Description Summary:
Axios fails to properly validate IPv4-mapped IPv6 addresses in its proxy bypass function, leading to potential SSRF.

Executive Summary:
An SSRF vulnerability in Axios allows attackers to bypass proxy configurations by exploiting improper handling of IPv4-mapped IPv6 addresses.

Vulnerability Details

CVE-ID: CVE-2026-44492

Affected Software: Axios

Affected Versions: Prior to 0.32.0 and 1.16.0

Vulnerability: The shouldBypassProxy function in Axios does not correctly recognize IPv4-mapped IPv6 addresses. This allows an attacker to bypass NO_PROXY settings, potentially leading to Server-Side Request Forgery (SSRF) and allowing unauthorized access to internal network resources.

Business Impact

With a CVSS score of 8.6, this vulnerability facilitates SSRF, which can allow an attacker to interact with internal services that are not exposed to the public internet. This could result in the unauthorized retrieval of internal data, internal service discovery, or the exploitation of other internal-only vulnerabilities, creating a significant risk to internal network security.

Remediation Plan

Immediate Action: Update the Axios library to version 1.16.0 or 0.32.0 to resolve the proxy bypass logic error.

Proactive Monitoring: Monitor server-side network logs for requests directed at internal IP addresses or services that should be shielded by proxy bypass configurations.

Compensating Controls: Implement strict firewall rules to ensure that application servers cannot initiate unauthorized connections to sensitive internal segments, regardless of proxy configuration.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 12, 2026, a public exploit is available for this vulnerability. While there is no specific confirmation of active exploitation in the wild, the presence of a public exploit significantly increases the risk level.

Analyst Recommendation

The potential for SSRF makes this a critical security concern for any environment relying on internal service segmentation. Organizations should update Axios to the recommended versions immediately and review their network egress policies to ensure internal resources are properly protected.

Description Summary:
A use-after-free vulnerability in the Blink rendering engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A critical use-after-free vulnerability in the Google Chrome Blink engine enables remote attackers to achieve heap corruption, potentially leading to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-4449

Affected Software: Google Chrome

Affected Versions: Google Chrome: 146.0.7680.153

Vulnerability: This flaw is a use-after-free vulnerability (CWE-416) within the Blink rendering engine. It can be triggered by an unauthenticated remote attacker who lures a user into visiting a malicious HTML page.

Business Impact

The exploitation of this vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code within the context of the browser. Given the CVSS score of 8.8, this poses a significant risk to organizational data confidentiality, integrity, and availability. Successful exploitation could result in full system compromise or the theft of sensitive session credentials and user information.

Remediation Plan

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later immediately to resolve the memory management flaw.

Proactive Monitoring: Review browser security logs and endpoint detection systems for unusual process behavior or crashes associated with the Chrome rendering engine.

Compensating Controls: Deploy endpoint protection platforms that can detect and block malicious web content or known exploit patterns targeting browser memory corruption.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free vulnerabilities in browser engines are highly sought after by threat actors due to their reliability in bypassing modern exploit mitigations.

Analyst Recommendation

Organizations must prioritize the deployment of this update across all workstations and managed devices. Because browser-based vulnerabilities are frequently weaponized, applying the provided patch is the only effective way to neutralize the risk of remote code execution. Ensure that automatic update mechanisms are active and functioning correctly to maintain browser security.

Description Summary:
The RVF (Remix Validated Form) library is susceptible to prototype pollution, allowing unauthorized modification of object attributes.

Executive Summary:
A prototype pollution vulnerability in the RVF library for React can lead to application instability or potential unauthorized logic manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44483

Affected Software: airjp73 RVF (@rvf/set-get)

Affected Versions: >= 7.0.0, < 7.0.2; >= 6.0.0, < 6.0.4

Vulnerability: This is a Prototype Pollution (CWE-1321) vulnerability. By injecting malicious properties into the object prototype, an unauthenticated remote attacker can influence the behavior of the application by causing it to use unexpected values for object attributes.

Business Impact

Prototype pollution can be a severe vulnerability in JavaScript-based environments, as it may allow an attacker to bypass security checks, alter application logic, or cause denial-of-service conditions. With a CVSS score of 8.2, this vulnerability is considered high risk because it is easily exploitable over the network without authentication. The potential for impact ranges from minor logic errors to complete application takeover depending on how the application handles object properties.

Remediation Plan

Immediate Action: Update the @rvf/set-get package to versions 7.0.2 or 6.0.4 immediately.

Proactive Monitoring: Use automated dependency scanning tools (e.g., Snyk, npm audit) to identify and block vulnerable versions of the RVF library in the CI/CD pipeline.

Compensating Controls: Implement input validation to sanitize data before it is passed to libraries that might be susceptible to prototype pollution, and use Object.freeze() or Object.create(null) for sensitive objects.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Prototype pollution vulnerabilities are often difficult to detect in standard logs, making patching the primary line of defense.

Analyst Recommendation

The existence of a proof-of-concept elevates the risk of this vulnerability. Developers should immediately update their project dependencies to the patched versions to eliminate the possibility of object attribute manipulation.

Description Summary:
A vulnerability in the soundcloud-rpc Discord integration allows local command execution via malicious track metadata.

Executive Summary:
A critical vulnerability in the soundcloud-rpc integration for Discord allows remote attackers to achieve local command execution on the user's machine via manipulated track metadata.

Vulnerability Details

CVE-ID: CVE-2026-44482

Affected Software: Discord Rich Presence (soundcloud-rpc)

Affected Versions: Prior to 0.1.8

Vulnerability: The application incorrectly handles track metadata, rendering it as raw HTML within privileged Electron views. This allows an attacker to execute arbitrary code locally by crafting a track title with a malicious payload.

Business Impact

Successful exploitation results in full local command execution on the victim's machine, potentially compromising all data and credentials stored on the host. With a CVSS score of 9.6, this flaw poses a severe risk to endpoint security and user confidentiality.

Remediation Plan

Immediate Action: Update the soundcloud-rpc application to version 0.1.8 or later.

Proactive Monitoring: Monitor for unexpected child processes spawned by the Electron-based application.

Compensating Controls: Restrict application permissions where possible and ensure the endpoint is protected by robust EDR solutions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of the soundcloud-rpc integration should update immediately to mitigate the risk of remote code execution. Given the impact on the local operating system, this update should be treated with high urgency.

Description Summary:
A heap buffer overflow in the ANGLE graphics component of Google Chrome allows a remote attacker to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity heap buffer overflow in Google Chrome allows remote attackers to compromise browser integrity through malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-4448

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 146.0.7680.153

Vulnerability: This vulnerability is a heap buffer overflow (CWE-122) within the ANGLE graphics library component of the browser. It is remotely exploitable by an unauthenticated attacker who lures a user to visit a specifically crafted HTML page.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk to organizational security. Successful exploitation could lead to arbitrary code execution, complete system compromise, or unauthorized access to sensitive user data stored within the browser environment.

Remediation Plan

Immediate Action: Update all Google Chrome instances to version 146.0.7680.153 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for abnormal browser process behavior or unexpected crash reports associated with the ANGLE graphics engine.

Compensating Controls: Deploy browser-based security policies that restrict navigation to untrusted or newly registered domains and ensure that the browser is running with the latest security baseline configurations.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is considered highly exploitable due to the nature of heap buffer overflows, the requirement for user interaction (UI:R) serves as a partial mitigating factor.

Analyst Recommendation

Given the potential for remote code execution and the severity of the flaw, organizations should prioritize the deployment of the Chrome update across all endpoints. Security teams must ensure that automatic updates are enabled and verify that the target version is successfully applied to prevent exploitation of the heap corruption vector.

Description Summary:
Google Chrome contains an inappropriate implementation in the V8 JavaScript engine that allows remote code execution via a crafted HTML page.

Executive Summary:
A critical vulnerability in the V8 engine of Google Chrome allows remote attackers to execute arbitrary code within a sandboxed environment.

Vulnerability Details

CVE-ID: CVE-2026-4447

Affected Software: Google Chrome

Affected Versions: prior to 146.0.7680.153

Vulnerability: This is an inappropriate implementation vulnerability in the V8 JavaScript engine. A remote attacker can trigger this flaw by enticing a user to visit a specially crafted HTML page, leading to arbitrary code execution within the browser's sandbox.

Business Impact

With a CVSS score of 8.8, this is a high-severity risk. While the code execution is constrained within the sandbox, such vulnerabilities are frequently leveraged as part of larger attack chains to escape the sandbox, potentially leading to full system compromise or sensitive data theft from the user's local environment.

Remediation Plan

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later to ensure the V8 engine is patched against this implementation flaw.

Proactive Monitoring: Use endpoint security tools to monitor for suspicious browser process behavior or unexpected network connections originating from Chrome instances.

Compensating Controls: Enable browser-based security features such as site isolation and ensure that users are trained to avoid interacting with untrusted or suspicious web content.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, browser-based vulnerabilities are high-value targets for attackers.

Analyst Recommendation

Given the ubiquity of Google Chrome, this update should be deployed across all workstations immediately. Proactive patching is the most effective defense against the potential for remote code execution and subsequent sandbox escape attempts.

Description Summary:
Zed is vulnerable to OS Command Injection due to improper neutralization of special elements, potentially allowing arbitrary code execution.

Executive Summary:
An OS Command Injection vulnerability in the Zed code editor could allow an attacker to execute arbitrary commands, posing a significant risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44466

Affected Software: Zed Industries Zed

Affected Versions: < 0.229.0

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an attacker to inject and execute unauthorized commands. The attack requires user interaction (UI:R) and is performed locally (AV:L), though it may result in a complete compromise of the system.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized system access, data exfiltration, or the installation of malicious software. Given the CVSS score of 8.6, this is a High-severity issue that could result in significant operational disruption and compromise of sensitive development environments.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.229.0 or later to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for suspicious process execution, particularly those initiated by the Zed application.

Compensating Controls: Ensure the principle of least privilege is applied to the user account running the Zed editor to limit the potential impact of command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for arbitrary command execution.

Analyst Recommendation

Organizations using the Zed code editor should treat this vulnerability with high priority. We recommend an immediate upgrade to version 0.229.0 across all developer workstations to neutralize the risk of OS command injection.

Description Summary:
Zed is susceptible to OS Command Injection, which may allow an attacker to execute arbitrary system commands through specially crafted input.

Executive Summary:
A critical OS Command Injection vulnerability in the Zed code editor potentially enables attackers to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44465

Affected Software: Zed Industries Zed

Affected Versions: < 0.227.1

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) flaw triggered by the improper neutralization of special elements. It requires user interaction and local access, but the potential impact involves full system compromise.

Business Impact

The potential for arbitrary command execution represents a severe risk to the confidentiality, integrity, and availability of host systems. With a CVSS score of 8.6, this vulnerability requires prompt remediation to prevent unauthorized access or malicious activity within the development environment.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.227.1 or later to remediate the vulnerability.

Proactive Monitoring: Review security logs for anomalous command-line arguments or unexpected child processes spawned by the Zed application.

Compensating Controls: Implement endpoint security solutions that can detect and block unauthorized or suspicious OS command executions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this vulnerability makes it an attractive target for attackers aiming to gain local persistence.

Analyst Recommendation

Due to the severity of OS command injection flaws, security teams should expedite the deployment of version 0.227.1. Users should ensure their development environments are updated immediately to mitigate the risk of exploitation.

Description Summary:
Zed is vulnerable to OS Command Injection caused by an incomplete list of disallowed inputs, allowing for the potential execution of unauthorized commands.

Executive Summary:
An OS Command Injection flaw in the Zed code editor allows for unauthorized command execution, presenting a significant security risk to host systems.

Vulnerability Details

CVE-ID: CVE-2026-44463

Affected Software: Zed Industries Zed

Affected Versions: < 0.229.0

Vulnerability: This vulnerability involves both an Incomplete List of Disallowed Inputs (CWE-184) and OS Command Injection (CWE-78). By bypassing existing filters, an attacker can inject malicious commands that the application executes with the privileges of the user.

Business Impact

The ability to execute arbitrary commands on a user's machine creates a high risk of data theft and system compromise. A CVSS score of 8.6 underscores the urgency of patching this vulnerability, as it could lead to full system control if successfully exploited.

Remediation Plan

Immediate Action: Upgrade to Zed version 0.229.0 or later to address the underlying input validation flaws.

Proactive Monitoring: Monitor for unusual shell commands or unexpected network activity originating from the Zed application process.

Compensating Controls: Utilize host-based intrusion detection systems (HIDS) to monitor for suspicious command execution patterns on developer machines.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of input validation and command injection flaws makes this a high-priority risk.

Analyst Recommendation

Organizations should prioritize updating the Zed editor to version 0.229.0 immediately. This patch addresses the critical input validation failures that facilitate command injection, effectively closing the primary attack vector.

Description Summary:
Zed is vulnerable to OS Command Injection, allowing an attacker to execute arbitrary commands on the host system.

Executive Summary:
The Zed code editor is affected by a critical OS Command Injection vulnerability that could allow for full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44461

Affected Software: Zed Industries Zed

Affected Versions: < 0.227.1

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an attacker to execute arbitrary operating system commands. The attack vector is local (AV:L), implying an attacker must have some level of local access or user interaction to trigger the injection.

Business Impact

Successful exploitation of this vulnerability can lead to complete system compromise, including unauthorized access to sensitive source code, environment variables, and local data. Given the CVSS score of 8.6, this represents a high-severity risk to the integrity and confidentiality of developer workstations.

Remediation Plan

Immediate Action: Update the Zed code editor to version 0.227.1 or later immediately.

Proactive Monitoring: Review system logs for unauthorized process execution or suspicious shell activity originating from the Zed editor process.

Compensating Controls: Ensure that the editor is run with the least privilege necessary, avoiding administrative or root execution contexts to limit the impact of a potential injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the potential for arbitrary code execution.

Analyst Recommendation

The severity of this command injection flaw necessitates an immediate upgrade to version 0.227.1. Organizations should prioritize patching developer environments to prevent potential lateral movement or data theft.

Description Summary:
A use after free vulnerability in the WebRTC component of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A critical use after free vulnerability in Google Chrome WebRTC enables remote attackers to achieve heap corruption, posing a significant risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-4446

Affected Software: Google Chrome

Affected Versions: Google Chrome versions prior to 146.0.7680.153

Vulnerability: This is a use after free vulnerability (CWE-416) within the WebRTC component. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a specially crafted HTML page, leading to potential heap corruption.

Business Impact

Successful exploitation of this memory corruption vulnerability can lead to arbitrary code execution, which grants an attacker the ability to compromise user data, install malicious software, or pivot within the local network. With a CVSS score of 8.8, this flaw represents a high risk to organizational security, particularly for environments where browser-based workflows are central to business operations.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 146.0.7680.153 or later immediately to incorporate the provided security patches.

Proactive Monitoring: Monitor endpoint security logs for unusual browser process crashes or unexpected network traffic patterns originating from the browser, which may indicate exploitation attempts.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to identify and block suspicious browser-based execution chains, and ensure browser security settings are configured to restrict script execution where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use after free flaws in complex components like WebRTC are inherently difficult to exploit reliably, yet they remain a frequent target for sophisticated threat actors.

Analyst Recommendation

The severity of this vulnerability, combined with the nature of memory corruption in a widely used browser, necessitates immediate patching. Organizations should prioritize deploying the Chrome update across all systems to eliminate the risk of remote exploitation and potential system compromise.

Description Summary:
Coder is vulnerable to OS command injection, which can be triggered by unauthenticated users through specially crafted requests.

Executive Summary:
An OS command injection vulnerability in Coder could allow an unauthenticated attacker to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44454

Affected Software: Coder Coder

Affected Versions: < 2.29.7; >= 2.30.0, < 2.30.2

Vulnerability: This is an OS command injection vulnerability (CWE-78) where improper neutralization of special elements allows attackers to inject and execute commands. The vulnerability is exploitable by unauthenticated remote users.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a high risk to the host environment. An attacker can leverage this flaw to gain unauthorized control over the server, potentially stealing credentials, exfiltrating data, or establishing persistence, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Coder installation to version 2.29.7 or 2.30.2 to remediate the command injection flaw.

Proactive Monitoring: Inspect system processes and network traffic for suspicious command execution patterns or unauthorized outbound connections.

Compensating Controls: Utilize a WAF to inspect incoming HTTP requests for malicious command sequences or shell metacharacters that target this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Command injection is a critical vulnerability that requires immediate attention. Organizations must verify their current version of Coder and apply the necessary patches immediately to prevent potential remote code execution by unauthenticated adversaries.

Description Summary:
A vulnerability in the Lumiverse AI chat application allows authenticated users to achieve arbitrary OS-level code execution via the MCP server creation endpoint.

Executive Summary:
A critical command injection vulnerability in Lumiverse allows authenticated users to execute arbitrary commands on the underlying host server.

Vulnerability Details

CVE-ID: CVE-2026-44450

Affected Software: Lumiverse AI chat application

Affected Versions: Prior to 0.9.7

Vulnerability: The MCP server creation endpoint fails to validate the args array passed to child processes, allowing an attacker to inject inline-code execution flags. While the exploit requires the attacker to be logged in, it bypasses intended restrictions to grant OS-level code execution.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a maximum risk to the server infrastructure. An attacker with standard user access can escalate privileges to the OS level, resulting in full control over the Lumiverse server and potential access to sensitive data or internal network resources.

Remediation Plan

Immediate Action: Update the Lumiverse AI chat application to version 0.9.7 or later.

Proactive Monitoring: Monitor server process logs for unexpected child processes or unusual commands being executed by the application user.

Compensating Controls: Implement strict containerization or sandboxing for the application to limit the impact if code execution is achieved.

Exploitation Status

Public Exploit Available: Null

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of Lumiverse must upgrade to version 0.9.7 immediately. Given the ease of achieving OS-level code execution, this update is essential for maintaining the security and integrity of the hosting environment.

Description Summary:
A use after free vulnerability in the WebRTC component of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity use after free vulnerability in Google Chrome WebRTC enables remote attackers to execute arbitrary code or cause application crashes via malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-4445

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 146.0.7680.153

Vulnerability: The vulnerability is a use after free flaw (CWE-416) within the WebRTC component, which can be triggered by an unauthenticated remote attacker using a crafted HTML page to cause heap corruption.

Business Impact

Successful exploitation of this flaw could allow a remote attacker to achieve code execution on the user's system, leading to a total compromise of confidentiality, integrity, and availability. Given the CVSS score of 8.8, this vulnerability poses a significant risk to organizational endpoints, as it can be weaponized through common web browsing activities to bypass security controls.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 146.0.7680.153 or later immediately to resolve the memory management defect.

Proactive Monitoring: Monitor endpoint security logs for unusual browser activity or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that endpoint protection software is active and configured to block known malicious web domains, which may serve as delivery vectors for the crafted HTML pages.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use after free flaws in browser engines are highly valuable to threat actors for remote code execution chains, necessitating prompt patching.

Analyst Recommendation

The severity of this vulnerability, combined with its potential for remote code execution, makes immediate deployment of the Google Chrome update mandatory. Security administrators should prioritize this update across all corporate workstations to prevent potential exploitation via malicious web navigation.

Description Summary:
A SQL injection vulnerability in ERPNext allows authenticated attackers to execute arbitrary SQL commands via improper neutralization of special elements.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44447) poses a critical risk of full database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44447

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: < 16.9.0

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) because it fails to properly sanitize user-supplied input before using it in database queries. This vulnerability requires the attacker to have low-level authenticated access to the application.

Business Impact

Successful exploitation allows an attacker to bypass security controls, potentially leading to unauthorized access to sensitive business data, modification of records, or complete system takeover. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and confidentiality, which could result in severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade to ERPNext version 16.9.0 or later to ensure the vulnerability is patched.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected syntax errors or suspicious SQL keywords that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious input directed at the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable once authenticated, the requirement for credentials limits the initial attack surface.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize patching this vulnerability immediately. Administrators must ensure that all instances of ERPNext are updated to the fixed version to prevent potential database-level compromise.

Description Summary:
ERPNext contains a SQL injection vulnerability that allows authenticated users to execute arbitrary SQL commands due to improper input sanitization.

Executive Summary:
An authenticated SQL injection vulnerability in ERPNext (CVE-2026-44446) presents a critical risk, enabling attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44446

Affected Software: Frappe ERPNext

Affected Versions: frappe erpnext: >= 16.0.0-beta.1, < 16.14.0, < 15.104.3

Vulnerability: This is a CWE-89 (SQL Injection) vulnerability occurring in the application's query handling layer. Exploitation requires the attacker to be authenticated, though the impact is severe, potentially allowing for full administrative control over the underlying database.

Business Impact

The ability to inject arbitrary SQL queries allows an attacker to exfiltrate sensitive corporate data, alter financial or operational records, or gain unauthorized administrative access. The CVSS score of 8.8 underscores the severity of this risk, posing a threat to the core reliability and security of the ERP system.

Remediation Plan

Immediate Action: Update ERPNext to version 16.14.0 or 15.104.3, depending on the current branch in use.

Proactive Monitoring: Review application access logs and database audit trails for unauthorized query attempts or signs of anomalous database activity.

Compensating Controls: Implement strict input validation at the application level and utilize a WAF to block common SQL injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total database impact, though it is currently not known to be exploited in the wild.

Analyst Recommendation

Immediate remediation is required to secure the database layer. IT teams should verify their current version against the affected ranges and apply the vendor-provided patches as soon as possible to mitigate the risk of data breach.

Description Summary:
A missing authorization vulnerability in ERPNext allows authenticated users to modify data outside their permitted roles.

Executive Summary:
A critical authorization flaw in ERPNext allows authenticated users to escalate their privileges, enabling unauthorized data modification and potential system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-44442

Affected Software: Frappe ERPNext

Affected Versions: < 16.9.1

Vulnerability: The issue is a missing authorization check (CWE-862) on specific endpoints. While the vulnerability requires the attacker to be an authenticated user, the flaw allows them to bypass role-based access controls to perform unauthorized actions.

Business Impact

This vulnerability undermines the core security model of the ERPNext platform. An attacker with low-level access can perform administrative tasks or modify sensitive business data, leading to severe operational disruption or financial data compromise. Despite requiring authentication, the CVSS score of 9.9 highlights the extreme impact this has on organizational data integrity.

Remediation Plan

Immediate Action: Upgrade the ERPNext installation to version 16.9.1 or later.

Proactive Monitoring: Audit recent database modification logs for changes made by users that fall outside their assigned roles or standard business workflows.

Compensating Controls: Enforce the principle of least privilege for all user accounts and ensure the ERP instance is not accessible to unauthorized external personnel.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While it requires authentication, the impact is severe, and the vulnerability is inherently exploitable for any user with valid system credentials.

Analyst Recommendation

Organizations using ERPNext must prioritize the update to version 16.9.1. By addressing this authorization bypass, administrators can restore the integrity of their role-based access controls and prevent internal privilege escalation that could lead to widespread system abuse.

Description Summary:
A stack buffer overflow vulnerability in the WebRTC component of Google Chrome allows remote attackers to trigger stack corruption via a crafted HTML page.

Executive Summary:
A high severity stack buffer overflow in Google Chrome WebRTC permits remote code execution, posing a critical risk to user device integrity.

Vulnerability Details

CVE-ID: CVE-2026-4444

Affected Software: Google Chrome

Affected Versions: Google Chrome: 146.0.7680.153

Vulnerability: The flaw is a stack buffer overflow (CWE-121) within the WebRTC component of Chrome. An unauthenticated remote attacker can exploit this by enticing a user to navigate to a specifically crafted HTML page, leading to potential stack corruption and arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows a remote attacker to gain control over the affected browser process, potentially leading to unauthorized data access, malware installation, or system compromise. With a CVSS score of 8.8, this vulnerability represents a significant risk that could lead to full loss of confidentiality, integrity, and availability for the end-user system.

Remediation Plan

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later immediately to resolve the vulnerable WebRTC component.

Proactive Monitoring: Monitor endpoint security logs for unusual browser crashes or unexpected process behavior associated with web browsing activity.

Compensating Controls: Deploy endpoint protection solutions capable of detecting buffer overflow attempts and utilize browser security policies to restrict untrusted scripts where possible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to trigger memory corruption via standard web navigation.

Analyst Recommendation

Given the high severity and the nature of browser-based vulnerabilities, organizations should prioritize the deployment of the Chrome update across all managed endpoints. Failure to patch may expose users to drive-by download attacks, and the urgency of this update is bolstered by the potential for remote code execution.

Description Summary:
A heap buffer overflow in the WebAudio component of Google Chrome allows remote attackers to execute arbitrary code via a crafted HTML page.

Executive Summary:
A critical heap buffer overflow vulnerability in Google Chrome allows remote attackers to achieve arbitrary code execution through malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-4443

Affected Software: Google Chrome

Affected Versions: Google Chrome: 146.0.7680.153 up to (excluding) 146.0.7680.153

Vulnerability: This is a heap buffer overflow (CWE-122) within the WebAudio engine. It is an unauthenticated vulnerability triggered when a user visits a specially crafted HTML page.

Business Impact

The ability for a remote attacker to execute arbitrary code poses a severe risk to organizational security, potentially leading to total system compromise, data theft, or the installation of malware. With a CVSS score of 8.8, this high-severity flaw requires immediate attention to prevent lateral movement within the network from compromised endpoints.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 146.0.7680.153 or later to apply the necessary security patches.

Proactive Monitoring: Monitor endpoint security logs for unusual process execution patterns or unexpected browser crashes that may indicate exploitation attempts.

Compensating Controls: Utilize endpoint protection platforms and browser security policies to restrict the execution of untrusted scripts or the loading of suspicious web content.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the requirement for user interaction (UI:R) slightly mitigates the immediate attack surface for automated web-based worms.

Analyst Recommendation

Given the potential for arbitrary code execution, this vulnerability represents a significant threat to browser integrity. IT administrators must prioritize the deployment of the latest Chrome security updates across all managed devices to ensure that the WebAudio heap overflow is remediated and the attack surface is closed.

Description Summary:
FreeRDP is affected by a heap-based buffer overflow vulnerability in the Remote Desktop Protocol implementation, which could allow for remote code execution.

Executive Summary:
A heap-based buffer overflow in FreeRDP versions prior to 3.26.0 poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44421

Affected Software: FreeRDP FreeRDP

Affected Versions: < 3.26.0

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122). Based on the CVSS vector (AV:N/AC:L/PR:N/UI:R), the attacker can trigger this flaw remotely without authentication, though it requires user interaction.

Business Impact

The vulnerability allows for total technical impact, including potential remote code execution, which could lead to unauthorized system access, data theft, or complete compromise of the host environment. With a CVSS score of 8.8, this is a high-severity issue that should be prioritized to prevent system-wide security breaches.

Remediation Plan

Immediate Action: Update FreeRDP to version 3.26.0 or later immediately to apply the necessary memory safety patches.

Proactive Monitoring: Monitor network traffic for anomalous RDP sessions and review system logs for crashes or unexpected process behavior associated with the FreeRDP client/server.

Compensating Controls: Use network-level authentication (NLA) and restrict RDP access to trusted network segments to limit exposure to potentially malicious input.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for memory corruption in a widely used protocol implementation.

Analyst Recommendation

Given the potential for remote code execution and the existence of proof-of-concept material, organizations should treat this vulnerability with high urgency. Patching to version 3.26.0 is the only reliable method to mitigate the risk of heap-based memory corruption in FreeRDP.

Description Summary:
FreeRDP is affected by a heap-based buffer overflow vulnerability, which could allow an authenticated user to perform remote code execution.

Executive Summary:
A heap-based buffer overflow in FreeRDP versions prior to 3.26.0 allows authenticated attackers to potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44420

Affected Software: FreeRDP FreeRDP

Affected Versions: < 3.26.0

Vulnerability: This is a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker with low-level privileges (authenticated) can trigger this vulnerability remotely without requiring user interaction.

Business Impact

The ability for an authenticated attacker to execute arbitrary code poses a severe risk to internal system integrity and lateral movement potential. Given the CVSS score of 8.8, this vulnerability represents a critical security gap that could be weaponized to escalate privileges or exfiltrate sensitive data from the host.

Remediation Plan

Immediate Action: Upgrade to FreeRDP version 3.26.0 or higher as soon as possible.

Proactive Monitoring: Review authentication logs and session activity for signs of unauthorized privilege escalation or unusual command execution patterns.

Compensating Controls: Implement strict role-based access control (RBAC) to minimize the number of users capable of interacting with the vulnerable RDP components.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for authentication slightly reduces the attack surface compared to unauthenticated vectors, but it remains a high-priority risk.

Analyst Recommendation

The vulnerability requires immediate attention for all systems running FreeRDP. Administrators must prioritize the update to version 3.26.0 to ensure that memory safety improvements are active and the heap overflow condition is remediated.

Description Summary:
A heap buffer overflow vulnerability in the Google Chrome CSS engine allows remote attackers to trigger heap corruption via a specially crafted HTML page.

Executive Summary:
A high-severity heap buffer overflow in Google Chrome allows remote attackers to compromise user systems through malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-4442

Affected Software: Google Chrome

Affected Versions: Versions prior to 146.0.7680.153

Vulnerability: This is a heap buffer overflow (CWE-122) within the CSS processing engine. The vulnerability is triggered when an unauthenticated remote attacker entices a user to visit a malicious webpage.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could lead to arbitrary code execution, resulting in full system compromise, data theft, or the installation of malicious software on the end user workstation.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 146.0.7680.153 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for unusual process crashes or anomalous behavior originating from the Chrome browser process.

Compensating Controls: Deploy endpoint protection solutions that can detect and block memory corruption exploits and leverage browser-based security policies to restrict the execution of untrusted scripts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently associated with known active exploitation, heap buffer overflows in browser engines are high-value targets for attackers and should be remediated as a priority.

Analyst Recommendation

Given the potential for remote code execution and the high severity score, this vulnerability poses a significant risk to organizational endpoints. Administrators must prioritize the deployment of the latest Chrome security updates across the entire fleet to prevent potential exploitation of this memory corruption flaw.

Description Summary:
JetBrains TeamCity contains a vulnerability related to missing authentication, potentially allowing unauthorized access to system functions.

Executive Summary:
A critical authentication-related vulnerability in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 exposes the platform to potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-44413

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1; 2025.11.5

Vulnerability: The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). An unauthenticated attacker can exploit this flaw to interact with sensitive endpoints, leading to unauthorized information disclosure or potential configuration changes.

Business Impact

Successful exploitation allows unauthorized parties to gain access to sensitive build artifacts, source code, or internal configuration details, which could facilitate further attacks against the development pipeline. With a CVSS score of 8.2, this vulnerability is a high-priority risk that threatens the security of the entire software supply chain managed by TeamCity.

Remediation Plan

Immediate Action: Update TeamCity installations to version 2026.1 or the relevant patched release (2025.11.5) immediately.

Proactive Monitoring: Review TeamCity audit logs for anomalous access patterns or unauthorized API requests originating from untrusted network segments.

Compensating Controls: Restrict access to the TeamCity interface via VPN or IP-allowlisting at the network level until the update is applied.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit available).

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication for critical functions represents a significant security design flaw that must be addressed via the vendor-supplied patch.

Analyst Recommendation

This vulnerability represents a significant security gap in the CI/CD pipeline. Organizations should apply the recommended updates immediately to prevent unauthorized access to build environments and sensitive project data.

Description Summary:
A use-after-free vulnerability in the Base component of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome could allow a remote attacker to achieve arbitrary code execution or cause a crash via a malicious webpage.

Vulnerability Details

CVE-ID: CVE-2026-4441

Affected Software: Google Chrome

Affected Versions: Versions prior to 146.0.7680.153

Vulnerability: This is a use-after-free vulnerability (CWE-416) within the Base component of the browser. It allows an unauthenticated remote attacker to trigger heap corruption when a user visits a specially crafted HTML page.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for significant impact on system integrity and availability. Successful exploitation could lead to arbitrary code execution within the context of the browser, potentially allowing an attacker to bypass security controls, steal sensitive session data, or compromise the underlying host system.

Remediation Plan

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor endpoint security logs for unusual browser crashes or unexpected process spawned by the Chrome executable.

Compensating Controls: Ensure that users are operating under the principle of least privilege to limit the impact of successful code execution if the browser is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free flaws in browser engines are highly susceptible to exploitation via malicious websites and represent a primary vector for client-side attacks.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a significant risk to organizational assets. Administrators should prioritize the deployment of the latest Chrome security updates across all workstations to mitigate the threat of heap corruption and unauthorized code execution.

Description Summary:
Voltronic Power SNMP Web Pro 1.1 is vulnerable to unauthenticated remote code execution via the upload.cgi endpoint, allowing attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in Voltronic Power SNMP Web Pro allows remote attackers to achieve full system compromise with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-44402

Affected Software: Voltronic Power SNMP Web Pro

Affected Versions: 1.1

Vulnerability: The application contains an unrestricted file upload flaw in the firmware update functionality (upload.cgi). Attackers can bypass authentication by providing an invalid session cookie and subsequently upload a malicious tar archive that is extracted to a privileged directory and executed as root.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected device. Given the root-level execution, this could lead to complete data exfiltration, the installation of persistent backdoors, or the use of the device as a pivot point for further lateral movement within the network. With a CVSS score of 9.8, this vulnerability represents an extreme risk to infrastructure integrity and confidentiality.

Remediation Plan

Immediate Action: Update Voltronic Power SNMP Web Pro to the latest available version provided by the vendor. Ensure that any device currently running version 1.1 is taken offline or isolated until the patch is successfully applied.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /cgi-bin/upload.cgi endpoint. Review system logs for unauthorized file extractions or the execution of unexpected processes originating from the /root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests to the upload.cgi endpoint that do not originate from authorized administrative IP addresses. Restrict access to the device management interface to a secure, segmented management network.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (Virgula0/CVE-2026-44402).

Analyst Notes: As of September 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no valid credentials to interact with the vulnerable firmware update process.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of functional proof-of-concept code, immediate remediation is required. Administrators must prioritize updating all instances of Voltronic Power SNMP Web Pro to the patched version. Failure to act promptly exposes the entire network segment to high-impact unauthorized access and potential system-wide compromise.

Description Summary:
MailEnable Enterprise Premium contains an improper authorization vulnerability in the WebAdmin mobile portal allowing privilege escalation.

Executive Summary:
An authentication bypass vulnerability in MailEnable Enterprise Premium allows low-privileged users to escalate privileges to administrative levels and compromise the system.

Vulnerability Details

CVE-ID: CVE-2026-44400

Affected Software: MailEnable Enterprise Premium

Affected Versions: MailEnable MailEnable Enterprise Premium: 0 through 10.55

Vulnerability: This flaw involves an authorization bypass through user-controlled keys, specifically allowing authenticated low-privileged users to reuse authentication tokens for administrative actions.

Business Impact

A successful exploit permits unauthorized users to execute administrative tasks, leading to total confidentiality, integrity, and availability loss for the affected mail server. The high CVSS score of 8.1 reflects the severe operational disruption and potential data compromise associated with administrative takeover.

Remediation Plan

Immediate Action: Apply the latest security updates provided by MailEnable as soon as they become available.

Proactive Monitoring: Monitor authentication logs for unusual patterns of token reuse or low-privileged accounts performing administrative functions within the WebAdmin portal.

Compensating Controls: Implement strict network segmentation and restrict access to the WebAdmin portal to trusted management networks until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw presents a high risk due to the potential for total system compromise once token reuse is leveraged by an attacker.

Analyst Recommendation

Administrators must prioritize securing the WebAdmin interface and review user session handling immediately. Applying vendor patches is critical to close this privilege escalation vector and prevent unauthorized administrative access.

Description Summary:
A critical out of bounds read and write vulnerability in Google Chrome WebGL allows remote attackers to perform arbitrary memory operations via a crafted HTML page.

Executive Summary:
Google Chrome versions prior to 146.0.7680.153 contain a critical memory safety vulnerability that allows remote attackers to execute arbitrary read and write operations.

Vulnerability Details

CVE-ID: CVE-2026-4440

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 146.0.7680.153

Vulnerability: The vulnerability is an out of bounds read and write error occurring within the WebGL component. This flaw allows an unauthenticated remote attacker to compromise system memory by enticing a user to visit a specially crafted HTML page.

Business Impact

The ability to perform arbitrary read and write operations on a user system poses a significant risk to data confidentiality, integrity, and availability. Given the CVSS score of 8.8, this vulnerability is classified as High severity and could facilitate full system compromise or the bypass of browser security sandboxes.

Remediation Plan

Immediate Action: Update all Google Chrome instances to version 146.0.7680.153 or later immediately to incorporate the vendor provided security patches.

Proactive Monitoring: Monitor endpoint logs for unusual browser crashes or unexpected behavior associated with WebGL rendering processes.

Compensating Controls: While no direct virtual patch exists for this memory flaw, enforcing strict browser security policies and utilizing endpoint protection software can help mitigate the impact of successful exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. While the flaw is highly severe, the requirement for user interaction (UI:R) serves as a partial barrier to immediate mass exploitation.

Analyst Recommendation

The severity of this memory safety issue necessitates an immediate organizational update to the latest stable version of Google Chrome. Security teams should prioritize the deployment of this update across all workstations to ensure protection against potential remote code execution attempts leveraging this WebGL flaw.

Description Summary:
A critical out-of-bounds memory access vulnerability in Google Chrome for Android's WebGL component allows remote attackers to potentially achieve a sandbox escape via a crafted HTML page.

Executive Summary:
A critical sandbox escape vulnerability exists in Google Chrome for Android that could allow a remote attacker to compromise the host device through malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-4439

Affected Software: Google Chrome

Affected Versions: Versions prior to 146.0.7680.153

Vulnerability: This is an out-of-bounds memory access flaw located in the WebGL component of the browser. The vulnerability allows an unauthenticated, remote attacker to trigger memory corruption and potentially escape the browser sandbox by enticing a user to visit a specially crafted HTML page.

Business Impact

The ability to escape the browser sandbox represents a critical security failure, as it allows an attacker to bypass the primary boundary between malicious web content and the underlying operating system. Given the CVSS score of 8.8, this vulnerability poses a high risk of unauthorized system access, data theft, or device control. Successful exploitation could lead to significant reputational damage and the compromise of sensitive user data stored on the affected Android devices.

Remediation Plan

Immediate Action: Update Google Chrome on all affected Android devices to version 146.0.7680.153 or later immediately.

Proactive Monitoring: Monitor device logs for unusual browser crashes or unexpected background process activity that may indicate attempts to exploit memory corruption flaws.

Compensating Controls: While there is no direct virtual patch for this browser-level flaw, ensure that Google Play Protect is enabled on all Android endpoints to detect and block malicious applications or web-based threats.

Exploitation Status

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's potential for sandbox escape makes it a high-value target for attackers, necessitating rapid deployment of the provided security update.

Analyst Recommendation

Due to the severity of a sandbox escape vulnerability and the relative ease with which users can be targeted through malicious websites, organizations must prioritize patching. System administrators should push the latest Chrome update to all managed mobile devices as soon as possible to mitigate the risk of remote compromise.

Description Summary:
A session management vulnerability in the Le Circuit Electrique backend allows multiple connections with the same ID, potentially leading to a denial-of-service via resource exhaustion.

Executive Summary:
A vulnerability in the Hydro-Québec charging station backend allows unauthenticated attackers to overwhelm the system by reusing charging station identifiers.

Vulnerability Details

CVE-ID: CVE-2026-44383

Affected Software: Hydro-Québec Le Circuit Electrique charging station backend

Affected Versions: Hydro-Québec Le Circuit Electrique charging station backend: 0 up to (excluding) June_2026

Vulnerability: The system suffers from a session handling flaw (CWE-613) where it fails to properly invalidate or restrict multiple concurrent connections using the same charging station ID. This allows an unauthenticated attacker to inject malicious OCPP clients, leading to backend resource exhaustion.

Business Impact

This vulnerability poses a significant risk to the availability of the charging station network. Successful exploitation could result in service disruption for legitimate users, causing reputational damage to the service provider and potential operational downtime. The CVSS score of 7.5 (High) reflects the high impact on system availability, even though confidentiality and integrity remain unaffected.

Remediation Plan

Immediate Action: Upgrade the affected backend systems to the version released in June 2026 or later as specified by Hydro-Québec.

Proactive Monitoring: Monitor backend logs for anomalous connection patterns, specifically multiple concurrent sessions originating from the same charging station ID.

Compensating Controls: Implement rate limiting and stricter session validation at the network edge or via a Web Application Firewall (WAF) to prevent unauthorized concurrent connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor capable of sending network traffic to the OCPP interface.

Analyst Recommendation

The high severity of this vulnerability, combined with its impact on critical infrastructure, necessitates immediate attention. Administrators must verify their deployment status against the June 2026 update and apply the vendor-provided fixes to ensure the continued availability and integrity of the charging station network.

Description Summary:
A remote, low-privileged attacker can manipulate Modbus registers in GPL750 odorizers to disrupt natural gas odorant injection levels.

Executive Summary:
A critical vulnerability in GPL Odorizers GPL750 devices allows remote attackers to compromise industrial gas odorization processes, posing significant safety and operational risks.

Vulnerability Details

CVE-ID: CVE-2026-4436

Affected Software: GPL Odorizers GPL750 (XL4, XL4 Prime, XL7, and XL7 Prime)

Affected Versions: GPL750 (XL4): v1.0 up to v6.0; (XL4 Prime): v4.0 up to v6.0; (XL7): v13.0 up to v20.0; (XL7 Prime): v18.4 up to v20.0

Vulnerability: The vulnerability, categorized as CWE-306 (Missing Authentication for Critical Function), allows an unauthenticated remote attacker to send malicious Modbus packets to the device. This enables unauthorized modification of registers controlling odorant injection logic.

Business Impact

The ability to manipulate odorant injection levels in gas lines poses a severe risk to public safety and physical infrastructure. Because odorization is a critical safety requirement for detecting gas leaks, failure to maintain correct levels can result in catastrophic incidents. With a CVSS score of 8.6, this flaw represents a High severity risk that could lead to widespread operational disruption and significant liability.

Remediation Plan

Immediate Action: Update the GPL750 firmware to version 6.0 or 20.0 (depending on the model) by following the vendor provided instructions to extract updated files to a microSD card or obtaining a preconfigured card from the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized Modbus communications targeting the affected GPL750 devices and review system logs for unexpected register changes.

Compensating Controls: Implement strict network segmentation to isolate industrial control systems from external networks and deploy industrial firewalls capable of deep packet inspection to block unauthorized Modbus commands.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to its remote, unauthenticated nature and potential for physical impact in an operational technology environment.

Analyst Recommendation

Given the safety-critical nature of the affected equipment, administrators must prioritize this update across all deployment sites. Ensure that all firmware update procedures are performed according to the specific vendor instructions provided in the CISA advisory to prevent further operational instability.

Description Summary:
A code injection vulnerability in the Meshtastic firmware GitHub workflow allows unauthorized execution of attacker-controlled code, leading to potential supply chain compromise.

Executive Summary:
A critical code injection vulnerability in the Meshtastic firmware repository allows unauthenticated attackers to execute malicious code via manipulated pull requests.

Vulnerability Details

CVE-ID: CVE-2026-44359

Affected Software: Meshtastic firmware

Affected Versions: < 2.7.21.1370b23

Vulnerability: The vulnerability stems from improper control of code generation (CWE-94) and inclusion of functionality from untrusted sources (CWE-829), where GitHub workflows automatically execute attacker-supplied files from forks without approval.

Business Impact

This flaw carries a CVSS score of 10.0, indicating the highest level of risk. An attacker could achieve full repository takeover, compromise self-hosted runners, or inject malicious code into the firmware supply chain, resulting in widespread downstream impact for users of the mesh networking solution.

Remediation Plan

Immediate Action: Update the Meshtastic firmware repository and associated build workflows to version 2.7.21.1370b23 or later.

Proactive Monitoring: Review repository CI/CD logs for any unrecognized workflow execution patterns or unauthorized attempts to access repository secrets.

Compensating Controls: Disable automatic workflow triggers for pull requests from external contributors until the environment is fully patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it bypasses standard security gates in the CI/CD pipeline.

Analyst Recommendation

Due to the critical severity and the potential for supply chain poisoning, immediate remediation is required. Developers and maintainers must ensure all workflows are updated to the patched version to prevent unauthorized code execution.

Description Summary:
BentoML is susceptible to OS command and code injection, which could allow an unauthenticated attacker to execute arbitrary commands if they can induce a user to interact with a malicious payload.

Executive Summary:
A critical OS command and code injection vulnerability in BentoML allows unauthenticated attackers to execute arbitrary code, posing a severe risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44346

Affected Software: BentoML BentoML

Affected Versions: < 1.4.39

Vulnerability: This vulnerability involves both CWE-78 (OS Command Injection) and CWE-94 (Code Injection). The CVSS vector (PR:N) indicates that the attack does not require prior authentication, though it does require user interaction (UI:R).

Business Impact

Exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the host system, which could lead to a total system compromise, unauthorized data exfiltration, or the installation of persistent backdoors. With a CVSS score of 8.8, the potential for significant organizational impact is high.

Remediation Plan

Immediate Action: Upgrade the BentoML Python library to version 1.4.39 or later to patch the injection vulnerabilities.

Proactive Monitoring: Review system logs for suspicious process execution, unusual outbound network connections, or unexpected file modifications occurring within the BentoML environment.

Compensating Controls: Implement strict input validation and sanitization for all data passed to BentoML processes and utilize a secure, isolated environment (e.g., containers with restricted privileges) to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for user interaction slightly reduces the immediate attack surface for automated exploitation.

Analyst Recommendation

Given the potential for remote code execution, organizations using BentoML must prioritize upgrading to version 1.4.39. This update is critical to preventing unauthorized access and ensuring the security of the AI model serving environment.

Description Summary:
BentoML contains an OS command injection vulnerability, allowing an unauthenticated attacker to execute arbitrary commands via malicious user interaction.

Executive Summary:
A critical OS command injection vulnerability in BentoML enables unauthenticated remote attackers to execute arbitrary commands, creating a significant risk of system-wide compromise.

Vulnerability Details

CVE-ID: CVE-2026-44345

Affected Software: BentoML BentoML

Affected Versions: < 1.4.39

Vulnerability: The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS vector (PR:N) specifies that no authentication is required, while the UI:R flag indicates that successful exploitation requires interaction from an authorized user.

Business Impact

A successful exploit could allow an attacker to gain full control over the server running BentoML, leading to data theft, lateral movement, or full system takeover. The CVSS score of 8.8 reflects the high severity and the potential for a complete technical impact on the affected infrastructure.

Remediation Plan

Immediate Action: Immediately update the BentoML library to version 1.4.39 or higher to eliminate the injection vulnerability.

Proactive Monitoring: Monitor for unexpected shell commands or child processes spawned by the BentoML application and review access logs for suspicious user interactions.

Compensating Controls: Utilize WAF rules to detect and block common OS command injection payloads and apply the principle of least privilege to the service account running the BentoML environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable if an attacker can successfully trick an authenticated user into interacting with a malicious payload.

Analyst Recommendation

This vulnerability poses a severe threat to the operational environment. All deployments of BentoML must be updated to version 1.4.39 immediately to mitigate the risk of remote command execution and ensure the long-term security of the platform.

Description Summary:
PraisonAI multi-agent teams system contains an unspecified security vulnerability requiring immediate investigation.

Executive Summary:
A security vulnerability in the PraisonAI multi-agent platform could potentially expose critical business logic to unauthorized manipulation.

Vulnerability Details

CVE-ID: CVE-2026-44340

Affected Software: PraisonAI Multi-agent teams system

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The exact nature of this vulnerability is currently under investigation; however, it affects the core multi-agent framework of the PraisonAI system. The authentication requirements remain indeterminate pending further vendor disclosure.

Business Impact

Given the CVSS score of 7.5, this vulnerability represents a high-risk scenario that could lead to unauthorized access or degradation of AI-driven workflows. Successful exploitation may result in the compromise of proprietary automated processes and the leakage of sensitive data handled by the agentic architecture.

Remediation Plan

Immediate Action: Review the official PraisonAI security advisories and apply available patches or configuration changes immediately.

Proactive Monitoring: Monitor system logs for unusual agent behavior or unauthorized API calls directed at the core framework.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact of a potential agent-based compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of AI agent systems in business workflows, the potential for exploitation is considered high.

Analyst Recommendation

Security teams should prioritize the identification of PraisonAI instances within their environment. Applying the vendor-supplied updates is the only definitive way to mitigate this risk; monitor vendor communication channels closely for technical bulletins.

Description Summary:
PraisonAI contains an unsafe reflection vulnerability via externally controlled tool names, allowing unauthenticated attackers to invoke unintended application callables.

Executive Summary:
An unsafe reflection vulnerability in MervinPraison PraisonAI and praisonaiagents allows unauthenticated remote attackers to invoke arbitrary application callables, leading to potential integrity compromise and partial data access.

Vulnerability Details

CVE-ID: CVE-2026-44339

Affected Software: MervinPraison PraisonAI and praisonaiagents

Affected Versions: praisonaiagents < 1.6.37, praisonai < 4.6.37

Vulnerability: This is an unsafe reflection flaw classified as CWE-470, where externally controlled input selects classes or code. The application resolves unresolved tool names against module globals and main when default permissions do not reject undeclared tool names, requiring no authentication.

Business Impact

The high CVSS score of 8.6 reflects significant potential for unauthorized control execution and data tampering. A successful exploit could allow attackers to execute unintended functions within the application context, resulting in system compromise, unauthorized data modification, and potential operational disruption.

Remediation Plan

Immediate Action: Update praisonai to version 4.6.37 and praisonaiagents to version 1.6.37 or later via PyPI.

Proactive Monitoring: Monitor application logs for unusual tool invocation patterns, unexpected module calls, or unauthorized interaction attempts with internal agent functions.

Compensating Controls: Implement strict input validation rules at the network perimeter or application gateway to inspect tool-call parameters and reject unexpected or malformed inputs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from permissive tool handling that enables unauthenticated code path selection.

Analyst Recommendation

Given the high severity score and the availability of a proof-of-concept, organizations must prioritize patching immediately. Administrators should upgrade both praisonai and praisonaiagents to their respective fixed versions to eliminate the reflection vector and secure the agent environment.

Description Summary:
PraisonAI ships a legacy Flask API server with authentication disabled by default, allowing unauthenticated callers to trigger agent workflows.

Executive Summary:
A missing authentication vulnerability in PraisonAI affects versions 2.5.6 through 4.6.33, exposing multi-agent workflows to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-44338

Affected Software: MervinPraison PraisonAI

Affected Versions: MervinPraison PraisonAI: >= 2.5.6, < 4.6.34

Vulnerability: This vulnerability is classified as a missing authentication flaw (CWE-306) residing in the legacy Flask API server, which allows unauthenticated remote attackers to access restricted endpoints and trigger workflows via the chat interface.

Business Impact

A successful exploit allows unauthorized users to interact with deployed multi-agent workflows, potentially leading to unauthorized data exposure, manipulation of agent actions, and resource exhaustion. With a CVSS score of 7.3, this high severity issue poses a significant risk to organizational operations and confidentiality if the API is exposed to untrusted networks.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.6.34 or later to resolve the missing authentication issue in the Flask API server.

Proactive Monitoring: Monitor API access logs for unusual inbound requests targeting the chat and agent endpoints, especially those originating from external or unauthenticated IP addresses.

Compensating Controls: Implement network segmentation or deploy a Web Application Firewall rule to restrict access to the legacy Flask API server until updates can be applied.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub and a Nuclei detection template is available.

Analyst Notes: As of May 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of unauthenticated network vectors significantly lowers the barrier for attackers.

Analyst Recommendation

Administrators must treat this vulnerability with high priority due to the presence of public proof-of-concept code and unauthenticated remote vector access. Immediate application of the 4.6.34 patch is required to secure the environment against unauthorized workflow execution.

Description Summary:
PraisonAI's MCP server fails to sanitize file paths in tool arguments, allowing unauthenticated attackers to perform arbitrary file writes and achieve code execution.

Executive Summary:
An unauthenticated directory traversal vulnerability in PraisonAI permits attackers to overwrite critical system files, leading to full system compromise via arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-44336

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 4.6.34

Vulnerability: The MCP server fails to validate input paths, allowing an attacker to use directory traversal sequences (e.g., ../../) to write files outside the intended directory. This permits the dropping of malicious Python .pth files into site-packages, resulting in arbitrary code execution in subsequent Python processes.

Business Impact

Successful exploitation allows an attacker to gain persistent, unauthorized access to the host server. This poses a significant risk of data theft, configuration tampering, and full system takeover. The 9.6 CVSS score underscores the severity of this vulnerability, necessitating urgent intervention to prevent exploitation.

Remediation Plan

Immediate Action: Update the PraisonAI installation to version 4.6.34 immediately to enforce strict path validation and containment checks.

Proactive Monitoring: Review file integrity logs for unauthorized modifications in Python site-packages or unexpected file creation within the application's base directory.

Compensating Controls: Restrict the service account running the PraisonAI process to the minimum necessary filesystem permissions to limit the scope of potential file overwrites.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe risk of persistence and code execution. Security teams must treat this as a high-priority update. Ensure all instances are patched to version 4.6.34 and verify that the service is running with the least privilege required to perform its functions.

Description Summary:
PraisonAI contains a logical flaw in its URL checking mechanism that allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks.

Executive Summary:
A logical flaw in PraisonAI's URL validation logic exposes the application to Server-Side Request Forgery (SSRF), potentially allowing unauthorized internal network access.

Vulnerability Details

CVE-ID: CVE-2026-44335

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 1.6.32

Vulnerability: The application's URL checking logic is insufficient, allowing an unauthenticated attacker to bypass security filters. This enables the application to be used as a proxy to send requests to internal resources that are otherwise inaccessible from the public internet.

Business Impact

SSRF vulnerabilities can lead to the exposure of internal-only services, metadata endpoints, and sensitive configuration interfaces. By leveraging the internal trust of the server, an attacker can bypass traditional network defenses. The 9.8 CVSS score reflects the high potential for lateral movement and internal reconnaissance within the organization's infrastructure.

Remediation Plan

Immediate Action: Upgrade to PraisonAI version 1.6.32 or later to rectify the URL validation logic flaws.

Proactive Monitoring: Monitor egress traffic from the server for requests directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application server from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for internal network exposure, this vulnerability requires immediate attention. Administrators must apply the patch version 1.6.32 to prevent SSRF-based attacks that could lead to broader infrastructure compromise.

Description Summary:
An unauthenticated code injection vulnerability in PraisonAI versions 4.5.139 through 4.6.31 allows remote attackers to execute arbitrary code via recipe execution.

Executive Summary:
An unauthenticated code injection vulnerability in MervinPraison PraisonAI versions 4.5.139 through 4.6.31 allows remote attackers to execute arbitrary code, creating a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44334

Affected Software: MervinPraison PraisonAI

Affected Versions: >= 4.5.139, < 4.6.32

Vulnerability: This flaw is classified as a Code Injection vulnerability under CWE-94, occurring because an import sink in praisonai/templates/tool_override.py lacks proper access controls and is reached during recipe execution. The attacker can trigger this vulnerability unauthenticated via the POST /v1/recipes/run endpoint.

Business Impact

A successful exploit of this vulnerability grants the attacker full control over the host system, leading to potential data exfiltration, system downtime, and severe reputational damage. With a CVSS score of 8.4, the risk level is high, reflecting the potential for total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update PraisonAI immediately to version 4.6.32 or later where the import sink is properly guarded.

Proactive Monitoring: Monitor API access logs for suspicious POST requests directed at the /v1/recipes/run endpoint, particularly those referencing unusual local paths or external GitHub repositories.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block unauthorized requests to the recipe execution endpoint until updates can be applied.

Exploitation Status

Public Exploit Available: No - no confirmed public exploit or weaponized module is present in the current threat intelligence feeds.

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of an unguarded import sink that executes modules remotely without authentication makes this defect highly susceptible to weaponization.

Analyst Recommendation

The severity and remote attack vector of this vulnerability demand immediate attention from IT administrators. Apply the available patch to version 4.6.32 immediately to eliminate the exposure and protect the environment from potential exploitation.

Description Summary:
A SQL injection vulnerability in ProFTPD allows unauthenticated remote attackers to inject arbitrary SQL commands via reverse DNS lookups.

Executive Summary:
An unauthenticated SQL injection vulnerability in ProFTPD versions through 1.3.9a allows remote attackers to execute arbitrary SQL commands and compromise backend database systems when reverse DNS is enabled.

Vulnerability Details

CVE-ID: CVE-2026-44331

Affected Software: ProFTPD ProFTPD

Affected Versions: ProFTPD 0 through 1.3.9a

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the sqltab_fetch_clients_cb function within contrib/mod_wrap2_sql.c, triggered when an unauthenticated attacker supplies a crafted domain name processed during a reverse DNS lookup.

Business Impact

A successful exploit allows attackers to manipulate backend database queries, potentially leading to unauthorized data access, data modification, or complete database compromise. Given the high CVSS score of 8.1, this vulnerability poses a severe threat to data confidentiality, integrity, and availability, particularly for systems utilizing database authentication or logging integrations.

Remediation Plan

Immediate Action: Update ProFTPD to the patched version following commit 7666224 or apply the vendor security update immediately.

Proactive Monitoring: Monitor database query logs for abnormal SQL syntax errors, suspicious query structures, or unexpected input originating from reverse DNS lookups.

Compensating Controls: Disable the "UseReverseDNS" directive in the ProFTPD configuration if reverse DNS lookups are not strictly required for operation.

Exploitation Status

Public Exploit Available: No (no public exploit or proof-of-concept is currently confirmed in the available threat data).

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The attack vector requires network access and specific configuration settings, namely having "UseReverseDNS on" enabled.

Analyst Recommendation

Administrators must treat this high severity vulnerability with urgency and apply the available upstream patch or code fix immediately. Disabling reverse DNS resolution serves as an effective temporary mitigation while permanent updates are scheduled and deployed.

Description Summary:
The free5GC NEF component suffers from an authentication bypass on the PFD management route group, allowing unauthenticated attackers to manipulate application data and subscriptions.

Executive Summary:
A critical authentication bypass in the free5GC NEF component allows unauthenticated attackers to read sensitive PFD data and manipulate notification subscriptions.

Vulnerability Details

CVE-ID: CVE-2026-44330

Affected Software: free5GC free5GC

Affected Versions: Prior to 4.2.2

Vulnerability: The nnef-pfdmanagement route group is mounted without inbound OAuth2/bearer-token authorization, permitting unauthenticated access to PFD data retrieval and subscription management.

Business Impact

A CVSS score of 10 reflects the severe impact of this vulnerability, which enables an attacker to influence PFD application data and subscription notifications. This could lead to service disruption, unauthorized data exfiltration, or the poisoning of network policy configurations within the 5G core.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or higher to enforce proper OAuth2 authentication for PFD management operations.

Proactive Monitoring: Monitor for anomalous GET/POST/DELETE requests targeting the NEF PFD management API endpoints.

Compensating Controls: Utilize a Service Mesh with strict authorization policies to intercept and block unauthorized requests to the NEF SBI interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of core network policy components, immediate patching is required. Failure to secure these endpoints could allow attackers to manipulate critical network traffic and subscriber policies.

Description Summary:
The free5GC SMF component improperly manages UPI route groups, allowing unauthenticated attackers to perform unauthorized read, write, and delete operations.

Executive Summary:
A critical authentication bypass in the free5GC SMF component allows an unauthenticated network attacker to perform unauthorized management operations on the 5G core network.

Vulnerability Details

CVE-ID: CVE-2026-44329

Affected Software: free5GC SMF

Affected Versions: Prior to 4.2.2

Vulnerability: The vulnerability stems from the SMF component mounting UPI management route groups without required OAuth2/bearer-token authorization middleware. This allows an unauthenticated attacker with network access to the Service-Based Architecture (SBI) to interact directly with UPI endpoints.

Business Impact

The CVSS score of 10.0 signifies the highest level of risk, as it allows for unauthorized control over critical 5G network management functions. Exploitation could lead to severe network disruption, interception of communication, or total manipulation of user plane nodes, causing catastrophic service outages.

Remediation Plan

Immediate Action: Update free5GC SMF to version 4.2.2 or later to implement required authorization middleware.

Proactive Monitoring: Audit network logs for unauthorized access attempts or suspicious traffic patterns directed at SBI endpoints and UPI management routes.

Compensating Controls: Implement strict network micro-segmentation to ensure only authorized components can communicate with the SMF service, effectively isolating it from untrusted network segments.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is exceptionally severe due to the lack of any authentication requirements. Organizations utilizing free5GC must prioritize the update to version 4.2.2 to close this critical security gap and prevent unauthorized manipulation of core network infrastructure.

Description Summary:
The free5GC core network implementation is vulnerable to missing authentication and authorization, leading to potential service disruption or unauthorized state manipulation.

Executive Summary:
The free5GC core network software contains critical authentication and authorization flaws that could allow unauthenticated attackers to impact network availability.

Vulnerability Details

CVE-ID: CVE-2026-44328

Affected Software: free5GC free5GC

Affected Versions: < 4.2.2

Vulnerability: This vulnerability involves missing authentication (CWE-306) and authorization (CWE-862) for critical functions, alongside a NULL pointer dereference (CWE-476). The vulnerability is remotely exploitable (AV:N) by an unauthenticated attacker, potentially leading to denial-of-service or improper network control.

Business Impact

Exploitation of these flaws poses a significant risk to 5G network core integrity. An attacker could potentially crash critical network services or bypass security controls, resulting in system downtime and potential unauthorized access to network management functions. The CVSS score of 8.2 reflects the high impact on availability and the lack of required authentication.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or later and ensure the Go package github.com/free5gc/smf is updated to version 1.4.3.

Proactive Monitoring: Monitor network core logs for abnormal request patterns or service crashes that might indicate exploitation attempts.

Compensating Controls: Implement strict network ingress filtering and segmentation to restrict access to the 5G core control plane to authorized management subnets only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of authentication requirements.

Analyst Recommendation

Due to the critical nature of core network infrastructure, administrators must apply these updates immediately. Given the remote exploitability, failure to patch leaves the 5G core exposed to significant operational and security risks.

Description Summary:
The free5GC NEF component fails to enforce authentication on the OAM route group, allowing unauthenticated network attackers to access OAM-related functions.

Executive Summary:
A critical authentication bypass in the free5GC NEF component allows unauthenticated network attackers to access the OAM interface.

Vulnerability Details

CVE-ID: CVE-2026-44327

Affected Software: free5GC free5GC

Affected Versions: Prior to 4.2.2

Vulnerability: The OAM route group is mounted without any inbound OAuth2 or bearer-token middleware, exposing the interface to any attacker capable of reaching the Service-Based Architecture (SBI) network.

Business Impact

With a CVSS score of 10, this vulnerability allows for unauthenticated interaction with core network management functions. While currently a stub, the lack of an authentication boundary creates a structural defect that exposes the core network to unauthorized management operations, leading to potential denial of service or future exploitation of added OAM features.

Remediation Plan

Immediate Action: Upgrade to free5GC version 4.2.2 or higher to implement mandatory authentication middleware across all OAM route groups.

Proactive Monitoring: Monitor network traffic directed at the NEF SBI interface for unauthorized connection attempts or unexpected OAM requests.

Compensating Controls: Implement strict network segmentation and mTLS (mutual TLS) at the transport layer to ensure only authorized network functions can communicate with the NEF.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security defect in a 5G core component. It is imperative that operators apply the 4.2.2 update immediately to establish a hardened authentication boundary for the OAM interface.

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Linkwarden allows authenticated users to make unauthorized requests to internal services via insufficient URL validation.

Executive Summary:
An SSRF vulnerability in Linkwarden allows authenticated users to probe internal network services, potentially leading to unauthorized data access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44313

Affected Software: Linkwarden Linkwarden

Affected Versions: Prior to 2.13.0

Vulnerability: The fetchTitleAndHeaders function contains an SSRF flaw due to inadequate URL validation. Authenticated users can bypass checks that only verify the "http://" or "https://" prefix to query internal, non-public services.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a significant risk to the internal network infrastructure. An attacker can leverage this SSRF to scan internal ports, interact with internal APIs, or access metadata services, potentially leading to further compromise of the internal environment.

Remediation Plan

Immediate Action: Update Linkwarden to version 2.13.0 or later to implement strict URL validation.

Proactive Monitoring: Monitor network logs for outbound requests originating from the Linkwarden server directed at internal IP ranges or sensitive internal services.

Compensating Controls: Implement network segmentation to isolate the Linkwarden instance and restrict its ability to communicate with internal, non-public resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SSRF vulnerabilities are often used as a stepping stone for deeper network penetration. Organizations should prioritize updating Linkwarden and ensuring that the host server follows the principle of least privilege regarding network access.

Description Summary:
Netflix Lemur is vulnerable to LDAP injection, which may allow an authenticated attacker to manipulate backend queries.

Executive Summary:
Netflix Lemur versions prior to 1.9.0 contain an LDAP injection vulnerability that allows authenticated users to compromise backend data integrity.

Vulnerability Details

CVE-ID: CVE-2026-44304

Affected Software: Netflix Lemur

Affected Versions: < 1.9.0

Vulnerability: This is an LDAP Injection vulnerability (CWE-90) where the application fails to properly neutralize special elements in inputs used for LDAP queries, allowing authenticated attackers to execute unauthorized queries.

Business Impact

An attacker capable of exploiting this LDAP injection could potentially bypass access controls, extract sensitive directory information, or gain unauthorized administrative privileges within the Lemur environment. Given the 8.1 CVSS score, this vulnerability poses a severe risk to the confidentiality and integrity of certificate management operations.

Remediation Plan

Immediate Action: Update to Lemur version 1.9.0 or later to resolve the underlying input sanitization flaw.

Proactive Monitoring: Monitor LDAP query logs for unusual query patterns or syntax errors that suggest injection attempts.

Compensating Controls: Implement strict input validation and query parameterization at the application level if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit available).

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by an authenticated user with access to the affected search functions.

Analyst Recommendation

The risk of directory manipulation via LDAP injection is substantial. Users should update to version 1.9.0 immediately to ensure that LDAP queries are correctly neutralized and that the integrity of the certificate management system is maintained.

Description Summary:
A code injection vulnerability in protobufjs-cli allows authenticated attackers to execute arbitrary code during the generation process.

Executive Summary:
A code injection vulnerability in protobufjs-cli (CVE-2026-44295) poses a critical risk by allowing authenticated attackers to execute arbitrary code within the host environment.

Vulnerability Details

CVE-ID: CVE-2026-44295

Affected Software: Protobuf protobufjs-cli

Affected Versions: protobufjs protobuf.js: >= 2.0.0, < 2.0.2, < 1.2.1

Vulnerability: This vulnerability is a CWE-94 (Code Injection) flaw where the command-line tool fails to properly control the generation of code. An authenticated user can influence the output, leading to the execution of unintended code, often requiring user interaction to trigger the malicious payload.

Business Impact

Successful exploitation can lead to remote code execution (RCE) on the developer or build system, potentially resulting in full system compromise, malicious code insertion into software builds, or unauthorized access to internal development environments. The CVSS score of 8.7 highlights the extreme risk to development pipelines and organizational security.

Remediation Plan

Immediate Action: Update the protobufjs-cli package to version 1.2.1 or 2.0.2 via your package manager.

Proactive Monitoring: Monitor build servers and development machines for unexpected execution processes or unauthorized changes to source code files.

Compensating Controls: Limit access to the protobufjs-cli utility to authorized users only and ensure build processes are isolated within restricted environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it directly impacts code generation, which is a critical trust point in software development.

Analyst Recommendation

Organizations utilizing protobufjs-cli must treat this as a high-priority update. Developers and build engineers should verify their dependencies and upgrade to the patched versions immediately to prevent potential supply chain attacks.

Description Summary:
The protobuf.js library is vulnerable to code injection when compiling protobuf definitions into JavaScript functions, potentially allowing unauthorized code execution.

Executive Summary:
A code injection vulnerability in protobuf.js allows authenticated attackers to execute arbitrary JavaScript, posing a significant risk to application integrity.

Vulnerability Details

CVE-ID: CVE-2026-44293

Affected Software: protobufjs protobuf.js

Affected Versions: < 7.5.6, >= 8.0.0, < 8.0.2

Vulnerability: The vulnerability (CWE-94) involves improper control of code generation. An attacker with low privileges can leverage this flaw to inject malicious code during the compilation of protobuf definitions.

Business Impact

Successful exploitation permits an attacker to execute arbitrary code within the context of the application, leading to potential data exfiltration or full system compromise. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could severely impact business operations and the confidentiality of sensitive data managed by the affected application.

Remediation Plan

Immediate Action: Update the protobufjs package to version 7.5.6 or 8.0.2 via your package manager (e.g., npm install protobufjs@latest).

Proactive Monitoring: Monitor application logs for unusual JavaScript execution patterns or unexpected calls to sensitive system functions originating from protobuf processing modules.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation to limit the scope of potential code injection attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a low-privilege authenticated user to trigger, but the resulting impact is severe.

Analyst Recommendation

Organizations utilizing protobuf.js must prioritize upgrading to the patched versions immediately. Given the nature of code injection, leaving this vulnerability unpatched creates a direct pathway for unauthorized system access and should be addressed in the current sprint cycle.

Description Summary:
The protobuf.js library contains a code injection vulnerability when compiling protobuf definitions, potentially allowing attackers to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in protobuf.js allows attackers to execute arbitrary code, presenting a significant security risk to any application utilizing this library for serialization.

Vulnerability Details

CVE-ID: CVE-2026-44291

Affected Software: protobufjs protobuf.js

Affected Versions: < 7.5.6, >= 8.0.0, < 8.0.2

Vulnerability: This vulnerability is identified as CWE-94 (Code Injection). An unauthenticated attacker can exploit the way the library compiles protobuf definitions into JavaScript functions to achieve arbitrary code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a serious threat to application security. Successful exploitation could lead to full application compromise, allowing an attacker to manipulate data, bypass security controls, or extract sensitive information processed by the library.

Remediation Plan

Immediate Action: Update the npm package protobufjs to version 7.5.6 or 8.0.2, depending on the current branch in use.

Proactive Monitoring: Monitor applications using this library for unexpected behavior or unauthorized execution of JavaScript functions during the serialization/deserialization process.

Compensating Controls: If immediate patching is not feasible, restrict the library's ability to process untrusted or externally sourced protobuf definitions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The library's core function of compiling definitions makes it a high-value target for injection attacks.

Analyst Recommendation

Security teams must prioritize updating the protobufjs dependency to the identified secure versions. Failure to patch this vulnerability leaves applications vulnerable to remote code execution, which could be leveraged to compromise the entire host environment.

Description Summary:
A logic error in AWS-LC CRL distribution point validation causes partitioned CRLs to be incorrectly rejected, leading to the bypass of certificate revocation checks.

Executive Summary:
A logic error in the AWS-LC cryptographic library allows revoked certificates to bypass validation checks, potentially compromising the integrity of secure communications.

Vulnerability Details

CVE-ID: CVE-2026-4428

Affected Software: AWS AWS-LC

Affected Versions: AWS-LC 1.24.0 up to 1.71.0, AWS-LC-FIPS 3.0.0 up to 3.3.0

Vulnerability: The vulnerability is an improper check for certificate revocation (CWE-299) that occurs during CRL distribution point validation. An unauthenticated attacker can leverage this flaw to ensure that revoked certificates are accepted as valid by the affected library.

Business Impact

This vulnerability poses a significant risk to the authenticity and confidentiality of encrypted traffic. By bypassing revocation checks, an attacker could potentially utilize compromised or revoked certificates to perform man-in-the-middle attacks or impersonate trusted entities. With a CVSS score of 7.4, this high-severity flaw requires prompt attention to maintain the trust boundary of internal and external network services.

Remediation Plan

Immediate Action: Update AWS-LC to version 1.71.0 or AWS-LC-FIPS to version 3.3.0. For environments utilizing Rust, ensure the dependent crates are updated to aws-lc-sys 0.39.0 or aws-lc-fips-sys 0.13.13.

Proactive Monitoring: Review application logs for unusual TLS handshake patterns or certificate validation errors that may indicate an attempt to utilize revoked credentials.

Compensating Controls: Ensure that network-level traffic inspection is active and that certificate pinning is implemented where feasible to reduce reliance on standard revocation checks in high-risk environments.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the logic of certificate validation within the library and does not require complex exploit delivery, making the timely application of vendor patches the most effective defense.

Analyst Recommendation

Given the potential for certificate validation bypass, organizations should prioritize the update of any services or applications bundling the AWS-LC library. Failure to address this flaw leaves systems vulnerable to the acceptance of revoked identities, which undermines the core security posture of TLS-dependent communications. Apply the provided fixes immediately to restore robust certificate revocation enforcement.