---METADATA---
VENDOR: Genealogy
PRODUCT: Genealogy
AFFECTED_VERSIONS: Prior to 5.9.1
---END_METADATA---

Description Summary:
A broken access control flaw in the Genealogy PHP application allows authenticated users to transfer ownership of arbitrary non-personal team workspaces to their own accounts.

Executive Summary:
A critical access control vulnerability in Genealogy permits authenticated users to perform unauthorized team ownership takeovers.

Vulnerability Details

CVE-ID: CVE-2026-39355

Affected Software: Genealogy

Affected Versions: Prior to 5.9.1

Vulnerability: The application fails to properly validate permissions when transferring team ownership. This allows any authenticated user to escalate their privileges by claiming ownership of teams they do not manage.

Business Impact

This vulnerability presents a significant risk of data exfiltration and unauthorized administrative control over team workspaces. With a CVSS score of 9.9, the impact on organizational data privacy is extreme, as attackers can gain access to all data associated with compromised teams.

Remediation Plan

Immediate Action: Update the Genealogy application to version 5.9.1 or later to remediate the access control logic.

Proactive Monitoring: Audit ownership change logs to identify any unauthorized transfers of team workspaces that occurred prior to patching.

Compensating Controls: Restrict access to the application to trusted internal networks and implement strict session monitoring for unusual account activity.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a standard user to seize control of arbitrary workspaces is a critical security failure. Organizations should prioritize updating to version 5.9.1 to ensure that authorization checks are correctly enforced across all team management functions.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in ChurchCRM's API middleware allows unauthenticated attackers to access protected API endpoints, exposing sensitive member data and system information.

Executive Summary:
A critical authentication bypass in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to gain unauthorized access to restricted API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-39339

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is an authentication bypass vulnerability located in the ChurchCRM/Slim/Middleware/AuthMiddleware.php file. Unauthenticated attackers can circumvent security controls by injecting "api/public" into the request URL.

Business Impact

The vulnerability poses a severe risk to data confidentiality and integrity, as it allows unauthorized access to church member databases and internal system metadata. With a CVSS score of 9.1, this flaw could lead to mass data exfiltration and potential regulatory non-compliance regarding sensitive personal information.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.1.0 or later immediately to apply the necessary middleware security patch.

Proactive Monitoring: Review web server and application access logs for unusual patterns, specifically monitoring for requests containing "api/public" strings targeting protected endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing "api/public" in the URL path until the patch can be deployed.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the sensitivity of the data involved, the potential for exploitation is high.

Analyst Recommendation

The severity of this authentication bypass cannot be overstated, as it provides a direct path to sensitive internal data without requiring credentials. Organizations must prioritize the update to version 7.1.0 to eliminate this exposure and prevent unauthorized access to their management systems.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to inject arbitrary PHP code, resulting in full server compromise.

Executive Summary:
A critical pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to achieve full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-39337

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is a pre-authentication remote code execution vulnerability originating from improper sanitization of the "$dbPassword" variable during the installation process. It serves as an incomplete remediation for a previous vulnerability (CVE-2025-62521).

Business Impact

Successful exploitation grants an attacker complete control over the underlying server, enabling data theft, lateral movement, and the installation of persistent backdoors. Given the critical CVSS score of 10, this vulnerability represents an existential threat to the integrity and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update ChurchCRM to version 7.1.0 immediately; if installation is currently in progress, ensure the environment is isolated until the patch is applied.

Proactive Monitoring: Audit server logs for unexpected execution of PHP files or anomalous processes initiated during or after the installation phase.

Compensating Controls: Ensure the installation directory is protected by strict file system permissions and restrict public access to the setup wizard interface.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents the highest level of risk, allowing for total server takeover. It is imperative that administrators verify their ChurchCRM installations are updated to 7.1.0 to prevent remote command execution and maintain the security of the host environment.

---METADATA---
VENDOR: TriliumNext
PRODUCT: Trilium
AFFECTED_VERSIONS: < 0.102.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in Trilium Notes, involving improper access control and missing authentication, allows unauthorized users to access and manipulate critical application functions.

Executive Summary:
Improper access control in Trilium Notes allows unauthenticated users to access critical functions, necessitating an immediate update to version 0.102.2.

Vulnerability Details

CVE-ID: CVE-2026-39310

Affected Software: TriliumNext Trilium

Affected Versions: All versions prior to 0.102.2

Vulnerability: This vulnerability encompasses improper access control (CWE-284) and missing authentication for critical functions (CWE-306). The vulnerability is remotely exploitable without authentication, allowing attackers to perform actions that should be restricted to authenticated users.

Business Impact

Successful exploitation poses a significant risk to personal knowledge bases stored within the application, as unauthorized users could read, modify, or delete sensitive notes. With a CVSS score of 8.6, this vulnerability represents a major security failure for any organization relying on Trilium for documentation or personal data storage.

Remediation Plan

Immediate Action: Update Trilium to version 0.102.2 or later to ensure proper authentication controls are enforced.

Proactive Monitoring: Audit application access logs for any unauthorized access attempts or unexpected modifications to notes or configuration settings.

Compensating Controls: If the application must remain exposed, place it behind a secure VPN or an authenticated proxy that enforces strict access control before reaching the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning by threat actors.

Analyst Recommendation

The existence of a proof-of-concept combined with the ease of exploitation makes this a high-priority item for remediation. All users of Trilium Notes should apply the patch immediately to prevent unauthorized access to their knowledge bases.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 1.5.113
---END_METADATA---

Description Summary:
A Path Traversal vulnerability in the PraisonAI Action Orchestrator allows attackers to read or write arbitrary files on the host system.

Executive Summary:
A critical Path Traversal flaw in PraisonAI enables attackers to overwrite sensitive files or execute payloads via the Action Orchestrator.

Vulnerability Details

CVE-ID: CVE-2026-39305

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.113

Vulnerability: The Action Orchestrator fails to sanitize input paths, permitting the use of directory traversal sequences (../). This allows an attacker to escape the designated workspace directory and perform unauthorized file system operations.

Business Impact

With a CVSS score of 9.0, this vulnerability allows for significant system-level impact. Attackers can gain persistence, modify configuration files, or overwrite binaries, leading to total compromise of the PraisonAI host.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.113 or later to patch the path validation logic.

Proactive Monitoring: Monitor file system activity logs for unauthorized modifications to sensitive directories and binary files.

Compensating Controls: Run the application within a containerized environment with a read-only root file system and strictly limited volume mounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities in orchestration systems are extremely dangerous. Organizations must upgrade to version 1.5.113 immediately to prevent potential remote code execution or system file tampering.

---METADATA---
VENDOR: Pivotal
PRODUCT: CRM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in Pivotal CRM that may allow unauthorized access or impact system integrity.

Executive Summary:
A high-severity vulnerability in Pivotal CRM poses a significant risk to organizational data integrity and system access control.

Vulnerability Details

CVE-ID: CVE-2026-39253

Affected Software: Pivotal CRM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within Pivotal CRM. Based on the CVSS score of 8.1, this flaw likely allows for unauthorized actions that could compromise the confidentiality or integrity of the CRM environment.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive customer data, potentially resulting in regulatory non-compliance and significant reputational harm. With a CVSS score of 8.1, the vulnerability is classified as High, indicating that successful exploitation could lead to a substantial compromise of the CRM's core functionality.

Remediation Plan

Immediate Action: Apply all vendor-supplied security patches for Pivotal CRM immediately upon release.

Proactive Monitoring: Monitor system and application access logs for unusual patterns or unauthorized administrative activity.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter malicious traffic targeting the CRM interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, organizations should treat this vulnerability with urgency. Administrators must verify their current version against the vendor's security documentation and prioritize patching to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Agents component of Google Chrome allows unauthenticated remote attackers to potentially execute arbitrary code via a crafted web page.

Executive Summary:
Google Chrome versions prior to 146 are susceptible to a use-after-free vulnerability in the Agents component, which could lead to remote code execution by an unauthenticated attacker.

Vulnerability Details

CVE-ID: CVE-2026-3917

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free (UAF) vulnerability in the "Agents" component of Chrome. An unauthenticated remote attacker can exploit this by manipulating memory through a malicious website, causing the browser to reference memory that has already been freed.

Business Impact

A use-after-free condition can be reliably used to achieve remote code execution (RCE). This allows an attacker to bypass security boundaries and potentially gain access to local files or the corporate network. The CVSS score of 8.8 highlights the severe potential for system compromise and data breach.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 146 or later immediately to fix the memory management flaw in the Agents component.

Proactive Monitoring: Use memory-protection features provided by modern operating systems and monitor for unusual activity in the Chrome GPU or renderer processes.

Compensating Controls: Employ a robust web gateway solution to block access to untrusted or high-risk web categories, reducing the likelihood of encountering an exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Use-after-free vulnerabilities are common targets for sophisticated attackers seeking to bypass browser security.

Analyst Recommendation

The severity of a use-after-free vulnerability in a core browser component cannot be overstated. It provides a direct path for remote attackers to compromise end-user devices. Immediate patching to version 146 is the primary and most effective recommendation to mitigate this critical security risk.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
Google Chrome contains a heap buffer overflow in the WebML component, enabling unauthenticated remote attackers to achieve memory corruption or code execution via malicious pages.

Executive Summary:
A heap buffer overflow in the WebML component of Google Chrome prior to version 146 allows remote, unauthenticated attackers to potentially execute code on a victim's system.

Vulnerability Details

CVE-ID: CVE-2026-3915

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a heap buffer overflow within the WebML framework. An unauthenticated attacker can exploit this by hosting a malicious page that, when rendered by Chrome, overflows allocated memory buffers to gain control over program execution.

Business Impact

This vulnerability threatens the integrity of the user's computing environment. If exploited, it could lead to the theft of sensitive session data, credentials, or the installation of malware. The CVSS score of 8.8 reflects the high impact on confidentiality and availability should a remote execution occur.

Remediation Plan

Immediate Action: Force an update of Google Chrome to the latest stable version (146 or higher) to patch the vulnerable WebML code.

Proactive Monitoring: Monitor network traffic for connections to suspicious domains and review endpoint logs for browser-related crashes which may indicate failed exploit attempts.

Compensating Controls: Utilize browser sandboxing and application control policies to limit the potential impact of a successful browser exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Historically, WebML-related flaws are prime candidates for exploitation due to the complexity of media processing.

Analyst Recommendation

To maintain a secure posture, it is critical to address browser vulnerabilities before they are integrated into active exploit kits. We recommend an immediate audit of all installed Chrome versions and the mandatory application of the version 146 update to eliminate the risk of heap-based memory corruption.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability in the WebML component of Google Chrome allows unauthenticated remote attackers to potentially execute arbitrary code via crafted web content.

Executive Summary:
Google Chrome is vulnerable to a heap buffer overflow in its WebML component, which could allow a remote attacker to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-3913

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a heap buffer overflow vulnerability located in the WebML implementation. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a specially crafted, malicious website, leading to memory corruption.

Business Impact

Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser's sandbox or cause the application to crash. Given the ubiquity of Chrome in corporate environments, this poses a risk of workstation compromise and subsequent lateral movement. The CVSS score of 8.8 indicates a high severity due to the ease of remote delivery via the web.

Remediation Plan

Immediate Action: Update Google Chrome to version 146 or later across all workstations to resolve the underlying memory management issue.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual browser child processes or unexpected memory allocation patterns.

Compensating Controls: Implement web filtering to prevent users from visiting known malicious or untrusted websites that could host exploit code.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Browser-based heap overflows are frequently targeted for "drive-by download" attacks, making rapid patching essential.

Analyst Recommendation

The risk of remote code execution through a standard web browser is a high-priority threat. Organizations must ensure that Chrome's auto-update feature is enabled and functional across the enterprise. Immediate deployment of version 146 is the only effective way to mitigate this memory corruption vulnerability and protect end-user systems.

---METADATA---
VENDOR: Iru, Inc
PRODUCT: Kandji Agent
AFFECTED_VERSIONS: Before v.4.7.5(5374)
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability in the Kandji Agent allows attackers to invoke restricted functionality through a client validation gap.

Executive Summary:
A local privilege escalation vulnerability in the Kandji Agent prior to version 4.7.5(5374) could allow an attacker to gain elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2026-39118

Affected Software: Iru, Inc Kandji Agent

Affected Versions: Before v.4.7.5(5374)

Vulnerability: This vulnerability is caused by a client validation gap in the Kandji Agent. A local attacker can exploit this weakness to bypass intended restrictions and invoke privileged agent functionality, leading to privilege escalation.

Business Impact

The 8.4 CVSS score indicates a high risk for local environments. An attacker who has already gained low-level access to a machine can use this vulnerability to escalate their privileges to match the agent's service account, potentially allowing full control over the affected device and bypassing security management policies.

Remediation Plan

Immediate Action: Update the Kandji Agent to version v.4.7.5(5374) or later to close the validation gap.

Proactive Monitoring: Monitor for unexpected execution of agent-related commands or unauthorized attempts to access protected system configurations.

Compensating Controls: Enforce strict access control on local user accounts and apply the principle of least privilege to minimize the risk of a local attacker reaching the vulnerable agent.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical in managed environments. Administrators should deploy the updated version of the Kandji Agent across all endpoints immediately to prevent local attackers from elevating their access and compromising the integrity of the managed fleet.

---METADATA---
VENDOR: PHPGurukul
PRODUCT: Apartment Visitors Management System
AFFECTED_VERSIONS: V1.1
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The Apartment Visitors Management System login page is vulnerable to SQL Injection, allowing unauthenticated attackers to manipulate queries and retrieve sensitive database contents.

Executive Summary:
A critical SQL injection vulnerability in the Apartment Visitors Management System login page allows unauthenticated attackers to bypass authentication and access sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-39109

Affected Software: PHPGurukul Apartment Visitors Management System

Affected Versions: V1.1

Vulnerability: This is an SQL Injection vulnerability occurring in the username parameter of the index.php login page. The application fails to properly sanitize user input, allowing an unauthenticated attacker to inject malicious SQL commands into the backend database queries.

Business Impact

The CVSS score of 9.4 highlights the severity of this flaw, which enables unauthorized access to the application's database. This could result in the total compromise of visitor data, administrative credentials, and other sensitive information stored within the system, potentially leading to regulatory and privacy compliance failures.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the application via network-level controls or take the system offline until the code can be manually audited and secured.

Proactive Monitoring: Monitor database logs for unusual query patterns, such as unexpected UNION SELECT statements or excessive error messages generated during login attempts.

Compensating Controls: Deploy a WAF with strict SQL injection protection rules to filter malicious input directed at the login endpoint.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of 2026-04-20, there is no public information indicating active exploitation or a published weaponized exploit for this vulnerability, though a proof-of-concept was assessed by CISA. The vulnerability is highly exploitable due to the lack of input sanitization in a public-facing authentication component.

Analyst Recommendation

Due to the lack of an official patch, this system should be treated as high-risk. If the software is currently in production, immediate isolation from the public internet is recommended until the vendor releases a secure version or the specific SQL injection point is remediated by the developer.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to 146
---END_METADATA---

Description Summary:
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.

Executive Summary:
Active exploitation of a V8 engine flaw in Google Chrome allows unauthenticated remote attackers to execute arbitrary code, posing a severe threat to enterprise security.

Vulnerability Details

CVE-ID: CVE-2026-3910

Affected Software: Google Chrome

Affected Versions: Prior to 146

Vulnerability: The vulnerability stems from an "inappropriate implementation" within the V8 JavaScript engine. This type of flaw typically involves logic errors in the JIT (Just-In-Time) compiler, which an unauthenticated remote attacker can exploit to bypass memory safety protections and execute code.

Business Impact

With a CVSS score of 8.8 and confirmed active exploitation, the business impact is significant. A successful attack can result in the full compromise of the browser process, potentially allowing for sandbox escapes and subsequent infection of the underlying host system. This endangers sensitive corporate data and user credentials.

Remediation Plan

Immediate Action: Force an update of Google Chrome to version 146 or higher to close the exploitation window.

Proactive Monitoring: Monitor for crashes in the Chrome renderer process and investigate any associated shellcode-like behavior detected by security software.

Compensating Controls: Implement "Site Isolation" features and use application control software to prevent unauthorized executables from running on workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This vulnerability is listed on the CISA KEV, confirming that it is being used in active attacks. Organizations have a very limited timeframe to apply patches before the risk of widespread compromise increases.

Analyst Recommendation

Immediate patching is the only effective defense against this actively exploited V8 flaw. Administrators should prioritize this update alongside CVE-2026-3909, as both affect the same software version and are being targeted simultaneously by threat actors. Ensure all users restart their browsers to finalize the update.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to 146
---END_METADATA---

Description Summary:
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.

Executive Summary:
A high-severity out-of-bounds write in Google Chrome's Skia engine is under active exploitation, allowing attackers to execute arbitrary code via malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-3909

Affected Software: Google Chrome

Affected Versions: Prior to 146

Vulnerability: This vulnerability is an out-of-bounds write within the Skia component, which handles graphics rendering. An unauthenticated attacker can trigger this flaw by enticing a user to visit a specially crafted website, leading to memory corruption and potential remote code execution (RCE) within the browser's sandbox.

Business Impact

As a CVSS 8.8 vulnerability included in the CISA KEV, the risk is immediate and verified. Successful exploitation can lead to the compromise of user workstations, theft of session cookies, and unauthorized access to corporate web applications. The active exploitation status elevates this from a theoretical risk to a confirmed threat.

Remediation Plan

Immediate Action: Update Google Chrome to version 146 or later immediately across the entire enterprise to mitigate active threats.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to look for suspicious child processes originating from Chrome or unusual memory allocation patterns.

Compensating Controls: Deploy web filtering to block access to known malicious domains and ensure browser sandboxing features are strictly enforced via Group Policy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This vulnerability is confirmed to be under active exploitation in the wild. While a public exploit payload may not be broadly available, the inclusion in CISA KEV indicates that sophisticated threat actors are currently utilizing this flaw.

Analyst Recommendation

Due to confirmed active exploitation, this vulnerability must be treated with the highest priority. IT teams should automate the deployment of Chrome version 146 and verify that all endpoints have successfully updated. The 13-day window remaining for remediation emphasizes the urgency of this action.

---METADATA---
VENDOR: Ntfy
PRODUCT: ntfy.sh
AFFECTED_VERSIONS: Before v.2.21
---END_METADATA---

Description Summary:
A vulnerability in the parseActions function of ntfy.sh allows remote attackers to execute arbitrary code.

Executive Summary:
A critical code execution vulnerability in ntfy.sh allows unauthenticated remote attackers to compromise the server by exploiting the parseActions function.

Vulnerability Details

CVE-ID: CVE-2026-39087

Affected Software: ntfy.sh

Affected Versions: Before v.2.21

Vulnerability: The parseActions function incorrectly handles user-supplied data, leading to a vulnerability that allows for arbitrary code execution. This can be triggered by a remote attacker without authentication.

Business Impact

With a CVSS score of 9.8, this flaw represents a significant risk to any infrastructure running ntfy.sh. Exploitation allows an attacker to gain control over the server, potentially leading to unauthorized data access and service disruption.

Remediation Plan

Immediate Action: Update ntfy.sh to version 2.21 or later.

Proactive Monitoring: Review server logs for suspicious activity and monitor for unexpected outbound network connections from the ntfy service.

Compensating Controls: Implement network-level access controls to limit exposure of the ntfy service to trusted users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute arbitrary code makes this a top-priority item. Administrators must update the software immediately to protect against potential remote exploitation.

---METADATA---
VENDOR: PrestaShop
PRODUCT: upsshipping
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the PrestaShop upsshipping module that may allow unauthorized access to sensitive information.

Executive Summary:
A potential information disclosure vulnerability in the PrestaShop upsshipping module poses a risk of unauthorized data exposure to unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-39079

Affected Software: PrestaShop upsshipping

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an unauthenticated access issue, allowing remote attackers to potentially retrieve sensitive data without requiring prior login or high-level privileges.

Business Impact

Successful exploitation could lead to the unauthorized disclosure of sensitive business or customer information managed by the PrestaShop platform. While the CVSS score of 7.5 indicates a High severity, the impact is focused on data confidentiality, which could lead to significant regulatory or reputational damage.

Remediation Plan

Immediate Action: Consult the vendor advisory at https://labs.esokia.com/cve/cve-2026-39079/ for specific patch availability and update instructions.

Proactive Monitoring: Monitor web server access logs for anomalous, high-frequency requests targeting module-specific directories or parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious traffic patterns directed at the affected module's URI.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is considered automatable, increasing the likelihood of widespread scanning.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for unauthenticated access, administrators should treat this vulnerability with urgency. Prioritize reviewing the vendor's guidance and apply any available security updates or module patches immediately to prevent unauthorized data access.

---METADATA---
VENDOR: Oinone
PRODUCT: Pamirs
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in Oinone Pamirs 7 that may allow for unauthorized interaction with the application.

Executive Summary:
A security vulnerability in Oinone Pamirs 7 potentially exposes the application to unauthorized network-based exploitation.

Vulnerability Details

CVE-ID: CVE-2026-39054

Affected Software: Oinone Pamirs

Affected Versions: See vendor advisory

Vulnerability: This is a network-accessible vulnerability that does not require authentication or user interaction to exploit. The technical specifics regarding the vulnerable function or parameter remain undisclosed in current vendor documentation.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a significant risk to the integrity and availability of the Oinone Pamirs environment. Successful exploitation could lead to unauthorized access or operational disruption, potentially compromising sensitive business data stored within the platform.

Remediation Plan

Immediate Action: Review the official Oinone changelog and security advisories to identify and apply the necessary security updates or configuration changes.

Proactive Monitoring: Monitor network traffic and application logs for unusual patterns or access attempts, specifically focusing on requests originating from untrusted network segments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules to inspect incoming traffic and block potentially malicious payloads targeting the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of detailed technical documentation complicates risk assessment, the network-adjacent nature of the flaw warrants prompt attention.

Analyst Recommendation

Given the High severity rating, administrators must treat this as a priority update. Consult the official Oinone project resources immediately to determine if your specific deployment is impacted and apply the vendor-recommended remediation steps as soon as they become available.