected router, potentially allowing an attacker to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized network access, interception of traffic, or the redirection of internal communications. As the device is no longer supported by the vendor, the lack of official security updates significantly increases the long-term risk to organizational infrastructure.

Remediation Plan

Immediate Action: Because the product is end-of-life and no official patch is available, the most effective remediation is to retire the device and replace it with a supported model. If immediate replacement is impossible, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formEasySetPassword endpoint. Review system logs for signs of process crashes or unexpected service restarts that may indicate attempted buffer overflow exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to inspect and block HTTP requests containing overly long strings in the curTime parameter.

Exploitation Status

Public Exploit Available: Yes, a functional Python proof-of-concept script is available via the GitHub repository referenced in the vulnerability research write-up.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the stack-based overflow in the web service component.

Analyst Recommendation

The presence of a functional proof-of-concept, combined with the fact that D-Link no longer provides security support for this device, necessitates immediate action. Organizations currently utilizing the D-Link DIR-513 should prioritize the decommissioning of these units to prevent potential remote code execution and network compromise. If the hardware cannot be retired immediately, strict network segmentation and perimeter filtering are required to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Portainer
PRODUCT: Portainer Community Edition
AFFECTED_VERSIONS: >= 2.33.0, < 2.33.8, >= 2.39.0, < 2.39.2, >= 2.40.0, < 2.41.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Portainer Community Edition contains an incorrect authorization vulnerability that may allow authenticated users to perform unauthorized actions.

Executive Summary:
Portainer Community Edition is affected by an authorization bypass vulnerability that allows authenticated users to perform actions exceeding their assigned privileges.

Vulnerability Details

CVE-ID: CVE-2026-44850

Affected Software: Portainer Portainer Community Edition

Affected Versions: >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0

Vulnerability: This is an authorization flaw (CWE-863) where the application fails to correctly enforce permissions, allowing an authenticated user to gain unauthorized access to administrative functions or container management tasks.

Business Impact

The CVSS score of 8.5 (Critical) highlights the significant risk of privilege escalation. An attacker with low-level access could potentially escalate their privileges to manage containers or modify configurations, leading to unauthorized control over the entire containerized infrastructure.

Remediation Plan

Immediate Action: Upgrade Portainer instances to the fixed versions (2.33.8, 2.39.2, or 2.41.0) based on the current release branch.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or actions performed by users that do not match their defined roles.

Compensating Controls: Temporarily restrict access to the Portainer management interface to trusted IP addresses or require multi-factor authentication if not already enforced.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly impactful due to the central role Portainer plays in orchestrating container environments.

Analyst Recommendation

Administrators should treat this as a high-priority update. Because this vulnerability facilitates privilege escalation within the management platform, applying the relevant security patch is essential to maintain the integrity and security of the container orchestration environment.

---METADATA---
VENDOR: Docker
PRODUCT: Portainer Community Edition / Swarm
AFFECTED_VERSIONS: Portainer Community Edition from 2.33.0 to before 2.33.8, 2.39.0 to before 2.39.2, and 2.40.0 to before 2.41.0
---END_METADATA---

Description Summary:
A security bypass in Portainer allows non-admin users with access to a Docker Swarm endpoint to create or update services with elevated privileges.

Executive Summary:
A critical vulnerability in Portainer Community Edition allows non-admin users to bypass security settings, potentially gaining root-level control over the host system via Docker Swarm.

Vulnerability Details

CVE-ID: CVE-2026-44849

Affected Software: Docker / Portainer Community Edition (Swarm service)

Affected Versions: Portainer Community Edition from 2.33.0 to before 2.33.8, 2.39.0 to before 2.39.2, and 2.40.0 to before 2.41.0

Vulnerability: This vulnerability allows a non-admin user with access to a Docker Swarm endpoint to bypass security controls. By manipulating the creation or update process of Swarm services, an attacker can gain elevated privileges and potentially control the host system.

Business Impact

With a CVSS score of 8.8, this flaw presents a high risk of host-level compromise. An attacker could leverage this to gain root access to the host, leading to full system takeover, data theft, and the disruption of containerized applications, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update Portainer Community Edition to versions 2.33.8, 2.39.2, or 2.41.0 immediately.

Proactive Monitoring: Monitor Swarm service creation/update logs for anomalous activity originating from non-admin accounts.

Compensating Controls: Restrict access to the Portainer interface and Docker Swarm endpoints to verified administrative users only.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 2, 2026, public Proof-of-Concept (PoC) exploits are available for this vulnerability, significantly increasing the risk of active exploitation.

Analyst Recommendation

This vulnerability, combined with public exploit availability, necessitates an immediate response. Organizations should prioritize patching their Portainer installations to prevent attackers from escalating privileges and gaining control over their containerized environments and underlying infrastructure.

---METADATA---
VENDOR: Docker
PRODUCT: Portainer Community Edition
AFFECTED_VERSIONS: Portainer Community Edition from 2.33.0 to before 2.33.8, 2.39.0 to before 2.39.2, and 2.40.0 to before 2.41.0
---END_METADATA---

Description Summary:
A critical flaw in Portainer's RBAC layer allows non-admin users with Docker endpoint access to execute privileged operations directly against the Docker daemon.

Executive Summary:
A critical vulnerability in Portainer Community Edition permits non-admin users to escalate privileges to host root code execution via direct interaction with the Docker daemon.

Vulnerability Details

CVE-ID: CVE-2026-44848

Affected Software: Docker / Portainer Community Edition

Affected Versions: Portainer Community Edition from 2.33.0 to before 2.33.8, 2.39.0 to before 2.39.2, and 2.40.0 to before 2.41.0

Vulnerability: This vulnerability resides in the Role-Based Access Control (RBAC) layer. It allows a non-admin user who has access to a Docker endpoint to bypass security checks and call privileged plugin operations directly against the underlying Docker daemon.

Business Impact

Assigned a CVSS score of 8.8, this vulnerability is extremely dangerous as it enables host-level root code execution. A successful exploit could lead to complete system compromise, unauthorized access to all containerized data, and lateral movement within the environment, resulting in catastrophic business impact.

Remediation Plan

Immediate Action: Update Portainer Community Edition to versions 2.33.8, 2.39.2, or 2.41.0 immediately.

Proactive Monitoring: Monitor Docker daemon logs and Portainer audit logs for suspicious API calls or unauthorized plugin management activities.

Compensating Controls: Implement the principle of least privilege by restricting user access to Docker endpoints and utilizing host-based intrusion detection systems.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 2, 2026, public Proof-of-Concept (PoC) exploits are available for this vulnerability, significantly increasing the risk of active exploitation.

Analyst Recommendation

Given the availability of public exploits and the severity of root-level code execution, this patch should be treated as an emergency. Administrators must apply the recommended updates immediately to prevent attackers from gaining full control over the container infrastructure and the underlying host.

---METADATA---
VENDOR: Masteriyo
PRODUCT: Masteriyo LMS (WordPress Plugin)
AFFECTED_VERSIONS: All versions up to, and including, 2.1.6
---END_METADATA---

Description Summary:
The Masteriyo LMS plugin for WordPress allows authenticated Student-level users to escalate their privileges to Administrator via the InstructorsController.

Executive Summary:
The Masteriyo LMS WordPress plugin contains a critical privilege escalation flaw that allows users with basic student access to gain full administrative control over the website.

Vulnerability Details

CVE-ID: CVE-2026-4484

Affected Software: Masteriyo LMS (WordPress Plugin)

Affected Versions: All versions up to, and including, 2.1.6

Vulnerability: This vulnerability is a Privilege Escalation flaw within the InstructorsController::prepare_object_for_database function. The plugin fails to properly validate role update requests, allowing an authenticated attacker with Student-level permissions to modify their own user role to "administrator."

Business Impact

The impact is a total compromise of the WordPress environment. An attacker gaining administrator access can delete content, steal user data, install malicious plugins, or deface the site. The CVSS score of 9.8 reflects the critical risk, as even low-privileged authenticated users can bypass all security barriers to take full control.

Remediation Plan

Immediate Action: Update the Masteriyo LMS plugin to the latest version (v2.1.7 or higher) immediately to resolve the role validation logic error.

Proactive Monitoring: Audit the WordPress user database for any unexpected changes in user roles, specifically looking for students who have recently acquired administrator or instructor privileges.

Compensating Controls: Implement a security plugin that monitors for unauthorized role changes and alerts administrators in real-time.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation. However, privilege escalation vulnerabilities in popular WordPress plugins are frequently targeted once the technical details of the vulnerable function are disclosed.

Analyst Recommendation

Due to the ease of exploitation and the high impact of a student-to-admin escalation, this patch should be applied immediately. Organizations running Masteriyo LMS must verify their plugin versions and ensure that role management functions are properly restricted to authorized administrators only.

---METADATA---
VENDOR: Snipe-IT
PRODUCT: IT Asset/License Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Snipe-IT asset and license management system that requires immediate remediation.

Executive Summary:
A high-severity vulnerability in the Snipe-IT management system poses a significant risk to organizational asset data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-44832

Affected Software: Snipe-IT IT Asset/License Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of the vulnerability is currently undergoing technical validation; however, given the CVSS score of 8.8, it likely involves a high-impact flaw such as unauthorized access or remote code execution. Administrators should assume an unauthenticated attacker could potentially exploit this to compromise the application.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive IT inventory data, license keys, and organizational infrastructure details. With a CVSS score of 8.8, this flaw represents a significant risk to confidentiality and integrity, potentially enabling further lateral movement within the network.

Remediation Plan

Immediate Action: Consult the official Snipe-IT security advisory immediately to identify and apply the necessary software patches or configuration changes.

Proactive Monitoring: Review application access logs for anomalous behavior, such as unexpected API calls or unauthorized administrative attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter potentially malicious traffic targeting the Snipe-IT environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Snipe-IT must prioritize this update. IT teams should verify their current version against vendor documentation and apply the latest security patches to mitigate the risk of unauthorized data access.

---METADATA---
VENDOR: Docker
PRODUCT: Gotenberg
AFFECTED_VERSIONS: < 8.33.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gotenberg, a Docker-powered API for PDF files, contains a path traversal vulnerability that could allow unauthorized access to sensitive files on the host system.

Executive Summary:
A path traversal vulnerability in Gotenberg allows potential unauthorized access to files, necessitating an immediate update to version 8.33.0.

Vulnerability Details

CVE-ID: CVE-2026-44829

Affected Software: Gotenberg

Affected Versions: < 8.33.0

Vulnerability: This is a path traversal vulnerability (CWE-22) that allows an attacker to escape intended directory restrictions. The CVSS vector notes that this vulnerability requires user interaction and is accessible via the network, potentially leading to unauthorized file disclosure.

Business Impact

An attacker could leverage this vulnerability to read sensitive configuration files or other data stored on the server, leading to information disclosure and potentially further system compromise. While the CVSS score is 8.8, the requirement for user interaction slightly modifies the attack flow, but the impact remains critical for environments handling sensitive documents.

Remediation Plan

Immediate Action: Update the Gotenberg container image to version 8.33.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Review application logs for suspicious file path patterns or requests containing directory traversal sequences such as double dots (../) in API calls.

Compensating Controls: Ensure that the Gotenberg container is running with the principle of least privilege, specifically utilizing read-only file systems and restricted container capabilities to limit the impact of potential traversal.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Path traversal flaws are well-documented and commonly targeted once discovered, so proactive patching is strongly advised.

Analyst Recommendation

Users of the Gotenberg API should immediately upgrade to version 8.33.0 to mitigate the risk of file system traversal. Failure to update leaves the deployment vulnerable to unauthorized data access by malicious actors.

---METADATA---
VENDOR: huggingface
PRODUCT: diffusers
AFFECTED_VERSIONS: < 0.38.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Hugging Face Diffusers library is vulnerable to code injection, which may allow remote attackers to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in the Hugging Face Diffusers library allows for potential remote code execution by an attacker.

Vulnerability Details

CVE-ID: CVE-2026-44827

Affected Software: huggingface diffusers

Affected Versions: < 0.38.0

Vulnerability: This is a CWE-94 (Improper Control of Generation of Code) vulnerability. The library fails to properly sanitize input, enabling an attacker to inject and execute arbitrary code within the context of the application.

Business Impact

Exploitation of this vulnerability allows for arbitrary code execution, which can lead to unauthorized data access, system manipulation, or complete control over the host running the diffusion models. With a CVSS score of 8.8, the potential for severe operational and security impact is high.

Remediation Plan

Immediate Action: Update the diffusers package to version 0.38.0 or later.

Proactive Monitoring: Review application execution logs for signs of unexpected code execution or unauthorized model loading patterns.

Compensating Controls: Run the application with the principle of least privilege, ensuring the process account has minimal access to the underlying system and sensitive data.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. This vulnerability is highly dangerous in machine learning pipelines where untrusted models might be processed.

Analyst Recommendation

Immediate patching to version 0.38.0 is essential to neutralize this threat. Ensure that all downstream dependencies are also updated and audit any custom code that interacts with the Diffusers library to ensure no secondary injection vectors exist.

---METADATA---
VENDOR: Givanz
PRODUCT: Vvveb
AFFECTED_VERSIONS: < 1.0.8.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Vvveb CMS is susceptible to an improper validation of input quantity, which can be leveraged by unauthenticated attackers to potentially impact system integrity.

Executive Summary:
An unauthenticated input validation vulnerability in Vvveb CMS allows remote attackers to potentially manipulate data integrity within the platform.

Vulnerability Details

CVE-ID: CVE-2026-44826

Affected Software: Givanz Vvveb

Affected Versions: < 1.0.8.2

Vulnerability: This vulnerability (CWE-1284) involves improper validation of specified quantities in input, allowing an unauthenticated remote attacker to potentially bypass intended business logic or constraints.

Business Impact

Successful exploitation allows an attacker to manipulate application data, which may result in unauthorized changes to website content or e-commerce configurations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to site administrators, potentially leading to unauthorized data modification and service disruption.

Remediation Plan

Immediate Action: Update Vvveb to version 1.0.8.2 or later immediately to incorporate the necessary input validation checks.

Proactive Monitoring: Review web server and application logs for suspicious input patterns or unexpected bulk operations that deviate from normal user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and filter anomalous input parameters that might attempt to exploit quantity-based logic flaws.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by unauthenticated remote actors due to the lack of input verification.

Analyst Recommendation

Organizations utilizing Vvveb must prioritize this update, as the vulnerability is automatable and has a confirmed proof-of-concept. Applying the vendor-provided patch is the only reliable method to eliminate the risk of unauthorized data manipulation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office Excel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in Microsoft Office Excel allows an unauthorized attacker to disclose sensitive information over a network.

Executive Summary:
An out-of-bounds read flaw in Microsoft Office Excel exposes the risk of unauthorized information disclosure through malformed files.

Vulnerability Details

CVE-ID: CVE-2026-44822

Affected Software: Microsoft Office Excel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an out-of-bounds read flaw within the Excel file parsing engine. It allows an unauthorized attacker to disclose information by inducing the application to read outside of its intended memory boundaries, likely through a specially crafted spreadsheet file.

Business Impact

Rated with a CVSS score of 8.2, this vulnerability is significant given Excel's role as a pervasive data connector and automation host. The ability to disclose memory contents could lead to the exposure of sensitive business data or credentials, undermining organizational security posture.

Remediation Plan

Immediate Action: Consult the Microsoft Security Update Guide and apply the latest security patches for Office Excel.

Proactive Monitoring: Monitor for unusual file access patterns or Excel process crashes that could indicate attempts to exploit file-parsing vulnerabilities.

Compensating Controls: Utilize email and web gateway filters to block suspicious or untrusted Excel files from entering the network environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Excel is a highly utilized and complex tool, vulnerabilities within its engine are often targeted. Administrators should prioritize applying the relevant security updates to all systems running Microsoft Office.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows DHCP Client
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Windows DHCP Client allows unauthenticated remote attackers to execute code via crafted network packets.

Executive Summary:
A critical stack-based buffer overflow in the Windows DHCP Client exposes systems to unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44815

Affected Software: Microsoft Windows DHCP Client

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is a stack-based buffer overflow within the DHCP client processing logic. An unauthenticated attacker can trigger this condition by sending specially crafted network packets to a target system, resulting in arbitrary code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to any Windows-based environment. Successful exploitation allows for complete system compromise without user interaction, which could facilitate the rapid spread of malware or ransomware across the network.

Remediation Plan

Immediate Action: Install the latest Windows security patches provided by Microsoft to address the DHCP client overflow.

Proactive Monitoring: Monitor network traffic for unusual or malformed DHCP traffic patterns that may indicate an attempt to trigger the buffer overflow.

Compensating Controls: Implement network-level segmentation to limit the exposure of sensitive hosts to potentially untrusted DHCP traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to its potential for wormable exploitation. Security teams should ensure that all Windows systems are fully patched and that update management processes are functioning correctly to deploy this fix across the entire fleet immediately.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 11 version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1
---END_METADATA---

Description Summary:
Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to perform local privilege escalation.

Executive Summary:
A high-severity privilege escalation vulnerability in Windows Cryptographic Services enables unauthorized local users to gain elevated system permissions.

Vulnerability Details

CVE-ID: CVE-2026-44810

Affected Software: Microsoft Windows

Affected Versions: Windows 11 version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1

Vulnerability: The vulnerability stems from improper authentication handling within Windows Cryptographic Services. This allows an unauthorized local attacker to exploit the service to elevate their current privileges to a higher level, such as SYSTEM.

Business Impact

With a CVSS score of 8.4, this privilege escalation flaw is a major concern. As privilege escalation accounts for a significant portion of current threat activity, this vulnerability provides a critical step for attackers attempting to move laterally or persist within a compromised environment.

Remediation Plan

Immediate Action: Apply the latest Windows security updates released by Microsoft to address the improper authentication in Cryptographic Services.

Proactive Monitoring: Audit local system logs for unauthorized attempts to escalate privileges or unexpected changes to service configurations.

Compensating Controls: Enforce the principle of least privilege for local user accounts to limit the potential impact of an escalation attempt.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation is a primary vector for successful cyberattacks. Given that this vulnerability affects multiple versions of Windows 11, immediate patching is essential to prevent unauthorized access and potential system-wide compromise.

---METADATA---
VENDOR: Nautobot
PRODUCT: Nautobot
AFFECTED_VERSIONS: >= 3.0.0a2, < 3.1.2; >= 2.4.0, < 2.4.33
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nautobot contains a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to perform unauthorized requests.

Executive Summary:
A Server-Side Request Forgery vulnerability in Nautobot allows authenticated attackers to potentially access internal resources or perform unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-44797

Affected Software: Nautobot

Affected Versions: >= 3.0.0a2, < 3.1.2; >= 2.4.0, < 2.4.33

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability. An authenticated user with low privileges can leverage the application's functionality to force the server to make requests to arbitrary destinations, potentially bypassing network segmentation.

Business Impact

Successful exploitation of this SSRF vulnerability could allow an attacker to interact with internal services that are otherwise unreachable from the public internet. This poses a significant risk to the confidentiality of internal network infrastructure and may provide a foothold for further lateral movement within the environment. While the CVSS score of 8.5 denotes high severity, the requirement for authenticated access slightly lowers the immediate risk compared to unauthenticated remote code execution.

Remediation Plan

Immediate Action: Upgrade to Nautobot version 3.1.2 or 2.4.33 immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor egress traffic from the Nautobot server for unexpected connection attempts to internal IP addresses or sensitive management interfaces.

Compensating Controls: Implement strict egress filtering (allow-listing) at the network level to restrict the server's ability to reach unauthorized internal or external destinations.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user who can reach the vulnerable endpoint.

Analyst Recommendation

Given the potential for lateral movement and internal reconnaissance, administrators should prioritize the application of the patched versions. Review all user roles and permissions within Nautobot to ensure the principle of least privilege is strictly enforced while the update is being deployed.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: >= 2025.4.0, < 2025.4.4, >= 2026.0.0, < 2026.0.3, < 2025.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Spinnaker is vulnerable to unsafe reflection and deserialization of untrusted data, which could allow an authenticated attacker to execute arbitrary code.

Executive Summary:
Spinnaker is affected by multiple critical vulnerabilities involving unsafe deserialization and reflection that could lead to full system compromise by an authenticated user.

Vulnerability Details

CVE-ID: CVE-2026-44795

Affected Software: Spinnaker Spinnaker

Affected Versions: >= 2025.4.0, < 2025.4.4, >= 2026.0.0, < 2026.0.3, < 2025.3.3

Vulnerability: This vulnerability consists of CWE-470 (Unsafe Reflection) and CWE-502 (Deserialization of Untrusted Data). An authenticated attacker can leverage these flaws to manipulate application logic and execute arbitrary code on the underlying host.

Business Impact

The exploitation of these vulnerabilities carries a high business risk, as successful execution allows an attacker to gain full control over the continuous delivery pipeline. Given the CVSS score of 8.8, this flaw could lead to unauthorized access to sensitive deployment environments, data exfiltration, or the injection of malicious code into production software, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update Spinnaker to the latest patched versions identified in the vendor security advisory.

Proactive Monitoring: Review application logs for unusual deserialization patterns or unexpected class instantiation requests that deviate from normal operational baselines.

Compensating Controls: Ensure the Spinnaker instance is isolated within a restricted network segment and apply strict access controls to limit the number of users with the privileges required to reach the vulnerable endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating their Spinnaker environments to the latest secure versions to eliminate the risk of remote code execution. Failure to patch these components leaves the continuous delivery pipeline exposed to significant security threats.

---METADATA---
VENDOR: n8n
PRODUCT: n8n
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the n8n workflow automation platform that may allow for unauthorized access or system impact.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could lead to significant unauthorized system access if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-44792

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the n8n workflow automation environment, potentially allowing an attacker to manipulate workflow processes. Given the nature of automation platforms, this vulnerability likely requires varying levels of authentication depending on the specific workflow configuration.

Business Impact

Successful exploitation of this flaw could result in the unauthorized execution of automated workflows, leading to potential data exfiltration, unauthorized API interactions, or the compromise of connected third-party services. With a CVSS score of 8.9, this vulnerability presents a high risk to business operations, particularly for organizations relying on n8n for critical data orchestration and pipeline management.

Remediation Plan

Immediate Action: Identify the current n8n version and apply the latest security updates provided by the vendor immediately.

Proactive Monitoring: Review audit logs for unusual workflow executions or unauthorized access to sensitive node configurations.

Compensating Controls: Implement strict network access controls and ensure the n8n instance is not exposed to the public internet without proper authentication gateways.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, immediate patching is required to prevent potential workflow hijacking. Organizations should prioritize updating their n8n instances and performing a comprehensive review of existing workflow logs to identify any indicators of compromise.

---METADATA---
VENDOR: n8n
PRODUCT: n8n
AFFECTED_VERSIONS: Prior to 1.123.43, 2.22.1, and 2.20.7
---END_METADATA---

Description Summary:
An authenticated workflow bypass vulnerability in the n8n XML node allows for Remote Code Execution (RCE) when chained with other nodes.

Executive Summary:
A critical authentication bypass in the n8n XML node allows authenticated users to achieve Remote Code Execution on the host server by chaining vulnerable operations.

Vulnerability Details

CVE-ID: CVE-2026-44791

Affected Software: n8n n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: This vulnerability is an authentication bypass that invalidates a previous security patch for the XML node. By crafting specific workflows, an authenticated attacker can execute arbitrary code on the n8n host, circumventing existing functional restrictions.

Business Impact

The potential for Remote Code Execution carries the highest level of risk, as it grants an attacker full control over the application server. With a CVSS score of 9.4, this vulnerability could lead to total data breaches, lateral movement into internal networks, and permanent loss of system integrity.

Remediation Plan

Immediate Action: Upgrade to version 1.123.43, 2.22.1, or 2.20.7 to restore security protections for the XML node.

Proactive Monitoring: Monitor for anomalous process execution or unexpected outbound network connections originating from the n8n container or host.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect incoming XML payloads for malicious patterns, though patching remains the only reliable mitigation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it allows for full system compromise via Remote Code Execution. Administrators must treat this as an emergency update; ensure all instances of n8n are updated to the specified versions immediately to prevent unauthorized code execution.

---METADATA---
VENDOR: n8n
PRODUCT: n8n
AFFECTED_VERSIONS: Prior to 1.123.43, 2.22.1, and 2.20.7
---END_METADATA---

Description Summary:
An authenticated user can inject CLI flags via the Git node's Push operation in n8n, enabling arbitrary file read access on the host server.

Executive Summary:
An authenticated command injection vulnerability in n8n allows attackers to read arbitrary files from the host server, potentially resulting in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44790

Affected Software: n8n n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: This is an authenticated command injection vulnerability where a user with permission to modify workflows can inject CLI flags into the Git node. By manipulating the Push operation, an attacker can bypass security controls to read sensitive files from the underlying n8n server.

Business Impact

The ability to read arbitrary files from the server represents a critical security failure, as it allows attackers to exfiltrate configuration files, secrets, or system credentials. With a CVSS score of 9.4, this vulnerability poses an extreme risk, potentially leading to a complete compromise of the workflow automation environment and all data processed therein.

Remediation Plan

Immediate Action: Upgrade n8n immediately to version 1.123.43, 2.22.1, or 2.20.7 to apply the necessary patches.

Proactive Monitoring: Review application and system logs for unexpected Git node activity or unusual CLI flag patterns originating from workflow operations.

Compensating Controls: Restrict permissions for creating or modifying workflows to trusted users only and implement strict network segmentation to limit the blast radius of a compromised node.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this arbitrary file read vulnerability, organizations must prioritize patching the n8n environment immediately. Restricting workflow creation privileges is a necessary secondary measure to ensure that only verified personnel can interact with potentially dangerous node operations until the update is applied.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: Prior to 1.123.43, 2.22.1, and 2.20.7
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in n8n, exploitable via an unvalidated pagination parameter, can lead to remote code execution for authenticated users.

Executive Summary:
An authenticated remote code execution vulnerability exists in n8n due to insecure prototype pollution, requiring immediate updates to protected versions.

Vulnerability Details

CVE-ID: CVE-2026-44789

Affected Software: n8n-io n8n

Affected Versions: Prior to 1.123.43, 2.22.1, and 2.20.7

Vulnerability: The vulnerability exists in the HTTP Request node, where unvalidated pagination parameters allow an authenticated user with workflow modification permissions to perform global prototype pollution. This can be chained to achieve arbitrary remote code execution on the underlying host.

Business Impact

The CVSS score of 9.4 reflects the severity of achieving remote code execution. An attacker who has gained low-privileged access to the platform can escalate their privileges to take full control of the workflow automation instance, potentially accessing integrated services and sensitive data across the enterprise.

Remediation Plan

Immediate Action: Update n8n to version 1.123.43, 2.22.1, 2.20.7, or later to address the prototype pollution vector.

Proactive Monitoring: Monitor workflow modification logs for suspicious activity and review system execution logs for unexpected child processes or unusual shell commands.

Compensating Controls: Enforce strict role-based access control (RBAC) to limit which users can create or modify workflows until the patch can be applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for RCE makes this an urgent security concern for organizations utilizing automation workflows.

Analyst Recommendation

The severity of this flaw necessitates an immediate update to the latest patched versions. Security teams should prioritize patching this instance to prevent authenticated users from escalating their privileges and compromising the integrity of the automation platform.

---METADATA---
VENDOR: Discourse
PRODUCT: Discourse
AFFECTED_VERSIONS: 2026.1.0-latest to 2026.1.5, 2026.4.0-latest to 2026.4.2, 2026.5.0-latest to 2026.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Discourse is affected by an improper privilege management vulnerability, which may allow unauthenticated remote attackers to gain unauthorized access to sensitive information.

Executive Summary:
A privilege management flaw in the Discourse discussion platform allows unauthenticated remote attackers to potentially gain unauthorized access to sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-44787

Affected Software: Discourse

Affected Versions: >= 2026.1.0-latest < 2026.1.5, >= 2026.4.0-latest < 2026.4.2, >= 2026.5.0-latest < 2026.5.1

Vulnerability: This vulnerability (CWE-269) stems from improper privilege management within the Discourse platform. It allows an unauthenticated, remote attacker to perform actions or access data outside of their intended permissions.

Business Impact

The vulnerability is assigned a CVSS score of 8.2 (High). If exploited, this could result in the unauthorized disclosure of private forum content, user information, or metadata, leading to significant reputational damage and potential regulatory non-compliance regarding user data privacy.

Remediation Plan

Immediate Action: Upgrade Discourse instances to the patched versions (v2026.1.5, v2026.4.2, or v2026.5.1) depending on the active release track.

Proactive Monitoring: Monitor platform access logs for unusual patterns, such as mass data scraping or unauthorized requests to administrative endpoints by non-privileged accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter suspicious traffic and block requests targeting sensitive API endpoints that may be exposed by this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability is exploitable by unauthenticated remote attackers, it presents a high risk to the confidentiality of the platform. Administrators should apply the relevant security patches immediately to ensure user data remains protected and to maintain the integrity of the discussion environment.

---METADATA---
VENDOR: Yi Technology
PRODUCT: YI Home Camera 2
AFFECTED_VERSIONS: 2.1.1_20171024151200
CONFIDENCE: high
MISSING: patch
CREDITS: 0rbitingZer0 (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351768","name":"VDB-351768 | Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.351768","name":"VDB-351768 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773162","name":"Submit #773162 | yitechnology YI Home Camera 2 2.1.1_20171024151200 HTTP Firmware OTA Without Cryptographic Signature","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.151Z
---END_METADATA---

Description Summary:
Yi Technology YI Home Camera 2 contains an improper cryptographic signature verification flaw in its HTTP Firmware Update Handler, allowing for remote manipulation of firmware updates.

Executive Summary:
A critical vulnerability in the Yi Technology YI Home Camera 2 firmware allows remote attackers to bypass cryptographic signature verification, potentially leading to unauthorized firmware modification.

Vulnerability Details

CVE-ID: CVE-2026-4478

Affected Software: Yi Technology YI Home Camera 2

Affected Versions: 2.1.1_20171024151200

Vulnerability: The vulnerability resides in the HTTP Firmware Update Handler within the home/web/ipc file, where insufficient verification of cryptographic signatures occurs. This flaw allows an unauthenticated remote attacker to potentially compromise the integrity of the device firmware.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to upload malicious firmware to the affected camera, leading to a complete loss of device integrity and potential surveillance of the private environment. Given the CVSS score of 8.1, the risk is classified as High, as it provides an attacker the ability to maintain persistence on the device and circumvent security controls.

Remediation Plan

Immediate Action: As there is currently no official patch available from the vendor, users should isolate affected cameras from the public internet using network segmentation or firewall rules to prevent remote access.

Proactive Monitoring: Security teams should monitor network traffic for suspicious HTTP requests directed toward the firmware update endpoints and review device logs for unauthorized configuration changes.

Compensating Controls: Deploying a Web Application Firewall or intrusion detection system configured to inspect incoming traffic for malformed firmware update payloads can help mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced by VulDB (ID 351768).

Analyst Notes: As of March 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently difficult to exploit due to high attack complexity, but the potential impact on device integrity remains significant.

Analyst Recommendation

Given the lack of a vendor-provided security update, users must prioritize isolating these devices from external network access to prevent remote exploitation. Organizations should evaluate the necessity of these devices in high-security environments and consider decommissioning them if they cannot be adequately protected through network-level controls.

---METADATA---
VENDOR: SAP
PRODUCT: Manufacturing Integration and Intelligence
AFFECTED_VERSIONS: XMII 15.4, 15.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authorization check in SAP Manufacturing Integration and Intelligence allows unauthenticated remote attackers to access sensitive scheduling-related functions.

Executive Summary:
An unauthenticated remote access vulnerability in SAP Manufacturing Integration and Intelligence threatens the security and availability of critical production scheduling functions.

Vulnerability Details

CVE-ID: CVE-2026-44765

Affected Software: SAP Manufacturing Integration and Intelligence

Affected Versions: XMII 15.4, 15.5

Vulnerability: This is a missing authorization check (CWE-862) that allows an unauthenticated remote attacker to interact with application functions. The vulnerability exists due to a failure to validate user permissions before executing scheduling-related operations.

Business Impact

The ability for unauthenticated remote attackers to access scheduling functions can lead to unauthorized modification of manufacturing processes, resulting in operational downtime or data compromise. With a CVSS score of 7.3, this flaw represents a significant risk to industrial control environments and integrated business systems.

Remediation Plan

Immediate Action: Apply the relevant security patches released by SAP through the official security patch day portal to remediate the missing authorization controls.

Proactive Monitoring: Review application access logs for suspicious requests originating from unauthorized network segments or unexpected IP addresses targeting scheduling modules.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to block unauthorized access attempts targeting the vulnerable application endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for remote attackers.

Analyst Recommendation

Organizations utilizing SAP Manufacturing Integration and Intelligence must prioritize this update to prevent unauthorized manipulation of production scheduling. Ensure that security updates are applied immediately following the vendor's guidance to close the authorization gap.

---METADATA---
VENDOR: SAP
PRODUCT: Manufacturing Integration and Intelligence
AFFECTED_VERSIONS: XMII 15.4, 15.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization check in SAP Manufacturing Integration and Intelligence allows unauthenticated attackers to send crafted requests to the Cost Servlet.

Executive Summary:
An unauthenticated authorization bypass vulnerability in SAP Manufacturing Integration and Intelligence exposes the Cost Servlet to unauthorized requests, posing a risk of data manipulation or system impact.

Vulnerability Details

CVE-ID: CVE-2026-44764

Affected Software: SAP Manufacturing Integration and Intelligence

Affected Versions: XMII 15.4, 15.5

Vulnerability: The application fails to perform necessary authorization checks on the Cost Servlet. This allows an unauthenticated attacker to interact with the servlet directly by sending crafted requests.

Business Impact

The CVSS score of 7.3 indicates a high severity risk due to the lack of required authentication for an interface that may handle sensitive manufacturing or financial data. Successful exploitation could lead to unauthorized access to business logic, potential data corruption, or denial of service, which would disrupt manufacturing operations and potentially lead to financial or production reporting inaccuracies.

Remediation Plan

Immediate Action: Update SAP Manufacturing Integration and Intelligence to the latest security patch provided by SAP in note 3758910.

Proactive Monitoring: Review access logs for the Cost Servlet to identify suspicious or unexpected requests originating from unauthorized users.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter and block unauthorized requests directed at the affected servlet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by any network-adjacent attacker due to the absence of authentication requirements on the target servlet.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized interaction with business-critical manufacturing systems, organizations should prioritize the application of the vendor-supplied patch. Administrators must verify their version of SAP XMII and apply the recommended updates immediately to close this authorization gap.

---METADATA---
VENDOR: SAP SE
PRODUCT: Manufacturing Integration and Intelligence
AFFECTED_VERSIONS: XMII 15.4, 15.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
SAP Manufacturing Integration and Intelligence contains an improper path validation vulnerability allowing privileged attackers to manipulate file operations.

Executive Summary:
Insufficient file path validation in SAP Manufacturing Integration and Intelligence allows a privileged attacker to perform unauthorized file operations, potentially compromising system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44763

Affected Software: SAP SE Manufacturing Integration and Intelligence

Affected Versions: XMII 15.4, 15.5

Vulnerability: The application is vulnerable to improper limitation of a pathname to a restricted directory (CWE-22). A privileged attacker can use specially crafted input to bypass file path validation and access or modify files outside of the intended directory.

Business Impact

With a CVSS score of 7.6, this vulnerability represents a significant risk to system integrity and confidentiality. By manipulating file paths, an attacker could read sensitive configuration files, overwrite critical application components, or gain further execution privileges, leading to full system compromise.

Remediation Plan

Immediate Action: Apply the relevant security patches provided by SAP via the official SAP Security Patch Day channels. Consult SAP Note 3759854 for specific patch instructions.

Proactive Monitoring: Review file system access logs for anomalous activity, specifically looking for attempts to traverse directories or access files outside of standard application paths.

Compensating Controls: Ensure the application service account operates with the principle of least privilege, specifically restricting file system write and read permissions to only the directories absolutely necessary for operation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation requires high privileges, making it a target for malicious insiders or attackers who have already compromised an administrative account.

Analyst Recommendation

Organizations using SAP Manufacturing Integration and Intelligence versions 15.4 or 15.5 must treat this as a high-priority update. Administrators should review the referenced SAP security notes and apply the necessary patches immediately to prevent potential unauthorized file system access.