---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux Kernel (multiple versions)
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's NFC LLCP subsystem results from missing return statements after socket state checks.

Executive Summary:
A use-after-free vulnerability in the Linux kernel's NFC LLCP subsystem could be exploited to cause system instability or potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-31629

Affected Software: Linux Kernel

Affected Versions: Linux Kernel (multiple versions); Systems with NFC hardware and LLCP subsystem enabled

Vulnerability: The flaw occurs in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc() where missing return statements after LLCP_CLOSED checks lead to double release operations on socket resources, causing a reference count underflow.

Business Impact

The CVSS score of 8.8 indicates a high-severity issue. An attacker with adjacent network access could exploit this reference count underflow to trigger a use-after-free condition, potentially leading to system crashes or arbitrary code execution on the target device.

Remediation Plan

Immediate Action: Update to a kernel version that includes the fix for missing return statements in the NFC LLCP subsystem.

Proactive Monitoring: Monitor system logs for NFC-related errors or kernel warnings associated with socket state management.

Compensating Controls: Disable the NFC LLCP subsystem if it is not required for device functionality.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the complexity of kernel-level networking code. Administrators should prioritize patching systems that utilize NFC LLCP to prevent potential exploitation by attackers within physical proximity.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux Kernel (multiple versions with NFC digital protocol support enabled)
---END_METADATA---

Description Summary:
A heap buffer overflow in the Linux kernel's NFC digital protocol subsystem allows for potential arbitrary code execution.

Executive Summary:
A heap buffer overflow in the Linux kernel's NFC subsystem poses a critical risk, potentially allowing an attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-31622

Affected Software: Linux Kernel

Affected Versions: Linux Kernel (multiple versions with NFC digital protocol support enabled); Systems with NFC-A hardware and the digital NFC driver loaded

Vulnerability: The vulnerability is a heap buffer overflow in digital_in_recv_sdd_res() caused by a lack of bounds checking on the NFC-A cascade depth. A malicious peer device can trigger this overflow to overwrite heap memory.

Business Impact

With a CVSS score of 8.8, this vulnerability is highly dangerous for mobile and embedded devices. Successful exploitation could lead to arbitrary code execution, granting an attacker full control over the affected device via proximity-based NFC communication.

Remediation Plan

Immediate Action: Apply the kernel patch associated with commit e329e71013c9 or update to the latest available kernel distribution.

Proactive Monitoring: If NFC is not required, disable the affected NFC digital protocol drivers to eliminate the attack surface.

Compensating Controls: Implement kernel-level exploit mitigations if hardware constraints prevent immediate patching.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

For devices utilizing NFC, this vulnerability is a high priority. Organizations should audit their device fleet to identify systems with NFC enabled and deploy the necessary kernel updates immediately.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (SMB Client)
AFFECTED_VERSIONS: Multiple versions, including Red Hat Enterprise Linux 6, 7, 8, 9, 10 kernel packages.
---END_METADATA---

Description Summary:
The Linux kernel SMB client implementation contains an out-of-bounds read vulnerability when parsing symlink error responses due to insufficient length validation.

Executive Summary:
A high-severity out-of-bounds read vulnerability in the Linux kernel SMB client could allow an untrusted server to leak sensitive kernel memory.

Vulnerability Details

CVE-ID: CVE-2026-31613

Affected Software: Linux Kernel (SMB Client)

Affected Versions: Multiple versions, including Red Hat Enterprise Linux 6, 7, 8, 9, 10.

Vulnerability: This is an Out-of-Bounds Read vulnerability (CWE-125) in the smb2_check_message() function. The flaw allows a malicious or compromised SMB server to provide a crafted symlink error response that lacks proper length checks, potentially allowing an attacker to read kernel memory via the readlink(2) system call.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a severe risk to data confidentiality. By leaking sensitive kernel memory, an attacker could obtain information required to bypass other security protections, such as KASLR, facilitating further exploitation. The risk is particularly relevant for environments that frequently mount untrusted or remote SMB shares.

Remediation Plan

Immediate Action: Apply the latest kernel updates provided by your Linux distribution vendor to incorporate the necessary length validation fixes.

Proactive Monitoring: Review system call logs for anomalous readlink behavior or frequent SMB-related connectivity errors that might indicate an attempt to probe the client's memory.

Compensating Controls: Ensure that SMB mounts are only performed against trusted, authenticated, and hardened server infrastructure to mitigate the risk of interaction with a malicious server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of trusting remote file system responses. System administrators should prioritize updating kernel packages to ensure that SMB client operations correctly validate response lengths, effectively neutralizing the risk of kernel memory exposure.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel (ksmbd)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the Linux kernel's ksmbd component allows unauthorized memory access via malicious SID structures.

Executive Summary:
A network-exploitable memory access vulnerability in the Linux kernel's ksmbd component could lead to unauthorized access or system instability.

Vulnerability Details

CVE-ID: CVE-2026-31611

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an out-of-bounds read vulnerability in the parse_dacl() function. The vulnerability occurs because the code does not verify that a Security Identifier (SID) contains at least 3 sub-authorities before attempting to access sub_auth[2], allowing an attacker to read out-of-bounds memory.

Business Impact

The vulnerability is network-exploitable, meaning an attacker could potentially gain unauthorized access to file resources or cause a system crash by sending a crafted SID. With a CVSS score of 8.6, this is a high-severity risk for any infrastructure utilizing the ksmbd server for file sharing.

Remediation Plan

Immediate Action: Apply the latest kernel security patches from your vendor. Multiple commits are available for various kernel branches to ensure the SID structure is validated before access.

Proactive Monitoring: Review ksmbd access logs for anomalous or malformed SID patterns that may indicate an exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level firewall rules to restrict access to the ksmbd service to trusted subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability is network-accessible, it poses a higher risk than local kernel flaws. Administrators running ksmbd should treat this as a high-priority update and ensure that all kernel packages are patched to the latest version.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux Kernel (multiple versions with KVM x86 support)
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's KVM x86 MMIO emulation subsystem allows local privilege escalation.

Executive Summary:
A use-after-free vulnerability in the Linux kernel's KVM subsystem could allow a local attacker to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-31588

Affected Software: Linux Kernel

Affected Versions: Linux Kernel (multiple versions with KVM x86 support); Systems running KVM-based virtualization (QEMU/KVM)

Vulnerability: This is a use-after-free vulnerability occurring when an emulated MMIO write crosses a page boundary. The KVM subsystem incorrectly handles the data payload, leading to a condition where the kernel attempts to access freed memory.

Business Impact

The CVSS score of 8.8 confirms the severity of this issue. By gaining elevated privileges, an attacker could bypass container isolation or virtual machine boundaries, leading to full host compromise and the theft of sensitive data from other virtualized workloads.

Remediation Plan

Immediate Action: Update to a kernel version that includes the fix for MMIO fragment scratch field handling.

Proactive Monitoring: Monitor system logs for KVM-related kernel crashes or unusual memory access errors.

Compensating Controls: Restrict access to KVM-based virtualization features to only trusted users or processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This kernel vulnerability represents a significant risk to virtualized environments. Administrators must ensure their Linux distributions are patched to the latest kernel version to prevent potential privilege escalation by local attackers.

---METADATA---
VENDOR: IBM
PRODUCT: API Connect
AFFECTED_VERSIONS: 12.1.0.0 up to (excluding) 12.1.0.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
IBM API Connect versions 12.1.0.0 through 12.1.0.2 are susceptible to a vulnerability involving the use of default credentials, potentially allowing unauthorized access.

Executive Summary:
A critical security vulnerability in IBM API Connect 12 allows unauthorized access due to the use of default credentials, posing a significant risk to API management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-3144

Affected Software: IBM API Connect

Affected Versions: 12.1.0.0 up to (excluding) 12.1.0.3

Vulnerability: This issue (CWE-1392) involves the use of default credentials within the application. An unauthenticated attacker could potentially leverage these known credentials to gain administrative or unauthorized access to the affected API management system.

Business Impact

The presence of default credentials creates an immediate pathway for attackers to compromise the integrity and confidentiality of the API gateway. Given the CVSS score of 8.1, the impact includes potential unauthorized control over managed APIs, exposure of sensitive backend services, and a total loss of trust in the API management layer.

Remediation Plan

Immediate Action: Update IBM API Connect to version 12.1.0.3 or higher and ensure all default passwords are changed immediately upon installation.

Proactive Monitoring: Audit all user accounts and access logs for signs of unauthorized login attempts using common or default naming conventions.

Compensating Controls: Restrict network access to the API Connect management console to trusted IP addresses and implement multi-factor authentication where possible.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority, as default credentials are a primary target for automated scanning and exploitation. Update to the patched version immediately and perform a full audit of all administrative accounts.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A memory safety vulnerability in the Linux kernel ksmbd module allows out-of-bounds writes during compound SMB requests, potentially leading to system crashes or arbitrary code execution.

Executive Summary:
The Linux kernel ksmbd module is vulnerable to an out-of-bounds write flaw during compound SMB requests, posing a significant risk of memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-31432

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an out-of-bounds (OOB) write vulnerability occurring within the ksmbd kernel module. It is triggered when processing compound requests—specifically a READ command followed by a QUERY_INFO(Security) command—which can cause the system to write past the allocated buffer while constructing security descriptors.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high severity rating. Successful exploitation could lead to kernel-level memory corruption, resulting in service denial, system instability, or a potential escalation of privileges for an attacker, severely impacting the availability and integrity of sensitive enterprise infrastructure.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest stable release provided by your distribution vendor as soon as the patch becomes available.

Proactive Monitoring: Monitor system logs for kernel panics or unusual ksmbd activity that may indicate attempts to trigger memory corruption.

Compensating Controls: Restrict access to SMB services to trusted network segments and ensure that ksmbd is only enabled if strictly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which involves kernel memory corruption, the potential for exploitation is high.

Analyst Recommendation

Given the severity of a kernel-level memory corruption vulnerability, administrators should prioritize this update as part of their next maintenance cycle. Ensure all Linux-based file servers running ksmbd are patched immediately upon vendor release to prevent potential remote exploitation.

---METADATA---
VENDOR: wpwax
PRODUCT: FormGent
AFFECTED_VERSIONS: 0 through 1.9.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The FormGent WordPress plugin is vulnerable to unauthenticated arbitrary file deletion via the REST API, potentially allowing attackers to delete critical files such as wp-config.php.

Executive Summary:
A critical vulnerability in the FormGent WordPress plugin allows unauthenticated attackers to perform arbitrary file deletion, posing a severe risk of complete site takeover.

Vulnerability Details

CVE-ID: CVE-2026-3141

Affected Software: wpwax FormGent

Affected Versions: 0 through 1.9.2

Vulnerability: This is an improper authorization vulnerability (CWE-862) occurring because the REST API endpoint for attachments lacks authentication middleware. An unauthenticated attacker can manipulate file paths to delete sensitive system files.

Business Impact

Successful exploitation permits the deletion of essential configuration files, including wp-config.php. This can force a site into a fresh installation state, resulting in total loss of site control, data destruction, and significant business disruption. The CVSS score of 9.1 reflects the high impact on integrity and availability.

Remediation Plan

Immediate Action: Update the FormGent plugin to version 1.10.0 or the latest available release immediately.

Proactive Monitoring: Review web server and WordPress access logs for unusual requests directed at the /wp-json/formgent/responses/attachments endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected REST API route until the plugin can be patched.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of any authentication requirements for a file system operation.

Analyst Recommendation

Given the critical severity and the potential for full site compromise, administrators must prioritize updating the FormGent plugin. If an immediate update is not feasible, the plugin should be deactivated to prevent exploitation while a maintenance window is scheduled.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel's ksmbd module causes an improper state change during failed multichannel SMB2_SESSION_SETUP requests.

Executive Summary:
A flaw in the Linux kernel's ksmbd SMB3 server implementation could lead to improper resource handling, potentially impacting system stability.

Vulnerability Details

CVE-ID: CVE-2026-31409

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability occurs when a multichannel SMB2_SESSION_SETUP request with the SMB2_SESSION_REQ_FLAG_BINDING flag fails. The ksmbd module sets conn->binding = true but fails to clear it on the error path, representing a state management error.

Business Impact

With a CVSS score of 8.8, this kernel-level issue is significant. Failure to properly clear connection states could potentially be leveraged by an attacker to disrupt service or lead to memory corruption, impacting the stability and security of the file server.

Remediation Plan

Immediate Action: Apply the kernel patch referencing commit 00ce8d6789dae72d042a4522264964c72891ca37.

Proactive Monitoring: Monitor kernel logs for errors related to SMB2 session setups and ksmbd binding failures.

Compensating Controls: If patching is delayed, limit SMB3 traffic access to trusted networks to reduce the surface area for potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities require prompt attention to maintain system integrity. Administrators should verify if their distribution provides an updated kernel package containing the fix for this issue and deploy it during the next maintenance cycle.

---METADATA---
VENDOR: Mysterium Network
PRODUCT: Mysterium Node
AFFECTED_VERSIONS: Mysterium Node before v1.36.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authorization vulnerability in the Mysterium Node configuration endpoint allows unauthenticated attackers to overwrite node settings and achieve full takeover.

Executive Summary:
An improper authorization flaw in Mysterium Node allows unauthenticated remote attackers to achieve full node takeover via crafted configuration requests.

Vulnerability Details

CVE-ID: CVE-2026-31309

Affected Software: Mysterium Network Mysterium Node

Affected Versions: Mysterium Node before v1.36.0

Vulnerability: The vulnerability exists in the /tequilapi/config/user endpoint, which fails to perform proper authorization checks. This allows an unauthenticated attacker to send a crafted POST request to overwrite the node's configuration, leading to a complete compromise of the node.

Business Impact

With a CVSS score of 7.5 (High), this vulnerability represents a significant risk to infrastructure integrity. A successful exploit grants an attacker full control over the node, which could be leveraged for unauthorized network participation, lateral movement, or data exfiltration. The lack of authentication requirements makes this highly susceptible to automated exploitation.

Remediation Plan

Immediate Action: Upgrade all instances of Mysterium Node to version v1.36.0 or later immediately.

Proactive Monitoring: Review access logs for the /tequilapi/config/user endpoint for unauthorized POST requests or unexpected changes to node configuration files.

Compensating Controls: Restrict network access to the node's management interface using firewalls or VPNs to ensure only authorized administrative traffic can reach the API.

Exploitation Status

Public Exploit Available: Yes (A public proof-of-concept is available via GitHub).

Analyst Notes: As of July 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public PoC significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

The combination of an unauthenticated attack vector and the availability of a public proof-of-concept necessitates immediate remediation. Administrators must treat this as a high-priority update to prevent unauthorized node takeover.

---METADATA---
VENDOR: Download Monitor
PRODUCT: Download Monitor (WordPress Plugin)
AFFECTED_VERSIONS: All versions up to, and including, 5.x
---END_METADATA---

Description Summary:
The Download Monitor plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This allows unauthorized access to restricted files in versions up to 5.x.

Executive Summary:
The Download Monitor WordPress plugin contains a high-severity IDOR vulnerability that allows unauthorized users to access and download restricted files.

Vulnerability Details

CVE-ID: CVE-2026-3124

Affected Software: Download Monitor (WordPress Plugin)

Affected Versions: Up to and including version 5.x

Vulnerability: The plugin fails to properly validate user permissions when requesting specific file IDs. This Insecure Direct Object Reference (IDOR) allows an attacker to access sensitive downloads by simply guessing or iterating through resource identifiers.

Business Impact

This vulnerability directly threatens the confidentiality of digital assets, including proprietary software, sensitive documents, or paid content. With a CVSS score of 7.5, the risk is high; unauthorized access to these files could lead to significant intellectual property theft and loss of revenue for organizations relying on the plugin for access control.

Remediation Plan

Immediate Action: Update the Download Monitor plugin to the latest version immediately to resolve the improper authorization checks.

Proactive Monitoring: Review WordPress access logs for patterns of sequential file requests or access attempts to file IDs that do not belong to the requesting user.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block IDOR-style attacks and directory traversal patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation. However, IDOR vulnerabilities are notoriously easy to exploit once the vulnerable parameter is identified.

Analyst Recommendation

The 7.5 CVSS score highlights the urgent need for remediation. Administrators must update the plugin immediately to the latest version to prevent unauthorized users from harvesting sensitive digital assets.

---METADATA---
VENDOR: SuperDuper
PRODUCT: superduper
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The superduper project is subject to a security vulnerability, the details of which remain largely unspecified in public documentation.

Executive Summary:
The superduper project contains an unspecified vulnerability that may allow for significant security impacts, requiring immediate investigation by users.

Vulnerability Details

CVE-ID: CVE-2026-31225

Affected Software: SuperDuper superduper

Affected Versions: See vendor advisory

Vulnerability: The exact nature of this vulnerability is currently underspecified, though it is categorized with a high CVSS score of 8.8. It involves a network-accessible vector that may allow for impact to confidentiality, integrity, and availability.

Business Impact

A CVSS score of 8.8 indicates a high risk to business operations. Without specific technical details, organizations should assume that any system utilizing the superduper project is potentially exposed to remote compromise, which could lead to unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Monitor the official GitHub repository for the superduper project for security advisories and patch releases.

Proactive Monitoring: Isolate systems running the superduper project from critical network segments until more information is available.

Compensating Controls: Deploy Web Application Firewalls (WAF) or Network Intrusion Detection Systems (NIDS) to monitor for anomalous traffic patterns directed at services utilizing this project.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of detailed technical documentation makes this a high-uncertainty risk.

Analyst Recommendation

Due to the lack of clear remediation instructions and the high severity score, users of the superduper project should act with extreme caution. Immediately review project dependencies and monitor the referenced GitHub repository for official guidance and security updates.

---METADATA---
VENDOR: Snorkel Team
PRODUCT: Snorkel
AFFECTED_VERSIONS: through 0.10.0
CONFIDENCE: medium
MISSING: technical_details, patch
---END_METADATA---

Description Summary:
A vulnerability exists in the Snorkel library that may allow for significant security impact, though specific technical details remain currently undisclosed by the vendor.

Executive Summary:
The Snorkel library (up to v0.10.0) is affected by a critical vulnerability that may result in total system compromise if exploited.

Vulnerability Details

CVE-ID: CVE-2026-31224

Affected Software: Snorkel Team Snorkel

Affected Versions: through 0.10.0

Vulnerability: The exact nature of this vulnerability is currently unspecified; however, the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates an unauthenticated, remotely exploitable flaw requiring user interaction.

Business Impact

A successful exploit of this vulnerability could lead to a total loss of confidentiality, integrity, and availability of the affected system. Given the high CVSS score of 8.8, organizations relying on Snorkel for data processing or machine learning workflows face significant risk of unauthorized data access or system manipulation.

Remediation Plan

Immediate Action: As no official fix has been released, prioritize auditing environments where Snorkel is deployed and restrict exposure to untrusted network traffic.

Proactive Monitoring: Monitor application logs for abnormal execution patterns or unexpected outbound network connections originating from the Snorkel environment.

Compensating Controls: Implement strict network segmentation and ensure that services utilizing Snorkel are not directly exposed to the public internet to minimize the likelihood of user-interaction-based attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Users should monitor the official Snorkel GitHub repository for upcoming security patches.

Analyst Recommendation

Due to the high severity score and the lack of a current vendor-supplied patch, users should treat this vulnerability with extreme caution. We recommend isolating affected instances from critical production workflows until a formal security update is provided by the Snorkel project.

---METADATA---
VENDOR: Snorkel Team
PRODUCT: Snorkel
AFFECTED_VERSIONS: through 0.10.0
CONFIDENCE: medium
MISSING: technical_details, patch
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the Snorkel library, affecting all versions up to and including 0.10.0.

Executive Summary:
All versions of the Snorkel library through 0.10.0 are susceptible to a critical security flaw that could lead to full system impact.

Vulnerability Details

CVE-ID: CVE-2026-31223

Affected Software: Snorkel Team Snorkel

Affected Versions: through 0.10.0

Vulnerability: This is a remotely exploitable vulnerability that does not require prior authentication, though it does require user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Business Impact

The potential for total technical impact (Confidentiality, Integrity, and Availability) makes this a severe risk for any business relying on the Snorkel library. Unauthorized access or data corruption could disrupt critical business operations and result in a significant loss of system control.

Remediation Plan

Immediate Action: Since a patch is not yet available, assess the necessity of the current Snorkel implementation and consider disabling or isolating the component.

Proactive Monitoring: Review system and application logs for anomalous behavior or unauthorized access attempts targeting the library's functions.

Compensating Controls: Utilize a Web Application Firewall (WAF) or equivalent network security filtering to block potentially malicious payloads that could trigger the vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of detailed technical documentation necessitates a proactive, defensive posture.

Analyst Recommendation

Organizations should prioritize the identification of all instances of Snorkel within their development and production environments. Maintain close observation of the official project communication channels for the release of a security patch to address this critical exposure.

---METADATA---
VENDOR: Snorkel Team
PRODUCT: Snorkel
AFFECTED_VERSIONS: through 0.10.0
CONFIDENCE: medium
MISSING: technical_details, patch
---END_METADATA---

Description Summary:
A critical, remotely exploitable vulnerability has been identified in the Snorkel library affecting versions up to 0.10.0.

Executive Summary:
The Snorkel library (up to v0.10.0) contains a critical vulnerability that poses a severe risk to system security.

Vulnerability Details

CVE-ID: CVE-2026-31222

Affected Software: Snorkel Team Snorkel

Affected Versions: through 0.10.0

Vulnerability: This vulnerability allows for potential remote exploitation by an unauthenticated attacker, contingent on user interaction, which could result in high-impact damage to the target system.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a major security risk, potentially leading to unauthorized system access and full compromise of the affected environment. Organizations must evaluate their reliance on this library and the exposure of the systems in which it is integrated.

Remediation Plan

Immediate Action: As no fix is currently provided, take immediate steps to reduce the attack surface by limiting exposure and monitoring affected systems.

Proactive Monitoring: Implement enhanced logging and alerting to detect any unusual activity or unauthorized access attempts related to the Snorkel library.

Compensating Controls: If immediate removal is not possible, apply network-level controls to restrict access to the affected service and mitigate the potential for remote exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The absence of a patch requires immediate defensive vigilance.

Analyst Recommendation

Given the critical nature of the vulnerability, security teams should treat the Snorkel library as a high-risk component. Proactively monitor vendor communications for a patch and be prepared to deploy it immediately upon release to secure the environment.

---METADATA---
VENDOR: Altice Labs
PRODUCT: GR140DG Fibre Router
AFFECTED_VERSIONS: Firmware 3GN8020801R13, 3GN8020802R0A, 3GN8020803R0A
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the traceroute diagnostic handler of Altice Labs GR140DG routers allows authenticated remote attackers to execute arbitrary commands as root.

Executive Summary:
Authenticated remote attackers can achieve full root-level code execution on Altice Labs GR140DG routers by exploiting an OS command injection flaw in the traceroute diagnostic handler.

Vulnerability Details

CVE-ID: CVE-2026-31196

Affected Software: Altice Labs GR140DG Fibre Router

Affected Versions: Firmware 3GN8020801R13, 3GN8020802R0A, 3GN8020803R0A

Vulnerability: Similar to the ping handler vulnerability, the traceroute handler in /bin/httpd_clientside fails to sanitize user input in the destAddr parameter. This allows authenticated attackers to perform shell command substitution and execute commands with root privileges.

Business Impact

The CVSS score of 8.8 highlights the critical nature of this vulnerability, as it provides a pathway for total control over the networking hardware. An attacker with access to the management interface could leverage this to gain persistence, conduct man-in-the-middle attacks, or utilize the device as a node in a botnet.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by the vendor to remediate the command injection flaw in the diagnostic tools.

Proactive Monitoring: Review router audit logs for signs of unauthorized diagnostic tool usage or unexpected outbound connections.

Compensating Controls: Strictly limit administrative access to the router's management interface to secure, dedicated management workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to network integrity. Immediate patching is required to ensure that the router cannot be leveraged by malicious actors to compromise the local network or internet connectivity.

---METADATA---
VENDOR: Altice Labs
PRODUCT: GR140DG Fibre Router
AFFECTED_VERSIONS: Firmware 3GN8020801R13, 3GN8020802R0A, 3GN8020803R0A
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the ping diagnostic handler of Altice Labs GR140DG routers allows authenticated remote attackers to execute arbitrary commands as root.

Executive Summary:
Authenticated remote attackers can achieve full root-level code execution on Altice Labs GR140DG routers by exploiting an OS command injection flaw in the ping diagnostic handler.

Vulnerability Details

CVE-ID: CVE-2026-31195

Affected Software: Altice Labs GR140DG Fibre Router

Affected Versions: Firmware 3GN8020801R13, 3GN8020802R0A, 3GN8020803R0A

Vulnerability: The vulnerability exists in the /bin/httpd_clientside binary, where unsanitized user input provided via the destAddr parameter is passed directly to a system call. This allows an authenticated attacker to inject arbitrary shell commands.

Business Impact

The CVSS score of 8.8 reflects the extreme severity of this issue, as it grants an attacker root access to the underlying operating system of the router. This compromise could allow an attacker to intercept network traffic, pivot into internal networks, or permanently disable the device, leading to significant security and operational risks.

Remediation Plan

Immediate Action: Update the router firmware to a version that addresses this command injection vulnerability as provided by the ISP or vendor.

Proactive Monitoring: Monitor router management logs for unexpected shell command patterns or configuration changes initiated via the web interface.

Compensating Controls: Disable remote access to the router's web management interface and restrict access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Root-level command injection is a critical vulnerability that effectively nullifies all security controls on the device. Users must coordinate with their service provider to ensure the affected routers are patched or replaced immediately.

---METADATA---
VENDOR: ToToLink
PRODUCT: A3300R
AFFECTED_VERSIONS: v17.0.0cu.557_B20221024
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated attackers to execute arbitrary commands via the stunServerAddr parameter.

Executive Summary:
A critical command injection vulnerability in ToToLink A3300R firmware allows unauthenticated remote attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-31181

Affected Software: ToToLink A3300R

Affected Versions: v17.0.0cu.557_B20221024

Vulnerability: The device fails to properly sanitize input in the stunServerAddr parameter within the /cgi-bin/cstecgi.cgi script, allowing for unauthenticated remote command execution.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server, potentially leading to complete loss of confidentiality, integrity, and availability of the device and potential pivot points into the internal network.

Remediation Plan

Immediate Action: Check the ToToLink support portal for the latest firmware release and apply it immediately to all affected A3300R units.

Proactive Monitoring: Monitor network traffic for suspicious requests directed at /cgi-bin/cstecgi.cgi and review system logs for unexpected process execution.

Compensating Controls: Restrict access to the device's web management interface to trusted IP addresses via firewall rules and disable remote management if not strictly required.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication required to trigger the injection.

Analyst Recommendation

Given the critical severity and the existence of a public proof-of-concept, immediate action is required to secure these devices. Administrators should verify the current firmware version and prioritize the application of vendor-supplied patches to prevent unauthorized remote command execution.

---METADATA---
VENDOR: ToToLink
PRODUCT: A3300R
AFFECTED_VERSIONS: v17.0.0cu.557_B20221024
---END_METADATA---

Description Summary:
The ToToLink A3300R firmware contains a command injection vulnerability in the stunMaxAlive parameter, allowing unauthenticated remote code execution.

Executive Summary:
A critical remote command execution vulnerability in ToToLink A3300R firmware allows unauthenticated attackers to gain full control of the device via manipulated CGI parameters.

Vulnerability Details

CVE-ID: CVE-2026-31178

Affected Software: ToToLink A3300R

Affected Versions: v17.0.0cu.557_B20221024

Vulnerability: This is a command injection vulnerability within the /cgi-bin/cstecgi.cgi endpoint. The stunMaxAlive parameter lacks adequate sanitization, allowing an unauthenticated attacker to execute arbitrary system-level commands.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe threat to network infrastructure. Successful exploitation results in full administrative control of the router, potentially allowing attackers to facilitate man-in-the-middle attacks or establish persistent persistence within the network.

Remediation Plan

Immediate Action: Update the affected ToToLink A3300R firmware to the latest version, which contains fixes for this command injection vulnerability.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or unexpected traffic patterns that deviate from normal baseline behavior.

Compensating Controls: Disable remote administrative access to the router and restrict access to the management interface to trusted internal networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for catastrophic failure of network security controls makes immediate patching mandatory.

Analyst Recommendation

This vulnerability is critical and requires immediate attention. Organizations using the ToToLink A3300R must verify their firmware versions and apply the necessary patches to protect the network perimeter from unauthorized remote access.

---METADATA---
VENDOR: ToToLink
PRODUCT: A3300R
AFFECTED_VERSIONS: v17.0.0cu.557_B20221024
---END_METADATA---

Description Summary:
The ToToLink A3300R firmware contains a command injection vulnerability in the stunMinAlive parameter, allowing unauthenticated remote code execution.

Executive Summary:
A critical remote command execution vulnerability in ToToLink A3300R firmware allows unauthenticated attackers to gain full control of the device via manipulated CGI parameters.

Vulnerability Details

CVE-ID: CVE-2026-31177

Affected Software: ToToLink A3300R

Affected Versions: v17.0.0cu.557_B20221024

Vulnerability: This vulnerability is a command injection flaw within the /cgi-bin/cstecgi.cgi script. By providing a malicious payload to the stunMinAlive parameter, an unauthenticated attacker can execute arbitrary commands on the underlying system.

Business Impact

This vulnerability carries a 9.8 CVSS score, representing a critical threat to organizational network security. Exploitation allows for complete device takeover, enabling attackers to bypass security boundaries and compromise the confidentiality and integrity of all traffic passing through the router.

Remediation Plan

Immediate Action: Apply the latest security firmware update provided by ToToLink to resolve the vulnerability in the CGI handling logic.

Proactive Monitoring: Review system logs for signs of suspicious command execution or unexpected configuration changes on the router.

Compensating Controls: Restrict access to the router's web-based management interface to authorized, internal-only IP addresses to mitigate remote attack vectors.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the ease of triggering this flaw, the risk of automated scanning and exploitation is significant.

Analyst Recommendation

Administrators must prioritize updating the firmware for all ToToLink A3300R units. Given the severity of remote code execution, delaying remediation exposes the internal network to high-risk unauthorized access.

---METADATA---
VENDOR: ToToLink
PRODUCT: A3300R
AFFECTED_VERSIONS: v17.0.0cu.557_B20221024
---END_METADATA---

Description Summary:
The ToToLink A3300R firmware contains a command injection vulnerability in the stunEnable parameter, allowing unauthenticated remote code execution.

Executive Summary:
A critical remote command execution vulnerability in ToToLink A3300R firmware allows unauthenticated attackers to gain full control of the device via manipulated CGI parameters.

Vulnerability Details

CVE-ID: CVE-2026-31175

Affected Software: ToToLink A3300R

Affected Versions: v17.0.0cu.557_B20221024

Vulnerability: This is a command injection vulnerability located in the /cgi-bin/cstecgi.cgi endpoint. Unauthenticated attackers can inject arbitrary system commands into the stunEnable parameter.

Business Impact

The 9.8 CVSS score reflects the extreme risk posed by this vulnerability. Remote code execution on networking hardware allows an attacker to pivot into the internal network, intercept traffic, or use the device as a node in a botnet, causing significant operational disruption.

Remediation Plan

Immediate Action: Update the A3300R firmware to the latest available version provided by ToToLink that addresses this command injection flaw.

Proactive Monitoring: Monitor internal network traffic for anomalous outbound connections originating from the router that may indicate command-and-control activity.

Compensating Controls: If patching is delayed, isolate the device management interface from the public internet using firewall rules or ACLs to prevent remote access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of command injection on edge devices makes it a prime target for automated exploitation tools.

Analyst Recommendation

Immediate firmware updates are required for all affected ToToLink routers. If updates are unavailable, the device must be disconnected from external networks or restricted to trusted administrative IPs until a secure patch is applied.

---METADATA---
VENDOR: BillaBear
PRODUCT: BillaBear
AFFECTED_VERSIONS: All versions prior to Jan 2026
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
BillaBear contains a SQL Injection vulnerability in the EventRepository, potentially allowing authenticated attackers to execute arbitrary database commands.

Executive Summary:
BillaBear is vulnerable to a SQL injection flaw in the EventRepository that could lead to unauthorized data access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-31069

Affected Software: BillaBear

Affected Versions: All versions prior to Jan 2026

Vulnerability: This is a SQL injection vulnerability residing in the EventRepository component. The CVSS vector (PR:L) indicates that an attacker must possess low-level authenticated access to the application to trigger this flaw.

Business Impact

Successful exploitation of this vulnerability allows an attacker to manipulate database queries, which may result in the exfiltration of sensitive data, modification of records, or unauthorized administrative actions. Given the CVSS score of 8.8, this represents a high risk to business operations and data integrity, potentially leading to regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Review the BillaBear project repositories and vendor advisories for available security patches or updates released since January 2026.

Proactive Monitoring: Implement database query logging and monitor for anomalous patterns or unexpected syntax characteristic of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a PoC in public repositories significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Due to the high severity of SQL injection vulnerabilities and the existence of a proof-of-concept, administrators should prioritize this issue. Ensure that BillaBear instances are updated to the latest available version and enforce strict principle-of-least-privilege database access controls to minimize the blast radius of a potential compromise.

---METADATA---
VENDOR: TOTOlink
PRODUCT: A3600R
AFFECTED_VERSIONS: v5.9c.4959
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
TOTOlink A3600R contains a buffer overflow in the setAppEasyWizardConfig interface, allowing unauthenticated remote attackers to trigger arbitrary code execution or denial of service.

Executive Summary:
A critical buffer overflow vulnerability in TOTOlink A3600R routers allows unauthenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-31027

Affected Software: TOTOlink A3600R

Affected Versions: v5.9c.4959

Vulnerability: The vulnerability exists within the /lib/cste_modules/app.so library due to improper length validation of the rootSsid parameter. This is an unauthenticated remote code execution flaw triggered via the setAppEasyWizardConfig interface.

Business Impact

A successful exploit grants an attacker full control over the affected networking device. Given the CVSS score of 9.8, this poses a severe risk to network integrity, potentially enabling man-in-the-middle attacks, data exfiltration, or complete loss of network availability for the organization.

Remediation Plan

Immediate Action: Check the manufacturer's support portal for firmware updates addressing this buffer overflow. If no patch is available, restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs for unusual traffic patterns or segmentation faults associated with the setAppEasyWizardConfig interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) or network-level IPS rules to filter traffic containing malformed or excessively long rootSsid parameters.

Exploitation Status

Public Exploit Available: No (no weaponized exploit or public PoC confirmed in available data).

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its nature as an unauthenticated memory corruption vulnerability.

Analyst Recommendation

This vulnerability represents a critical risk to edge networking infrastructure. Administrators must prioritize identifying all TOTOlink A3600R units in their environment and applying vendor-supplied firmware updates immediately upon release to prevent potential remote compromise.