---METADATA---
VENDOR: Notesnook
PRODUCT: Notesnook
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Notesnook note-taking application could lead to unauthorized data access or a compromise of user information.

Executive Summary:
Notesnook users face a significant security risk due to a high-severity flaw that could compromise the confidentiality and integrity of stored private notes.

Vulnerability Details

CVE-ID: CVE-2026-33955

Affected Software: Notesnook

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are not fully disclosed, the vulnerability affects the core Notesnook application. The CVSS score of 8.6 suggests a high-impact flaw, possibly involving an authentication bypass or a breakdown in the encryption implementation used to protect user notes.

Business Impact

For organizations or individuals using Notesnook for sensitive data, this vulnerability presents a major risk of data exfiltration. A successful exploit could result in the exposure of proprietary information, credentials, or personal data stored within the app. The CVSS score of 8.6 justifies an urgent response to prevent reputational and legal damage following a potential data breach.

Remediation Plan

Immediate Action: Users should update the Notesnook application across all platforms (mobile, desktop, and web) to the latest secured version immediately.

Proactive Monitoring: Review account access logs for any unrecognized login sessions or unusual data synchronization patterns.

Compensating Controls: Ensure that multi-factor authentication (MFA) is enabled for the Notesnook account to provide an additional layer of security against unauthorized access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation of this vulnerability. Given the high CVSS score, the technical community is likely to investigate the flaw quickly, increasing the risk of a future exploit.

Analyst Recommendation

Due to the high severity and the sensitive nature of the data handled by Notesnook, immediate patching is mandatory. Users should verify they are running the latest version and remain vigilant for any signs of account compromise until the update is confirmed.

---METADATA---
VENDOR: Signal
PRODUCT: Signal K Server
AFFECTED_VERSIONS: Prior to 2.24.0-beta.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability via Admin Role Injection in Signal K Server allows attackers to gain full administrative access.

Executive Summary:
A critical privilege escalation vulnerability in Signal K Server prior to version 2.24.0-beta.4 allows unauthenticated attackers to hijack administrative control.

Vulnerability Details

CVE-ID: CVE-2026-33950

Affected Software: Signal K Server

Affected Versions: Prior to 2.24.0-beta.4

Vulnerability: The vulnerability allows an unauthenticated attacker to inject an administrative role via the /enableSecurity endpoint, resulting in full control over the server.

Business Impact

The CVSS score of 9.4 highlights the severe impact of this vulnerability, which grants an attacker full administrative privileges. This could lead to the compromise of vessel routing data, modification of critical system configurations, and total server takeover, creating significant operational and safety risks.

Remediation Plan

Immediate Action: Upgrade Signal K Server to version 2.24.0-beta.4 or higher to remediate the administrative role injection flaw.

Proactive Monitoring: Monitor server logs for suspicious access to the /enableSecurity endpoint and verify the list of authorized administrators for any unauthorized additions.

Compensating Controls: Restrict network access to the Signal K Server management interface to trusted IP addresses only, using a VPN or firewall to limit exposure to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete administrative compromise, users of Signal K Server must upgrade to the latest version immediately. Furthermore, administrators should conduct an audit of current user permissions and security configurations to ensure no unauthorized administrative accounts were created while the system was vulnerable.

---METADATA---
VENDOR: MaxSite
PRODUCT: MaxSite CMS
AFFECTED_VERSIONS: Up to 109
---END_METADATA---

Description Summary:
A security flaw in MaxSite CMS up to version 109 presents a high-severity risk to the integrity of the content management system.

Executive Summary:
MaxSite CMS versions up to 109 contain a security vulnerability that could allow attackers to compromise the application's integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-3395

Affected Software: MaxSite CMS

Affected Versions: All versions up to and including 109

Vulnerability: A security flaw exists in the MaxSite CMS architecture. While the specific technical vector is not detailed in the summary, the vulnerability is categorized as high severity and impacts the core CMS functionality.

Business Impact

A successful exploit could result in unauthorized modifications to website content, potential data leakage, or service disruption. The CVSS score of 7.3 indicates a High severity level, suggesting that while exploitation may require specific conditions, the impact on business operations and reputation is significant.

Remediation Plan

Immediate Action: Upgrade MaxSite CMS to a version higher than 109 immediately to mitigate the identified security risks.

Proactive Monitoring: Monitor CMS administrative logs for unauthorized login attempts or unexpected changes to system configurations and file structures.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter suspicious traffic and enforce strong access control policies for the CMS administrative interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of a public exploit provides a window for administrators to patch before widespread scanning begins.

Analyst Recommendation

Organizations using MaxSite CMS should treat this as a high-priority update. Ensure that all CMS installations are moved to a supported, patched version to maintain a secure web presence.

---METADATA---
VENDOR: Incus
PRODUCT: Incus
AFFECTED_VERSIONS: Versions prior to 6.23.0
---END_METADATA---

Description Summary:
Incus versions prior to 6.23.0 are vulnerable to an arbitrary file write flaw where path traversal in systemd credential keys allows root-level writes to the host filesystem.

Executive Summary:
Incus virtual machine and container managers are vulnerable to a critical privilege escalation where an attacker can write arbitrary files as root on the host server, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33945

Affected Software: Incus

Affected Versions: Versions prior to 6.23.0

Vulnerability: The vulnerability exists in the handling of systemd.credential configuration keys. Because Incus allows periods in credential names, an attacker can use traversal sequences (e.g., ../../../root/.bashrc) to escape the intended directory and write files to the host filesystem with root privileges.

Business Impact

A successful exploit allows an attacker with instance configuration privileges to escalate to root on the host server. This can result in a total loss of host integrity, permanent denial of service, or the ability to compromise all other instances running on the same hardware. The CVSS score of 9.9 highlights the extreme severity of this host-escape scenario.

Remediation Plan

Immediate Action: Update Incus to version 6.23.0 or later to patch the configuration key parsing logic.

Proactive Monitoring: Audit instance configuration logs for any keys containing suspicious path traversal patterns or excessive use of periods in systemd.credential fields.

Compensating Controls: Limit the ability to modify instance configurations to highly trusted administrators and use mandatory access control (MAC) systems like AppArmor to restrict where the Incus daemon can write files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Host-escape vulnerabilities in virtualization platforms are among the most critical security risks. Administrators must apply the version 6.23.0 update immediately to prevent instance-to-host privilege escalation.

---METADATA---
VENDOR: Saloon
PRODUCT: Saloon (PHP Library)
AFFECTED_VERSIONS: Versions prior to 4.0.0
---END_METADATA---

Description Summary:
Saloon versions prior to 4.0.0 are vulnerable to PHP Object Injection via insecure use of unserialize() in the AccessTokenAuthenticator class, potentially leading to remote code execution.

Executive Summary:
The Saloon PHP library is vulnerable to a critical object injection flaw that can be leveraged to achieve remote code execution by providing malicious serialized OAuth token data.

Vulnerability Details

CVE-ID: CVE-2026-33942

Affected Software: Saloon

Affected Versions: Versions prior to 4.0.0

Vulnerability: The library used unserialize() with allowed_classes => true in its AccessTokenAuthenticator class. If an attacker can control the serialized string (e.g., via cache poisoning or file overwrites), they can inject a "gadget" object that triggers malicious code execution through PHP magic methods during instantiation.

Business Impact

This vulnerability can lead to full remote code execution, especially in environments containing common PHP gadget chains like Monolog. The CVSS score of 9.8 reflects the high impact on confidentiality and integrity, as an attacker could gain complete control over the application's execution environment.

Remediation Plan

Immediate Action: Upgrade the Saloon library to version 4.0.0 or higher. This version removes the dangerous use of PHP serialization for token management.

Proactive Monitoring: Monitor for suspicious activity in application cache directories and review logs for PHP serialization errors or unexpected object types.

Compensating Controls: If upgrading is not immediately possible, ensure that the storage mechanism for OAuth tokens (e.g., Redis, file system) is strictly secured and inaccessible to untrusted users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

PHP Object Injection remains a critical threat to modern applications. Users of the Saloon library should migrate to version 4.0.0 immediately to eliminate the use of unserialize() and mitigate the risk of remote code execution.

---METADATA---
VENDOR: Handlebars
PRODUCT: Handlebars.js
AFFECTED_VERSIONS: 4.0.0 through 4.7.8
---END_METADATA---

Description Summary:
Handlebars.js allows Remote Code Execution when Handlebars.compile() processes a crafted AST object containing unsanitized numeric literals.

Executive Summary:
Handlebars.js versions prior to 4.7.9 are vulnerable to unauthenticated Remote Code Execution if an attacker can provide a malicious AST object to the template compiler.

Vulnerability Details

CVE-ID: CVE-2026-33937

Affected Software: Handlebars Handlebars.js

Affected Versions: 4.0.0 through 4.7.8

Vulnerability: The Handlebars.compile() function accepts pre-parsed Abstract Syntax Tree (AST) objects. The value field of a NumberLiteral node is injected directly into generated JavaScript without sanitization. An unauthenticated attacker who can control the input to compile() can execute arbitrary JavaScript on the server.

Business Impact

This is a critical RCE vulnerability in a widely used library. Successful exploitation allows an attacker to execute code with the privileges of the Node.js process, leading to full server takeover and data compromise. The CVSS score of 9.8 reflects the severity and potential for widespread impact across numerous applications.

Remediation Plan

Immediate Action: Update the handlebars package to version 4.7.9 or later in all project dependencies.

Proactive Monitoring: Audit application code to ensure that Handlebars.compile() is only called with trusted string inputs and never with objects derived from user-supplied JSON.

Compensating Controls: Use the Handlebars runtime-only build (handlebars/runtime) in production environments where templates are pre-compiled, as this build does not include the vulnerable compile() function.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. However, because Handlebars is a foundational dependency for many web applications, this vulnerability has a massive attack surface.

Analyst Recommendation

Updating to version 4.7.9 is the most effective mitigation. Developers should also adopt the practice of pre-compiling templates and using the runtime-only version of Handlebars in production to eliminate the risk of dynamic compilation vulnerabilities entirely.

---METADATA---
VENDOR: Incus
PRODUCT: Incus
AFFECTED_VERSIONS: Versions prior to 6.23.0
---END_METADATA---

Description Summary:
Incus versions prior to 6.23.0 contain a critical sandbox escape in the pongo2 template implementation that allows arbitrary file reads and writes as root on the host server.

Executive Summary:
A critical vulnerability in Incus allows for arbitrary file read and write operations with root privileges on the host system by bypassing the template engine's filesystem isolation.

Vulnerability Details

CVE-ID: CVE-2026-33897

Affected Software: Incus

Affected Versions: Versions prior to 6.23.0

Vulnerability: The implementation of pongo2 templates within Incus fails to enforce chroot isolation. An attacker capable of creating or modifying instance templates can bypass the instance's filesystem boundaries to read or write any file on the host operating system with root authority.

Business Impact

This flaw permits an attacker to fully compromise the host server and all hosted instances. By reading sensitive host files (like /etc/shadow) or writing malicious binaries/scripts, an attacker can achieve persistent root access. The CVSS score of 9.9 reflects the critical nature of this host-level compromise.

Remediation Plan

Immediate Action: Upgrade Incus to version 6.23.0 immediately to restore proper template isolation and chroot enforcement.

Proactive Monitoring: Inspect all pongo2 template files for commands that attempt to access paths outside the standard instance directory structure.

Compensating Controls: Disable the use of instance templates if they are not strictly required for operations, or restrict template modification permissions to a minimal set of users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The failure of the chroot mechanism in the template engine is a high-priority security issue. Immediate patching is required to ensure that the isolation between the host and its containers remains intact.

---METADATA---
VENDOR: Gematik
PRODUCT: Authenticator
AFFECTED_VERSIONS: < 4.16.0
---END_METADATA---

Description Summary:
Gematik Authenticator is vulnerable to authentication flow hijacking via malicious deep links, allowing attackers to impersonate victim users.

Executive Summary:
Gematik Authenticator users are at risk of identity theft and session hijacking if they click on malicious deep links, potentially compromising sensitive health data.

Vulnerability Details

CVE-ID: CVE-2026-33875

Affected Software: Gematik Authenticator Gematik Authenticator

Affected Versions: Versions prior to 4.16.0

Vulnerability: The application is vulnerable to authentication flow hijacking. An unauthenticated attacker can craft a malicious deep link that, when clicked by a victim, redirects the authentication process to the attacker, allowing them to log in using the victim's identity.

Business Impact

This vulnerability directly threatens the confidentiality of digital health records. A successful attack allows unauthorized access to sensitive medical information and identity impersonation within the German health infrastructure. The CVSS score of 9.3 reflects the critical impact on user privacy and the high potential for targeted phishing attacks.

Remediation Plan

Immediate Action: Update Gematik Authenticator to version 4.16.0 or greater immediately.

Proactive Monitoring: Organizations should educate users on the risks of clicking unsolicited links, even those that appear to open legitimate local applications.

Compensating Controls: There are no known technical workarounds for this vulnerability; the software update is the only effective mitigation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. This type of vulnerability is often used in highly targeted social engineering campaigns.

Analyst Recommendation

The update to version 4.16.0 is mandatory for all users of the Gematik Authenticator. Given the sensitive nature of the data protected by this application, administrators should verify that all managed devices have been updated to the patched version to prevent identity hijacking.

---METADATA---
VENDOR: Apache
PRODUCT: Cassandra
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

Executive Summary:
An input validation vulnerability in Azure Managed Instance for Apache Cassandra allows authorized attackers to achieve remote code execution, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-33844

Affected Software: Apache Cassandra (Azure Managed Instance)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper input validation that allows an authenticated attacker to inject and execute malicious code within the database environment.

Business Impact

A CVSS score of 9.0 confirms the severity of this vulnerability. Successful exploitation could lead to full system compromise, data theft, and the disruption of critical business services dependent on the Cassandra instance.

Remediation Plan

Immediate Action: Update the Azure Managed Instance for Apache Cassandra to the latest version.

Proactive Monitoring: Review database logs for anomalous input patterns and unauthorized command execution.

Compensating Controls: Implement input filtering and validation at the application level to prevent potentially malicious payloads from reaching the database.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation. The potential for RCE makes this a high-priority risk.

Analyst Recommendation

Apply all vendor-provided updates immediately. Ensure that the database environment is isolated and that access is strictly controlled to mitigate the risk of unauthorized input injection.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Machine Learning
AFFECTED_VERSIONS: 3.0.0 up to (excluding) 1.7.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An injection vulnerability in Azure Machine Learning allows unauthorized attackers to perform spoofing over a network due to improper neutralization of special elements in output.

Executive Summary:
A critical injection vulnerability in Microsoft Azure Machine Learning allows remote attackers to perform spoofing attacks.

Vulnerability Details

CVE-ID: CVE-2026-33833

Affected Software: Microsoft Azure Machine Learning

Affected Versions: 3.0.0 up to (excluding) 1.7.6

Vulnerability: This vulnerability involves CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) indicates that an unauthenticated attacker can trigger this via a network-based vector, though it requires user interaction.

Business Impact

The ability for an attacker to perform spoofing can lead to the compromise of data integrity and potential redirection of users to malicious resources. With a CVSS score of 8.2 (High), this vulnerability poses a significant risk to the trustworthiness of machine learning workflows and associated data pipelines.

Remediation Plan

Immediate Action: Update Microsoft Azure Machine Learning to version 1.7.6 or later as specified by the vendor security guide.

Proactive Monitoring: Monitor Azure logs for anomalous output generation or unexpected network traffic originating from the Machine Learning service.

Compensating Controls: Deploy Web Application Firewalls (WAF) with strict input/output validation rules to inspect traffic for injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable via network-based injection vectors, necessitating prompt attention.

Analyst Recommendation

Given the High severity rating and the potential for spoofing attacks, organizations should prioritize the update of Azure Machine Learning instances. Ensure all environments are patched to the secure version to prevent unauthorized manipulation of output components.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: See below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A double-free vulnerability in the Windows IKE Extension allows unauthenticated attackers to execute arbitrary code over a network.

Executive Summary:
A critical double-free vulnerability in the Windows IKE Extension enables unauthenticated remote code execution, posing a severe threat to all affected Windows systems.

Vulnerability Details

CVE-ID: CVE-2026-33824

Affected Software: Microsoft Windows (10 and 11 versions 1607, 1809, 21H2, 22H2, 22H3, 23H2)

Affected Versions: Windows 10 (10.0.14393.0 up to 10.0.14393.9060; 10.0.17763.0 up to 10.0.17763.8644; 10.0.19044.0 up to 10.0.19044.7184; 10.0.19045.0 up to 10.0.19045.7184); Windows 11 (10.0.22631.0 up to 10.0.22631.6936)

Vulnerability: This is a double-free vulnerability within the Windows IKE (Internet Key Exchange) Extension. An unauthenticated attacker can trigger this flaw over the network to achieve arbitrary code execution.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the attack is network-based and does not require authentication, it represents a significant threat to internal and external-facing systems, potentially leading to widespread data exfiltration or malware deployment.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft in the April 2026 update cycle to resolve the double-free condition.

Proactive Monitoring: Monitor network traffic for anomalous IKEv2 packet patterns and review system logs for crashes or unexpected service restarts related to the IKEEXT service.

Compensating Controls: Restrict network access to IKE/IPsec endpoints to known, trusted IP addresses using network-level firewalls until patches can be applied.

Exploitation Status

Public Exploit Available: Unknown — while there are public GitHub proof-of-concept repositories, there is no evidence of weaponized modules in curated sources like Metasploit or ExploitDB.

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a confirmed weaponized public exploit for this vulnerability. The vulnerability is highly dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

This vulnerability is highly critical due to the potential for unauthenticated remote code execution. Administrators should deploy the Microsoft security updates as a matter of high urgency across all affected Windows endpoints and servers.

---METADATA---
VENDOR: Microsoft
PRODUCT: Teams
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper authorization in Microsoft Teams permits an authorized attacker to perform unauthorized information disclosure over a network.

Executive Summary:
An authorization vulnerability in Microsoft Teams exposes sensitive information to authorized attackers, presenting a critical risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-33823

Affected Software: Microsoft Teams

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper authorization checks within Microsoft Teams, which can be leveraged by an already authenticated user to access information they are not permitted to view.

Business Impact

The exploitation of this flaw could lead to significant unauthorized disclosure of sensitive corporate data. With a CVSS score of 9.6, the severity is high, reflecting the potential for widespread data exposure that could compromise intellectual property, internal communications, and lead to regulatory compliance violations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft specifically for the Teams environment.

Proactive Monitoring: Review access logs for unusual patterns of data retrieval or unauthorized attempts to access sensitive channels.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and data loss prevention (DLP) policies to limit the scope of accessible data for standard users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the prevalence of Microsoft Teams in enterprise environments, the potential for exploitation is significant.

Analyst Recommendation

Security teams should prioritize patching this vulnerability across all endpoints using Microsoft Teams. Given the critical nature of the flaw, verify that automated update mechanisms are functioning correctly and audit user permissions to minimize the impact of potential unauthorized access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Bing
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A deserialization vulnerability in Microsoft Bing allows an unauthorized remote attacker to execute arbitrary code via the network.

Executive Summary:
A critical deserialization flaw in Microsoft Bing permits unauthenticated remote attackers to execute arbitrary code, creating a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33819

Affected Software: Microsoft Bing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from insecure deserialization of untrusted data handled by the application. This allows an unauthorized attacker to inject malicious payloads that execute code within the context of the service.

Business Impact

A CVSS score of 10.0 reflects the maximum severity, indicating that this vulnerability could lead to a total breach of the affected infrastructure. Successful exploitation may result in complete loss of data confidentiality, integrity, and system availability.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft for the Bing service immediately.

Proactive Monitoring: Review network traffic and server logs for unusual deserialization patterns or unexpected process execution following data ingestion.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input and restrict network access to the affected service components.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and its 10.0 CVSS score, immediate patching is required to prevent remote code execution. Security teams should verify that all instances of the affected software are updated to the vendor-recommended versions without delay.