---METADATA---
VENDOR: SAP
PRODUCT: Enterprise Search
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
SAP Enterprise Search for ABAP is vulnerable to SQL injection, allowing authenticated attackers to execute malicious database queries.

Executive Summary:
An authenticated attacker can exploit a SQL injection vulnerability in SAP Enterprise Search to gain unauthorized access to sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-34260

Affected Software: SAP Enterprise Search

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability caused by the improper concatenation of user-controlled input into database queries. An authenticated attacker can manipulate these queries to bypass security controls and access protected backend data.

Business Impact

The ability to perform SQL injection poses a significant risk to data confidentiality and system availability. With a CVSS score of 9.6, successful exploitation could lead to large-scale data breaches or application denial-of-service, severely impacting business operations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by SAP for the Enterprise Search component.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected syntax or large data retrieval requests.

Compensating Controls: Employ a Web Application Firewall (WAF) with SQL injection detection rules to inspect and block malicious input at the perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability, organizations must prioritize applying the SAP security update. Ensure that all database access is audited and that input validation is enforced at the application layer.

---METADATA---
VENDOR: SAP
PRODUCT: Forecasting & Replenishment
AFFECTED_VERSIONS: SCM 702, 712, 713, 714
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command execution vulnerability in SAP Forecasting & Replenishment allows an authenticated administrator to execute arbitrary OS commands.

Executive Summary:
An OS command injection vulnerability in SAP Forecasting & Replenishment enables an authenticated administrator to execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-34259

Affected Software: SAP Forecasting & Replenishment

Affected Versions: SCM 702, 712, 713, 714

Vulnerability: This is an OS command execution flaw (CWE-77) triggered by the abuse of a non-remote-enabled function. The attack requires high privileges (PR:H), meaning an authenticated administrator must initiate the malicious command.

Business Impact

While the attack requires administrative authorization, a successful exploit allows full control over the underlying operating system. This could lead to total compromise of the SAP application environment and potential lateral movement into the broader network. The CVSS score of 8.2 reflects the high impact on the entire system.

Remediation Plan

Immediate Action: Apply the relevant SAP Security Note (3732471) through the standard SAP support portal immediately.

Proactive Monitoring: Audit administrative activity and monitor system logs for suspicious command-line executions or unusual file modifications on the server.

Compensating Controls: Enforce strict role-based access control (RBAC) to limit the number of users with administrative authorizations and ensure that only authorized personnel can access sensitive functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-level administrative access significantly limits the attack surface.

Analyst Recommendation

Administrators should review the SAP Security Note 3732471 and apply the corresponding patches during the next maintenance window. Restricting administrative access remains a critical secondary control to prevent the abuse of such high-privilege functions.

---METADATA---
VENDOR: Xiph
PRODUCT: vorbis-tools (ogg123 utility)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch
---END_METADATA---

Description Summary:
A buffer underflow vulnerability exists in the ogg123 utility within vorbis-tools, potentially allowing for memory corruption.

Executive Summary:
A buffer underflow in the ogg123 utility of vorbis-tools poses a potential security risk for systems processing untrusted Ogg files.

Vulnerability Details

CVE-ID: CVE-2026-34253

Affected Software: Xiph vorbis-tools (ogg123)

Affected Versions: See vendor advisory

Vulnerability: This is a buffer underflow vulnerability located in the remote.c source file of the ogg123 utility. It can be triggered by unauthenticated attackers providing a malformed input, leading to partial impact on system availability or integrity.

Business Impact

While the technical impact is categorized as partial, a buffer underflow can lead to application crashes (Denial of Service) or potentially memory corruption. With a CVSS score of 8.2, the vulnerability is considered critical by the reporter, likely due to the risk of remote exploitability in media processing pipelines.

Remediation Plan

Immediate Action: Monitor the Xiph GitLab repository and official package maintainer channels for the release of a patched version of vorbis-tools.

Proactive Monitoring: Ensure that systems processing media files are running with the least privilege necessary to limit the impact of a potential crash or exploit.

Compensating Controls: Use application sandboxing or containerization to isolate the ogg123 utility from critical system resources.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of this flaw is low, making it a viable target for those capable of crafting malicious media files.

Analyst Recommendation

Users of vorbis-tools should exercise caution when processing files from untrusted sources. Monitor the upstream Xiph repository for a formal release of a fix and apply it as soon as it becomes available to remediate the buffer underflow risk.

---METADATA---
VENDOR: Rometheme
PRODUCT: RTMKit (WordPress Plugin)
AFFECTED_VERSIONS: 0 through 2.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The RTMKit Addons for Elementor plugin for WordPress contains a Local File Inclusion vulnerability allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A critical Local File Inclusion vulnerability in the RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers to potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3425

Affected Software: Rometheme RTMKit (WordPress Plugin)

Affected Versions: 0 through 2.0.2

Vulnerability: The plugin contains a Local File Inclusion vulnerability (CWE-98) due to improper control of filenames in include/require statements. Exploitation requires the attacker to have at least low-level (authenticated) access to the WordPress site.

Business Impact

An attacker successfully exploiting this vulnerability can read sensitive system files or execute arbitrary PHP code on the server. This could lead to a full site takeover, database compromise, and the potential for further lateral movement within the hosting environment, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the RTMKit plugin to version 2.0.3 or later immediately to address the underlying file inclusion flaw.

Proactive Monitoring: Audit WordPress user accounts for suspicious activity and monitor server access logs for requests attempting to access sensitive files or unexpected file paths.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the risk to attackers who have already obtained valid credentials.

Analyst Recommendation

Administrators should update the RTMKit plugin immediately. Furthermore, ensure that user registration and access control policies are strictly enforced to prevent unauthorized users from reaching the vulnerable function.

---METADATA---
VENDOR: wenxian
PRODUCT: wenxian
AFFECTED_VERSIONS: Versions 0.3.1 and prior
---END_METADATA---

Description Summary:
The wenxian GitHub Actions workflow is vulnerable to command injection via untrusted user input in issue comments, allowing arbitrary code execution on the GitHub runner.

Executive Summary:
An unauthenticated attacker can execute arbitrary code on a GitHub Actions runner by simply posting a crafted comment on a repository using the wenxian tool.

Vulnerability Details

CVE-ID: CVE-2026-34243

Affected Software: wenxian (GitHub Actions workflow)

Affected Versions: Versions 0.3.1 and prior

Vulnerability: The workflow uses issue_comment.body directly inside a shell command without sanitization. An unauthenticated attacker can post a comment containing shell metacharacters to trigger command injection and execute arbitrary code within the context of the GitHub Actions runner.

Business Impact

A successful exploit allows an attacker to hijack the CI/CD pipeline. This can lead to the theft of GitHub secrets (e.g., API keys, cloud credentials), the injection of malicious code into the software supply chain, or unauthorized access to the repository. The CVSS score of 9.8 highlights the extreme risk of supply chain compromise.

Remediation Plan

Immediate Action: Disable the affected GitHub Actions workflow immediately. Since no patch is currently available, manually sanitize the workflow file to use environment variables for user input instead of direct shell interpolation.

Proactive Monitoring: Review GitHub Actions run history for suspicious activity and audit all secrets used by the affected repository for potential compromise.

Compensating Controls: Use "Restrict repository permissions" in GitHub to ensure that the GITHUB_TOKEN has minimal permissions (read-only) for workflows triggered by external users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there are no publicly available patches. This vulnerability is particularly dangerous as it can be triggered by any GitHub user by simply commenting on an issue.

Analyst Recommendation

The lack of a vendor patch makes this a critical "zero-day" risk for users of wenxian. Immediate manual intervention is required to secure the GitHub Actions workflow. Ensure that all user-supplied data is treated as untrusted and never passed directly to a shell.

---METADATA---
VENDOR: Ctrlpanel
PRODUCT: Ctrlpanel
AFFECTED_VERSIONS: < 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ctrlpanel is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation.

Executive Summary:
A stored cross-site scripting vulnerability in Ctrlpanel could allow an authenticated attacker to execute arbitrary scripts in the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-34241

Affected Software: Ctrlpanel Ctrlpanel

Affected Versions: < 1.2.0

Vulnerability: This is an Improper Neutralization of Input during Web Page Generation (CWE-79) vulnerability. An authenticated attacker with low privileges can inject malicious scripts, which are then rendered in the browser of other users, including administrators, when they access the compromised interface.

Business Impact

Successful exploitation allows for session hijacking, unauthorized actions performed on behalf of legitimate users, and potential theft of sensitive billing or hosting configuration data. With a CVSS score of 8.7, this is a High-severity risk that could lead to significant account takeover scenarios within the hosting management environment.

Remediation Plan

Immediate Action: Upgrade to Ctrlpanel version 1.2.0 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review application logs for unusual script tags or unexpected characters in user-submitted input fields.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by authenticated users who can successfully inject content into the application.

Analyst Recommendation

Given the potential for privilege escalation and session compromise, organizations should prioritize the update to version 1.2.0. Failure to patch leaves administrative accounts vulnerable to script-based attacks that could compromise the entire hosting infrastructure.

---METADATA---
VENDOR: CtrlPanel
PRODUCT: CtrlPanel
AFFECTED_VERSIONS: 1.1.1 and prior
---END_METADATA---

Description Summary:
CtrlPanel contains an unauthenticated Remote Code Execution (RCE) vulnerability in its web-based installer, allowing attackers to execute arbitrary commands on the server.

Executive Summary:
An actively exploited, unauthenticated RCE vulnerability in CtrlPanel allows remote attackers to execute arbitrary code with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34234

Affected Software: CtrlPanel

Affected Versions: 1.1.1 and prior

Vulnerability: An unauthenticated attacker can trigger code execution via the web-based installer, which fails to properly validate the installation state and passes user input directly into shell commands.

Business Impact

With a CVSS score of 10.0, this vulnerability is critical and poses an immediate threat to the entire hosting infrastructure. Active exploitation in the wild indicates that attackers are likely using this flaw to establish persistent backdoors, exfiltrate hosting data, or deploy ransomware, leading to total loss of control over the affected servers.

Remediation Plan

Immediate Action: Update CtrlPanel to version 1.2.0 or higher immediately; if an update is not possible, remove or disable the public/installer/index.php file.

Proactive Monitoring: Search for evidence of unauthorized shell processes, unexpected file creations in web directories, and anomalous outbound network traffic.

Compensating Controls: Immediately restrict public access to the installer endpoint via WAF rules or server-level configuration (e.g., .htaccess or Nginx deny directives).

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 19, 2026, there is confirmed active exploitation of this vulnerability in the wild. Immediate patching is mandatory to secure the environment.

Analyst Recommendation

This is an extremely high-risk vulnerability with confirmed active exploitation. Organizations must treat this as a high-priority incident and apply the necessary patches or mitigating controls without delay to prevent unauthorized remote command execution.

---METADATA---
VENDOR: e-Excellence
PRODUCT: U-Office Force
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An insecure deserialization vulnerability in U-Office Force allows unauthenticated remote attackers to execute arbitrary code via crafted serialized content.

Executive Summary:
U-Office Force is vulnerable to a critical insecure deserialization flaw that enables unauthenticated remote attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-3422

Affected Software: e-Excellence U-Office Force

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly validate serialized data, leading to an Insecure Deserialization vulnerability. An unauthenticated remote attacker can exploit this by sending maliciously crafted serialized objects to the server, resulting in arbitrary code execution.

Business Impact

Successful exploitation allows an attacker to gain full control over the U-Office Force server, potentially leading to the exposure of sensitive corporate data and internal communications. With a CVSS score of 9.8, this vulnerability poses a severe threat to the confidentiality and integrity of the organization’s digital workspace.

Remediation Plan

Immediate Action: Update U-Office Force to the latest version immediately to address the insecure deserialization logic.

Proactive Monitoring: Review application logs for unusual error messages related to object deserialization and monitor for unauthorized shell activity on the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block common Java or .NET deserialization gadget chains.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, deserialization flaws are frequently targeted by advanced persistent threats (APTs) due to their reliability in achieving RCE.

Analyst Recommendation

The critical nature of this vulnerability requires an immediate response. Organizations should verify their current version of U-Office Force and apply vendor-supplied patches without delay to prevent unauthorized server access.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.36
---END_METADATA---

Description Summary:
A sandbox escape in SandboxJS allows attackers to bypass global object protection by utilizing an exposed constructor path, enabling arbitrary property writes in the host environment.

Executive Summary:
A critical sandbox escape vulnerability in SandboxJS allows attackers to bypass security protections, enabling arbitrary code execution and persistence across sandbox instances.

Vulnerability Details

CVE-ID: CVE-2026-34208

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.36

Vulnerability: The library fails to sufficiently block access to the constructor property within the sandbox. Attackers can leverage this.constructor.call to write arbitrary properties into host global objects, effectively breaking the isolation boundary.

Business Impact

This flaw permits an attacker to escape the intended sandbox isolation, which could lead to unauthorized access to host-level resources and sensitive memory. Given the CVSS score of 10.0, this represents the highest level of risk to applications relying on SandboxJS for secure code execution.

Remediation Plan

Immediate Action: Update the SandboxJS library to version 0.8.36 or later immediately.

Proactive Monitoring: Review application logs for unusual global object modifications or unexpected cross-sandbox interaction patterns.

Compensating Controls: Ensure that applications utilizing sandboxing implement secondary defense-in-depth measures, such as limiting the privileges of the process running the sandbox.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS rating, immediate remediation is required. Organizations using SandboxJS must prioritize upgrading to version 0.8.36 to ensure the integrity of their sandboxed environments and prevent potential host-level compromise.

---METADATA---
VENDOR: Home Assistant
PRODUCT: Home Assistant (Supervisor)
AFFECTED_VERSIONS: < 2026.03.02
---END_METADATA---

Description Summary:
Home Assistant Supervisor fails to restrict access to internal Docker endpoints when using host network mode on Linux, exposing unauthenticated management interfaces to the local network.

Executive Summary:
Home Assistant installations on Linux are vulnerable to unauthenticated access to internal management endpoints, potentially allowing local network attackers to compromise the home automation system.

Vulnerability Details

CVE-ID: CVE-2026-34205

Affected Software: Home Assistant Home Assistant Supervisor

Affected Versions: Versions prior to 2026.03.02

Vulnerability: On Linux, Home Assistant apps configured with "host network mode" fail to isolate unauthenticated endpoints bound to the internal Docker bridge. This allows any device on the same local network to access these administrative interfaces without any authentication.

Business Impact

Unauthorized access to Home Assistant can lead to the control of physical smart home devices, access to private camera feeds, and the theft of sensitive configuration data. The CVSS score of 9.6 reflects the high risk of unauthenticated access and the potential for complete system takeover by an attacker on the local network.

Remediation Plan

Immediate Action: Update Home Assistant Supervisor to version 2026.03.02 or later immediately.

Proactive Monitoring: Inspect local network traffic for unauthorized connections to Home Assistant's internal management ports (typically 8123 or other Docker-assigned ports).

Compensating Controls: Implement network segmentation (VLANs) to isolate the Home Assistant server from untrusted local devices until the update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. This vulnerability is particularly relevant for users who run Home Assistant on generic Linux distributions rather than the dedicated Home Assistant OS.

Analyst Recommendation

The update to Supervisor 2026.03.02 is critical for maintaining the privacy and security of the Home Assistant environment. Users should prioritize this update and review their network configuration to ensure that management interfaces are not exposed to untrusted segments of their local network.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: GPU Driver
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Software running as a non-privileged user can trigger an out-of-bounds write in the kernel via intentional GPU sparse memory API calls.

Executive Summary:
A high-severity kernel-level vulnerability exists in the GPU driver, allowing a local non-privileged user to achieve arbitrary code execution with kernel-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34195

Affected Software: Imagination Technologies GPU Driver

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from incorrect indexing of internal state when performing sparse allocation remapping. A local attacker can intentionally trigger these API calls to cause an out-of-bounds write, granting them control over the kernel's execution flow.

Business Impact

The CVSS score of 8.8 reflects the high risk posed by kernel-level exploits. Successful exploitation allows a local user to elevate their privileges to the highest level, potentially resulting in complete system takeover, persistence, and the bypass of all OS-level security controls.

Remediation Plan

Immediate Action: Apply the latest GPU driver updates provided by the hardware vendor or system manufacturer.

Proactive Monitoring: Monitor for unexpected system crashes or unusual kernel-related errors, which may indicate attempted exploitation.

Compensating Controls: Restrict access to GPU-accelerated applications to trusted users only and enforce the principle of least privilege for all local accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no evidence of proof of exploitation at the moment. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities of this nature are extremely dangerous. Administrators must prioritize updating GPU drivers on all affected systems to prevent local attackers from gaining full administrative control over the underlying host.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: 4.12 through 6.7
---END_METADATA---

Description Summary:
Canonical LXD versions 4.12 through 6.7 contain a privilege escalation vulnerability where restricted TLS certificate users can elevate to cluster admin.

Executive Summary:
A critical privilege escalation vulnerability in Canonical LXD allows authenticated users to gain cluster admin privileges.

Vulnerability Details

CVE-ID: CVE-2026-34179

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The doCertificateUpdate function fails to validate the Type field during PUT/PATCH requests to /1.0/certificates/{fingerprint}. This allows a remote authenticated attacker with restricted TLS access to escalate privileges to cluster admin.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an attacker to gain full control over the LXD cluster. This could lead to unauthorized access to all containers, data theft, and the ability to deploy malicious workloads across the cluster.

Remediation Plan

Immediate Action: Update LXD to a version that contains the fix for this privilege escalation vulnerability.

Proactive Monitoring: Monitor API audit logs for unusual certificate update requests or unauthorized administrative actions.

Compensating Controls: Limit access to the LXD API to only trusted, authorized users and implement strict network-level controls for cluster management traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation within container orchestration platforms is a high-priority risk. Administrators must update their LXD installations immediately to ensure that restricted users cannot elevate their privileges and compromise the entire cluster.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: Before 6.8
---END_METADATA---

Description Summary:
A backup import validation flaw in Canonical LXD allows authenticated remote attackers to bypass project restrictions and achieve full host compromise.

Executive Summary:
An authentication bypass vulnerability in the Canonical LXD backup import process allows an attacker to execute arbitrary configurations, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34178

Affected Software: Canonical LXD

Affected Versions: Before 6.8

Vulnerability: The vulnerability exists because the backup import process validates restrictions against the wrong file. An authenticated remote attacker with instance-creation permissions can craft a malicious archive to force privileged execution, bypassing security constraints.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw. By bypassing project restrictions, an attacker can gain full control over the host system, creating significant risk for data confidentiality, integrity, and availability within the affected LXD environment.

Remediation Plan

Immediate Action: Update all instances of Canonical LXD to version 6.8 or later to ensure backup integrity validation is enforced correctly.

Proactive Monitoring: Review logs for suspicious instance creation events or backup imports originating from untrusted or low-privilege users.

Compensating Controls: Implement strict Access Control Lists (ACLs) for users permitted to perform instance creation or backup restoration tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this as a high-priority update. The ability for a restricted user to gain full host access via a simple backup import makes this a critical path for remediation to prevent catastrophic system failure.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: 4.12 through 6.7
---END_METADATA---

Description Summary:
An incomplete denylist in Canonical LXD allows a restricted project user to inject AppArmor and QEMU configurations, facilitating privilege escalation to host root.

Executive Summary:
A critical vulnerability in Canonical LXD allows an attacker with restricted VM permissions to escape the sandbox and achieve full host root privileges.

Vulnerability Details

CVE-ID: CVE-2026-34177

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The vulnerability resides in the isVMLowLevelOptionForbidden function, which fails to correctly block raw.apparmor and raw.qemu.conf keys. An authenticated attacker with can_edit permissions can leverage this to bridge the LXD Unix socket and escalate privileges.

Business Impact

With a CVSS score of 9.1, this flaw represents a major security failure in multi-tenant environments. An attacker gaining host root access effectively compromises the entire hypervisor and all containers or VMs managed by the cluster, leading to total data loss and system-wide compromise.

Remediation Plan

Immediate Action: Upgrade Canonical LXD to the latest version to ensure the restricted project denylist is properly enforced.

Proactive Monitoring: Audit LXD project configurations for unauthorized usage of raw.apparmor or raw.qemu.conf keys.

Compensating Controls: Restrict the can_edit permission to only highly trusted administrators until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a severe risk to containerized and virtualized environments. Administrators must audit their current LXD configurations for signs of tampering and apply the vendor-provided patch immediately to prevent unauthorized host-level access.

---METADATA---
VENDOR: F5
PRODUCT: BIG-IP
AFFECTED_VERSIONS: 21.0.0, 17.5.0, 17.1.0, 16.1.0 and later (see enrichment)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint of F5 BIG-IP when running in Appliance mode.

Executive Summary:
An authenticated remote command injection vulnerability in F5 BIG-IP allows an attacker with high privileges to execute arbitrary system commands via the iControl REST API.

Vulnerability Details

CVE-ID: CVE-2026-34176

Affected Software: F5 BIG-IP

Affected Versions: Versions 21.0.0, 17.5.0, 17.1.0, and 16.1.0 and later (specific build ranges apply; see vendor advisory).

Vulnerability: This is an OS Command Injection vulnerability (CWE-78) occurring in an iControl REST endpoint. The vulnerability is exploitable by an authenticated user with high privileges, allowing them to inject and execute arbitrary commands on the underlying operating system.

Business Impact

Successful exploitation provides an attacker with high-level access to the BIG-IP appliance, potentially leading to full system compromise. Given that BIG-IP often sits at the edge of the network, this vulnerability poses a severe risk to the entire network infrastructure, justifying the high CVSS score of 8.7.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to move to a patched version (e.g., 21.1.0 or later) as specified in the F5 security advisory.

Proactive Monitoring: Review iControl REST API access logs for unusual command patterns and monitor system integrity for unauthorized configuration changes.

Compensating Controls: Restrict access to the iControl REST API to known, trusted management IP addresses and enforce strong multi-factor authentication for all administrative users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires high privileges, which significantly mitigates the risk from external, non-privileged attackers.

Analyst Recommendation

Organizations should prioritize patching their F5 BIG-IP appliances, as these devices are critical infrastructure. Ensure that administrative access is strictly controlled and audited to prevent exploitation by malicious or compromised internal accounts.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow an unauthorized party to perform actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Coolify could enable attackers to perform unauthorized actions, potentially leading to a full compromise of the application environment.

Vulnerability Details

CVE-ID: CVE-2026-34171

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is a CSRF (CWE-352) flaw where an attacker can trick an authenticated user into executing unwanted actions within the Coolify interface. This is typically achieved by enticing a user to click a malicious link while they have an active session.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the confidentiality and integrity of the application. An attacker could force administrative actions, such as changing system settings or creating new user accounts, leading to unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later to implement the required CSRF protection mechanisms.

Proactive Monitoring: Review audit logs for unexpected account modifications or changes to application settings that do not align with known administrative activity.

Compensating Controls: Encourage users to log out of the Coolify dashboard when not in use and implement browser-based security policies to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be highly damaging in management tools like Coolify. It is essential to update to the patched version immediately to ensure that session integrity is maintained and to prevent unauthorized administrative actions.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a severe risk to host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34168

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an authenticated user with low privileges to inject and execute arbitrary OS commands. The vulnerability exists due to improper neutralization of special elements used in system calls.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the server hosting Coolify. Given the high CVSS score of 8.8, this vulnerability could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell commands originating from the Coolify service account.

Compensating Controls: Ensure the Coolify service is running with the least privilege necessary on the host OS to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators should prioritize patching to version 4.0.0-beta.471 immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
FastGPT, an AI Agent building platform, contains a security vulnerability that could lead to unauthorized access or manipulation of AI agent configurations.

Executive Summary:
A security vulnerability in the FastGPT AI platform could allow attackers to compromise AI agent workflows, leading to data leakage or the execution of unauthorized AI tasks.

Vulnerability Details

CVE-ID: CVE-2026-34163

Affected Software: FastGPT

Affected Versions: See vendor advisory for affected versions

Vulnerability: FastGPT is an AI Agent building platform that integrates with databases like MongoDB and Redis. The vulnerability likely involves a failure to properly secure agent configurations or API interactions, potentially allowing an attacker to intercept or modify the logic of deployed AI agents.

Business Impact

As AI agents are increasingly used for automated business logic and data processing, a compromise in FastGPT could result in the leakage of proprietary prompts, API keys, or sensitive training data. The CVSS score of 7.7 reflects a high risk where an attacker could disrupt AI-driven business processes, leading to significant operational inaccuracies and loss of intellectual property.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the FastGPT maintainers and ensure that all associated database connections (MongoDB/Redis) use secure, encrypted channels.

Proactive Monitoring: Review AI agent execution logs for anomalous behavior and audit API access tokens for any signs of unauthorized usage or credential stuffing.

Compensating Controls: Implement strict network segmentation for the FastGPT environment and use robust authentication (such as OAuth2) to protect the agent-building interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the rising popularity of AI platforms makes them high-value targets for modern threat actors.

Analyst Recommendation

We recommend that organizations utilizing FastGPT for AI automation immediately review their deployment security and apply all available updates. Ensuring the integrity of AI workflows is critical for maintaining business continuity and protecting sensitive data processed by these agents.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: Prior to version 4.14.9.5
---END_METADATA---

Description Summary:
FastGPT exposes an unauthenticated HTTP tools testing endpoint that functions as a full HTTP proxy, enabling Server-Side Request Forgery (SSRF) and internal network scanning.

Executive Summary:
An unauthenticated attacker can use FastGPT as an open HTTP proxy to access internal network resources or mask malicious traffic, leading to significant exposure of private infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34162

Affected Software: FastGPT

Affected Versions: Prior to version 4.14.9.5

Vulnerability: The /api/core/app/httpTools/runTool endpoint lacks authentication and allows arbitrary HTTP requests to be made by the server. This functions as a full-featured HTTP proxy where an unauthenticated attacker can control the method, headers, body, and target URL.

Business Impact

The impact is a critical breach of perimeter security. Attackers can use this flaw to perform Server-Side Request Forgery (SSRF) to scan internal networks, access metadata services in cloud environments, or bypass IP-based access controls. The CVSS score of 10 reflects the total loss of control over the application's network communication capabilities.

Remediation Plan

Immediate Action: Update FastGPT to version 4.14.9.5 or later to enforce authentication on the affected testing endpoints.

Proactive Monitoring: Review application logs for high volumes of requests to the /runTool endpoint and monitor for outbound traffic to internal or unusual IP ranges.

Compensating Controls: Implement egress filtering on the server hosting FastGPT to prevent it from initiating connections to sensitive internal network segments or cloud metadata IPs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. The simplicity of exploiting an unauthenticated proxy makes this a likely candidate for automated scanning and exploitation.

Analyst Recommendation

Given the CVSS 10 rating, this vulnerability should be treated as an emergency. The ability for an unauthenticated outsider to pivot through the server into your internal network is a catastrophic risk. Apply the 4.14.9.5 patch immediately and restrict network access to the FastGPT server until remediated.

---METADATA---
VENDOR: llama.cpp
PRODUCT: llama.cpp
AFFECTED_VERSIONS: Prior to version b8492
---END_METADATA---

Description Summary:
An unauthenticated attacker can achieve remote code execution and ASLR bypass in llama.cpp by exploiting a lack of bounds validation in the RPC backend's tensor deserialization.

Executive Summary:
The llama.cpp LLM inference engine is vulnerable to unauthenticated remote code execution via its RPC backend, allowing attackers to fully compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-34159

Affected Software: llama.cpp

Affected Versions: Versions prior to b8492

Vulnerability: The RPC backend's deserialize_tensor() function fails to perform bounds validation when a tensor's buffer field is zero. This allows an unauthenticated attacker with TCP access to the RPC server to read/write arbitrary memory, bypass ASLR, and execute code.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation allows an attacker to take full control of the AI inference server, potentially stealing proprietary models, sensitive training data, or using the server for malicious purposes.

Remediation Plan

Immediate Action: Update llama.cpp to version b8492 or later immediately to implement the necessary bounds validation in the RPC backend.

Proactive Monitoring: Monitor the RPC server port for anomalous traffic patterns and unexpected memory usage spikes that could signal an exploitation attempt.

Compensating Controls: Do not expose the llama.cpp RPC server port to the public internet; use VPNs or SSH tunnels for remote access and implement strict IP whitelisting.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. However, the combination of ASLR bypass and RCE makes this a highly attractive target for attackers.

Analyst Recommendation

Given the unauthenticated nature of this RCE, immediate patching is mandatory. Organizations should also ensure that LLM infrastructure is isolated from untrusted networks to reduce the attack surface.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.469
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a high risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34158

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that permits an authenticated user with low-level privileges to inject malicious commands into the host operating system. The vulnerability stems from improper neutralization of special elements used in system calls.

Business Impact

The ability to execute arbitrary OS commands provides an attacker with a foothold on the server, potentially leading to full system compromise. With a CVSS score of 8.8, this high-severity vulnerability could result in unauthorized data exfiltration, service disruption, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system and application logs for unexpected shell process executions or irregular administrative activity.

Compensating Controls: Implement strict network segmentation and restrict access to the management interface to trusted IP addresses to limit the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a significant risk to the security of the host environment. Organizations should prioritize updating their Coolify instances to the latest available version immediately to remediate the command injection vector and prevent potential unauthorized remote code execution.

---METADATA---
VENDOR: NocoBase
PRODUCT: NocoBase
AFFECTED_VERSIONS: Prior to version 2.0.28
---END_METADATA---

Description Summary:
NocoBase Workflow Script Node allows authenticated sandbox escape to Remote Code Execution as root via prototype chain traversal of console objects. This flaw is patched in version 2.0.28.

Executive Summary:
An authenticated attacker can escape the Node.js sandbox in NocoBase to achieve full Remote Code Execution with root privileges, compromising the entire host system.

Vulnerability Details

CVE-ID: CVE-2026-34156

Affected Software: NocoBase

Affected Versions: Prior to version 2.0.28

Vulnerability: This is a sandbox escape vulnerability within the Workflow Script Node. An authenticated attacker can leverage exposed WritableWorkerStdio objects on the console object to traverse the prototype chain, bypassing the vm sandbox restrictions to execute arbitrary commands as the root user.

Business Impact

A successful exploit grants an attacker full control over the underlying server infrastructure. Given the root-level access, this results in total loss of data confidentiality, integrity, and availability, potentially leading to massive data breaches and long-term system compromise. The CVSS score of 9.9 reflects the critical nature of achieving unconstrained code execution on a business-critical no-code platform.

Remediation Plan

Immediate Action: Upgrade NocoBase to version 2.0.28 or later immediately to apply the security patch.

Proactive Monitoring: Review system logs for unusual Node.js process activity and monitor the WORKFLOW_SCRIPT_MODULES environment variable for unauthorized changes.

Compensating Controls: Restrict access to the NocoBase administrative interface and the Workflow builder to trusted personnel only using network-level access controls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the technical feasibility of prototype pollution and sandbox escapes, the potential for exploitation is extremely high once the patch is analyzed by threat actors.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows a user with workflow access to escalate to full system administrator. Organizations using NocoBase must prioritize the update to version 2.0.28. Immediate patching is the only effective way to mitigate the risk of a complete host takeover.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, allowing authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host, posing a significant risk to the entire self-hosted environment.

Vulnerability Details

CVE-ID: CVE-2026-34153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: The application fails to properly neutralize special elements used in an OS command, enabling an authenticated user to perform OS command injection. This vulnerability requires a low-privilege authenticated session to initiate the attack.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute commands with the privileges of the Coolify application. Given the CVSS score of 8.8, this poses a high risk of full system compromise, unauthorized data access, and potential lateral movement into other databases or services managed by the platform.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later to implement the necessary input neutralization patches.

Proactive Monitoring: Review system and application access logs for unusual command executions or unexpected process spawning originating from the Coolify service account.

Compensating Controls: Ensure the Coolify instance is running in an isolated container with minimal host-level permissions to limit the impact of a potential container escape or code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk to the integrity of the host server. Administrators are urged to prioritize the update to the latest version immediately to eliminate the command injection vector.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, enabling authenticated attackers to execute arbitrary system commands through insecure input handling.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify allows for remote code execution, threatening the integrity of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-34152

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability (CWE-78) occurs due to the improper neutralization of special characters in input fields, allowing an authenticated attacker to inject and execute OS-level commands. This effectively bypasses the application's intended functional boundaries.

Business Impact

The ability to execute OS commands on the host server provides an attacker with broad capabilities, including data theft, privilege escalation, and persistent backdooring of the environment. The CVSS score of 8.8 highlights the high risk associated with this vulnerability, requiring prompt remediation to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 4.0.0-beta.471 or later to remediate the command injection flaw.

Proactive Monitoring: Regularly audit server access logs and monitor for unexpected command execution or child processes being spawned by the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns in request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for Coolify users. Administrators are strongly advised to perform the update to version 4.0.0-beta.471 across all environments to ensure protection against potential exploitation.

---METADATA---
VENDOR: WSO2
PRODUCT: WSO2 API Manager
AFFECTED_VERSIONS: Various, see enrichment details
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WSO2 API Manager contains an XML External Entity (XXE) style vulnerability within its SchemaValidator Mediator due to improper handling of XML document type declarations.

Executive Summary:
Improper XML validation handling in the WSO2 SchemaValidator Mediator exposes multiple WSO2 products to potential information disclosure and denial of service attacks.

Vulnerability Details

CVE-ID: CVE-2026-3415

Affected Software: WSO2 API Manager, Universal Gateway, Traffic Manager, Carbon API Gateway, and Carbon API Management Implementation.

Affected Versions: See enrichment data for specific ranges, including WSO2 API Manager versions 3.2.0 through 4.6.0.

Vulnerability: The vulnerability is identified as CWE-776, involving the improper handling of special elements in XML Document Type Declarations. The attack requires high privileges (PR:H) to execute, as it affects internal validation flows within the product.

Business Impact

An attacker with administrative access could exploit this flaw to cause a denial of service or potentially leak sensitive information from the server. Given the CVSS score of 8.7, this poses a substantial risk to the stability and confidentiality of the API management infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately by following the instructions at the official WSO2 security advisory page.

Proactive Monitoring: Review system logs for unusual XML processing errors or spikes in resource consumption that may indicate attempts to trigger the validation flaw.

Compensating Controls: Ensure that XML parsers are configured to disable Document Type Declarations (DTD) and external entity expansion at the gateway level.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the required privilege level is high, the impact on availability and confidentiality warrants prompt attention.

Analyst Recommendation

Organizations should prioritize patching their WSO2 deployments to the versions specified in the vendor advisory. Failure to address this vulnerability could lead to significant service disruptions in API-heavy environments.

---METADATA---
VENDOR: itsourcecode
PRODUCT: University Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A flaw in itsourcecode University Management System version 1 presents a high-severity security risk to the application's environment.

Executive Summary:
A secondary flaw has been identified in the University Management System, further increasing the risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-3413

Affected Software: itsourcecode University Management System

Affected Versions: Version 1

Vulnerability: A flaw has been found in the University Management System. This vulnerability, distinct from others in the same product, contributes to the overall attack surface of the management platform.

Business Impact

The potential for unauthorized data access or system manipulation remains high. If exploited, this could lead to a loss of data integrity and potential disruption of university services. The CVSS score of 7.3 confirms the High severity of the risk, necessitating prompt remediation to protect institutional assets.

Remediation Plan

Immediate Action: Update the University Management System to the latest available version that includes fixes for this specific flaw.

Proactive Monitoring: Regularly review application and server logs for signs of unauthorized access attempts or unusual system behavior.

Compensating Controls: Implement network segmentation to isolate the management system from other critical assets and enforce strict input validation on all web forms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The presence of multiple flaws in the same version emphasizes the need for a comprehensive update strategy.

Analyst Recommendation

Institutions using the itsourcecode University Management System version 1 must apply all available security patches immediately. Maintaining an up-to-date software environment is the most effective defense against exploitation.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical OS command injection vulnerability exists in the text_to_subtitles.php script of the Guardian language-system, allowing unauthenticated remote code execution.

Executive Summary:
The Guardian language-system is vulnerable to an unauthenticated remote code execution flaw that permits attackers to execute arbitrary commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-34117

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in text_to_subtitles.php. An unauthenticated remote attacker can inject shell metacharacters to execute unauthorized OS commands.

Business Impact

The CVSS score of 9.8 underscores the severity of this flaw, which allows for full system compromise without requiring authentication. Business impacts include the loss of confidentiality, integrity, and availability of the affected system, as well as the potential for lateral movement into the broader internal network.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the improper input sanitization in text_to_subtitles.php.

Proactive Monitoring: Review server logs for anomalous process execution or unexpected outbound network connections originating from the web server service account.

Compensating Controls: Utilize a WAF to filter and deny requests to text_to_subtitles.php that include malicious shell command sequences in the id parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this command injection vulnerability, immediate patching is required. Security teams should treat this as a high-priority incident until the vendor-supplied update is verified as installed across all affected instances.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical OS command injection vulnerability exists in the transcribe.php script of the Guardian language-system, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Guardian language-system poses a critical risk of total server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34116

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in transcribe.php. An unauthenticated remote attacker can inject arbitrary shell metacharacters to execute OS-level commands.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat. Successful exploitation provides an attacker with full control over the underlying server, potentially leading to unauthorized data exfiltration, service disruption, and the establishment of a persistent backdoor within the corporate network.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest vendor-supplied version immediately to incorporate necessary input sanitization.

Proactive Monitoring: Inspect web server access logs for suspicious strings containing shell metacharacters (e.g., ;, &&, |) within the id parameter of requests to transcribe.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming HTTP requests that contain shell injection patterns in the id query parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for unauthenticated remote code execution, which is one of the most severe security risks. Organizations should prioritize patching this system immediately and audit the server for any signs of unauthorized activity that may have occurred prior to remediation.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the transcribe_amazon.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, resulting in a critical risk to the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-34115

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id parameter before passing it to an exec() call within transcribe_amazon.php. This allows unauthenticated remote attackers to trigger arbitrary OS command execution by injecting shell metacharacters.

Business Impact

The CVSS score of 9.8 underscores the severity of this issue. A successful attack effectively grants the adversary the same level of access as the web service user, which can be leveraged to compromise the entire host, exfiltrate data, or disrupt business operations.

Remediation Plan

Immediate Action: Patch the Guardian language-system to the latest version to neutralize the vulnerability in the transcription component.

Proactive Monitoring: Monitor system and web server logs for irregular process execution patterns or unexpected shell activity linked to the transcribe_amazon.php file.

Compensating Controls: Deploy WAF signatures designed to detect and block shell-injection characters in HTTP GET parameters to provide virtual patching until the update is applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to the lack of required authentication and the potential for full system compromise. Immediate application of vendor patches is strongly recommended to protect the integrity and security of the affected environment.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the translate_text.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, presenting a critical risk to server security.

Vulnerability Details

CVE-ID: CVE-2026-34114

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper input sanitization in the translate_text.php script, where the id parameter is passed to a system exec() call. The flaw is exploitable by unauthenticated remote attackers who can inject arbitrary shell commands.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Exploitation could lead to complete system takeover, unauthorized access to sensitive translation data, and the potential for lateral movement into other segments of the internal network.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the command injection flaw in the translate_text.php file.

Proactive Monitoring: Monitor server logs for suspicious activity, specifically looking for attempts to pass shell commands through the translate_text.php endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that contain malicious command injection patterns directed at the translation module.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of exploitation for this unauthenticated command injection makes this a top priority for remediation. Security teams must ensure all instances of the affected software are updated to the secure version to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the speech_text.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34113

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: This is a command injection vulnerability occurring in speech_text.php where the id GET parameter is passed directly to a PHP exec() function. Because no authentication is required, any remote actor can supply malicious shell metacharacters to execute unauthorized OS commands.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. Successful exploitation allows an attacker to gain full control over the underlying server, resulting in potential data theft, service disruption, and the establishment of a persistent backdoor within the corporate network.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest vendor-supplied version immediately to patch the command injection vulnerability.

Proactive Monitoring: Review web server access logs for unusual GET requests containing shell metacharacters (e.g., ;, |, &&) targeting the speech_text.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing shell command syntax in the id parameter.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the lack of authentication requirements, this vulnerability presents an immediate threat to the confidentiality and integrity of your infrastructure. Organizations should prioritize patching the Guardian language-system as a matter of urgency to prevent unauthorized remote code execution.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in speechmac.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34112

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter in speechmac.php before passing it to a PHP exec() function. This vulnerability allows an unauthenticated remote attacker to perform command injection, enabling them to execute arbitrary system-level commands.

Business Impact

The ability for an attacker to execute arbitrary commands without authentication represents a significant danger, potentially allowing them to pivot within the network or exfiltrate sensitive data. With a CVSS score of 9.8, this vulnerability warrants immediate attention to prevent unauthorized access and protect business-critical infrastructure.

Remediation Plan

Immediate Action: Install the latest software update from the vendor to remediate the command injection flaw in speechmac.php.

Proactive Monitoring: Regularly audit server logs for suspicious activity involving the speechmac.php endpoint and associated shell execution attempts.

Compensating Controls: Implement WAF rules specifically designed to detect and block command injection payloads targeting vulnerable GET parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the lack of authentication required, this vulnerability represents an urgent threat. It is highly recommended that administrators apply the available security updates immediately to mitigate the risk of remote code execution and unauthorized server access.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in speechmac_text.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34111

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: This vulnerability resides in the speechmac_text.php script, where the id GET parameter is unsafely concatenated into a PHP exec() command. An unauthenticated remote attacker can exploit this lack of sanitization to inject and execute arbitrary OS-level commands.

Business Impact

Successful exploitation allows an attacker to gain unauthorized execution privileges on the host server, which can lead to catastrophic data breaches and complete system compromise. The CVSS score of 9.8 confirms that this represents an extreme risk to the organization's security posture and data confidentiality.

Remediation Plan

Immediate Action: Update the Guardian Language-System to the latest version to address the improper input handling in speechmac_text.php.

Proactive Monitoring: Monitor server-side process logs for unauthorized or unexpected PHP execution patterns related to the jobs/speech_audio_mac_text.php script.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out requests containing malicious shell metacharacters targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation and the level of access granted to an attacker. Security teams must treat this as a high-priority item and ensure the vendor-provided patch is implemented across all production environments immediately.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in complex_start.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34110

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists due to improper input sanitization in the complex_start.php file, where the id GET parameter is passed directly into a PHP exec() function. An unauthenticated remote attacker can leverage this by appending shell metacharacters to execute unauthorized OS commands.

Business Impact

The exploitation of this flaw grants attackers complete control over the underlying server, leading to potential data exfiltration, system destruction, or lateral movement into the internal network. With a CVSS score of 9.8, this vulnerability is classified as critical, representing an immediate threat to the integrity and availability of business operations.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian immediately to sanitize the input parameters.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing shell metacharacters or unexpected system calls originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing suspicious shell syntax directed at complex_start.php.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this command injection flaw and the lack of authentication required for exploitation, immediate remediation is mandatory. Organizations should prioritize updating the Guardian Language-System to the latest patched version to prevent potential remote code execution and unauthorized system access.

---METADATA---
VENDOR: itsourcecode
PRODUCT: University Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A security vulnerability in itsourcecode University Management System version 1 could lead to unauthorized access to academic and administrative records.

Executive Summary:
The University Management System contains a high-severity vulnerability that poses a significant risk to the confidentiality and integrity of university data.

Vulnerability Details

CVE-ID: CVE-2026-3411

Affected Software: itsourcecode University Management System

Affected Versions: Version 1

Vulnerability: A security vulnerability has been detected in the software. While the specific flaw is not detailed, such systems are often prone to authentication bypass or injection-based attacks that compromise the underlying database.

Business Impact

Exploitation of this flaw could allow unauthorized individuals to access or modify student records, financial data, or sensitive institutional information. The CVSS score of 7.3 reflects a High severity, indicating a credible threat to the institution's operational security and compliance status.

Remediation Plan

Immediate Action: Apply the latest security updates from itsourcecode for the University Management System immediately.

Proactive Monitoring: Audit user account activity for anomalies and monitor database logs for signs of SQL injection or unauthorized data extraction.

Compensating Controls: Use a Web Application Firewall (WAF) to block common web-based attacks and ensure that all administrative interfaces are protected by strong authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as educational institutions are frequent targets for cyberattacks.

Analyst Recommendation

Immediate patching is recommended to protect the University Management System. IT departments should ensure that all instances of the software are updated to the most recent secure version to prevent data breaches.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system is vulnerable to unauthenticated remote code execution due to improper sanitization of the 'id' parameter in speech.php.

Executive Summary:
An unauthenticated command injection vulnerability in the Guardian language-system allows remote attackers to execute arbitrary OS commands via the speech.php script.

Vulnerability Details

CVE-ID: CVE-2026-34109

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application insecurely passes the 'id' GET parameter directly into a PHP exec() function within speech.php. This lack of input validation permits an unauthenticated attacker to inject shell commands, leading to unauthorized OS-level execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to business operations. Exploitation allows attackers to gain full control over the underlying server, potentially leading to total data loss, unauthorized access to sensitive language processing assets, and significant system downtime during incident response efforts.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest version, which includes necessary input sanitization for the speech.php script.

Proactive Monitoring: Monitor system logs for anomalous child processes spawned by the web server user, which may indicate command injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious GET requests targeting speech.php that include command-chaining syntax.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of multiple command injection vulnerabilities in the Guardian language-system indicates a systemic issue with input handling. It is recommended to apply the vendor patches immediately and conduct a comprehensive security review of the entire codebase to identify any additional unpatched injection vectors.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system is vulnerable to unauthenticated remote code execution due to improper sanitization of the 'id' parameter in text.php.

Executive Summary:
An unauthenticated command injection vulnerability in the Guardian language-system allows remote attackers to execute arbitrary OS commands with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34108

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the 'id' GET parameter before passing it to a PHP exec() function in text.php. This allows an unauthenticated attacker to inject shell metacharacters and execute arbitrary operating system commands.

Business Impact

A CVSS score of 9.8 reflects the severe impact of this vulnerability, which facilitates full remote code execution. Successful exploitation results in complete system compromise, enabling attackers to install backdoors, exfiltrate sensitive data, or pivot into the internal network, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the command injection vulnerability in text.php.

Proactive Monitoring: Review web server access logs for requests containing shell metacharacters (e.g., ;, |, &, `) in the 'id' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing common shell injection payloads targeting the text.php file.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is trivial to exploit and carries extreme risk to the host server. Security teams should treat this as a high-priority remediation item and verify that all instances of the Guardian language-system are patched or isolated from public access until a fix is deployed.