---METADATA---
VENDOR: CairoSVG
PRODUCT: CairoSVG
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
CairoSVG, a Python-based SVG to PDF/PNG converter, is vulnerable to a flaw that may lead to unauthorized file access or resource exhaustion during graphics processing.

Executive Summary:
The CairoSVG library contains a high-severity vulnerability that could allow an attacker to compromise systems during the conversion of maliciously crafted SVG files.

Vulnerability Details

CVE-ID: CVE-2026-31899

Affected Software: CairoSVG

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the processing of SVG files by the CairoSVG library. Attackers may be able to provide specially crafted SVG files that exploit the underlying Cairo graphics library, potentially leading to Server-Side Request Forgery (SSRF) or local file inclusion.

Business Impact

With a CVSS score of 7.5, this vulnerability poses a high risk to applications that allow users to upload or process SVG images. An exploit could lead to the exposure of internal system files or provide a foothold for further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Upgrade the CairoSVG Python package to the latest version immediately to patch the processing flaw.

Proactive Monitoring: Monitor system resource usage and outbound network connections from servers performing SVG conversions for signs of SSRF or exploitation attempts.

Compensating Controls: Implement strict sandboxing for graphics processing tasks and use a Content Security Policy (CSP) to limit the capabilities of processed SVG content.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. SVG processing libraries are frequent targets for researchers, and public exploits often follow shortly after disclosure.

Analyst Recommendation

Immediate remediation is required for any application utilizing CairoSVG for image conversion. Updating the library is the most effective way to mitigate the risk of remote exploitation and protect internal data from unauthorized access.

---METADATA---
VENDOR: jsPDF
PRODUCT: jsPDF
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
jsPDF contains a high-severity vulnerability within its JavaScript-based PDF generation logic that could allow for malicious exploitation during document creation.

Executive Summary:
A high-severity vulnerability in the jsPDF library poses a significant risk to applications generating client-side documents, potentially allowing for unauthorized code execution or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-31898

Affected Software: jsPDF jsPDF

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the core processing logic of the jsPDF library. While the specific mechanism is not detailed in the summary, vulnerabilities in this library often involve unauthenticated attackers manipulating document inputs to trigger improper memory handling or script execution.

Business Impact

A successful exploit could lead to the generation of malicious PDF files, which may be used to deliver further payloads to end-users or compromise the environment where the PDF is generated. With a CVSS score of 8.1, this represents a High-tier risk that could result in significant reputational damage and the loss of data integrity within automated reporting systems.

Remediation Plan

Immediate Action: Update the jsPDF library to the latest patched version available on npm or via the project's official repository to mitigate the underlying flaw.

Proactive Monitoring: Implement strict input validation for any user-supplied data that is incorporated into generated PDFs to detect and block injection attempts.

Compensating Controls: Deploy Content Security Policies (CSP) to restrict the execution of unauthorized scripts that might be triggered during the PDF generation process.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the widespread use of jsPDF in web applications, the potential for exploitation is high.

Analyst Recommendation

The High severity of this vulnerability (CVSS 8.1) necessitates immediate attention from development teams. Organizations should prioritize updating their dependencies and auditing their PDF generation workflows to ensure that malicious inputs cannot bypass existing security controls.

---METADATA---
VENDOR: WeGIA
PRODUCT: WeGIA
AFFECTED_VERSIONS: Prior to 3.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WeGIA contains a critical SQL injection vulnerability in the remover_produto_ocultar.php script due to improper handling of user-supplied request data.

Executive Summary:
A critical SQL injection vulnerability in WeGIA allows attackers to execute arbitrary database commands, leading to total data exfiltration or system disruption.

Vulnerability Details

CVE-ID: CVE-2026-31896

Affected Software: WeGIA

Affected Versions: Prior to 3.6.6

Vulnerability: The vulnerability stems from the use of extract($_REQUEST) followed by direct concatenation of variables into a SQL query. This allows an attacker to manipulate SQL queries, enabling unauthorized data access or denial-of-service via time-based attacks.

Business Impact

The severity of this flaw is underscored by the 9.8 CVSS score, indicating critical risk. An attacker can bypass security controls to extract the entire contents of the database, potentially including sensitive donor or institutional information, or render the application unusable.

Remediation Plan

Immediate Action: Update the WeGIA application to version 3.6.6 immediately to implement secure parameter binding and remove unsafe request handling.

Proactive Monitoring: Review database audit logs for anomalous query patterns, specifically looking for time-based delay commands or unexpected syntax.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious requests targeting the vulnerable script.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a high-impact vulnerability that requires immediate attention. Administrators must prioritize the update to version 3.6.6 to eliminate the insecure query execution path and protect institutional data.

---METADATA---
VENDOR: Dagu
PRODUCT: Dagu
AFFECTED_VERSIONS: Versions prior to 2.2.4
---END_METADATA---

Description Summary:
A path traversal vulnerability in Dagu's workflow engine allows attackers to manipulate the dagRunId field to delete arbitrary directories, including the system temporary directory.

Executive Summary:
A critical path traversal vulnerability in Dagu allows for arbitrary directory deletion, potentially leading to a system-wide denial of service on root or Docker deployments.

Vulnerability Details

CVE-ID: CVE-2026-31886

Affected Software: Dagu Workflow Engine

Affected Versions: Versions prior to 2.2.4

Vulnerability: This flaw exists in the inline DAG execution endpoints where the dagRunId field is passed to filepath.Join without validation. An unauthenticated or unauthorized caller can use ".." segments to traverse the file system, causing a deferred os.RemoveAll call to delete unintended directories, such as /tmp.

Business Impact

A successful exploit can result in a total Denial of Service (DoS). In non-root deployments, the attacker can disrupt all concurrent Dagu processes by deleting their temporary files. In root or Docker environments, the deletion of the entire /tmp directory can crash the underlying operating system and all hosted services. The CVSS score of 9.1 reflects the critical nature of this availability impact and the lack of complex requirements for exploitation.

Remediation Plan

Immediate Action: Update Dagu to version 2.2.4 or later immediately to resolve the path validation flaw and prevent unauthorized directory deletion.

Proactive Monitoring: Review system logs for HTTP requests containing directory traversal sequences (e.g., "../") targeted at DAG execution endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path traversal characters in the dagRunId parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of constructing a traversal payload, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, particularly for organizations running Dagu in containerized or root-privileged environments. The ability for an attacker to trigger a system-wide denial of service necessitates an immediate upgrade to version 2.2.4. Organizations should prioritize this patch in their next maintenance window to mitigate the risk of significant operational downtime.

---METADATA---
VENDOR: Taskosaur
PRODUCT: Taskosaur
AFFECTED_VERSIONS: 1.0.0
---END_METADATA---

Description Summary:
Taskosaur 1.0.0 allows unauthenticated attackers to register accounts with SUPER_ADMIN privileges by manually modifying the role parameter during the registration process.

Executive Summary:
A critical privilege escalation vulnerability in Taskosaur allows any unauthenticated user to register as a SUPER_ADMIN, granting them full control over the project management platform.

Vulnerability Details

CVE-ID: CVE-2026-31874

Affected Software: Taskosaur

Affected Versions: 1.0.0

Vulnerability: The application fails to validate the role parameter during user registration. An unauthenticated attacker can manipulate the registration request payload to include a SUPER_ADMIN role, which the backend accepts without restriction, resulting in a fully privileged administrative account.

Business Impact

This flaw allows for the complete compromise of the Taskosaur instance, including access to all project data, AI task execution logs, and user information. With a CVSS score of 9.8, the vulnerability enables an attacker to effectively hijack the entire platform and its integrated conversational AI tools.

Remediation Plan

Immediate Action: Update Taskosaur to a version higher than 1.0.0 that enforces server-side role assignment restrictions.

Proactive Monitoring: Audit the user database for any accounts created with the SUPER_ADMIN role that were not explicitly authorized by existing administrators.

Compensating Controls: Temporarily disable public user registration until the patch is applied or implement a manual approval process for all new accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. The simplicity of this "Insecure Direct Object Reference" (IDOR) style flaw makes it highly likely to be exploited if the platform is public-facing.

Analyst Recommendation

The ability for any user to self-promote to the highest level of administrative access is a fundamental security failure. Immediate remediation via software update is required to protect organizational data and maintain the integrity of the project management environment.

---METADATA---
VENDOR: Cloud
PRODUCT: Cloud CLI (Claude Code UI)
AFFECTED_VERSIONS: Prior to 1.24.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Cloud CLI utility is vulnerable to OS command injection via improper sanitization of Git-related API parameters, allowing authenticated attackers to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in Cloud CLI versions prior to 1.24.0 poses a critical risk by allowing authenticated attackers to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-31862

Affected Software: Cloud, Cloud CLI

Affected Versions: Prior to 1.24.0

Vulnerability: The application utilizes execAsync() with improper string interpolation of user-controlled parameters within Git-related API endpoints. This flaw allows an authenticated attacker to inject and execute arbitrary OS commands.

Business Impact

Successful exploitation grants an attacker the ability to execute commands with the privileges of the application process. Given the CVSS score of 9.1, this vulnerability poses a severe risk of full system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Cloud CLI to version 1.24.0 or later immediately to sanitize input parameters correctly.

Proactive Monitoring: Review system and application logs for suspicious process execution patterns or unexpected shell commands originating from the CLI tool.

Compensating Controls: Restrict access to the CLI utility to authorized users only and ensure the application runs with the principle of least privilege to minimize potential impact.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a critical security risk that can lead to complete system takeover. Organizations using the Cloud CLI must prioritize the update to version 1.24.0 to mitigate the risk of remote command execution.

---METADATA---
VENDOR: Jellyfin
PRODUCT: jellyfin-ios
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The jellyfin-ios GitHub Actions workflow is vulnerable to arbitrary code execution via pull requests, potentially leading to full repository takeover and App Store supply chain attacks.

Executive Summary:
A critical CI/CD workflow vulnerability in the Jellyfin iOS repository allows unauthenticated attackers to execute arbitrary code, threatening the integrity of the Apple App Store supply chain.

Vulnerability Details

CVE-ID: CVE-2026-31852

Affected Software: Jellyfin (jellyfin-ios)

Affected Versions: See vendor advisory for specific workflow revisions.

Vulnerability: The code-quality.yml GitHub Actions workflow improperly handles pull requests from forked repositories. Due to excessive write permissions, an unauthenticated attacker can execute arbitrary code during the CI process, leading to the exfiltration of secrets and the potential poisoning of App Store releases and container registries.

Business Impact

This vulnerability represents a high-impact supply chain risk. A successful exploit could allow an attacker to compromise the entire Jellyfin organization, inject malicious code into official iOS app releases, and exfiltrate highly privileged credentials. The CVSS score of 10 reflects the absolute severity of a potential repository and organization takeover.

Remediation Plan

Immediate Action: No action is required from end users; the Jellyfin maintainers must secure the GitHub Actions workflows by following the principle of least privilege and restricting fork-based triggers.

Proactive Monitoring: Maintainers should audit GitHub Actions logs for suspicious pull request activity and rotate any secrets that may have been exposed during the vulnerable period.

Compensating Controls: Organizations should implement mandatory code review for all CI/CD configuration changes and utilize GitHub's "Require approval for all outside collaborators" setting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. This is a workflow-level vulnerability, meaning the software itself is not "buggy," but the build environment was insecurely configured.

Analyst Recommendation

While end users are not required to take action, this incident highlights the critical importance of CI/CD security. Development teams must ensure that GitHub Actions workflows triggered by external contributors do not have access to sensitive secrets or write permissions.

---METADATA---
VENDOR: Rukovoditel
PRODUCT: CRM
AFFECTED_VERSIONS: 3.6.4 and earlier
---END_METADATA---

Description Summary:
A reflected XSS vulnerability in the Rukovoditel CRM Zadarma telephony API allows unauthenticated attackers to execute malicious scripts.

Executive Summary:
An unauthenticated reflected cross-site scripting (XSS) vulnerability in Rukovoditel CRM poses a high risk of session hijacking and credential theft.

Vulnerability Details

CVE-ID: CVE-2026-31845

Affected Software: Rukovoditel CRM

Affected Versions: 3.6.4 and earlier

Vulnerability: The Zadarma telephony API endpoint (/api/tel/zadarma.php) fails to sanitize the zd_echo GET parameter, allowing an unauthenticated attacker to inject arbitrary JavaScript that executes in the victim's browser.

Business Impact

With a CVSS score of 9.3, this vulnerability is critical. Attackers can exploit this to perform session hijacking, phishing attacks, or account takeovers, potentially leading to unauthorized access to sensitive CRM data and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Rukovoditel CRM to version 3.7 or later.

Proactive Monitoring: Review web server logs for suspicious requests to the Zadarma API endpoint containing script-like patterns.

Compensating Controls: Deploy a WAF with rules configured to detect and block reflected XSS attempts in URL parameters.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 11, 2026, there is no public information indicating active exploitation. However, the ease of exploitation and potential impact necessitate immediate patching.

Analyst Recommendation

Given the high CVSS score and the nature of XSS, organizations should prioritize upgrading to version 3.7 immediately to eliminate the injection vector.

---METADATA---
VENDOR: goodoneuz
PRODUCT: pay-uz Laravel package
AFFECTED_VERSIONS: <= 2.2.24
---END_METADATA---

Description Summary:
The pay-uz Laravel package contains an unauthenticated remote code execution vulnerability via the /payment/api/editable/update endpoint.

Executive Summary:
An unauthenticated remote code execution vulnerability in the pay-uz Laravel package allows attackers to overwrite critical payment files and execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-31843

Affected Software: goodoneuz pay-uz Laravel package

Affected Versions: <= 2.2.24

Vulnerability: The application fails to implement authentication middleware on the /payment/api/editable/update endpoint, allowing unauthenticated attackers to write arbitrary content into executable PHP files. These files are subsequently executed by the server, resulting in remote code execution (RCE).

Business Impact

With a CVSS score of 9.8, this is a critical vulnerability that grants an attacker full control over the application server. The potential impact includes the theft of sensitive financial data, unauthorized transactions, and complete server compromise, which could lead to significant reputational and financial damage.

Remediation Plan

Immediate Action: Update the pay-uz package to the latest secure version immediately and audit the /payment/api/ directory for unauthorized file modifications.

Proactive Monitoring: Monitor access logs for unauthorized POST requests to the /payment/api/editable/update endpoint and inspect file integrity on the server.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block traffic to the vulnerable endpoint and restrict access to the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the ease of exploitation (no authentication required), the risk is extreme.

Analyst Recommendation

This vulnerability is highly severe due to the lack of required authentication and the direct impact on code execution. Organizations utilizing this package must treat this as a top-priority remediation item and verify the integrity of their payment processing workflows immediately.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to version 3.33.4
---END_METADATA---

Description Summary:
Budibase versions prior to 3.33.4 are vulnerable to Server-Side Request Forgery (SSRF). The SSRF protection is ineffective by default, allowing unauthenticated requests to internal services.

Executive Summary:
Budibase is vulnerable to a critical unauthenticated SSRF flaw because its internal IP blacklist protection is disabled by default in official deployment configurations.

Vulnerability Details

CVE-ID: CVE-2026-31818

Affected Software: Budibase Budibase

Affected Versions: Prior to version 3.33.4

Vulnerability: A Server-Side Request Forgery (SSRF) exists in the REST datasource connector. The platform's protection mechanism is ineffective because the BLACKLIST_IPS environment variable is empty by default, causing the security check to return false and allow all requests to internal resources.

Business Impact

Attackers can use the Budibase server as a proxy to scan and attack internal network services that are not otherwise reachable from the internet. The CVSS score of 9.6 highlights the high risk of internal infrastructure exposure, which could lead to secondary compromises of databases or internal management tools.

Remediation Plan

Immediate Action: Update Budibase to version 3.33.4 and ensure that the BLACKLIST_IPS environment variable is correctly populated with internal and reserved IP ranges.

Proactive Monitoring: Review outbound network logs from the Budibase server for requests directed at internal IP addresses (e.g., 10.x.x.x, 192.168.x.x).

Compensating Controls: Use network-level egress filtering to prevent the Budibase container from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the "fail-open" nature of the protection mechanism makes this highly exploitable in standard installations.

Analyst Recommendation

This SSRF vulnerability effectively neutralizes the network perimeter for any organization running Budibase. It is imperative to update to version 3.33.4 immediately. Furthermore, administrators should adopt a "deny-by-default" egress policy for application containers to mitigate the impact of similar SSRF flaws in the future.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Server
AFFECTED_VERSIONS: 3.31.4 and earlier
---END_METADATA---

Description Summary:
A regex bypass in Budibase's middleware allows unauthenticated attackers to skip all authentication and authorization checks by appending a webhook path pattern to any API request URL.

Executive Summary:
A critical authentication bypass in Budibase allows unauthenticated remote attackers to access any server-side API endpoint, resulting in complete unauthorized control over the platform.

Vulnerability Details

CVE-ID: CVE-2026-31816

Affected Software: Budibase Server

Affected Versions: 3.31.4 and earlier

Vulnerability: The isWebhookEndpoint() function uses an unanchored regex against the full request URL, which includes query parameters. An unauthenticated attacker can bypass the authorized() middleware by appending ?/webhooks/trigger to any request, skipping all role checks and CSRF protections.

Business Impact

This vulnerability effectively disables the security layer of the entire Budibase platform. An attacker can perform any action permitted by the API, including data exfiltration, user manipulation, and workflow modification. The CVSS score of 9.1 reflects the critical risk to organizational data and the ease with which an unauthenticated actor can compromise the internal tools built on the platform.

Remediation Plan

Immediate Action: Upgrade Budibase server to version 3.31.5 or later immediately to resolve the regex validation error in the middleware.

Proactive Monitoring: Inspect server logs for any API requests containing query strings with webhook-related patterns (e.g., webhooks/trigger) originating from unauthorized users.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests where the query string contains path traversal or webhook-specific keywords used to bypass middleware logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of appending a query string to bypass authentication makes this an extremely attractive target for attackers.

Analyst Recommendation

This is a "zero-click" authentication bypass that places all data within the Budibase environment at risk. It is imperative that administrators apply the update to version 3.31.5 immediately to re-establish the security perimeter of their low-code applications.

---METADATA---
VENDOR: Intel
PRODUCT: Linux Kernel (perf/x86)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory management vulnerability exists in the Linux kernel's perf/x86 subsystem, specifically involving improper handling of auto counter reload and software event groups.

Executive Summary:
A flaw in the Linux kernel’s perf/x86 subsystem could allow for memory corruption, potentially leading to system instability or local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-31782

Affected Software: Intel Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue involves a potential bad container_of pointer cast within the intel_pmu_hw_config function. This occurs when an auto counter reload process interacts with a mixed group of events, potentially leading to memory corruption.

Business Impact

With a CVSS score of 7.8, this high-severity vulnerability poses a significant risk to system integrity. Exploitation by a local, authenticated attacker could result in kernel-level crashes (Denial of Service) or potentially arbitrary code execution, compromising the confidentiality and availability of the host system.

Remediation Plan

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer to address the kernel-level memory management flaw.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: Restrict access to performance monitoring tools (e.g., perf) to highly privileged users only to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the kernel in system security, organizations should prioritize patching affected systems. Ensure that your automated patch management workflows are updated to include the latest kernel security releases to mitigate this risk effectively.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux Kernel (mainline, including 7.1-rc1, 6.12 through 6.19.x)
---END_METADATA---

Description Summary:
An authentication bypass in the Linux kernel's ksmbd SMB3 server allows attackers to hijack durable file handles.

Executive Summary:
An authentication bypass in the Linux kernel's ksmbd module enables attackers to hijack durable file handles, posing a high risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-31717

Affected Software: Linux Kernel

Affected Versions: Linux Kernel (mainline, including 7.1-rc1); Linux distributions shipping ksmbd with SMB2 durable handle support; Linux 6.12 through 6.19.x

Vulnerability: This is an authentication bypass where the ksmbd server fails to verify if the security context of a reconnect request matches the original file open. An attacker can hijack orphaned durable handles to gain unauthorized access to files.

Business Impact

With a CVSS score of 8.8, this is a significant security flaw for file servers. Attackers can gain unauthorized access to sensitive files, violating the MS-SMB2 protocol specification and potentially leading to the theft of confidential information.

Remediation Plan

Immediate Action: Apply the kernel patch associated with commit 49110a8ce654 immediately to enforce durable handle owner validation.

Proactive Monitoring: Monitor SMB server logs for unauthorized attempts to reconnect to existing file handles or abnormal session behavior.

Compensating Controls: Disable durable handle support in ksmbd configuration if it is not required for business operations.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 2, 2026, public PoC exploits are available. Given the ability to hijack existing sessions, immediate patching is required to protect sensitive file shares.

Analyst Recommendation

The availability of public exploit code makes this a high-priority remediation. Organizations running ksmbd as an SMB3 server must apply the provided kernel patch immediately to prevent unauthorized file access.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Linux kernel ksmbd module fails to properly validate ACE sizes in smb_check_perm_dacl, allowing for buffer boundary violations when processing access control lists.

Executive Summary:
The Linux kernel ksmbd module contains a flaw in access control list processing that fails to validate ACE sizes, potentially leading to memory access violations.

Vulnerability Details

CVE-ID: CVE-2026-31712

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the smb_check_perm_dacl() function within the ksmbd module. The function fails to enforce a minimum size for Access Control Entries (ACEs), allowing an attacker to supply malformed ACE structures that bypass existing boundary checks.

Business Impact

The vulnerability is rated at 8.3 (High) on the CVSS scale, reflecting the potential for memory access violations within the kernel. Exploitation of such flaws can lead to system instability, denial of service, or potentially facilitate more complex exploitation chains aimed at unauthorized access to files governed by SMB shares.

Remediation Plan

Immediate Action: Apply the relevant kernel security patches provided by your distribution vendor immediately to ensure proper validation of ACE structures.

Proactive Monitoring: Review system audit logs and kernel crash reports for evidence of unexpected memory access errors associated with SMB traffic.

Compensating Controls: Implement strict network-level access controls to limit exposure of the SMB service and verify that the ksmbd module is configured with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which involves improper input validation in critical kernel code, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the ongoing need for rigorous input validation within the kernel's SMB implementation. Security teams should prioritize patching this issue to maintain the integrity of the kernel environment and prevent potential memory-based attacks against the file-sharing subsystem.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Linux kernel SMB client allows for improper validation of DACL pointers, potentially leading to security descriptor corruption.

Executive Summary:
The Linux kernel contains a high-severity vulnerability in the SMB client that could be leveraged to manipulate security descriptors.

Vulnerability Details

CVE-ID: CVE-2026-31709

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the SMB client's handling of DACL (Discretionary Access Control List) validation within build_sec_desc() and id_mode_to_cifs_acl(). An attacker capable of manipulating server-supplied DACL offsets could trigger an invalid pointer reference, potentially leading to unauthorized security descriptor modification.

Business Impact

With a CVSS score of 8.8, this kernel-level flaw poses a critical risk to data integrity and system access controls. Successful exploitation could allow a malicious actor to bypass file permissions or corrupt system security descriptors, leading to privilege escalation or unauthorized data access within a networked environment.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest stable release provided by your distribution vendor that includes the fix for this SMB client vulnerability.

Proactive Monitoring: Audit system logs for kernel-related errors or anomalies specifically involving SMB/CIFS mount points and permission change operations.

Compensating Controls: Restrict access to untrusted SMB servers and utilize network-level segmentation to limit the reach of potential SMB-based attacks within the infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of kernel-level flaws necessitates proactive patching to prevent potential local or remote privilege escalation.

Analyst Recommendation

Kernel vulnerabilities require high-priority remediation due to their potential for total system compromise. Administrators must coordinate with their Linux distribution maintainers to apply the necessary security updates to ensure the integrity of the kernel's access control mechanisms.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Linux kernel's smb client, specifically within the smb2_ioctl_query_info function, involving an out-of-bounds read.

Executive Summary:
An out-of-bounds read vulnerability in the Linux kernel's SMB client, rated at high severity, could potentially lead to system instability or information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-31708

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the smb2_ioctl_query_info function, specifically within the QUERY_INFO path. An attacker capable of influencing the SMB response could trigger an out-of-bounds read, potentially leading to memory corruption or the leakage of sensitive kernel memory.

Business Impact

A CVSS score of 8.1 reflects the critical nature of kernel-level vulnerabilities. Successful exploitation could result in a system crash (Denial of Service) or the exposure of sensitive data residing in kernel memory, which could be leveraged by an attacker to facilitate further privilege escalation or system compromise.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest distribution-provided version that includes the fix for this smb client issue.

Proactive Monitoring: Monitor system logs for kernel panics or repeated service crashes related to SMB/CIFS mount points.

Compensating Controls: Restrict access to untrusted or potentially malicious SMB servers, as the vulnerability typically requires interaction with a malicious SMB response to trigger.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities are inherently dangerous due to their potential for full system impact. Security teams should prioritize patching the Linux kernel across all affected environments immediately. Ensure that kernel updates are tested in a staging environment before widespread deployment to prevent operational disruptions while maintaining a robust security posture.