---METADATA---
VENDOR: Mattermost
PRODUCT: Plugin Legal Hold
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Mattermost Plugin Legal Hold allows for potential security bypasses in version 1 and earlier.

Executive Summary:
The Mattermost Plugin Legal Hold is affected by a high-severity vulnerability that could facilitate unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3524

Affected Software: Mattermost Plugin Legal Hold

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Legal Hold plugin for Mattermost, potentially allowing an attacker to bypass intended security controls. The flaw may allow unauthorized access to sensitive legal hold data depending on the authentication context.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive legal records stored within the Mattermost environment. With a CVSS score of 8.8, this poses a substantial risk to legal compliance and organizational confidentiality.

Remediation Plan

Immediate Action: Update the Legal Hold plugin to the latest available version provided by Mattermost.

Proactive Monitoring: Review audit logs for unauthorized access to the Legal Hold plugin or export functions.

Compensating Controls: Limit access to the Legal Hold plugin functionality to a restricted set of authorized users using role-based access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates immediate attention to ensure sensitive legal data remains protected.

Analyst Recommendation

Organizations utilizing the Mattermost Legal Hold plugin must update to the latest version immediately to mitigate this high-risk vulnerability. Ensuring that security patches are applied promptly is critical for maintaining data integrity.

---METADATA---
VENDOR: Oracle
PRODUCT: MCP Server Helper Tool
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Oracle MCP Server Helper Tool component of Oracle Open Source Projects.

Executive Summary:
A high-severity vulnerability in the Oracle MCP Server Helper Tool may allow for unauthorized system interaction, necessitating immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-35228

Affected Software: Oracle MCP Server Helper Tool

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the helper tool component of the Oracle MCP Server. The specific nature of the flaw requires further technical disclosure from the vendor, but users should assume the potential for unauthorized access or execution within the environment.

Business Impact

With a CVSS score of 8.7, this vulnerability is classified as High. Successful exploitation could lead to unauthorized system access, potential data compromise, or service disruption, significantly impacting operational continuity and security posture.

Remediation Plan

Immediate Action: Review the official Oracle security advisory for patch availability and apply all recommended updates to the MCP Server environment.

Proactive Monitoring: Monitor server access logs for anomalous behavior or unauthorized process execution originating from the helper tool.

Compensating Controls: Restrict network access to the affected service using internal firewalls to limit the attack surface while awaiting patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Given the High severity rating, organizations should treat this as a priority update. Ensure that all instances of the Oracle MCP Server Helper Tool are identified and patched as soon as the vendor releases the necessary security updates.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Budibase platform could allow for unauthorized actions, potentially leading to a breach of the application environment.

Executive Summary:
The Budibase low-code platform contains a high-severity flaw that may allow attackers to bypass security controls and access sensitive application data.

Vulnerability Details

CVE-ID: CVE-2026-35218

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the Budibase open-source platform. Based on the high CVSS score of 8.7, it is likely that the flaw permits an attacker to perform high-impact actions, such as bypassing capability checks or executing unauthorized commands within the application context.

Business Impact

A breach of a Budibase instance could result in the loss of critical business data and the disruption of automated workflows. Because these platforms often integrate with multiple third-party services, an attacker could potentially use this vulnerability to move laterally into other connected systems. The high CVSS score underscores the urgent need for remediation.

Remediation Plan

Immediate Action: Update Budibase to the latest version provided by the vendor to address this security vulnerability.

Proactive Monitoring: Monitor database query logs and API request patterns for any signs of anomalous behavior or unauthorized data extraction.

Compensating Controls: Implement strong multi-factor authentication (MFA) for all Budibase users and restrict administrative privileges to the minimum necessary personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, the risk remains high due to the functional power of the affected platform.

Analyst Recommendation

It is critical to apply the vendor's security updates immediately. Given the potential for high-impact data compromise, security teams should verify the update across all Budibase deployments to ensure the environment is fully protected against this flaw.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to version 3.33.4
---END_METADATA---

Description Summary:
Budibase versions prior to 3.33.4 contain an unauthenticated Remote Code Execution (RCE) flaw. Attackers can trigger Bash-based automations via a public webhook to execute commands as root.

Executive Summary:
Budibase is vulnerable to a critical unauthenticated remote code execution flaw that allows attackers to execute arbitrary commands as the root user via public webhooks.

Vulnerability Details

CVE-ID: CVE-2026-35216

Affected Software: Budibase Budibase

Affected Versions: Prior to version 3.33.4

Vulnerability: This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution (RCE) by triggering a specific automation containing a Bash step through the public webhook endpoint. The exploit requires no authentication and executes with root privileges within the server container.

Business Impact

A successful exploit results in the total compromise of the Budibase server, allowing attackers to steal sensitive data, modify applications, or move laterally within the network. The CVSS score of 9.0 reflects the critical nature of unauthenticated root-level access. Organizations may face significant data breaches and operational downtime if this vulnerability is exploited.

Remediation Plan

Immediate Action: Update Budibase to version 3.33.4 or later immediately to patch the vulnerable automation logic.

Proactive Monitoring: Monitor access logs for unusual requests to the public webhook endpoint and review container logs for unexpected Bash execution.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to webhook endpoints to known, trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—specifically the lack of authentication and root execution—the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, as it grants full system control to unauthenticated remote actors. IT teams must prioritize the update to Budibase version 3.33.4 immediately. Failure to patch leaves the entire low-code environment and its underlying data exposed to complete takeover.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Budibase open-source low-code platform that could lead to unauthorized access or system compromise.

Executive Summary:
Budibase is affected by a high-severity vulnerability that could allow attackers to compromise the low-code application environment and its associated data.

Vulnerability Details

CVE-ID: CVE-2026-35214

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Budibase platform, though the specific technical mechanism is not detailed in the summary. Given the CVSS score of 8.7, it likely involves a flaw in authentication, access control, or remote code execution within the application framework.

Business Impact

As a low-code platform, Budibase often handles sensitive business logic and data integrations. A compromise could lead to the exposure of proprietary application data, unauthorized modification of business workflows, and potential access to connected databases. The CVSS score of 8.7 indicates a high risk to the confidentiality and integrity of the platform.

Remediation Plan

Immediate Action: Administrators should update their Budibase instances to the latest secure version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review application access logs for unusual login activity or unauthorized changes to application schemas and configurations.

Compensating Controls: Ensure that Budibase is deployed behind a robust Web Application Firewall (WAF) and that network access is restricted to authorized IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the popularity of Budibase in corporate environments makes it an attractive target for attackers.

Analyst Recommendation

Apply the primary remediation patch immediately. Organizations utilizing Budibase for critical business functions should prioritize this update to prevent unauthorized access to their low-code applications and underlying data sources.

---METADATA---
VENDOR: Apache
PRODUCT: Flink
AFFECTED_VERSIONS: 1.15.0 up to (excluding) 1.20.4, 2.0.2, 2.1.2, 2.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache Flink is vulnerable to code injection during SQL code generation, which can be exploited by authenticated users to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in Apache Flink allows authenticated attackers to execute arbitrary code via the SQL interface.

Vulnerability Details

CVE-ID: CVE-2026-35194

Affected Software: Apache Flink

Affected Versions: 1.15.0 up to (excluding) 1.20.4, 2.0.2, 2.1.2, 2.2.1

Vulnerability: This is a code injection vulnerability (CWE-94) in the SQL code generation component of Apache Flink. It requires an attacker to have authenticated access to the system to trigger the injection through specially crafted SQL queries.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary code within the context of the Flink service, potentially leading to full system compromise, data theft, or lateral movement within the network. Given the CVSS score of 8.1, the impact is severe, particularly in environments where Flink processes sensitive data or has high-level system permissions.

Remediation Plan

Immediate Action: Upgrade to Apache Flink versions 1.20.4, 2.0.2, 2.1.2, or 2.2.1 to resolve the code generation flaw.

Proactive Monitoring: Monitor SQL query logs for unusual syntax or patterns that may indicate attempts to inject code into the generation process.

Compensating Controls: Restrict access to the Flink SQL interface to trusted users only and implement strict network segmentation to limit the reach of a potential compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication reduces the attack surface but does not eliminate the risk from malicious or compromised internal accounts.

Analyst Recommendation

Given the potential for remote code execution, organizations using Apache Flink must apply the provided security updates as a matter of urgency. Ensure that internal access controls are strictly enforced to minimize the risk of exploitation by unauthorized or compromised users.

---METADATA---
VENDOR: Chyrp Lite
PRODUCT: Chyrp Lite
AFFECTED_VERSIONS: Prior to 2026.01
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Chyrp Lite administration console allows authenticated users to access arbitrary files and achieve remote code execution.

Executive Summary:
Chyrp Lite is vulnerable to a critical path traversal flaw that allows authenticated users to overwrite system files and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-35174

Affected Software: Chyrp Lite

Affected Versions: Prior to 2026.01

Vulnerability: The administration console contains a path traversal vulnerability that permits users with 'Change Settings' permissions to modify the uploads path. This can be abused to read sensitive files, such as config.json.php, to extract database credentials, or to overwrite system files to achieve remote code execution.

Business Impact

Given the CVSS score of 9.1, this vulnerability is critical. An attacker with minimal administrative access can escalate their privileges to full system compromise, resulting in complete data exposure and loss of control over the blogging engine.

Remediation Plan

Immediate Action: Update Chyrp Lite to version 2026.01 or later immediately.

Proactive Monitoring: Review file integrity logs for unauthorized modifications to core system files and monitor access logs for attempts to traverse directories in the configuration path.

Compensating Controls: Restrict administrative access to the blogging engine to trusted internal IP addresses and enforce the principle of least privilege for all user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for total system compromise makes it a high-risk issue.

Analyst Recommendation

All administrators of Chyrp Lite must upgrade to the latest version immediately. The ability to achieve remote code execution via this flaw makes it a primary target for attackers, and rapid patching is necessary to maintain system security.

---METADATA---
VENDOR: Kedro
PRODUCT: Kedro
AFFECTED_VERSIONS: Prior to 1.3.0
---END_METADATA---

Description Summary:
Kedro is vulnerable to remote code execution due to unvalidated logging configuration paths that permit arbitrary callable instantiation.

Executive Summary:
A critical remote code execution vulnerability in Kedro allows attackers to execute arbitrary system commands via maliciously crafted logging configurations.

Vulnerability Details

CVE-ID: CVE-2026-35171

Affected Software: Kedro

Affected Versions: Prior to 1.3.0

Vulnerability: The application loads logging configurations from a user-controlled environment variable (KEDRO_LOGGING_CONFIG) without validation. The configuration schema allows for arbitrary callable instantiation, which an attacker can exploit to execute system commands.

Business Impact

Exploitation of this vulnerability grants the attacker the ability to execute code with the permissions of the Kedro process. This can lead to total system takeover, data exfiltration, and lateral movement within the production environment, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Upgrade Kedro to version 1.3.0 or later to ensure logging configurations are properly validated.

Proactive Monitoring: Monitor system logs and process execution for unexpected child processes spawned by the Kedro application.

Compensating Controls: Restrict the ability of external users to set environment variables on systems running Kedro and implement OS-level hardening.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to achieve remote code execution makes this a high-priority risk. Administrators must update to the patched version of Kedro immediately to close this execution vector and protect the integrity of the data science environment.

---METADATA---
VENDOR: OpenSTAManager
PRODUCT: OpenSTAManager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the OpenSTAManager technical assistance and invoicing software.

Executive Summary:
Security teams must address a critical vulnerability in OpenSTAManager to prevent potential unauthorized access to sensitive invoicing and support data.

Vulnerability Details

CVE-ID: CVE-2026-35168

Affected Software: OpenSTAManager OpenSTAManager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the OpenSTAManager platform. The flaw, rated at 8.8 on the CVSS scale, likely involves a lack of proper validation or authorization checks, potentially allowing an attacker to manipulate core system functions or access restricted data.

Business Impact

The exploitation of this vulnerability could result in unauthorized access to sensitive business records, including technical support logs and invoicing data. Given the 8.8 CVSS score, the risk to the confidentiality and integrity of business operations is substantial, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update OpenSTAManager to the latest version released by the vendor to address the identified security flaw.

Proactive Monitoring: Review audit logs for unauthorized attempts to access or modify invoicing records and monitor for unusual spikes in traffic.

Compensating Controls: Deploy WAF rules to detect and block malicious payloads that attempt to bypass application-level access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability dictates that it should be treated as a high-priority task. IT administrators should verify the status of their OpenSTAManager installation and apply all vendor-recommended security updates to mitigate the risk of compromise.

---METADATA---
VENDOR: Apache
PRODUCT: Fineract
AFFECTED_VERSIONS: 0 through 1.14.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Apache Fineract Report Execution API (runreports endpoint) allows authenticated users to execute arbitrary SQL commands.

Executive Summary:
A high-severity SQL injection vulnerability in Apache Fineract allows authenticated attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-35152

Affected Software: Apache Fineract

Affected Versions: 0 through 1.14.0

Vulnerability: The application fails to properly sanitize user-supplied input within the Report Execution API. This flaw allows an authenticated attacker to perform SQL injection, potentially leading to unauthorized data access or modification.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, which may contain sensitive financial or user data. Given the CVSS score of 8.8, the potential for unauthorized data exfiltration or corruption poses a significant risk to organizational data integrity and compliance requirements.

Remediation Plan

Immediate Action: Upgrade to the latest version of Apache Fineract as specified by the vendor's security advisory and ensure that the report execution functionality is properly restricted.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax or queries originating from the runreports endpoint that deviate from standard operational behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application APIs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full database access by an authenticated attacker.

Analyst Recommendation

Given the high CVSS score and the direct impact on database security, administrators should prioritize patching this vulnerability immediately. Ensure all authenticated users are audited and that database permissions follow the principle of least privilege to minimize potential damage.

---METADATA---
VENDOR: HCL Software
PRODUCT: DFXServer
AFFECTED_VERSIONS: 2.5 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HCL DFXServer is susceptible to an authentication bypass vulnerability, enabling remote attackers to manipulate server responses to gain unauthorized access.

Executive Summary:
An authentication bypass vulnerability in HCL DFXServer allows remote attackers to compromise system access via server response manipulation.

Vulnerability Details

CVE-ID: CVE-2026-35149

Affected Software: HCL Software DFXServer

Affected Versions: 2.5 and below

Vulnerability: This is an authentication bypass by capture-replay (CWE-294) vulnerability. It allows an unauthenticated remote attacker to bypass security checks by manipulating server responses.

Business Impact

An attacker successfully exploiting this vulnerability can gain unauthorized access to the DFXServer, potentially leading to the compromise of sensitive data or the manipulation of application logic. Given the CVSS score of 8.2, this vulnerability poses a severe risk to the confidentiality and integrity of the application environment.

Remediation Plan

Immediate Action: Update the HCL DFXServer to the latest patched version recommended by the vendor.

Proactive Monitoring: Monitor network traffic and server response logs for anomalous patterns that suggest tampering or replay attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate server responses and block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: No (no weaponized exploit confirmed).

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to its remote, unauthenticated nature.

Analyst Recommendation

The ability for an unauthenticated attacker to bypass authentication makes this a high-priority issue. Administrators should ensure that the HCL DFXServer is updated to the latest version immediately to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: HCL
PRODUCT: DFXServer
AFFECTED_VERSIONS: Version 2.5 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HCL DFXServer is vulnerable to a broken authentication flaw, allowing unauthenticated attackers to bypass security controls via direct API access.

Executive Summary:
An unauthenticated authorization bypass vulnerability in HCL DFXServer permits unauthorized API access, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-35147

Affected Software: HCL DFXServer

Affected Versions: Version 2.5 and below

Vulnerability: This vulnerability is an authorization bypass (CWE-639) occurring within the API management interface. The flaw allows unauthenticated remote attackers to interact with protected API endpoints by manipulating user-controlled keys.

Business Impact

The ability for an unauthenticated actor to interact with the API can lead to unauthorized data exposure and potential manipulation of internal server functions. Given the CVSS score of 8.2, this vulnerability represents a high risk to business operations, as it could facilitate the exfiltration of sensitive information or the unauthorized modification of system data.

Remediation Plan

Immediate Action: Upgrade to a version of HCL DFXServer that addresses this vulnerability, as specified in the HCL support documentation.

Proactive Monitoring: Review API access logs for anomalous request patterns or unauthorized authentication attempts directed at sensitive endpoints.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict direct API access to known, trusted IP addresses until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and high impact on confidentiality.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation over the network without requiring authentication. Organizations using HCL DFXServer must prioritize upgrading to the latest secure version immediately to close this authorization gap and prevent unauthorized system access.

---METADATA---
VENDOR: GDV
PRODUCT: serverconfig
AFFECTED_VERSIONS: Prior to version 6_0_0_7
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the gdv-serverconfig component allows a remote, authenticated user to achieve full system compromise with root-level privileges.

Executive Summary:
A critical stack-based buffer overflow in gdv-serverconfig permits remote attackers with user privileges to execute arbitrary code with root-level access.

Vulnerability Details

CVE-ID: CVE-2026-35085

Affected Software: GDV serverconfig

Affected Versions: Prior to version 6_0_0_7

Vulnerability: This vulnerability, classified as CWE-121, involves a stack-based buffer overflow within the gdv-serverconfig utility. It allows a remote attacker who has already obtained standard user privileges to trigger a memory corruption event, ultimately leading to unauthorized full system access as the root user.

Business Impact

The exploitation of this vulnerability poses a severe threat to system integrity and confidentiality. With a CVSS score of 8.8, this high-severity flaw enables an attacker to bypass standard security boundaries, potentially resulting in complete system takeover, data exfiltration, and the installation of persistent malicious backdoors.

Remediation Plan

Immediate Action: Update the gdv-serverconfig component to version 6_0_0_7 or later as specified in the vendor advisory (certvde.com/VDE-2026-039).

Proactive Monitoring: Audit system logs for unauthorized configuration changes or attempts to invoke root-level processes by standard user accounts.

Compensating Controls: Implement strict access control lists (ACLs) to limit which users can interact with the serverconfig service, reducing the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability to escalate privileges to root, this vulnerability represents a significant risk to organizational infrastructure. Administrators should prioritize patching affected systems to version 6_0_0_7 immediately to prevent potential privilege escalation.

---METADATA---
VENDOR: Unknown
PRODUCT: dali-devconfig
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack buffer overflow in the dali-devconfig utility allows authenticated users to execute arbitrary code with root privileges.

Executive Summary:
A critical stack buffer overflow in the dali-devconfig utility allows an authenticated attacker to manipulate input parameters and execute arbitrary code with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-35084

Affected Software: dali-devconfig

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack buffer overflow occurring within the dali-devconfig utility. By providing specially crafted input parameters, an authenticated user can trigger the overflow to execute arbitrary code with root privileges.

Business Impact

The CVSS score of 8.8 indicates a severe risk. Exploitation allows an authenticated user to completely compromise the underlying system, leading to unauthorized control, data theft, and potential disruption of services managed by the affected utility.

Remediation Plan

Immediate Action: Apply security updates provided by the vendor as outlined in the official advisory (VDE-2026-039).

Proactive Monitoring: Review system access logs for suspicious input provided to the dali-devconfig utility and monitor for unexpected service restarts or unauthorized code execution.

Compensating Controls: Restrict access to the dali-devconfig utility to authorized administrators only, and use host-based intrusion prevention systems to detect buffer overflow attempts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for arbitrary code execution with root privileges, it presents a significant threat. Administrators must review the vendor advisory (VDE-2026-039) and apply the recommended patches immediately to mitigate the risk of system-level compromise.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack buffer overflow vulnerability exists that allows a remote attacker with existing user privileges to elevate their access to full system root privileges.

Executive Summary:
A stack buffer overflow vulnerability allows a remote attacker with user-level access to escalate their permissions to full system root access.

Vulnerability Details

CVE-ID: CVE-2026-35083

Affected Software: Multiple Products (See vendor advisory)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a stack buffer overflow vulnerability. It requires an attacker to already possess authenticated user privileges, which they then exploit to gain full system-level access as root.

Business Impact

The CVSS score of 8.8 reflects the high risk of complete system takeover. While the vulnerability requires initial user access, the ability to escalate to root privileges allows an attacker to bypass all system security controls, access sensitive data, and maintain long-term persistence within the environment.

Remediation Plan

Immediate Action: Identify affected products in your environment and apply vendor-provided security patches immediately.

Proactive Monitoring: Monitor system logs for signs of unauthorized privilege escalation or unusual crashes of system services that may indicate exploit attempts.

Compensating Controls: Implement the principle of least privilege to ensure that standard user accounts have the minimum access necessary, thereby reducing the impact of a potential escalation attempt.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to gain root access makes this a high-priority vulnerability. Organizations should conduct a thorough inventory of their software to determine if any products are impacted and coordinate with vendors to apply the necessary security updates to prevent privilege escalation.

---METADATA---
VENDOR: Unknown
PRODUCT: ugw-logread
AFFECTED_VERSIONS: Prior to version 6_0_0_7
---END_METADATA---

Description Summary:
The ugw-logread method contains a path traversal vulnerability that allows authenticated remote attackers to access arbitrary local files.

Executive Summary:
An authenticated remote attacker can exploit a path traversal vulnerability in the ugw-logread method to access sensitive local system files.

Vulnerability Details

CVE-ID: CVE-2026-35082

Affected Software: ugw-logread

Affected Versions: Prior to version 6_0_0_7

Vulnerability: This vulnerability is classified as a Path Traversal (CWE-22) flaw occurring in the ugw-logread method. By failing to sufficiently validate user-supplied input, the application allows an attacker with user privileges to escape intended directory boundaries and read sensitive files from the underlying filesystem.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a significant risk of data exposure. An attacker could leverage this access to retrieve configuration files, credentials, or other sensitive system data, which could facilitate further lateral movement or complete system compromise.

Remediation Plan

Immediate Action: Update the affected component to version 6_0_0_7 or later as outlined in the vendor advisory (certvde.com/VDE-2026-036).

Proactive Monitoring: Review application logs for suspicious input patterns, particularly those containing directory traversal sequences (e.g., "../").

Compensating Controls: Use a Web Application Firewall (WAF) configured to inspect and block inputs containing path traversal characters directed at the logread utility.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to read arbitrary files is a critical security failure. Administrators must apply the vendor-supplied patch to version 6_0_0_7 immediately to prevent unauthorized access to sensitive local system data.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can recover a hardcoded password from a firmware image to gain full device access.

Executive Summary:
A critical security flaw allows unauthenticated remote attackers to extract hardcoded credentials from firmware images, granting full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-35075

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves the presence of hardcoded, default credentials within firmware images. An unauthenticated attacker can retrieve these credentials remotely, bypassing authentication mechanisms and gaining full access to the affected hardware devices.

Business Impact

The CVSS score of 9.8 reflects the high risk of unauthorized administrative access. This can lead to total system takeover, unauthorized configuration changes, and the potential for the device to be used as a pivot point for further attacks within the internal network.

Remediation Plan

Immediate Action: Update the affected device firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized administrative login attempts or anomalous behavior originating from devices known to be susceptible to this issue.

Compensating Controls: Isolate vulnerable devices in a restricted network segment and ensure administrative interfaces are not exposed to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Firmware-level vulnerabilities are particularly dangerous as they often bypass standard application-layer security. Administrators must verify device firmware versions and apply patches immediately to eliminate the risk of hardcoded credential extraction.

---METADATA---
VENDOR: Dell
PRODUCT: PowerScale InsightIQ
AFFECTED_VERSIONS: 0 up to (excluding) 6.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dell PowerScale InsightIQ is susceptible to an OS Command Injection vulnerability, allowing an authenticated attacker with high privileges to execute arbitrary commands on the underlying system.

Executive Summary:
An OS Command Injection vulnerability in Dell PowerScale InsightIQ allows authenticated attackers with high privileges to execute arbitrary commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35071

Affected Software: Dell PowerScale InsightIQ

Affected Versions: 0 up to (excluding) 6.3.0

Vulnerability: The application is vulnerable to OS Command Injection (CWE-78) due to improper neutralization of special elements. Based on the CVSS vector (PR:H), this requires an authenticated user with high-level administrative privileges to trigger.

Business Impact

The ability to execute arbitrary OS commands poses a critical risk to the confidentiality, integrity, and availability of the PowerScale environment. Given the CVSS score of 8.2, a successful exploit could allow an attacker to gain full control over the management appliance, leading to unauthorized data access, system disruption, and lateral movement within the network.

Remediation Plan

Immediate Action: Update Dell PowerScale InsightIQ to version 6.3.0 or later as specified in the vendor security advisory.

Proactive Monitoring: Review system and audit logs for unexpected process execution or unusual command-line activity originating from the InsightIQ service account.

Compensating Controls: Ensure that access to the InsightIQ management interface is restricted to authorized administrative personnel only, utilizing network-level access controls to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is 8.2, the requirement for high privileges mitigates the risk from external, unauthenticated attackers.

Analyst Recommendation

Organizations utilizing Dell PowerScale InsightIQ should prioritize patching to version 6.3.0. Although the vulnerability requires high privileges, the potential for total system impact necessitates prompt remediation to prevent unauthorized administrative escalation.

---METADATA---
VENDOR: Dell
PRODUCT: PowerFlex Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Dell PowerFlex Manager is affected by a missing authentication vulnerability that allows unauthenticated attackers to perform critical functions.

Executive Summary:
Dell PowerFlex Manager contains a critical missing authentication vulnerability that permits unauthenticated remote attackers to execute sensitive operations, risking total system control.

Vulnerability Details

CVE-ID: CVE-2026-35065

Affected Software: Dell PowerFlex Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a missing authentication for critical function vulnerability. It allows an unauthenticated attacker to interact with sensitive system functions that should otherwise require valid administrative credentials.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for unauthorized access to management functions without authentication. This could lead to complete administrative takeover of the PowerFlex environment, resulting in data loss, hardware manipulation, and severe operational downtime for enterprise storage infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware or software updates for PowerFlex Manager as soon as they become available.

Proactive Monitoring: Implement strict network segmentation to isolate the management interface and monitor for unauthorized connection attempts or unusual administrative activity.

Compensating Controls: Utilize a VPN or jump host to restrict access to the PowerFlex management interface, ensuring it is not exposed to the public internet or untrusted network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of missing authentication in infrastructure management software, immediate remediation is required. Administrators must ensure that PowerFlex Manager instances are not accessible from untrusted networks and apply all relevant security patches immediately upon release by Dell.

---METADATA---
VENDOR: text-generation-webui
PRODUCT: text-generation-webui
AFFECTED_VERSIONS: Prior to 4.1.1
---END_METADATA---

Description Summary:
The text-generation-webui application allows arbitrary Python file overwriting via extension settings, leading to remote code execution.

Executive Summary:
A critical file overwrite vulnerability in text-generation-webui allows attackers to gain remote code execution by replacing application scripts.

Vulnerability Details

CVE-ID: CVE-2026-35050

Affected Software: text-generation-webui

Affected Versions: Prior to 4.1.1

Vulnerability: The application permits saving extension settings in Python format within the application root. An attacker can overwrite critical files, such as download-model.py, which are subsequently executed by the application.

Business Impact

This vulnerability enables an attacker to achieve persistent code execution on the server running the web interface. Given the 9.1 CVSS score, this facilitates total system compromise and potential access to sensitive model files or user data.

Remediation Plan

Immediate Action: Update to text-generation-webui version 4.1.1 or later.

Proactive Monitoring: Monitor the application root directory for unauthorized file modifications or changes to existing Python scripts.

Compensating Controls: Restrict write permissions on the application directory to the absolute minimum required for the application to function.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of persistent code execution requires immediate remediation. Users must update the software and ensure that file system permissions are correctly configured to prevent unauthorized writes to critical application files.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: <= 16.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Piwigo installer improperly sanitizes database configuration POST parameters, allowing unauthenticated attackers to inject and execute arbitrary PHP code via the configuration file.

Executive Summary:
A critical remote code execution vulnerability in Piwigo versions 16.3.0 and earlier allows unauthenticated attackers to compromise the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-35048

Affected Software: Piwigo Piwigo

Affected Versions: <= 16.3.0

Vulnerability: This vulnerability is an improper input validation flaw affecting the installer process. An unauthenticated attacker can supply malicious POST parameters that are written directly into a PHP configuration file, leading to arbitrary code execution upon system access.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected web server. This could lead to complete data exfiltration, unauthorized modification of site content, and potential lateral movement within the network. Given the CVSS score of 9.8, this represents a critical risk to business continuity and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest version of Piwigo immediately to ensure the installer logic is corrected and input sanitization is properly enforced.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the installation directory or unusual modifications to the database configuration file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads within POST requests, specifically targeting PHP syntax injections.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease of injecting code directly into the application server.

Analyst Recommendation

The severity of this vulnerability cannot be overstated. Organizations running Piwigo must prioritize patching to the latest version, as the lack of authentication requirements makes this an attractive target for automated exploitation. Apply the vendor-provided update immediately to mitigate the risk of a full system compromise.