---METADATA---
VENDOR: Dalfox
PRODUCT: Dalfox
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
Dalfox contains an unauthenticated remote code execution vulnerability in its REST API server mode due to insecure deserialization of scan options.

Executive Summary:
An unauthenticated remote code execution vulnerability in Dalfox allows attackers to execute arbitrary shell commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-45087

Affected Software: Dalfox Dalfox

Affected Versions: Prior to 2.13.0

Vulnerability: The server mode deserializes attacker-supplied JSON directly into scan options, allowing an unauthenticated user to inject arbitrary shell commands that the Dalfox process will execute.

Business Impact

With a CVSS score of 10, this is a critical vulnerability that allows an unauthenticated attacker to gain full control over the host running the Dalfox server. This could lead to complete system compromise, data exfiltration, or the use of the host as a pivot point for further attacks.

Remediation Plan

Immediate Action: Update Dalfox to version 2.13.0 or later to ensure proper validation and stripping of scan options.

Proactive Monitoring: Monitor for unauthorized requests to the Dalfox API and check for unexpected child processes spawned by the Dalfox service.

Compensating Controls: If the Dalfox server must be exposed, implement strong authentication via an API key and restrict access to the service port (6664) using network-level controls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and trivial to exploit if the service is exposed to a network. Immediate updates are required, and the service should not be exposed without authentication.

---METADATA---
VENDOR: OpenSIPS
PRODUCT: opensips
AFFECTED_VERSIONS: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A NULL pointer dereference vulnerability in OpenSIPS allows unauthenticated remote attackers to trigger a denial of service by sending specifically crafted SIP requests.

Executive Summary:
A critical NULL pointer dereference vulnerability in OpenSIPS permits unauthenticated remote attackers to crash the service, resulting in a denial of service for critical communications.

Vulnerability Details

CVE-ID: CVE-2026-45084

Affected Software: OpenSIPS opensips

Affected Versions: >= 3.4.0, < 3.6.6, >= 4.0.0-beta, < 4.0.0-rc1

Vulnerability: This vulnerability is a NULL pointer dereference (CWE-476) occurring during the parsing or handling of SIP messages. It is accessible to unauthenticated remote attackers, as confirmed by the CVSS vector AV:N/AC:L/AT:N/PR:N.

Business Impact

The ability for a remote attacker to crash a core SIP server with a single crafted request poses a severe threat to organizations relying on OpenSIPS for telephony or messaging. The CVSS score of 8.7 reflects the high impact on availability, which could lead to significant operational downtime and loss of communication capabilities across the enterprise.

Remediation Plan

Immediate Action: Upgrade to OpenSIPS versions 3.6.6 or 4.0.0-rc1 to resolve the underlying pointer handling flaw.

Proactive Monitoring: Monitor server uptime and process health, specifically tracking restarts of the OpenSIPS daemon which may indicate successful exploitation of this vulnerability.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System capable of identifying and blocking malformed SIP traffic patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. NULL pointer dereferences in networking code are frequently discovered and exploited to force service outages.

Analyst Recommendation

Organizations should treat this vulnerability with high priority. Given the ease of exploitation, applying the vendor-recommended update is the only effective way to prevent potential service instability caused by malicious remote actors.

---METADATA---
VENDOR: PbootCMS
PRODUCT: PbootCMS
AFFECTED_VERSIONS: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, up to 3.2.12
CONFIDENCE: high
MISSING: patch
CREDITS: zmjjkk (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352074","name":"VDB-352074 | PbootCMS Member Login MemberController.php checkUsername sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352074","name":"VDB-352074 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773900","name":"Submit #773900 | 翱云科技 PbootCMS 3.2.12 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the PbootCMS member login function allows unauthenticated remote attackers to bypass authentication and access arbitrary user accounts.

Executive Summary:
PbootCMS is vulnerable to an unauthenticated SQL injection attack in the member login module, which allows remote attackers to bypass authentication and compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-4508

Affected Software: PbootCMS

Affected Versions: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, up to 3.2.12

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by the improper neutralization of the username parameter within the checkUsername function. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious SQL commands to manipulate database queries.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms, granting them unauthorized access to any frontend member account. This poses a severe risk of data exposure, potential account takeover, and unauthorized access to member-restricted content, which may lead to significant reputational damage and loss of user trust. While the CVSS score is 7.3, the ability for unauthenticated remote code execution or authentication bypass often carries higher operational risk than the score suggests.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should implement strict input validation on the login endpoint and consider disabling member registration or login functions if they are not business-critical until a vendor-supplied update is released.

Proactive Monitoring: Review web server and application logs for anomalous POST requests to the /member/login endpoint, specifically looking for SQL-related characters such as single quotes, dashes, or SQL keywords like UNION and OR in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing common SQL injection patterns in the username parameter to prevent exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the security researcher in the referenced GitHub repository.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from the direct concatenation of user-supplied input into SQL queries within the application model, which is a highly reliable vector for exploitation.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the ease of exploitation, this vulnerability should be treated with high urgency. Organizations using PbootCMS should immediately implement WAF protections and monitor for suspicious login attempts while actively tracking the vendor for a security update to address the underlying code flaw.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An XML External Entity (XXE) vulnerability in the Symfony DomCrawler component allows unauthenticated attackers to potentially read sensitive local files.

Executive Summary:
A High severity XML External Entity injection vulnerability in the Symfony DomCrawler component could allow unauthenticated attackers to access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-45071

Affected Software: Symfony Symfony and DomCrawler

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This is an XML External Entity (XXE) injection vulnerability (CWE-611) triggered when the DomCrawler component improperly handles XML input. The flaw is exploitable by unauthenticated remote actors.

Business Impact

Successful exploitation allows an attacker to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, or sensitive application data. With a CVSS score of 8.7, the impact on confidentiality is severe, posing a direct threat to the security of the hosting environment.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12.

Proactive Monitoring: Audit application logs for XML-based requests containing suspicious entity definitions or attempts to access local file paths.

Compensating Controls: Ensure that XML parsers are configured to disable the resolution of external entities and DTDs as a defense-in-depth measure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. XXE vulnerabilities remain a common target for data exfiltration.

Analyst Recommendation

The risk posed by this XXE vulnerability is significant. Administrators must ensure that the DomCrawler component is updated to the patched versions immediately to prevent unauthorized information disclosure.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Symfony components are vulnerable to insufficient verification of data authenticity and improper input validation, potentially allowing unauthorized data access.

Executive Summary:
The Symfony PHP framework and its security-http component are affected by critical input validation flaws that allow unauthenticated attackers to compromise data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-45069

Affected Software: Symfony Symfony/security-http

Affected Versions: >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

Vulnerability: This vulnerability involves the insufficient verification of data authenticity and improper input validation, which can be exploited by an unauthenticated remote attacker to gain unauthorized access to sensitive information.

Business Impact

Successful exploitation poses a significant risk to application integrity and data privacy. Given the CVSS score of 8.8, this high severity vulnerability allows attackers to bypass security controls without authentication, potentially leading to widespread data exposure or unauthorized manipulation of application state.

Remediation Plan

Immediate Action: Upgrade the Symfony framework and security-http component to version 6.4.40, 7.4.12, or 8.0.12 immediately to incorporate the necessary security patches.

Proactive Monitoring: Inspect web server access logs for anomalous request patterns or unexpected inputs directed at authentication-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter out malicious payloads that attempt to exploit input validation weaknesses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, which increases the necessity for a rapid patch cycle.

Analyst Recommendation

Organizations utilizing the Symfony framework must prioritize this update, as the absence of required authentication makes this an attractive target for automated exploitation. Apply the provided vendor patches to the affected versions immediately to neutralize the risk of unauthorized data access.

---METADATA---
VENDOR: Symfony
PRODUCT: Symfony
AFFECTED_VERSIONS: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Symfony framework and Mailer component allows for argument injection due to improper neutralization of argument delimiters.

Executive Summary:
An argument injection vulnerability in the Symfony framework and Mailer component, rated as High severity, poses a significant risk of unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2026-45068

Affected Software: Symfony Symfony and Mailer

Affected Versions: < 5.4.52, 6.0.0-BETA1 to < 6.4.40, 7.0.0-BETA1 to < 7.4.12, 8.0.0-BETA1 to < 8.0.12

Vulnerability: This vulnerability is an argument injection flaw (CWE-88) occurring when the framework improperly handles argument delimiters in commands. It is exploitable by unauthenticated remote attackers.

Business Impact

The ability to inject arbitrary arguments into command execution can lead to severe system compromise, including unauthorized code execution or manipulation of application behavior. Given the CVSS score of 8.7, this flaw represents a high risk to data integrity and system availability, necessitating immediate attention to prevent potential exploitation.

Remediation Plan

Immediate Action: Update the Symfony framework and Mailer component to versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 as appropriate for your branch.

Proactive Monitoring: Monitor server logs for unexpected command-line invocations or unusual process execution patterns that may indicate attempts to leverage this vulnerability.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied data that is passed to system commands, and utilize a Web Application Firewall to block suspicious request patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for direct command manipulation.

Analyst Recommendation

This vulnerability presents a high risk to the application ecosystem. Security teams should prioritize patching the affected Symfony components across all environments immediately to mitigate the risk of remote command injection.

---METADATA---
VENDOR: ClipBucket
PRODUCT: ClipBucket
AFFECTED_VERSIONS: Prior to version 5.5.3 - #129
---END_METADATA---

Description Summary:
The ClipBucket video sharing platform is vulnerable to unauthenticated blind SQL injection, allowing attackers to execute unauthorized database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in ClipBucket allows remote attackers to exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-45060

Affected Software: ClipBucket

Affected Versions: Prior to version 5.5.3 - #129

Vulnerability: The actions/progress_video.php endpoint fails to properly sanitize the ids parameter, leading to a blind SQL injection vulnerability. This flaw allows an unauthenticated attacker to inject malicious SQL queries to interact with the database.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it requires no authentication to execute. Successful exploitation could result in the full exfiltration of user databases, administrative credentials, or proprietary video content, leading to significant data breaches and potential loss of platform integrity.

Remediation Plan

Immediate Action: Update ClipBucket to version 5.5.3 - #129 or higher to patch the SQL injection vulnerability.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected UNION operations, or high volumes of suspicious requests targeting the progress_video.php endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block SQL injection patterns in incoming HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, it presents a significant risk to data confidentiality. Organizations running ClipBucket must apply the provided update immediately to prevent unauthorized database access and potential data exfiltration.

---METADATA---
VENDOR: Eosphoros-AI
PRODUCT: DB-GPT
AFFECTED_VERSIONS: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5
CONFIDENCE: high
MISSING: patch
CREDITS: Goku (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352070","name":"VDB-352070 | eosphoros-ai db-gpt Incomplete Fix editor sql injection","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.352070","name":"VDB-352070 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773891","name":"Submit #773891 | eosphoros-ai DB-GPT <=0.7.5 Remote command execution","tags":["third-party-advisory"]},{"url":"https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
An SQL injection vulnerability exists in the /api/v1/editor/ endpoint of Eosphoros-AI DB-GPT, allowing unauthenticated remote attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Eosphoros-AI DB-GPT allows unauthenticated remote attackers to compromise the underlying database, posing a severe risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-4504

Affected Software: Eosphoros-AI DB-GPT

Affected Versions: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /api/v1/editor/ component. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector (AV:N/PR:N).

Business Impact

Successful exploitation permits unauthorized access to the application database, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to business continuity and regulatory compliance, as the application fails to safely handle user-supplied input in a critical API path.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /api/v1/editor/ endpoint immediately.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from the API service account.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to inspect and block malicious SQL injection payloads targeting the /api/v1/editor/ URI.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced huntr.com bounty report.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability requires immediate attention. Security teams must prioritize isolating the vulnerable component and applying network-level filtering to prevent unauthorized exploitation while awaiting a formal fix from the project maintainers.

---METADATA---
VENDOR: RustFS
PRODUCT: Distributed Object Storage System
AFFECTED_VERSIONS: Prior to 1.0.0-beta.2
---END_METADATA---

Description Summary:
RustFS uses a hardcoded default secret key for internode RPC authentication, allowing attackers to bypass security if the environment is not explicitly configured.

Executive Summary:
A hardcoded secret key in the RustFS distributed storage system enables unauthorized internode communication and potential data access if default configurations are not overridden.

Vulnerability Details

CVE-ID: CVE-2026-45039

Affected Software: RustFS

Affected Versions: Prior to 1.0.0-beta.2

Vulnerability: The application utilizes a hardcoded DEFAULT_SECRET_KEY ("rustfsadmin") for HMAC-SHA256 signature validation in the internode RPC layer. This key is used when the RUSTFS_RPC_SECRET environment variable or the global S3 secret key is not explicitly set, effectively allowing an unauthenticated attacker to forge valid authentication requests.

Business Impact

With a CVSS score of 9.8, this is a critical vulnerability. An attacker capable of communicating with the internode RPC port could authenticate as a trusted node, potentially accessing, modifying, or deleting stored objects. This results in a severe breach of data confidentiality and integrity within the storage cluster.

Remediation Plan

Immediate Action: Upgrade RustFS to version 1.0.0-beta.2 or later, and ensure that a strong, unique secret key is configured via the RUSTFS_RPC_SECRET environment variable.

Proactive Monitoring: Audit RPC traffic for unauthorized authentication attempts or communication from nodes not belonging to the trusted cluster.

Compensating Controls: Use network-level segmentation or mTLS to ensure that only authorized internal nodes can communicate over the RPC port, effectively isolating the service from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the flaw makes it an attractive target for internal or network-adjacent threat actors.

Analyst Recommendation

The reliance on a hardcoded secret key is a significant security oversight. Organizations must upgrade to the patched version and immediately rotate any secrets that may have been exposed by relying on the default configuration.

---METADATA---
VENDOR: Eugeny
PRODUCT: Tabby
AFFECTED_VERSIONS: < 1.0.232
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Tabby terminal emulator is susceptible to open redirection and input validation flaws, which could be leveraged to redirect users to malicious, untrusted websites.

Executive Summary:
The Tabby terminal emulator before version 1.0.232 contains an open redirect vulnerability that can be exploited to facilitate phishing or malicious site redirection.

Vulnerability Details

CVE-ID: CVE-2026-45037

Affected Software: Eugeny Tabby

Affected Versions: < 1.0.232

Vulnerability: This issue involves an Incomplete List of Disallowed Inputs (CWE-184) leading to an Open Redirect (CWE-601). The vulnerability is exploitable by an unauthenticated attacker, though it requires user interaction (UI:R).

Business Impact

The ability to perform open redirects can be weaponized to bypass security filters and deceive users into visiting malicious domains. While the CVSS score of 7.1 reflects a high-severity risk, the primary impact is the potential for credential theft or malware delivery through social engineering, which can compromise both user and organizational security.

Remediation Plan

Immediate Action: Update the Tabby terminal emulator to version 1.0.232 or the latest available release.

Proactive Monitoring: Review web proxy logs or browser history for unexpected redirects originating from the terminal application context.

Compensating Controls: Utilize endpoint protection software and web filtering solutions to block access to known malicious domains and prevent users from navigating to untrusted sites.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dependent on social engineering and user interaction to be effective.

Analyst Recommendation

Users of the Tabby terminal emulator should update their software to version 1.0.232 immediately to eliminate the risk of open redirection. Organizations should educate users on the risks of clicking suspicious links, even when they appear to originate from trusted, locally installed applications.

---METADATA---
VENDOR: Eugeny
PRODUCT: Tabby
AFFECTED_VERSIONS: < 1.0.233
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Tabby terminal emulator is affected by an OS command injection vulnerability, allowing for potential arbitrary command execution on the host system.

Executive Summary:
Tabby terminal emulator versions prior to 1.0.233 are vulnerable to OS command injection, which could allow a local attacker to execute arbitrary commands with the privileges of the application.

Vulnerability Details

CVE-ID: CVE-2026-45036

Affected Software: Eugeny Tabby

Affected Versions: < 1.0.233

Vulnerability: This vulnerability is caused by the improper neutralization of special elements used in an OS command (CWE-78), resulting in command injection. The attack requires local access and specific conditions (AC:H) to trigger, but could lead to a total compromise of the application's environment.

Business Impact

Successful command injection grants an attacker the ability to execute arbitrary code on the underlying system, leading to full system compromise. With a CVSS score of 7.0, this vulnerability poses a severe risk to the integrity and availability of the host machine, potentially allowing for data theft, lateral movement, or the installation of persistent backdoors.

Remediation Plan

Immediate Action: Update the Tabby terminal emulator to version 1.0.233 or the latest available release.

Proactive Monitoring: Monitor system processes for unusual child processes spawned by the Tabby application, particularly those executing shell commands.

Compensating Controls: Apply strict OS-level permissions to the user account running Tabby to limit the potential blast radius of a successful command injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access and high complexity significantly limits the immediate threat surface, but the potential for total system compromise necessitates prompt patching.

Analyst Recommendation

Given the potential for arbitrary code execution, updating to version 1.0.233 is critical for all users of the Tabby terminal. Administrators should enforce standard security hygiene, such as minimizing user privileges and maintaining up-to-date application software, to mitigate the risk of local exploitation.

---METADATA---
VENDOR: PHPOffice
PRODUCT: PhpSpreadsheet
AFFECTED_VERSIONS: Prior to 1.30.5
---END_METADATA---

Description Summary:
An input validation flaw in PhpSpreadsheet allows attackers to bypass wrapper protections, leading to potential Remote Code Execution (RCE) via phar deserialization.

Executive Summary:
A critical input validation vulnerability in PHPOffice PhpSpreadsheet allows unauthenticated attackers to achieve Remote Code Execution through malicious spreadsheet files.

Vulnerability Details

CVE-ID: CVE-2026-45034

Affected Software: PHPOffice PhpSpreadsheet

Affected Versions: Prior to 1.30.5

Vulnerability: The library fails to correctly sanitize file paths containing phar wrappers when provided with specific malformed input. This allows an unauthenticated attacker to bypass the File::prohibitWrappers check and trigger deserialization of phar metadata, leading to RCE on PHP 7.x environments.

Business Impact

This vulnerability carries a CVSS score of 9.2, reflecting its potential for full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the web server user, leading to complete data exfiltration, unauthorized system access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade the PHPOffice PhpSpreadsheet library to version 1.30.5 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious file access patterns or attempts to load unconventional file schemes such as phar://, php://, or data://.

Compensating Controls: Implement strict file upload validation policies that restrict file types and prohibit the use of external wrappers or remote file inclusion in application logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this RCE vulnerability, organizations using PhpSpreadsheet must prioritize updating to version 1.30.5. Failure to patch allows trivial exploitation paths for attackers to gain persistent access to the underlying infrastructure.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow Desktop
AFFECTED_VERSIONS: 1.0.0 through 1.8.4
CONFIDENCE: high
MISSING: none
CREDITS: The vulnerability was reported to IBM by Akshat Sinha, Senior SRE Rubrik (https://www.linkedin.com/in/akshat-sinha-56876 (reporter)
SOURCES_JSON: [{"url":"https://www.ibm.com/support/pages/node/7271099","name":null,"tags":["vendor-advisory","patch"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.639Z
---END_METADATA---

Description Summary:
IBM Langflow Desktop 1.0.0 through 1.8.4 contains an authorization bypass vulnerability that allows unauthenticated users to access other users' images via an insecure object reference.

Executive Summary:
A critical authorization flaw in IBM Langflow Desktop versions 1.0.0 through 1.8.4 allows unauthenticated attackers to access unauthorized image data, potentially leading to significant information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-4503

Affected Software: IBM Langflow Desktop

Affected Versions: 1.0.0 through 1.8.4

Vulnerability: This vulnerability, identified as CWE-639, arises from an insecure direct object reference where user-controlled keys are not properly validated. An unauthenticated attacker can manipulate these keys to retrieve private images belonging to other users.

Business Impact

The ability for unauthenticated parties to access sensitive user data poses a severe risk to data confidentiality and regulatory compliance. With a CVSS score of 7.5, this high-severity vulnerability could lead to the unauthorized exposure of proprietary or personal imagery stored within the application, resulting in potential reputational damage and loss of user trust.

Remediation Plan

Immediate Action: Upgrade to IBM Langflow Desktop version 1.9.0 or newer immediately by utilizing the in-application update mechanism or downloading the latest installer from the official Langflow website.

Proactive Monitoring: Review application access logs for unusual patterns, such as sequential or high-frequency requests for image resources that do not correspond to standard user activity.

Compensating Controls: Deploy a Web Application Firewall to monitor and block abnormal HTTP requests containing suspicious object identifiers or unexpected parameter values.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements, which makes it highly automatable for external attackers.

Analyst Recommendation

Given the ease of exploitation and the potential for unauthorized data access, administrators must prioritize this update. Applying the patch to version 1.9.0 is the only effective way to remediate the underlying authorization logic failure and secure the application against potential data exposure incidents.

---METADATA---
VENDOR: Chainlit
PRODUCT: chainlit
AFFECTED_VERSIONS: >= 2.4.0rc0, < 2.12.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Chainlit versions 2.4.0rc0 through 2.11.x are vulnerable to unauthenticated OS command injection via the MCP endpoint when features.mcp.enabled is true.

Executive Summary:
A critical OS command injection vulnerability in Chainlit allows unauthenticated attackers to execute arbitrary code on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-45018

Affected Software: Chainlit chainlit

Affected Versions: >= 2.4.0rc0, < 2.12.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring in the backend/chainlit/mcp.py file. An unauthenticated attacker can supply a crafted command string to the POST /mcp endpoint, which is then improperly sanitized and executed by the system shell.

Business Impact

Successful exploitation grants an attacker full control over the server process, potentially leading to total system compromise, data exfiltration, and lateral movement within the network. Given the CVSS score of 9.8, this vulnerability represents an extreme risk to confidentiality, integrity, and availability that requires immediate remediation.

Remediation Plan

Immediate Action: Upgrade to Chainlit version 2.12.0 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the /mcp endpoint, particularly those containing shell metacharacters such as pipes or semicolons.

Compensating Controls: If patching is delayed, disable the MCP feature by setting features.mcp.enabled to false in the .chainlit/config.toml file and restrict network access to the application via a Web Application Firewall.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the direct path to shell execution.

Analyst Recommendation

This is a critical vulnerability that poses an immediate threat to any organization running affected versions of Chainlit. Security teams must prioritize upgrading to version 2.12.0 across all environments to eliminate this exposure.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: ApostropheCMS
AFFECTED_VERSIONS: ApostropheCMS versions up to and including 4.29.0
---END_METADATA---

Description Summary:
ApostropheCMS contains a password reset vulnerability where an unauthenticated attacker can manipulate the Host header to redirect password reset emails to an attacker-controlled domain.

Executive Summary:
ApostropheCMS is vulnerable to an unauthenticated account takeover flaw that allows attackers to redirect password reset links to malicious domains.

Vulnerability Details

CVE-ID: CVE-2026-45013

Affected Software: ApostropheCMS

Affected Versions: ApostropheCMS versions up to and including 4.29.0

Vulnerability: This is a Host header manipulation vulnerability within the password reset flow. An unauthenticated attacker can trigger a password reset for a known email address, causing the application to send a reset link that directs the victim to an attacker-controlled domain, facilitating full account takeover.

Business Impact

With a CVSS score of 8.1 (High), this vulnerability poses a severe risk to organizational security. Successful exploitation allows unauthorized parties to gain full control over user accounts, potentially leading to unauthorized data access, intellectual property theft, and loss of administrative control over the CMS platform.

Remediation Plan

Immediate Action: Manually configure the "apos.baseUrl" setting within the application configuration to explicitly define the expected domain and prevent Host header manipulation.

Proactive Monitoring: Review application logs for anomalous password reset requests or unexpected patterns in outgoing email traffic.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and sanitize incoming HTTP Host headers, blocking requests that do not match the expected environment domain.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for account takeover is high.

Analyst Recommendation

Given the high impact of account takeover, administrators must prioritize hardening the CMS configuration immediately. While no vendor patch is currently available, setting the "apos.baseUrl" is a critical security control to mitigate this risk.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: Prior to 4.1.2
---END_METADATA---

Description Summary:
phpMyFAQ lacks rate limiting on its TOTP authentication endpoint, allowing unauthenticated attackers to brute-force two-factor authentication tokens.

Executive Summary:
A lack of rate limiting in the phpMyFAQ administrative login endpoint allows unauthenticated attackers to brute-force TOTP tokens and bypass two-factor authentication.

Vulnerability Details

CVE-ID: CVE-2026-45010

Affected Software: phpMyFAQ

Affected Versions: Prior to 4.1.2

Vulnerability: The application fails to bind TOTP verification to a session or implement rate limiting on the /admin/check endpoint, permitting automated brute-force attacks against six-digit tokens.

Business Impact

Bypassing two-factor authentication grants an attacker full administrative access, potentially leading to total system compromise and data loss. This vulnerability is rated 9.1, reflecting the high risk to administrative security.

Remediation Plan

Immediate Action: Update phpMyFAQ to version 4.1.2 or later to implement necessary rate limiting and session binding.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts or sequential token submissions targeting the administrative interface.

Compensating Controls: Restrict access to the /admin/ path via IP allowlisting or VPN-only access to prevent public exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrative access is the highest security tier; failing to protect this endpoint renders all other security measures ineffective. Update the software immediately to enforce robust authentication controls.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in OpenClaw allows for unsafe configuration mutation via a gateway tool denylist bypass, enabling unauthorized system changes.

Executive Summary:
An unsafe configuration mutation flaw in OpenClaw allows authenticated attackers to bypass security filters and compromise system settings.

Vulnerability Details

CVE-ID: CVE-2026-45006

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.23

Vulnerability: This is an Incomplete List of Disallowed Inputs (CWE-184) vulnerability. It allows an authenticated user to bypass input validation filters, leading to unauthorized configuration mutations via the gateway tool.

Business Impact

By bypassing denylist filters, an attacker can modify system configurations that should be restricted, leading to significant security degradation. A CVSS score of 8.8 indicates a high-severity risk, where successful exploitation could lead to full loss of control over the application's operational parameters.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.4.23 to resolve the input validation bypass.

Proactive Monitoring: Audit system configuration changes and logs for any modifications made via the gateway tool that deviate from established operational baselines.

Compensating Controls: Restrict access to the affected gateway tool to only authorized personnel and implement strict egress filtering to prevent unauthorized configuration pushes.

Exploitation Status

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB).

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on system configuration integrity.

Analyst Recommendation

This vulnerability represents a significant risk to system stability and security. It is recommended that all users of OpenClaw update their instances to the 2026.4.23 release immediately to ensure input validation mechanisms are correctly enforced.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to arbitrary code execution due to an uncontrolled search path element.

Executive Summary:
An uncontrolled search path vulnerability in OpenClaw could allow an attacker to execute arbitrary code, potentially leading to a total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-45004

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.23

Vulnerability: This vulnerability (CWE-427) involves an uncontrolled search path element where the application may load malicious files from the current working directory. The vulnerability requires user interaction to facilitate the loading of untrusted components.

Business Impact

The ability for an attacker to achieve arbitrary code execution represents a significant security risk, potentially leading to full system compromise, data exfiltration, or installation of persistent backdoors. With a CVSS score of 7.8, this vulnerability poses a high risk to business operations and data security.

Remediation Plan

Immediate Action: Update the OpenClaw npm package to version 2026.4.23 immediately.

Proactive Monitoring: Scan for anomalous processes or unexpected execution of scripts initiated by the OpenClaw service.

Compensating Controls: Restrict the permissions of the directory where the application is executed to prevent unauthorized modification of local files.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data).

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it allows for code execution if an attacker can place a malicious file in the working directory.

Analyst Recommendation

The severity of this arbitrary code execution flaw necessitates immediate patching. Organizations should ensure all instances of the OpenClaw package are updated to version 2026.4.23 to eliminate this critical attack vector.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is affected by a missing authorization vulnerability in the gateway configuration.

Executive Summary:
A missing authorization flaw in OpenClaw allows authenticated users to mutate gateway configurations, potentially disrupting service availability.

Vulnerability Details

CVE-ID: CVE-2026-45001

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.20

Vulnerability: This is a missing authorization vulnerability (CWE-862) occurring within the agent tool access mechanism. An authenticated user can bypass configuration guards to modify gateway settings without proper permission checks.

Business Impact

An attacker exploiting this vulnerability could unauthorizedly alter system configurations, which may result in service disruption or the exposure of sensitive gateway parameters. With a CVSS score of 7.1, this flaw presents a substantial risk to service availability and configuration integrity.

Remediation Plan

Immediate Action: Update the OpenClaw npm package to version 2026.4.20 to enforce proper authorization checks.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or suspicious activity related to agent tool access.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users who can interact with sensitive gateway configuration tools.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data).

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on the attacker having valid user credentials to interact with the gateway tools.

Analyst Recommendation

To maintain the security and stability of your infrastructure, please apply the update to version 2026.4.20 as soon as possible. Restricting access to sensitive configuration tools remains a critical layer of defense against this vulnerability.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.4.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to arbitrary code execution via insecure handling of environment variables, allowing attackers to leverage functionality from an untrusted control sphere.

Executive Summary:
A vulnerability in OpenClaw allows for arbitrary code execution, posing a high risk of total system compromise to affected environments.

Vulnerability Details

CVE-ID: CVE-2026-44995

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.4.20

Vulnerability: This vulnerability (CWE-829) arises from the inclusion of functionality from an untrusted control sphere. An authenticated local attacker with low privileges can leverage this flaw to achieve arbitrary code execution.

Business Impact

The CVSS score of 7.3 reflects a high severity due to the potential for total impact on confidentiality, integrity, and availability of the affected system. Successful exploitation could allow an attacker to execute arbitrary commands, potentially leading to a complete takeover of the host or unauthorized access to sensitive application data.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.4.20 or later.

Proactive Monitoring: Audit environment variables and system logs for unexpected process execution or modifications to application configuration files.

Compensating Controls: Implement strict file system permissions and restrict user access to the environment where OpenClaw is running to mitigate the risk of local exploitation.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires local access, the impact is severe, necessitating prompt patching.

Analyst Recommendation

Given the potential for arbitrary code execution, organizations should prioritize upgrading to version 2026.4.20 immediately. Although local access is required, the severity of the potential impact warrants an expedited patch cycle to prevent unauthorized system control.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: sanitize-html
AFFECTED_VERSIONS: sanitize-html prior to 2.17.4
---END_METADATA---

Description Summary:
The sanitize-html library contains a sanitizer bypass vulnerability that can lead to stored XSS in applications rendering user-controlled content.

Executive Summary:
A sanitizer bypass in the sanitize-html library allows attackers to inject malicious HTML or JavaScript, leading to stored cross-site scripting (XSS) in dependent applications.

Vulnerability Details

CVE-ID: CVE-2026-44990

Affected Software: ApostropheCMS sanitize-html

Affected Versions: sanitize-html prior to 2.17.4

Vulnerability: This is a sanitizer bypass vulnerability where content inside a disallowed xmp element is incorrectly processed as live HTML or JavaScript. This occurs in the default disallowedTagsMode: 'discard' path, allowing an attacker to inject malicious code.

Business Impact

With a CVSS score of 9.3, this vulnerability is critical for web applications relying on sanitize-html. Successful exploitation allows for stored XSS, which can be used to hijack user sessions, steal sensitive session cookies, or perform unauthorized actions on behalf of authenticated administrators.

Remediation Plan

Immediate Action: Update the sanitize-html library dependency to version 2.17.4 or later in all affected project environments.

Proactive Monitoring: Audit application logs for suspicious script injection patterns in user-submitted content fields and monitor for unexpected client-side script execution.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts if an immediate library update is not feasible.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 12, 2026, there is public information confirming the vulnerability. Given the widespread use of this library in Node.js applications, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of this library in web application stacks, developers should prioritize updating to version 2.17.4. Failure to patch leaves applications vulnerable to persistent XSS attacks that can compromise user security.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-820LW
AFFECTED_VERSIONS: 2.03
CONFIDENCE: high
MISSING: none
CREDITS: junqi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352055","name":"VDB-352055 | D-Link DIR-820LW SSDP ssdpcgi_main os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352055","name":"VDB-352055 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773883","name":"Submit #773883 | D-Link DIR-820LW B2.03 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/yunleeeee/cve/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/25790888/OS.Command.Injection.in.D-Link.DIR-820LW.B2.03.via.the.HTTP_ST.environment.variable.in.ssdpcgi_main.function.zip","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the D-Link DIR-820LW 2.03 firmware due to improper input validation in the ssdpcgi_main function of the SSDP component.

Executive Summary:
An unauthenticated remote OS command injection vulnerability in D-Link DIR-820LW firmware version 2.03 poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4499

Affected Software: D-Link DIR-820LW

Affected Versions: 2.03

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered via the HTTP_ST environment variable within the ssdpcgi_main function of the SSDP component. An unauthenticated remote attacker can exploit this by sending specially crafted packets to the affected device.

Business Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands with elevated privileges on the router. This can lead to complete device takeover, interception of network traffic, persistence within the local network, and potential pivot points for further attacks against internal systems. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet immediately and check the official D-Link support portal for firmware updates or security patches. If no patch is available, replace the device as it is currently vulnerable to remote exploitation.

Proactive Monitoring: Review firewall and router logs for anomalous traffic patterns, specifically looking for unusual HTTP requests or unexpected inbound SSDP traffic. Monitor for signs of unauthorized configuration changes or unexpected process execution on the device if management interfaces are accessible.

Compensating Controls: Disable UPnP and SSDP services on the router if they are not strictly required for network functionality to reduce the attack surface. Utilize a perimeter firewall to block inbound access to the router management and discovery ports from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a proof of concept and technical details are available via the research documentation referenced in the CVE record.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the nature of the SSDP service.

Analyst Recommendation

The presence of a public proof of concept combined with the ease of remote exploitation makes this a high priority for remediation. Administrators should prioritize the decommissioning or patching of these legacy devices, as they are likely to remain targets for automated exploitation attempts. If patching is not feasible, the device must be isolated from the public internet to prevent unauthorized remote command execution.

---METADATA---
VENDOR: LibVNC
PRODUCT: LibVNCServer
AFFECTED_VERSIONS: <= 0.9.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
LibVNCServer is vulnerable to an out-of-bounds write, which may allow a remote attacker to execute arbitrary code or cause a crash.

Executive Summary:
A critical out-of-bounds write vulnerability in LibVNCServer could allow a remote attacker to execute arbitrary code or crash the affected application.

Vulnerability Details

CVE-ID: CVE-2026-44988

Affected Software: LibVNC LibVNCServer

Affected Versions: <= 0.9.15

Vulnerability: This is an out-of-bounds write vulnerability (CWE-787) triggered by improper handling of data within the VNC client library. The vulnerability is exploitable by an unauthenticated attacker, although it typically requires user interaction.

Business Impact

The ability to perform an out-of-bounds write poses a severe risk, as it can lead to remote code execution (RCE) on the host system. With a CVSS score of 8.8, this vulnerability poses a significant threat to system availability and security, potentially allowing attackers to gain full control over the affected client or server.

Remediation Plan

Immediate Action: Audit systems to identify instances of LibVNCServer and prepare for updates; monitor official project repositories for the release of a patched version.

Proactive Monitoring: Monitor network traffic to and from VNC endpoints for malformed packets or anomalous connection attempts.

Compensating Controls: Restrict access to VNC services to trusted networks via VPN or firewall rules to minimize exposure to untrusted remote attackers.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive due to the potential for memory corruption and arbitrary code execution.

Analyst Recommendation

Users and administrators should monitor the LibVNCServer GitHub repository for the official patch. Until a fix is available, isolate VNC instances from external exposure and restrict access to authorized personnel only to mitigate the risk of exploitation.

---METADATA---
VENDOR: Penpot
PRODUCT: Penpot
AFFECTED_VERSIONS: < 2.14.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Penpot contains an authentication bypass vulnerability that allows registered users to hijack arbitrary accounts by manipulating invitation flows and profile registration processes.

Executive Summary:
A critical authentication bypass in Penpot enables authenticated users to perform unauthorized account takeovers, potentially leading to full administrative compromise.

Vulnerability Details

CVE-ID: CVE-2026-44986

Affected Software: Penpot Penpot

Affected Versions: < 2.14.5

Vulnerability: The vulnerability stems from flaws in the team invitation and profile registration logic, where session creation is improperly linked to email matching without validating password credentials. This allows a user with existing access to impersonate other profiles by manipulating the registration sequence.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to any non-blocked user account, including those with elevated privileges. With a CVSS score of 9.9, the impact includes unauthorized data access, potential intellectual property theft within design projects, and total loss of account integrity.

Remediation Plan

Immediate Action: Upgrade Penpot to version 2.14.5 or later to resolve the authentication logic flaws.

Proactive Monitoring: Monitor user registration and invitation logs for anomalous activity, specifically frequent profile creation or suspicious associations between email addresses and user IDs.

Compensating Controls: Implement strict network-level access controls for the registration and invitation endpoints while the upgrade is being prepared.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly concerning due to its impact on user identity and access management.

Analyst Recommendation

The risk of account takeover necessitates urgent action. Organizations currently running Penpot should apply the 2.14.5 update immediately to secure their user base and prevent unauthorized access to sensitive collaborative design data.

---METADATA---
VENDOR: CrowdSecurity
PRODUCT: CrowdSec
AFFECTED_VERSIONS: 1.7.0 up to 1.7.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CrowdSec contains a vulnerability related to the improper handling of highly compressed data, which can lead to resource exhaustion.

Executive Summary:
A vulnerability in CrowdSec involving the improper handling of highly compressed data creates a risk of service disruption through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-44981

Affected Software: CrowdSecurity CrowdSec

Affected Versions: 1.7.0 up to 1.7.8

Vulnerability: This vulnerability involves the improper handling of highly compressed data (CWE-409), which allows an unauthenticated attacker to trigger excessive resource consumption through data amplification.

Business Impact

Successful exploitation of this vulnerability results in a denial-of-service condition, rendering the CrowdSec security service unavailable. With a CVSS score of 8.2, this represents a high risk to the availability of security infrastructure that relies on CrowdSec to block malicious traffic.

Remediation Plan

Immediate Action: Update CrowdSec to the version containing the fix (1.7.8 or later) as specified in the vendor security advisory.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory, to detect spikes that may indicate a data amplification attack.

Compensating Controls: Utilize a Web Application Firewall (WAF) or rate-limiting features at the network edge to inspect and drop malformed or excessively compressed requests before they reach the CrowdSec service.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the available data.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The vulnerability poses a direct threat to the availability of the CrowdSec security stack. Organizations should schedule an immediate update to the patched version to prevent potential denial-of-service attacks that could leave the network exposed to other threats.

---METADATA---
VENDOR: Elastic
PRODUCT: Kibana
AFFECTED_VERSIONS: 8.0.0 through 8.19.13
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.947Z
---END_METADATA---

Description Summary:
An execution with unnecessary privileges vulnerability exists in the Kibana Fleet plugin, allowing authenticated users to read index data outside their authorized Elasticsearch RBAC scope.

Executive Summary:
An authenticated privilege abuse vulnerability in Elastic Kibana allows users with Fleet sub-feature permissions to access unauthorized Elasticsearch index data, posing a significant data exposure risk.

Vulnerability Details

CVE-ID: CVE-2026-4498

Affected Software: Elastic Kibana

Affected Versions: 8.0.0 through 8.19.13

Vulnerability: The vulnerability involves an execution with unnecessary privileges (CWE-250) within the Fleet plugin debug route handlers. An authenticated user possessing specific Fleet sub-feature privileges can exploit this flaw to bypass RBAC controls and access restricted Elasticsearch index data.

Business Impact

Successful exploitation permits unauthorized access to sensitive index data, potentially leading to the compromise of confidential information stored within the Elasticsearch environment. With a CVSS score of 7.7, this is classified as a High severity issue, as it undermines the integrity of access control policies and could lead to significant data breaches or regulatory non-compliance.

Remediation Plan

Immediate Action: Update Elastic Kibana to version 8.19.14 or later, as specified in the official Elastic security advisory (ESA-2026-21).

Proactive Monitoring: Review Kibana access logs for anomalous requests directed at Fleet plugin debug endpoints and monitor for unauthorized attempts to query indices outside of standard user scopes.

Compensating Controls: Restrict access to the Fleet management features to only the most trusted administrative accounts until the patch is applied, and verify that existing RBAC policies are strictly enforced for all service accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires authenticated access, the ability to escalate data access beyond intended boundaries makes it a high-priority item for environments relying on granular RBAC.

Analyst Recommendation

Given the High severity of this privilege abuse vulnerability, administrators should prioritize the deployment of the vendor-provided patch. Organizations using Elastic Kibana versions 8.0.0 through 8.19.13 must verify their current version and upgrade to 8.19.14 immediately to ensure that RBAC enforcement is restored and sensitive data remains protected from unauthorized access.

---METADATA---
VENDOR: hapijs
PRODUCT: content
AFFECTED_VERSIONS: < 6.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @hapi/content package is susceptible to interpretation conflicts when parsing HTTP Content headers, potentially allowing for unexpected application behavior.

Executive Summary:
An interpretation conflict in the @hapi/content library may lead to security bypasses or data processing errors in applications relying on this parser.

Vulnerability Details

CVE-ID: CVE-2026-44974

Affected Software: hapijs content

Affected Versions: < 6.0.2

Vulnerability: The library contains an interpretation conflict (CWE-436) when processing HTTP Content headers. An unauthenticated attacker can supply crafted headers that are interpreted differently by the library than by other system components.

Business Impact

With a CVSS score of 7.7, this vulnerability poses a high risk of integrity compromise. If the application logic relies on these headers for security decisions, the conflict could allow attackers to bypass filters or access features they are not authorized to use, potentially leading to unauthorized data modification.

Remediation Plan

Immediate Action: Update the @hapi/content package to version 6.0.2 or higher within the project dependency tree.

Proactive Monitoring: Watch for application errors or unexpected behaviors related to request processing and header validation.

Compensating Controls: Ensure that downstream applications do not trust header information implicitly and perform secondary validation of all incoming content metadata.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation typically requires specific application implementation patterns that rely on the affected library's output.

Analyst Recommendation

Development teams should audit their package manifests and update @hapi/content to version 6.0.2 immediately. Securing the dependency chain is critical to preventing exploitation of this interpretation flaw.

---METADATA---
VENDOR: DataDog
PRODUCT: guarddog
AFFECTED_VERSIONS: >= 1.0.0, <= 2.9.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DataDog GuardDog is susceptible to Server-Side Request Forgery (SSRF) due to improper handling of network requests during the analysis of PyPI packages.

Executive Summary:
DataDog GuardDog contains a Server-Side Request Forgery (SSRF) vulnerability that could allow unauthenticated attackers to probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-44971

Affected Software: DataDog guarddog

Affected Versions: >= 1.0.0, <= 2.9.0

Vulnerability: The software is vulnerable to CWE-918 (SSRF), allowing an unauthenticated attacker to induce the application to make unauthorized requests to internal network segments or unauthorized services.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to internal infrastructure. Attackers may use this flaw to bypass firewalls, access internal metadata services, or perform reconnaissance on private network assets, potentially leading to deeper compromise of the environment.

Remediation Plan

Immediate Action: There is currently no fixed version available; users should monitor the official DataDog/guarddog GitHub repository for security updates and consider restricting the tool's network access.

Proactive Monitoring: Monitor egress traffic from the environment where GuardDog is running to identify attempts to reach internal endpoints that should not be accessible.

Compensating Controls: Implement strict egress filtering (e.g., via network security groups or firewall rules) to ensure the application cannot communicate with internal IP ranges or sensitive internal services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. SSRF vulnerabilities in network security tools are particularly dangerous as they can be used to pivot deeper into the network.

Analyst Recommendation

Until a patch is released, users must implement network-level egress controls to mitigate the SSRF risk. Organizations should treat this vulnerability as urgent due to the potential for internal network exposure and the existence of a proof-of-concept.

---METADATA---
VENDOR: Totolink
PRODUCT: WA300
AFFECTED_VERSIONS: 5.2cu.7112_B20190227
CONFIDENCE: high
MISSING: patch
CREDITS: junqi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352046","name":"VDB-352046 | Totolink WA300 cstecgi.cgi recvUpgradeNewFw os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352046","name":"VDB-352046 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773875","name":"Submit #773875 | Totolink WA300 V5.2cu.7112_B20190227 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/hellonestor/killallbug/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/user-attachments/files/25790616/Unauthenticated.Remote.Code.Execution.in.TOTOLINK.WA300.via.Command.Injection.in.recvUpgradeNewFw.zip","name":null,"tags":["exploit","patch"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
Totolink WA300 firmware version 5.2cu.7112_B20190227 contains an OS command injection vulnerability in the recvUpgradeNewFw function, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in Totolink WA300 allows attackers to inject and execute arbitrary OS commands via the device firmware upgrade process.

Vulnerability Details

CVE-ID: CVE-2026-4497

Affected Software: Totolink WA300

Affected Versions: 5.2cu.7112_B20190227

Vulnerability: The flaw resides in the recvUpgradeNewFw function within the /cgi-bin/cstecgi.cgi file, which fails to properly sanitize input before passing it to a system shell. This vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of sensitive data, and the ability to pivot into the local network, creating significant security and operational risks. Given the CVSS score of 7.3, this represents a high-severity risk that demands immediate attention.

Remediation Plan

Immediate Action: Since no official patch is currently available, immediately isolate affected devices from the public internet and restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the management interface or unexpected spikes in CPU usage related to CGI processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized or malformed requests targeting the /cgi-bin/cstecgi.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research materials linked to the CVE record.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of opportunistic attacks against exposed Totolink WA300 devices. Organizations should prioritize the isolation of these devices from external networks until a vendor-supplied firmware update is verified and applied. Continuous monitoring of device logs for signs of unauthorized command execution is essential until permanent remediation is achieved.

---METADATA---
VENDOR: Shepherdwind
PRODUCT: Velocity.js
AFFECTED_VERSIONS: Velocity.js versions 2.1.5 and earlier
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in Velocity.js allows attackers to modify Object.prototype, potentially leading to Denial of Service or Remote Code Execution.

Executive Summary:
A critical prototype pollution vulnerability in Velocity.js versions 2.1.5 and earlier exposes applications to potential Remote Code Execution and Denial of Service attacks.

Vulnerability Details

CVE-ID: CVE-2026-44966

Affected Software: Shepherdwind Velocity.js

Affected Versions: Velocity.js versions 2.1.5 and earlier

Vulnerability: This vulnerability occurs during the processing of #set directives in Velocity templates. It allows an unauthenticated remote attacker to inject malicious payloads into templates, potentially compromising the underlying server environment.

Business Impact

With a CVSS score of 8.3, this high-severity vulnerability poses a significant risk to organizational infrastructure. Successful exploitation could result in full system compromise, unauthorized data access, or persistent service disruption, severely impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest version of Velocity.js as specified by the vendor advisory to resolve the underlying prototype pollution flaw.

Proactive Monitoring: Audit application logs for suspicious #set directive patterns or unexpected Object.prototype modifications that may indicate exploit attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) and input validation routines to sanitize template-bound data before rendering.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, there is public information confirming the availability of exploit code for this vulnerability. Given the ease of exploitation, immediate patching is mandatory.

Analyst Recommendation

The presence of a public exploit combined with the potential for Remote Code Execution makes this a high-priority remediation task. Security teams should prioritize patching affected applications immediately to prevent unauthorized access and potential system-wide compromise.

---METADATA---
VENDOR: WebPros
PRODUCT: Plesk
AFFECTED_VERSIONS: 18.0.75.1, 18.0.76.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Plesk contains an XPath injection vulnerability in the APS Application Catalog, allowing authenticated users to execute arbitrary OS commands as a low-privileged user.

Executive Summary:
An authenticated XPath injection vulnerability in the Plesk APS Application Catalog enables command execution and local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-44962

Affected Software: WebPros Plesk

Affected Versions: 18.0.75.1, 18.0.76.2

Vulnerability: The application fails to properly sanitize user-supplied input before passing it into XPath queries (CWE-643). An authenticated, low-privileged user can exploit this to perform XPath injection, leading to arbitrary command execution on the underlying server.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a critical risk to hosting environments. Successful exploitation allows an authenticated attacker to escalate privileges, potentially leading to a full server compromise, unauthorized access to hosted data, and disruption of all services managed by the Plesk instance.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Plesk as specified in the vendor security advisory.

Proactive Monitoring: Audit server logs for suspicious command execution patterns or abnormal XPath query strings originating from the APS Application Catalog search functionality.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious XPath injection payloads directed at the catalog search.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve command execution makes this a high-priority update. Organizations should apply the vendor-provided patches immediately to prevent privilege escalation and maintain the integrity of the hosting server.

---METADATA---
VENDOR: Revive
PRODUCT: Adserver
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Revive Adserver 6 is susceptible to a vulnerability involving improper validation of user input when saving delivery limitations, potentially allowing for unauthorized system modifications.

Executive Summary:
A high-severity input validation flaw in Revive Adserver 6 could allow authenticated users to compromise the integrity of ad delivery configurations.

Vulnerability Details

CVE-ID: CVE-2026-44959

Affected Software: Revive Adserver

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs due to a failure to properly sanitize input when managing delivery limitations within the application. An authenticated user may exploit this failure to inject malicious data, potentially affecting the logic of the ad server.

Business Impact

The impact of this vulnerability includes the potential for unauthorized data modification and the disruption of legitimate advertising services. With a CVSS score of 8.8, this flaw represents a high risk to business continuity and data integrity, as it allows for the manipulation of critical ad-serving parameters.

Remediation Plan

Immediate Action: Apply the latest security patches released by the vendor to remediate the input validation vulnerability.

Proactive Monitoring: Continuously monitor the application for suspicious administrative activity and audit configuration changes made to delivery limitations for anomalies.

Compensating Controls: Utilize WAF rules to sanitize or block potentially malicious input payloads directed at the application's configuration endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploitation reports, the high severity of the flaw warrants immediate attention and patching.

Analyst Recommendation

Security teams should ensure that all Revive Adserver instances are updated to the current secure version immediately. Restrict administrative privileges to the minimum required level to mitigate the risk of an authenticated user leveraging this vulnerability to compromise the system.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: 2.14.0 before 2.14.3
---END_METADATA---

Description Summary:
Rancher's SAML Assertion Consumer Service handler is vulnerable to authentication replay attacks due to a failure to enforce one-time use of SAML assertions.

Executive Summary:
A critical authentication replay vulnerability in SUSE Rancher allows attackers to perform man-in-the-middle attacks, potentially leading to unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-44946

Affected Software: SUSE Rancher

Affected Versions: 2.14.0 before 2.14.3

Vulnerability: The vulnerability stems from a flaw in the SAML Assertion Consumer Service (ACS) handler, which fails to validate the single-use nature of SAML assertions. This allows an attacker to intercept and replay a valid assertion to gain unauthorized access to the Rancher management interface.

Business Impact

With a CVSS score of 9.5, this flaw poses a critical threat to the security of the container management infrastructure. Successful exploitation allows an attacker to impersonate legitimate users and gain administrative control over the Rancher environment, leading to potential data compromise and full system takeover.

Remediation Plan

Immediate Action: Upgrade all instances of Rancher to version 2.14.3 or later to ensure SAML assertion replay protection is correctly enforced.

Proactive Monitoring: Review authentication logs for suspicious or duplicate SAML login attempts that may indicate replay activity.

Compensating Controls: Ensure that SAML configurations enforce strict transport security (TLS) and session duration limits to minimize the window of opportunity for intercepted assertions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk associated with this SAML replay vulnerability is extreme for organizations relying on centralized authentication. Security teams must prioritize patching Rancher to the recommended version to maintain the integrity of their authentication and authorization processes.

---METADATA---
VENDOR: open-iscsi
PRODUCT: open-iscsi
AFFECTED_VERSIONS: open-iscsi open-iscsi: ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in open-iscsi allows unprivileged local users to interact with the iscsiuio control socket, potentially leading to unauthorized operations.

Executive Summary:
A high-severity authorization flaw in open-iscsi allows unprivileged local users to gain unauthorized access to the iscsiuio control socket, risking system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44944

Affected Software: open-iscsi open-iscsi

Affected Versions: open-iscsi open-iscsi: ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) that occurs because the iscsiuio control socket does not properly validate the permissions of the calling user. The vulnerability allows an unprivileged local user to perform actions that should be restricted.

Business Impact

The CVSS score of 8.5 emphasizes the risk to local system security. By interacting with the control socket, a malicious local user could potentially disrupt storage connectivity or perform unauthorized configuration changes, which could lead to system instability or data unavailability.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates or pull the fix from the official repository commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Proactive Monitoring: Monitor system authorization and audit logs for unauthorized attempts to access or manipulate the iscsiuio daemon or its associated control sockets.

Compensating Controls: Implement strict file system permissions on the control socket and limit the set of users who have shell access to the host system.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which significantly limits the attack surface to malicious insiders or compromised user accounts.

Analyst Recommendation

System administrators should prioritize patching open-iscsi on all Linux hosts. Ensuring that users have the principle of least privilege applied to their accounts will serve as a strong defense against this local authorization flaw.

---METADATA---
VENDOR: SUSE
PRODUCT: libzypp
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A relative path traversal vulnerability exists within the "keyhint" option of the repomd functionality in the SUSE libzypp library.

Executive Summary:
A relative path traversal vulnerability in the SUSE libzypp library could potentially allow for unauthorized file access or manipulation during repository metadata processing.

Vulnerability Details

CVE-ID: CVE-2026-44941

Affected Software: SUSE libzypp

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw occurs in the keyhint option handling within repomd processing. It allows for relative path traversal, which may permit an attacker to influence file operations performed by the library.

Business Impact

With a CVSS score of 8.4, this vulnerability is significant, as libzypp is a core component for package management in SUSE-based systems. Successful exploitation could lead to arbitrary file access or potentially malicious code execution during system updates, undermining the integrity of the entire software distribution and management process.

Remediation Plan

Immediate Action: Apply security updates for the libzypp package as released by the SUSE distribution maintainers.

Proactive Monitoring: Monitor package management logs for unusual repository synchronization errors or unexpected file access patterns during update cycles.

Compensating Controls: Ensure that package repositories are accessed via trusted, secure, and authenticated channels to minimize the risk of interacting with malicious metadata.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The integrity of package management is critical for system security. Administrators of SUSE-based environments must ensure that the libzypp library is updated as soon as the patch is available to protect the system against malicious repository metadata manipulation.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: SUSE Rancher: 0.15.0 up to (excluding) 0.15.2, 0.14.0 up to (excluding) 0.14.6, 0.13.0 up to (excluding) 0.13.11, 0.12.0 up to (excluding) 0.12.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the SUSE Rancher Fleet agent-side deployer fails to filter sensitive security keys from namespaceLabels, potentially leading to unauthorized information disclosure.

Executive Summary:
A high-severity vulnerability in the SUSE Rancher Fleet agent-side deployer allows authenticated users to access sensitive security keys, posing a significant risk to cluster integrity.

Vulnerability Details

CVE-ID: CVE-2026-44938

Affected Software: SUSE Rancher

Affected Versions: SUSE Rancher: 0.15.0 up to (excluding) 0.15.2, 0.14.0 up to (excluding) 0.14.6, 0.13.0 up to (excluding) 0.13.11, 0.12.0 up to (excluding) 0.12.15

Vulnerability: This is an improper protection of credentials (CWE-522) flaw where the agent-side deployer fails to sanitize namespaceLabels. An authenticated attacker with low-level access can potentially intercept or view sensitive keys used within the Fleet deployment process.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized exposure of sensitive credentials, potentially allowing an attacker to escalate privileges or gain full control over the affected Kubernetes clusters. With a CVSS score of 8.8, this represents a high risk to organizational data confidentiality and system availability. Successful exploitation may result in significant operational disruption and compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of the Fleet agent as specified in the official SUSE vendor advisory to ensure security-sensitive keys are properly filtered.

Proactive Monitoring: Review Kubernetes audit logs for suspicious activity involving namespace label modifications or unauthorized attempts to access secret resources.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the number of users who can modify namespace labels or deployment configurations within the cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this vulnerability, administrators should prioritize updating the Fleet agent across all affected Rancher environments. Failure to address this flaw could allow attackers to harvest critical credentials, leading to total compromise of the management plane.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher Fleet
AFFECTED_VERSIONS: 0.15.0 up to 0.15.2, 0.14.0 up to 0.14.6, 0.13.0 up to 0.13.11, 0.12.0 up to 0.12.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in SUSE Rancher Fleet allows for the forgery of unauthenticated webhook requests.

Executive Summary:
A high-severity SSRF vulnerability in SUSE Rancher Fleet enables unauthenticated attackers to forge webhook requests, potentially leading to unauthorized internal actions.

Vulnerability Details

CVE-ID: CVE-2026-44937

Affected Software: SUSE Rancher Fleet

Affected Versions: 0.15.0 up to 0.15.2, 0.14.0 up to 0.14.6, 0.13.0 up to 0.13.11, 0.12.0 up to 0.12.15

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the webhook handling component. The flaw allows unauthenticated remote actors to trigger forged requests, which may result in unauthorized resource interaction within the internal network.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk to organizational infrastructure. Successful exploitation could allow attackers to bypass network perimeters, interact with internal services that are not exposed to the public internet, or perform unauthorized operations within the Rancher environment, leading to significant system compromise.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of the Rancher Fleet component as specified in the vendor security advisory.

Proactive Monitoring: Monitor incoming webhook traffic and server access logs for anomalous request patterns or unexpected destination endpoints originating from the Rancher Fleet service.

Compensating Controls: Implement strict network egress filtering on the Rancher Fleet host to prevent unauthorized outbound requests to sensitive internal or external resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized internal network access, this vulnerability should be prioritized for remediation. Administrators must verify their current version against the affected releases and apply the provided security updates immediately to mitigate the risk of SSRF-based attacks.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher
AFFECTED_VERSIONS: Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, 0.12 before 0.12.15
---END_METADATA---

Description Summary:
A missing validation vulnerability in the SUSE Rancher Fleet Helm Deployer allows authenticated tenants to access the fleet credentials of other tenants.

Executive Summary:
A critical vulnerability in the SUSE Rancher Fleet component allows authenticated tenant users to perform cross-tenant credential theft, jeopardizing the security of managed Kubernetes clusters.

Vulnerability Details

CVE-ID: CVE-2026-44935

Affected Software: SUSE Rancher

Affected Versions: Fleet 0.15 < 0.15.2, 0.14 < 0.14.6, 0.13 < 0.13.11, 0.12 < 0.12.15

Vulnerability: The vulnerability exists due to missing validation of "valuesFrom" references in the Helm Deployer. This allows a malicious tenant to reference and access sensitive fleet credentials belonging to other tenants within the same Rancher environment.

Business Impact

The CVSS score of 9.9 underscores the catastrophic risk to multi-tenant container environments. Unauthorized access to fleet credentials can lead to a total compromise of managed downstream Kubernetes clusters, data leakage, and the potential for an attacker to execute arbitrary code across the entire infrastructure managed by the affected Rancher installation.

Remediation Plan

Immediate Action: Upgrade the SUSE Rancher Fleet component to the patched versions (0.15.2, 0.14.6, 0.13.11, or 0.12.15) as specified in the vendor security advisory.

Proactive Monitoring: Audit existing Helm deployments and review access logs for any unauthorized "valuesFrom" reference attempts or unexpected credential access requests.

Compensating Controls: Temporarily restrict the ability of untrusted users to deploy Helm charts until the patching process is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical for organizations utilizing SUSE Rancher in multi-tenant configurations. It is imperative that administrators verify their current Fleet version and apply the recommended updates immediately to prevent cross-tenant credential exposure and cluster-wide compromise.

---METADATA---
VENDOR: SUSE
PRODUCT: Rancher AI Agent
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
SUSE Rancher AI Agent inadvertently exposes sensitive information in logs when the debug log level is enabled.

Executive Summary:
A high-severity information disclosure vulnerability in SUSE Rancher AI Agent allows privileged users to access sensitive data when debug logging is active.

Vulnerability Details

CVE-ID: CVE-2026-44934

Affected Software: SUSE Rancher AI Agent

Affected Versions: 1.0.0 up to (excluding) 1.0.2

Vulnerability: This issue stems from the insertion of sensitive information into debugging code (CWE-215). It requires a privileged user (High level) to have already configured the system to a DEBUG log level, at which point sensitive data is logged in plain text.

Business Impact

With a CVSS score of 7.0, this vulnerability presents a risk of unauthorized data exposure. If logs are stored in insecure locations or accessible to unauthorized personnel, sensitive information could be compromised, potentially leading to further system exploitation or identity theft.

Remediation Plan

Immediate Action: Upgrade to version 1.0.2 or later, or disable DEBUG log levels immediately if an upgrade is not immediately feasible.

Proactive Monitoring: Audit existing log files for exposed sensitive data and restrict access to log storage locations to authorized personnel only.

Compensating Controls: Ensure that log management systems are encrypted at rest and that log access is strictly controlled via Role-Based Access Control (RBAC).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the SUSE Rancher AI Agent must treat this as a priority update. Immediate transition to the patched version is required to prevent inadvertent exposure of sensitive data through system logs.

---METADATA---
VENDOR: SUSE
PRODUCT: SUSE Linux Enterprise / openSUSE
AFFECTED_VERSIONS: 17.38.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PluginScript fails to correctly restrict chroot operations, allowing for path traversal vulnerabilities when the repoManagerRoot is configured to the system root.

Executive Summary:
A path traversal vulnerability in SUSE Linux PluginScript could allow an attacker with local access to escape intended directory restrictions and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44933

Affected Software: SUSE Linux Enterprise and openSUSE

Affected Versions: 17.38.8 (fixed in 17.38.9)

Vulnerability: This is a CWE-35 path traversal vulnerability occurring within the PluginScript component. The flaw allows unauthorized file system access when the repository manager root is set to the system root, requiring local access and user interaction to trigger.

Business Impact

Successful exploitation of this path traversal flaw could lead to unauthorized access to sensitive system files, potentially resulting in full system compromise. With a CVSS score of 7.8, this represents a significant risk to the confidentiality and integrity of the host system, necessitating prompt attention despite the requirement for local access.

Remediation Plan

Immediate Action: Update SUSE Linux Enterprise and openSUSE installations to version 17.38.9 or later to resolve the directory restriction flaw.

Proactive Monitoring: Monitor system logs for unusual file access patterns or attempts to traverse directories outside of expected plugin execution paths.

Compensating Controls: Ensure that the repoManagerRoot is configured to a non-root, restricted directory path to limit the scope of potential traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is high, but it is constrained by the requirement for local access and specific configuration parameters.

Analyst Recommendation

Given the potential for total technical impact, administrators should prioritize updating the PluginScript component on all affected SUSE systems. Applying the vendor-provided patch is the only definitive way to remediate the underlying path traversal mechanism.

---METADATA---
VENDOR: SUSE
PRODUCT: wicked dhcp client
AFFECTED_VERSIONS: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1
---END_METADATA---

Description Summary:
The wicked DHCP client is vulnerable to the processing of unsanitized strings from DHCP replies, potentially leading to system compromise.

Executive Summary:
The wicked DHCP client is susceptible to an easily exploitable vulnerability involving the processing of unsanitized strings from network replies.

Vulnerability Details

CVE-ID: CVE-2026-44932

Affected Software: wicked dhcp client

Affected Versions: wicked dhcp client before wicked 0.6.79-1.1 and wicked before 0.6.79-150700.3.3.1

Vulnerability: This vulnerability involves the passing of unsanitized strings from DHCP replies into the wicked dhcp client. Exploitation is considered easy and requires local network access to inject malicious DHCP responses.

Business Impact

With a CVSS score of 8.8, this flaw represents a major security risk for any system utilizing the wicked DHCP client. An attacker on the local network can exploit this to perform actions with the privileges of the DHCP client process. This could lead to full system compromise, particularly if the client runs with elevated permissions during network configuration.

Remediation Plan

Immediate Action: Apply vendor security updates to wicked version 0.6.79-1.1 or higher (or 0.6.79-150700.3.3.1 for specific distributions) immediately.

Proactive Monitoring: Monitor network traffic for anomalous DHCP traffic or unexpected network configuration changes on critical systems.

Compensating Controls: Use network segmentation to limit the exposure of sensitive systems to potentially untrusted DHCP servers and verify the integrity of DHCP responses where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it targets fundamental network configuration processes. Given the ease of exploitation, system administrators should prioritize patching all affected Linux systems to prevent potential network-based attacks and subsequent system compromise.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: patch
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352019","name":"VDB-352019 | Tenda A18 Pro MAC Filtering Configuration Endpoint setMacFilterCfg sub_423B50 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352019","name":"VDB-352019 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773727","name":"Submit #773727 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/5","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.123Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router firmware, allowing remote attackers to potentially achieve arbitrary code execution or cause a denial of service via the deviceList parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda A18 Pro firmware version V02.03.02.28 poses a significant risk of remote code execution or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4493

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the sub_423B50 function within the /goform/setMacFilterCfg endpoint, where insufficient bounds checking on the deviceList parameter leads to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements, the flaw allows remote manipulation of memory, which can be leveraged to overwrite the return address.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the web server or cause a complete denial of service of the networking device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized network access, interception of traffic, or complete takeover of the affected router, resulting in significant operational downtime or data breach.

Remediation Plan

Immediate Action: As no official patch is currently available, immediately restrict access to the web management interface of the Tenda A18 Pro to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repetitive or malformed POST requests to the /goform/setMacFilterCfg endpoint, which may indicate attempts to trigger the buffer overflow.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) rule to block or sanitize input to the /goform/setMacFilterCfg endpoint, specifically filtering for excessively long strings in the deviceList parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept Python script is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation in the processing of MAC filtering rules.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing Tenda A18 Pro routers should isolate these devices from the public internet immediately and monitor for anomalous traffic patterns until the vendor provides a firmware update. Failure to mitigate this risk leaves the infrastructure vulnerable to remote exploitation.

---METADATA---
VENDOR: Veritas
PRODUCT: InfoScale CmdServer
AFFECTED_VERSIONS: Before 7
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A security vulnerability exists in Veritas InfoScale CmdServer versions prior to 7, which may lead to unauthorized system access.

Executive Summary:
A critical security vulnerability in Veritas InfoScale CmdServer versions prior to 7 poses a high risk of unauthorized access and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44926

Affected Software: Veritas InfoScale CmdServer

Affected Versions: All versions prior to 7

Vulnerability: This vulnerability affects the CmdServer component of InfoScale. The CVSS vector (PR:L) indicates that an authenticated user with low privileges can achieve high levels of impact across confidentiality, integrity, and availability.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, which allows for the compromise of critical enterprise data and system services. Unauthorized access at this level could lead to a complete takeover of the InfoScale management layer, causing significant operational downtime and potential data loss.

Remediation Plan

Immediate Action: Upgrade Veritas InfoScale CmdServer to version 7 or higher as specified in the official vendor security bulletin.

Proactive Monitoring: Review InfoScale CmdServer access and audit logs for suspicious activity or unauthorized commands executed by low-privileged user accounts.

Compensating Controls: Restrict network access to the CmdServer management interface to known, trusted management workstations via firewall rules or VPNs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the potential for total technical impact, even if exploitation requires prior authentication.

Analyst Recommendation

Veritas InfoScale is a core infrastructure component; therefore, patching this vulnerability is critical to maintaining organizational security. Organizations should verify their current version and schedule an upgrade to version 7 immediately to eliminate the exposure.

---METADATA---
VENDOR: Veritas
PRODUCT: InfoScale
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability exists in Veritas InfoScale, which could allow an attacker to perform unauthorized actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Veritas InfoScale could allow attackers to execute unauthorized commands, potentially leading to a total compromise of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-44925

Affected Software: Veritas InfoScale

Affected Versions: See vendor advisory

Vulnerability: This is a CSRF vulnerability. The CVSS vector indicates the attack is possible from an adjacent network (AV:A) and does not require user interaction (UI:N), which is atypical for standard CSRF and suggests a highly accessible attack surface.

Business Impact

With a CVSS score of 8.8, this CSRF flaw poses a severe threat, allowing for unauthorized state-changing operations within the InfoScale management environment. This could result in unauthorized configuration changes or data manipulation, severely impacting the security posture and operational stability of the enterprise storage environment.

Remediation Plan

Immediate Action: Consult the official Veritas support portal to identify the specific patched version for your deployment of InfoScale and apply the update immediately.

Proactive Monitoring: Implement strict session management and ensure that all administrative interfaces are protected by strong authentication and anti-CSRF tokens.

Compensating Controls: Use a Web Application Firewall (WAF) or network access controls to restrict access to the InfoScale management interface to trusted, internal network segments only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score suggests that the vulnerability should be treated as a priority, despite the lack of specific versioning details provided in the current data.

Analyst Recommendation

Due to the high severity and the nature of CSRF attacks against administrative interfaces, organizations must treat this as a priority update. Administrators should verify their InfoScale version against the latest vendor security guidance and apply all recommended patches to prevent unauthorized system manipulation.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352018","name":"VDB-352018 | Tenda A18 Pro formSetQosBand set_qosMib_list stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352018","name":"VDB-352018 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773682","name":"Submit #773682 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda A18 Pro router allows authenticated attackers to achieve remote code execution or a denial of service via the /goform/formSetQosBand endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda A18 Pro router could allow a remote authenticated attacker to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-4492

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the set_qosMib_list function within the /goform/formSetQosBand endpoint, where unsanitized user input is copied into a fixed-size stack buffer using the unsafe strcpy function. Exploitation requires the attacker to have low-level authenticated access to the management interface.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected router, facilitating unauthorized access to internal network traffic or the ability to pivot into the local network. Given the CVSS score of 8.8, this poses a significant risk to data confidentiality and network integrity, potentially leading to total system compromise and operational downtime.

Remediation Plan

Immediate Action: Update the Tenda A18 Pro firmware to the latest available version provided by the manufacturer that addresses this buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formSetQosBand endpoint and audit router access logs for suspicious administrative activity.

Compensating Controls: Restrict access to the router management interface to trusted IP addresses only and disable remote management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept exists, which significantly lowers the barrier for potential attackers. The vulnerability is inherently dangerous due to the lack of bounds checking on user-supplied parameters, allowing for memory corruption.

Analyst Recommendation

This vulnerability represents a high-severity risk to network infrastructure. Administrators must prioritize updating the firmware on all affected Tenda A18 Pro devices immediately. If an update is not currently feasible, isolate the management interface from untrusted networks to prevent exploitation by unauthorized actors.

---METADATA---
VENDOR: Apache
PRODUCT: NiFi
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Apache NiFi 1 contains an unspecified vulnerability requiring immediate vendor-provided security updates for mitigation.

Executive Summary:
A high-severity vulnerability in Apache NiFi 1 requires immediate attention to prevent potential exploitation of the platform's data processing pipelines.

Vulnerability Details

CVE-ID: CVE-2026-44914

Affected Software: Apache NiFi

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability pertains to the Apache NiFi 1 series. Due to limited technical disclosure, the specific attack vector is currently categorized as requiring investigation via official vendor security advisories.

Business Impact

With a CVSS score of 7.5, this vulnerability is considered high risk, potentially enabling unauthorized access or disruption to data flows managed by NiFi. Successful exploitation could lead to significant data exposure or service outages within critical data ingestion pipelines, impacting overall business operations.

Remediation Plan

Immediate Action: Consult the official Apache NiFi security advisory page to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Review system access logs for anomalous behavior or unauthorized access patterns specifically targeting the NiFi management interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated signatures to filter potentially malicious requests aimed at the NiFi application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Apache NiFi 1 must treat this advisory with high urgency. Monitor the Apache security mailing lists and vendor documentation for the release of specific patches and apply them to all production environments upon verification.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352017","name":"VDB-352017 | Tenda A18 Pro SetIpMacBind fromSetIpMacBind stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352017","name":"VDB-352017 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773671","name":"Submit #773671 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router firmware, allowing remote attackers to execute arbitrary code via the /goform/SetIpMacBind endpoint.

Executive Summary:
A critical stack-based buffer overflow in Tenda A18 Pro firmware enables remote code execution, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-4491

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability is a stack-based buffer overflow located in the fromSetIpMacBind function within the /goform/SetIpMacBind endpoint. By sending a maliciously crafted list parameter, an authenticated attacker can trigger an unsafe strcpy operation that overwrites the stack frame and allows for arbitrary code execution or a denial of service.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected router with root privileges. This grants the attacker full control over the network gateway, potentially leading to unauthorized data interception, internal network pivoting, or complete loss of service. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security.

Remediation Plan

Immediate Action: Users should immediately update the Tenda A18 Pro firmware to a version beyond V02.03.02.28 that addresses this buffer overflow. If no patch is available, restrict access to the web management interface to trusted administrative networks only.

Proactive Monitoring: Monitor device logs for unexpected crashes of the httpd process or recurrent timeouts when accessing the IP-MAC binding configuration page.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /goform/SetIpMacBind endpoint that contain excessively long strings in the list parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue linked by the researcher.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input.

Analyst Recommendation

This vulnerability presents a significant risk to the security of the Tenda A18 Pro router. Administrators must prioritize updating the firmware to the latest available version to remediate the buffer overflow. Given the availability of a public proof-of-concept, the likelihood of exploitation by threat actors is elevated, making timely patching or network-level isolation mandatory.

---METADATA---
VENDOR: Tenda
PRODUCT: A18 Pro
AFFECTED_VERSIONS: V02.03.02.28
CONFIDENCE: high
MISSING: none
CREDITS: lilukun (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.352016","name":"VDB-352016 | Tenda A18 Pro openSchedWifi setSchedWifi stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352016","name":"VDB-352016 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773670","name":"Submit #773670 | Tenda A18pro V02.03.02.28 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lilukun337/cve/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.127Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda A18 Pro router within the setSchedWifi function, allowing authenticated attackers to cause a denial of service or execute arbitrary code.

Executive Summary:
A heap-based buffer overflow vulnerability in the Tenda A18 Pro router, specifically within the Wi-Fi scheduling configuration, poses a significant risk of remote code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-4490

Affected Software: Tenda A18 Pro

Affected Versions: V02.03.02.28

Vulnerability: The vulnerability exists in the /goform/openSchedWifi endpoint due to the use of the unsafe strcpy function. An authenticated attacker can supply oversized parameters to the schedStartTime or schedEndTime fields, causing memory corruption that may lead to service crashes or arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability could result in a complete loss of availability for the affected Tenda networking device, disrupting network connectivity for all dependent users and systems. Given the CVSS score of 8.8, the potential for arbitrary code execution creates a critical risk, as an attacker could gain persistent control over the networking infrastructure to facilitate further lateral movement or data interception within the internal network.

Remediation Plan

Immediate Action: Administrators should immediately restrict access to the web management interface and check the Tenda support portal for firmware updates that address this buffer overflow.

Proactive Monitoring: Monitor system logs for repeated crashes of the httpd service or unusual request patterns targeting the /goform/openSchedWifi endpoint.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure the management interface is only accessible from trusted administrative IP addresses, effectively mitigating the risk from unauthorized users.

Exploitation Status

Public Exploit Available: Yes — a functional proof-of-concept exploit is available via the researcher's GitHub repository.

Analyst Notes: As of March 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on common configuration parameters.

Analyst Recommendation

The severity of this flaw, combined with the availability of a public proof-of-concept, necessitates immediate attention. Administrators must prioritize the application of vendor patches or, at a minimum, isolate the management interface from the network to prevent unauthorized access and potential code execution.

---METADATA---
VENDOR: Netty Project
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Netty network framework may allow for exploitation of protocol-based communication channels.

Executive Summary:
A critical high-severity vulnerability within the Netty framework exposes protocol servers and clients to potential security risks.

Vulnerability Details

CVE-ID: CVE-2026-44894

Affected Software: Netty Project Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Netty framework, impacting its ability to safely process network protocols. It is essential to ensure that applications using this framework are updated to maintain the integrity of communication sessions.

Business Impact

The CVSS 7.5 rating indicates a high level of risk, as exploitation could lead to data compromise or unauthorized service interruption. For organizations leveraging Netty for high-performance networking, this vulnerability could result in severe business impact, including loss of data integrity and system availability.

Remediation Plan

Immediate Action: Apply vendor-provided security patches immediately upon availability to mitigate potential risks to network infrastructure.

Proactive Monitoring: Review application logs for irregular traffic patterns or evidence of unauthorized access to protocol-based service endpoints.

Compensating Controls: Implement virtual patching via a WAF or restrict network access to affected ports to reduce the likelihood of remote exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must move quickly to assess their exposure to this vulnerability. Updating the Netty library is the only definitive way to remediate the underlying flaw and ensure the continued security of the network communication layer.

---METADATA---
VENDOR: Netty Project
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Netty framework, impacting the integrity of protocol-based network communications.

Executive Summary:
The Netty network application framework is susceptible to a high-severity vulnerability that threatens the security of protocol server and client implementations.

Vulnerability Details

CVE-ID: CVE-2026-44893

Affected Software: Netty Project Netty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Netty framework, potentially allowing for unauthorized manipulation or disruption of network traffic. Given the framework's architecture, this could impact various protocol implementations depending on how the library is integrated into the host application.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to enterprise infrastructure. Exploitation could result in unauthorized data access or service outages, severely impacting business continuity and the security posture of systems that rely on Netty for critical network communications.

Remediation Plan

Immediate Action: Audit all systems to locate dependencies on the Netty framework and prioritize the application of security updates once released by the vendor.

Proactive Monitoring: Increase surveillance of server logs to identify unusual traffic spikes or protocol-specific anomalies that may indicate an exploitation attempt.

Compensating Controls: Utilize network-level security controls and firewalls to restrict access to services using Netty, minimizing the attack surface until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize the identification of affected Netty components within their environment. The high severity of this flaw necessitates a rapid response; stakeholders should monitor the official Netty security advisories to ensure prompt deployment of necessary patches.