---METADATA---
VENDOR: GitLab
PRODUCT: AI Gateway (Duo Workflow Service)
AFFECTED_VERSIONS: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0
---END_METADATA---

Description Summary:
Insecure template expansion in GitLab AI Gateway allows attackers to cause a denial-of-service or execute arbitrary code via crafted Duo Agent definitions.

Executive Summary:
A critical vulnerability in the GitLab AI Gateway Duo Workflow Service permits remote code execution or denial-of-service via insecure template expansion.

Vulnerability Details

CVE-ID: CVE-2026-1868

Affected Software: GitLab AI Gateway

Affected Versions: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0

Vulnerability: The AI Gateway component is vulnerable to insecure template expansion of user-supplied data through crafted Duo Agent Platform Flow definitions. An attacker can leverage this flaw to inject malicious code that the Gateway processes, leading to either a total system crash or arbitrary code execution.

Business Impact

A successful exploit could lead to the complete compromise of the AI Gateway, potentially exposing sensitive AI training data or integration secrets. The CVSS score of 9.9 indicates a near-maximum severity, reflecting the catastrophic potential for service downtime and unauthorized access to the underlying infrastructure.

Remediation Plan

Immediate Action: Update the GitLab AI Gateway to versions 18.6.2, 18.7.1, or 18.8.1 immediately.

Proactive Monitoring: Monitor the AI Gateway logs for unusual Duo Agent Platform Flow definitions or unexpected service restarts.

Compensating Controls: Ensure that the AI Gateway is deployed within a segmented network environment to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. GitLab has proactively released patches, and the high CVSS score necessitates urgent attention from security teams.

Analyst Recommendation

Because this vulnerability allows for remote code execution on a high-value AI component, remediation should be the highest priority. Administrators must update to the fixed versions (18.6.2, 18.7.1, or 18.8.1) immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Versions prior to 144
---END_METADATA---

Description Summary:
A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 144, which could allow a remote attacker to potentially exploit heap corruption via a crafted page.

Executive Summary:
A high-severity type confusion vulnerability in the Google Chrome V8 engine allows unauthenticated remote attackers to execute arbitrary code or cause system instability.

Vulnerability Details

CVE-ID: CVE-2026-1862

Affected Software: Google Chrome

Affected Versions: Versions prior to 144

Vulnerability: This vulnerability is a type confusion flaw within the V8 JavaScript engine. An unauthenticated remote attacker can trigger this condition by convincing a user to visit a specially crafted website, leading to memory corruption and potential arbitrary code execution within the browser's sandbox.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized code execution on the user's workstation, potentially compromising sensitive data or serving as an entry point for further lateral movement within the corporate network. With a CVSS score of 8.8, this High-severity flaw poses a significant risk to organizational productivity and data integrity if users interact with malicious web content.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 144 or later immediately to mitigate the risk of exploitation.

Proactive Monitoring: Organizations should monitor endpoint logs for unusual browser crashes or unexpected outbound connections from browser processes.

Compensating Controls: Implement robust web filtering and EDR solutions to block access to known malicious domains and detect post-exploitation behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of V8 type confusion flaws, the potential for weaponization by sophisticated threat actors is high.

Analyst Recommendation

The high CVSS score and the ubiquitous nature of the Chrome browser necessitate an immediate patching cycle. Security teams should prioritize the deployment of version 144 across all managed endpoints to prevent potential remote code execution attacks.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to version 144
---END_METADATA---

Description Summary:
A heap buffer overflow in the libvpx library within Google Chrome allows for potential remote code execution when processing malicious media content. This is resolved in version 144.

Executive Summary:
A high-severity heap buffer overflow in Google Chrome's libvpx component allows unauthenticated attackers to execute arbitrary code or cause a denial of service via specially crafted web content.

Vulnerability Details

CVE-ID: CVE-2026-1861

Affected Software: Google Chrome

Affected Versions: Prior to version 144

Vulnerability: A heap buffer overflow exists in the libvpx video codec library. An unauthenticated remote attacker can exploit this by enticing a user to visit a malicious website or view a malicious video, leading to memory corruption and potential code execution within the browser's context.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant threat to corporate endpoints. Successful exploitation could lead to the compromise of user workstations, theft of session cookies, or the installation of malware, bypassing standard browser security boundaries.

Remediation Plan

Immediate Action: Update Google Chrome to version 144 or later across all enterprise endpoints immediately to patch the vulnerable libvpx library.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual browser child processes or unexpected memory allocation patterns.

Compensating Controls: Implement web filtering to block known malicious domains and ensure that browser sandboxing features are strictly enforced via Group Policy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, heap overflows in media libraries are historically common targets for "zero-click" or "one-click" exploit chains.

Analyst Recommendation

Browser vulnerabilities are a primary entry point for modern cyberattacks. It is critical that organizations automate the update process for Google Chrome to ensure that version 144 is deployed rapidly across the entire fleet.

---METADATA---
VENDOR: PixelYourSite
PRODUCT: PixelYourSite PRO
AFFECTED_VERSIONS: All versions up to, and including, 12
---END_METADATA---

Description Summary:
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' and 'pys_landing_page' parameters in versions up to 12.

Executive Summary:
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting, which could allow attackers to execute malicious scripts in the browsers of site visitors and administrators.

Vulnerability Details

CVE-ID: CVE-2026-1844

Affected Software: PixelYourSite PixelYourSite PRO

Affected Versions: All versions up to, and including, 12

Vulnerability: This vulnerability is a Stored Cross-Site Scripting (XSS) flaw occurring within the 'pysTrafficSource' and 'pys_landing_page' parameters. An attacker can inject malicious JavaScript that is stored on the server and executed whenever a user visits the affected page, typically without requiring prior authentication to submit the initial payload.

Business Impact

A successful exploit allows for the execution of arbitrary code in the context of a user's browser session. This can lead to the theft of sensitive session cookies, unauthorized administrative actions, and the redirection of users to malicious websites. The CVSS score of 7.2 reflects a High severity, as the persistent nature of the exploit increases the likelihood of compromising high-privilege accounts.

Remediation Plan

Immediate Action: Update the PixelYourSite PRO plugin to the latest available version immediately to patch the vulnerable parameters.

Proactive Monitoring: Review web server logs for suspicious activity involving the 'pysTrafficSource' and 'pys_landing_page' parameters and monitor for unauthorized administrative user creation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns and script injection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the popularity of the plugin, the potential for exploitation is high once the vulnerability details are widely known.

Analyst Recommendation

The high CVSS score and the persistent nature of Stored XSS make this a significant risk to WordPress environments. IT administrators should prioritize the update of the PixelYourSite PRO plugin across all managed instances. Immediate remediation is necessary to prevent session hijacking and potential site takeover.

---METADATA---
VENDOR: Super Page Cache
PRODUCT: Super Page Cache
AFFECTED_VERSIONS: All versions up to, and including, 5
---END_METADATA---

Description Summary:
The Super Page Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Activity Log in all versions up to and including version 5.

Executive Summary:
The Super Page Cache plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in its Activity Log that could allow attackers to gain administrative access.

Vulnerability Details

CVE-ID: CVE-2026-1843

Affected Software: Super Page Cache

Affected Versions: All versions up to, and including, 5

Vulnerability: This vulnerability is a Stored Cross-Site Scripting (XSS) flaw within the plugin's Activity Log feature. An attacker can submit malicious data that is recorded in the log; when an administrator views the Activity Log in the WordPress dashboard, the malicious script executes in their browser context.

Business Impact

This flaw is particularly dangerous because it specifically targets administrators who are performing routine maintenance. Successful exploitation can lead to complete site compromise, as the attacker’s script runs with administrative privileges, allowing for the creation of new admin accounts or the modification of site files. The CVSS score is 7.2 (High).

Remediation Plan

Immediate Action: Update the Super Page Cache plugin to the latest version immediately to secure the Activity Log functionality.

Proactive Monitoring: Review the plugin's Activity Log for any unusual entries or script fragments and monitor for unauthorized changes to the WordPress configuration.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious payloads in HTTP requests before they can be recorded in application logs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation of this vulnerability. Because this vulnerability targets the administrative backend, it is a high-value target for attackers seeking long-term persistence.

Analyst Recommendation

Due to the direct threat to administrative accounts, this vulnerability requires immediate attention. IT teams should update the Super Page Cache plugin to the latest version across all WordPress installations. Failure to patch may result in a complete compromise of the WordPress environment when administrators view system logs.

---METADATA---
VENDOR: PixelYourSite
PRODUCT: PixelYourSite – Your smart PIXEL (TAG) & API Manager
AFFECTED_VERSIONS: All versions up to, and including, 11
---END_METADATA---

Description Summary:
The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'pysTrafficSource' and 'pys_landing_page' parameters.

Executive Summary:
A high-severity Stored XSS vulnerability in the PixelYourSite plugin allows attackers to inject malicious scripts into the WordPress admin dashboard, potentially leading to session hijacking.

Vulnerability Details

CVE-ID: CVE-2026-1841

Affected Software: PixelYourSite – Your smart PIXEL (TAG) & API Manager

Affected Versions: All versions up to, and including, 11

Vulnerability: The vulnerability is caused by insufficient input sanitization and output escaping on the 'pysTrafficSource' and 'pys_landing_page' parameters. This allows an attacker to inject arbitrary web scripts that execute whenever a user accesses the affected page.

Business Impact

Stored XSS can be used to hijack administrative sessions, steal sensitive cookies, or redirect users to malicious websites. Since the script is stored on the server, it can impact any administrator viewing the plugin's reports, leading to a potential full site compromise. The CVSS score is 7.2.

Remediation Plan

Immediate Action: Update the PixelYourSite plugin to the latest version (version 12 or higher) to ensure all inputs are properly sanitized.

Proactive Monitoring: Monitor for suspicious JavaScript execution in the browser console when accessing the WordPress dashboard and review logs for unusual traffic to the plugin's settings.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the sources from which scripts can be executed and mitigate the impact of XSS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation. XSS vulnerabilities in tracking plugins are common and often exploited to target site administrators.

Analyst Recommendation

Remediate this vulnerability immediately by applying the vendor's update. Stored XSS is a reliable method for attackers to gain administrative access by targeting the users who manage the site.

---METADATA---
VENDOR: WordPress
PRODUCT: Quick Playground
AFFECTED_VERSIONS: Up to and including 1.3.1
---END_METADATA---

Description Summary:
The Quick Playground plugin for WordPress contains an RCE vulnerability due to insufficient authorization on REST API endpoints, allowing unauthenticated file uploads.

Executive Summary:
A critical Remote Code Execution vulnerability in the Quick Playground WordPress plugin allows unauthenticated attackers to gain full server control.

Vulnerability Details

CVE-ID: CVE-2026-1830

Affected Software: WordPress Quick Playground Plugin

Affected Versions: Up to and including 1.3.1

Vulnerability: The plugin lacks proper authorization checks on REST API endpoints, allowing unauthenticated attackers to retrieve sync codes and perform arbitrary file uploads via path traversal, resulting in Remote Code Execution.

Business Impact

This vulnerability provides an attacker with the ability to execute arbitrary PHP code on the server. This leads to full site takeover, data exfiltration, and the potential for the server to be used as a botnet node, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Update the Quick Playground plugin to the latest version immediately. If no update is available, deactivate and remove the plugin.

Proactive Monitoring: Scan the server for unauthorized files, particularly in the uploads directory, and monitor access logs for suspicious REST API requests.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing path traversal patterns or suspicious file upload attempts to REST API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin vulnerabilities of this nature are frequently targeted. Administrators must ensure the plugin is updated or removed immediately to mitigate the risk of full server compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: Content Visibility for Divi Builder
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Content Visibility for Divi Builder plugin for WordPress contains a vulnerability that allows for remote code execution.

Executive Summary:
A high-severity remote code execution vulnerability in the Content Visibility for Divi Builder plugin puts WordPress sites at risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-1829

Affected Software: WordPress (Content Visibility for Divi Builder plugin)

Affected Versions: See vendor advisory for affected versions

Vulnerability: The plugin is susceptible to remote code execution (RCE). This allows an attacker to execute arbitrary code on the underlying server hosting the WordPress installation, typically by exploiting insecure input handling.

Business Impact

With a CVSS score of 8.8, this RCE vulnerability allows attackers to gain full control over the WordPress application and the underlying server. This can lead to complete data theft, website defacement, and the installation of backdoors or malware. The impact on business reputation and data privacy is severe, as compromised WordPress sites are frequently used for further malicious activities.

Remediation Plan

Immediate Action: Update the "Content Visibility for Divi Builder" plugin to the latest available version provided by the developer.

Proactive Monitoring: Monitor server-side logs for execution of unauthorized scripts or unusual PHP activity, and regularly audit file integrity for the WordPress directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets to block common RCE patterns and disable the plugin entirely if it is not business-critical until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

WordPress plugins are frequent targets for automated exploitation. Administrators should immediately update the affected plugin. If an update is not available, the plugin should be disabled or removed to eliminate the risk of remote code execution until a secure version is released.

---METADATA---
VENDOR: Karel Electronics
PRODUCT: Industry and Trade Inc Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A Cross-site Scripting (XSS) vulnerability in Karel Electronics software allows attackers to inject malicious scripts into web pages generated by the application.

Executive Summary:
Karel Electronics software is susceptible to a high-severity Cross-site Scripting (XSS) vulnerability that could lead to administrative session hijacking.

Vulnerability Details

CVE-ID: CVE-2026-1819

Affected Software: Karel Electronics Industry and Trade Inc Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability stems from the improper neutralization of input during web page generation, specifically a Cross-site Scripting (XSS) flaw. It allows an attacker to execute arbitrary JavaScript in the context of a user's browser, typically targeting unauthenticated users to gain initial access.

Business Impact

The impact of this high-severity (CVSS 8.8) XSS vulnerability is substantial, as it can be leveraged to steal session cookies, capture user credentials, or redirect users to malicious websites. In an industrial or trade context, compromising a management console could lead to unauthorized configuration changes and operational disruptions.

Remediation Plan

Immediate Action: Apply the latest security patches from Karel Electronics immediately to ensure proper input validation and output encoding are implemented.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing script tags (<script>) or unusual encoded characters.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of unauthorized scripts and use a WAF to filter malicious XSS payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score suggests that the XSS may be stored or target highly privileged accounts.

Analyst Recommendation

Organizations using Karel Electronics software must prioritize this update. XSS vulnerabilities are frequently used as entry points for more complex attacks, making immediate remediation essential for maintaining the integrity of the web management interface.

---METADATA---
VENDOR: Ziroom
PRODUCT: ZHOME A0101
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security weakness has been identified in the Ziroom ZHOME A0101 smart home device.

Executive Summary:
The Ziroom ZHOME A0101 smart home device contains a vulnerability that could allow attackers to compromise the device and impact user privacy or security.

Vulnerability Details

CVE-ID: CVE-2026-1803

Affected Software: Ziroom ZHOME A0101

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The identified weakness in the ZHOME A0101 device allows an attacker to potentially bypass security controls. Given the CVSS score of 8.1, the flaw likely involves unauthenticated access to device functions or sensitive configuration data.

Business Impact

For users and organizations utilizing Ziroom smart home technology, this flaw represents a significant privacy risk and potential entry point into the local network. A successful exploit could lead to unauthorized monitoring or control of the physical environment.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Ziroom to the ZHOME A0101 devices immediately.

Proactive Monitoring: Check network logs for unusual traffic originating from or directed toward smart home IoT devices.

Compensating Controls: Isolate IoT devices on a separate VLAN with restricted access to the primary corporate or personal network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. IoT devices are frequently targeted due to their often-prolonged lifecycles without updates.

Analyst Recommendation

Users should immediately verify the firmware version of their Ziroom devices. Security teams should ensure that all smart home hardware is segmented from critical assets to mitigate the impact of a potential compromise.

---METADATA---
VENDOR: Ziroom
PRODUCT: ZHOME A0101
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the Ziroom ZHOME A0101 smart home device. This vulnerability potentially allows attackers to compromise the integrity of the device's operations.

Executive Summary:
The Ziroom ZHOME A0101 smart home device contains a high-severity security flaw that could lead to unauthorized system access or device compromise.

Vulnerability Details

CVE-ID: CVE-2026-1802

Affected Software: Ziroom ZHOME A0101

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves an unspecified security flaw within the Ziroom ZHOME A0101 firmware version 1. Due to the nature of IoT vulnerabilities, this likely involves an unauthenticated or poorly authenticated interface exposed to the local network or internet.

Business Impact

A successful exploit of this vulnerability could grant an attacker control over smart home hardware, leading to a breach of physical security or privacy within a residence. With a CVSS score of 7.3, the risk is classified as High, as it could result in significant reputational damage to the vendor and potential safety risks for the end-users.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Ziroom immediately to mitigate the risk of exploitation.

Proactive Monitoring: Monitor local network traffic for unusual outbound connections originating from ZHOME devices or repeated failed login attempts.

Compensating Controls: Isolate IoT devices on a dedicated VLAN with strict firewall rules to prevent lateral movement if the device is compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in consumer IoT hardware, the potential for exploitation remains a significant concern once details are reverse-engineered.

Analyst Recommendation

The Ziroom ZHOME A0101 vulnerability poses a high risk to the privacy and security of smart home environments. It is critical that users check for and apply firmware updates immediately to address this security gap and prevent unauthorized access.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Container Platform
AFFECTED_VERSIONS: OpenShift Container Platform 4
---END_METADATA---

Description Summary:
A vulnerability in the OpenShift Route resource allows low-privileged users to inject malicious HAProxy configurations, potentially leading to cross-tenant traffic hijacking.

Executive Summary:
A high-severity flaw in OpenShift Container Platform 4 exposes multi-tenant environments to potential traffic interception and session hijacking.

Vulnerability Details

CVE-ID: CVE-2026-1784

Affected Software: Red Hat OpenShift Container Platform

Affected Versions: OpenShift Container Platform 4

Vulnerability: The vulnerability involves insufficient validation of the Route spec.path field. This allows an authenticated low-privileged user to inject arbitrary configurations into the shared router's HAProxy instance, effectively manipulating traffic routing for other tenants.

Business Impact

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity within shared cluster environments. By hijacking traffic between tenants, an attacker could intercept sensitive communications or perform unauthorized actions on behalf of other users, leading to potential data breaches and service disruption. With a CVSS score of 8.8, this flaw represents a severe risk to the security posture of the container orchestration layer.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for available patches and update all OpenShift Container Platform 4 clusters to the secure version immediately.

Proactive Monitoring: Audit existing Route configurations for unusual path definitions and monitor cluster ingress logs for anomalous routing behavior.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the ability of low-privileged users to create or modify Route resources until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for cross-tenant traffic hijacking, this vulnerability should be treated as a priority. Administrators must audit current Route configurations and apply the necessary patches provided by Red Hat as soon as they become available to prevent unauthorized access and potential data compromise.

Executive Summary:
A high-severity vulnerability exists in the Amazon SageMaker Python SDK, which could allow an attacker to execute arbitrary code within the SageMaker environment. Successful exploitation could lead to the compromise of sensitive machine learning models and data, disruption of operations, and unauthorized access to cloud resources. Organizations are strongly advised to update the affected software immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2026-1777

Affected Software: Amazon SageMaker Python SDK

Affected Versions: All versions before v3.0

Vulnerability: The vulnerability stems from improper input validation within certain functions of the Amazon SageMaker Python SDK. An attacker can craft a malicious input, such as a specially formatted training job name or configuration parameter, which is not properly sanitized by the SDK. When processed, this input can lead to a command injection, allowing the attacker to execute arbitrary commands on the underlying SageMaker instance with the permissions of the SageMaker execution role.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.2. Exploitation could have significant business consequences, including the theft of proprietary training data and intellectual property such as trained machine learning models. An attacker could also disrupt critical business operations by terminating or manipulating machine learning jobs, leading to financial loss and reputational damage. Furthermore, a compromised SageMaker instance could be used as a pivot point to attack other resources within the organization's AWS environment, escalating the overall security risk.

Remediation Plan

Immediate Action:

• Immediately upgrade the Amazon SageMaker Python SDK to version 3.0 or later on all development environments, CI/CD pipelines, and production systems.
• Monitor AWS CloudTrail and SageMaker logs for any signs of exploitation, such as unusual API calls, unexpected job configurations, or anomalous behavior from SageMaker instances.
• Review access logs for any unauthorized access patterns preceding the patch deployment.

Proactive Monitoring:

• Implement enhanced logging for SageMaker execution instances to capture process execution and network connection details.
• Monitor for outbound network traffic to unknown or suspicious destinations from SageMaker instances.
• Create alerts in AWS CloudWatch or a SIEM for the creation of SageMaker jobs with suspicious parameters or commands.

Compensating Controls:

• If immediate patching is not feasible, apply the principle of least privilege to SageMaker execution IAM roles, removing any permissions not strictly required for the job's function.
• Implement strict input validation and sanitization in application code for all data passed to the SageMaker SDK.
• Utilize VPCs and security groups to restrict network access for SageMaker instances, limiting their ability to communicate with the internet or other non-essential internal resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the nature of command injection vulnerabilities in widely used SDKs, it is highly probable that a proof-of-concept exploit will be developed and published by security researchers in the near future.

Analyst Recommendation

Given the high severity (CVSS 7.2) of this vulnerability and its potential for data exfiltration and operational disruption, we recommend that organizations treat this as a critical priority. All teams utilizing the Amazon SageMaker Python SDK should immediately apply the vendor-supplied update to version 3.0 or later. Although this CVE is not currently listed on the CISA KEV list, its impact warrants urgent remediation to prevent potential exploitation.

---METADATA---
VENDOR: GNOME Project
PRODUCT: libsoup
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A flaw was found in the libsoup HTTP library that could lead to a denial of service or potential code execution when processing malicious HTTP requests.

Executive Summary:
The libsoup HTTP library contains a vulnerability that could allow an attacker to disrupt services or execute arbitrary code on systems utilizing the library.

Vulnerability Details

CVE-ID: CVE-2026-1761

Affected Software: GNOME Project libsoup

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw in libsoup, a widely used HTTP client/server library, involves improper handling of specific HTTP protocol elements. This could be exploited by a remote attacker sending crafted HTTP traffic to an application that uses libsoup, leading to memory corruption.

Business Impact

With a CVSS score of 8.6, this vulnerability is High severity. Because libsoup is integrated into many GNOME-based applications and other Linux software, the impact is widespread. A successful exploit could lead to application crashes (DoS) or, in worse cases, remote code execution (RCE), compromising the security of the host system.

Remediation Plan

Immediate Action: Update the libsoup package to the latest version provided by your Linux distribution's package manager.

Proactive Monitoring: Monitor network-facing applications using libsoup for unexpected crashes or memory usage spikes that might indicate exploit attempts.

Compensating Controls: Deploy network-level filtering to block malformed HTTP requests and use memory protection mechanisms like ASLR and DEP to hinder exploit development.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Libraries like libsoup are critical components, and flaws in them have a broad impact across the ecosystem.

Analyst Recommendation

The ubiquity of libsoup makes this vulnerability a high priority for Linux system administrators. Immediate patching via standard distribution updates is required to mitigate the risk of remote attacks. Organizations should ensure all systems, including servers and workstations, are updated promptly.

---METADATA---
VENDOR: WordPress
PRODUCT: WP FOFT Loader plugin
AFFECTED_VERSIONS: All versions up to, and including, 2.x
---END_METADATA---

Description Summary:
The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation. This allows attackers to upload malicious scripts to the server.

Executive Summary:
The WP FOFT Loader plugin for WordPress suffers from a critical arbitrary file upload vulnerability that can lead to full remote code execution on the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-1756

Affected Software: WP FOFT Loader plugin for WordPress

Affected Versions: All versions up to, and including, 2.x

Vulnerability: The vulnerability exists in the 'WP_FOFT_Loader_Mimes::file_and_ext' function. Due to improper validation of file extensions and MIME types, an attacker can bypass security checks to upload executable files (e.g., .php scripts).

Business Impact

The ability to upload arbitrary files typically results in complete system compromise. An attacker can upload a web shell to gain remote code execution, allowing them to deface the site, steal data, or use the server for further attacks. The CVSS score of 8.8 reflects this critical risk.

Remediation Plan

Immediate Action: Update the WP FOFT Loader plugin to the latest version immediately. Check the 'wp-content/uploads' directory for any suspicious PHP files.

Proactive Monitoring: Implement file integrity monitoring (FIM) to alert on the creation of new executable files in directories that should only contain media or fonts.

Compensating Controls: Disable PHP execution in the uploads directory via .htaccess or web server configuration to prevent uploaded scripts from running.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Arbitrary file upload vulnerabilities are highly sought after by attackers for establishing persistence on a target.

Analyst Recommendation

This vulnerability poses a severe risk of total site takeover. It is imperative to apply the vendor's patch immediately and verify that no unauthorized files have already been uploaded to the environment.

---METADATA---
VENDOR: Lightspeed
PRODUCT: Ecwid by Lightspeed Ecommerce Shopping Cart
AFFECTED_VERSIONS: All versions up to, and including, 7
---END_METADATA---

Description Summary:
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to privilege escalation, which could allow unauthorized users to gain administrative access.

Executive Summary:
A critical privilege escalation vulnerability in the Ecwid by Lightspeed plugin puts e-commerce sites at risk of total administrative compromise.

Vulnerability Details

CVE-ID: CVE-2026-1750

Affected Software: Ecwid by Lightspeed Ecommerce Shopping Cart

Affected Versions: All versions up to, and including, 7

Vulnerability: This plugin contains a flaw that allows for privilege escalation. While the specific function is not named in the summary, the vulnerability typically involves an attacker leveraging an insecure endpoint or missing authorization check to elevate their session to an administrative level.

Business Impact

Successful exploitation allows an attacker to take full control of the e-commerce platform. This includes the ability to access customer data, modify product pricing, and intercept order information. The CVSS score of 8.8 reflects the severe impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Ecwid by Lightspeed Ecommerce Shopping Cart plugin to the latest version immediately to secure the vulnerable components.

Proactive Monitoring: Audit administrative user accounts for any unrecognized entries and review logs for suspicious activity originating from low-privileged accounts.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict access to WordPress administrative functions and monitor for privilege escalation attempt patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation. E-commerce plugins are high-value targets due to the sensitive nature of the data they process.

Analyst Recommendation

Given the potential for complete site takeover and data theft, this update should be treated as a high priority. Ensure that the patch is applied across all environments and that user accounts are audited for any signs of prior compromise.

---METADATA---
VENDOR: EFM Networks
PRODUCT: ipTIME A8004T Router
AFFECTED_VERSIONS: Firmware version 14
---END_METADATA---

Description Summary:
A vulnerability in the EFM ipTIME A8004T router firmware version 14 could lead to unauthorized access or system compromise.

Executive Summary:
The EFM ipTIME A8004T router contains a High-severity vulnerability in version 14 that could allow an attacker to compromise the device and the network it manages.

Vulnerability Details

CVE-ID: CVE-2026-1740

Affected Software: ipTIME A8004T

Affected Versions: Version 14

Vulnerability: This vulnerability was identified in the firmware of the ipTIME A8004T router. With a CVSS score of 7.3, the flaw likely involves a weakness in the web management interface or a network service that allows an attacker to bypass security controls or execute unauthorized commands.

Business Impact

A compromised router serves as a gateway for attackers to intercept network traffic, launch internal attacks, or enroll the device into a botnet. The High severity score justifies the urgency, as the router is a critical point of failure for network security.

Remediation Plan

Immediate Action: Update the ipTIME A8004T router firmware to the latest version provided by EFM Networks immediately.

Proactive Monitoring: Check the router's administration logs for unauthorized login attempts or changes to DNS and routing configurations.

Compensating Controls: Disable remote management interfaces on the WAN side and ensure that strong, unique passwords are used for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Router vulnerabilities are frequently targeted by automated scanning scripts.

Analyst Recommendation

Network edge devices are primary targets for initial access. It is vital to apply the firmware update immediately to prevent attackers from gaining a foothold in your network through this vulnerable router.

Executive Summary:
A high-severity vulnerability has been identified in the OS DataHub Maps plugin for WordPress, assigned CVE-2026-1730. This flaw allows an attacker to upload arbitrary files, including malicious code, to an affected website due to improper file type validation. Successful exploitation could lead to a complete compromise of the website, enabling data theft, site defacement, or further attacks launched from the compromised server.

Vulnerability Details

CVE-ID: CVE-2026-1730

Affected Software: OS DataHub Maps plugin for WordPress

Affected Versions: All versions up to, and including, 1

Vulnerability: The vulnerability exists within the OS_DataHub_Maps_Admin::add_file_and_ext function of the plugin. The function fails to properly validate the types of files being uploaded, allowing an authenticated attacker (and potentially an unauthenticated one, depending on the plugin's configuration) to bypass security checks. By crafting a malicious request, an attacker can upload a file with a dangerous extension, such as a PHP web shell, to the server. Executing this uploaded file would grant the attacker remote code execution capabilities within the context of the web server, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the business. Successful exploitation could result in a complete takeover of the organization's WordPress site. Potential consequences include the theft of sensitive data such as customer information and user credentials, financial loss through compromised e-commerce functions, severe reputational damage from website defacement, and the use of the compromised server as a platform to attack other systems. This could also lead to regulatory penalties if sensitive data is breached.

Remediation Plan

Immediate Action: Immediately update the OS DataHub Maps plugin to the latest patched version provided by the vendor. If the plugin is not essential for business operations, consider deactivating and uninstalling it to eliminate the attack surface. After updating, review WordPress security settings to ensure file permissions and user roles are configured according to the principle of least privilege.

Proactive Monitoring: Monitor web server access logs for unusual POST requests to endpoints associated with the OS DataHub Maps plugin. Regularly scan the WordPress wp-content/uploads directory and other writable directories for suspicious or unexpected files (e.g., files with .php, .phtml, .sh extensions). Implement a file integrity monitoring (FIM) solution to alert on unauthorized changes to core WordPress files and plugins.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to inspect file uploads and block attempts to upload executable file types. Additionally, configure the web server to disallow script execution in the directories where files are uploaded, which can prevent a web shell from running even if successfully uploaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, arbitrary file upload vulnerabilities are highly sought after by threat actors and are relatively straightforward to exploit. It is highly probable that exploits will be developed and used in the near future.

Analyst Recommendation

Given the high CVSS score of 8.8 and the critical impact of remote code execution, this vulnerability requires immediate attention. We strongly recommend that all organizations using the OS DataHub Maps plugin apply the necessary updates without delay. Although this CVE is not currently listed on the CISA KEV list, its severity warrants treating it as a critical priority. Organizations should assume it will be targeted by attackers and act swiftly to mitigate the risk through patching or the compensating controls outlined above.

---METADATA---
VENDOR: AdForest
PRODUCT: AdForest WordPress Theme
AFFECTED_VERSIONS: All versions up to, and including, 6.0.12
---END_METADATA---

Description Summary:
The AdForest WordPress theme (<= 6.0.12) is vulnerable to authentication bypass via the sb_login_user_with_otp_fun function, allowing attackers to log in as any user, including admins.

Executive Summary:
The AdForest WordPress theme contains a critical authentication bypass that allows unauthenticated attackers to take full control of any user account, including administrators.

Vulnerability Details

CVE-ID: CVE-2026-1729

Affected Software: AdForest WordPress Theme

Affected Versions: All versions up to, and including, 6.0.12

Vulnerability: The theme fails to properly verify a user's identity within the sb_login_user_with_otp_fun function during the OTP authentication process. This allows an unauthenticated attacker to bypass security checks and log in as any registered user, including those with administrative privileges.

Business Impact

A successful exploit allows for a total site takeover. Attackers can modify content, steal customer data, or install malicious plugins. Given the CVSS score of 9.8, this is a critical risk for any WordPress site utilizing this theme, as it completely undermines the site's security model.

Remediation Plan

Immediate Action: Update the AdForest theme to the latest patched version immediately. If a patch is unavailable, consider deactivating the theme or the OTP functionality.

Proactive Monitoring: Review WordPress user logs for suspicious logins, particularly those associated with administrative accounts that did not originate from known users.

Compensating Controls: Implement a secondary layer of authentication, such as a third-party 2FA plugin, that operates independently of the theme's built-in functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation. Authentication bypasses in popular WordPress themes are frequently targeted by automated exploit kits.

Analyst Recommendation

Due to the ease of exploitation and the potential for full administrative compromise, this update should be treated as mandatory and urgent. Website owners must ensure their themes are current and should monitor for any unauthorized user creation or role changes.

---METADATA---
VENDOR: Gravity Bookings
PRODUCT: Gravity Bookings Premium
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Gravity Bookings Premium plugin for WordPress is subject to an SQL injection vulnerability, potentially allowing attackers to access or alter database contents.

Executive Summary:
An SQL injection vulnerability in the Gravity Bookings Premium plugin poses a high risk to the confidentiality and integrity of WordPress database information.

Vulnerability Details

CVE-ID: CVE-2026-1719

Affected Software: Gravity Bookings Premium

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains an SQL injection vulnerability that allows an attacker to manipulate database queries. This flaw can be exploited to access restricted information or perform unauthorized operations on the site database.

Business Impact

This high-severity vulnerability (CVSS 7.5) could lead to the exposure of booking data, customer information, or administrative credentials. The resulting impact involves potential data breaches and disruption of critical business scheduling operations.

Remediation Plan

Immediate Action: Update the Gravity Bookings Premium plugin to the latest version provided by the vendor.

Proactive Monitoring: Monitor for suspicious database activity and unexpected query performance degradation that may indicate an ongoing injection attempt.

Compensating Controls: Use a Web Application Firewall (WAF) to block anomalous HTTP requests that contain malicious SQL syntax.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with high priority. Apply the latest vendor-supplied patch immediately and ensure that all WordPress plugins are kept up to date to minimize the attack surface.

---METADATA---
VENDOR: Keylime
PRODUCT: Keylime Registrar
AFFECTED_VERSIONS: 7.12.0 and later
---END_METADATA---

Description Summary:
The Keylime registrar fails to enforce client-side TLS authentication. This allows unauthenticated attackers to perform administrative operations, including deleting agents and retrieving TPM data.

Executive Summary:
A critical authentication bypass in the Keylime registrar allows unauthenticated network attackers to perform unauthorized administrative actions and compromise the integrity of the attestation framework.

Vulnerability Details

CVE-ID: CVE-2026-1709

Affected Software: Keylime Registrar

Affected Versions: 7.12.0 and later

Vulnerability: The registrar does not mandate client-side Transport Layer Security (TLS) certificates. This allows unauthenticated clients with network access to bypass authentication and execute administrative operations such as listing agents, retrieving public TPM data, and deleting agents.

Business Impact

The failure to enforce authentication in a security-critical component like a registrar undermines the entire Trusted Platform Module (TPM) attestation chain. With a CVSS score of 9.4, this flaw could lead to the unauthorized removal of trusted nodes and the exposure of sensitive hardware security data.

Remediation Plan

Immediate Action: Update Keylime to the latest patched version and ensure that client-side TLS authentication is explicitly enabled and enforced in the registrar configuration.

Proactive Monitoring: Audit registrar logs for administrative requests originating from clients that did not present a valid certificate.

Compensating Controls: Restrict network access to the Keylime registrar using firewalls or VPC security groups to ensure only authorized internal components can communicate with it.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. The vulnerability significantly lowers the barrier for attackers to disrupt trusted computing environments.

Analyst Recommendation

The administrative nature of this bypass makes it a high-priority risk. Organizations relying on Keylime for system integrity must update their deployments immediately and verify that TLS client authentication is strictly enforced.

Executive Summary:
A critical vulnerability exists in the Eclipse Theia Website's automated software build process that could allow an attacker to execute malicious code. By submitting a specially crafted pull request, an unauthorized user could gain extensive control over the project's environment, enabling them to steal sensitive secrets, modify the official website, and inject malicious code into the repository. This flaw represents a complete compromise of the affected system's integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-1699

Affected Software: In the Eclipse Theia Website Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability lies within a GitHub Actions workflow file (.github/workflows/preview.yml) which improperly uses the pull_request_target trigger. This trigger is designed to run workflows with access to the base repository's secrets and a privileged GITHUB_TOKEN, even for pull requests from forked repositories. The workflow dangerously combines this trigger with steps that check out and execute code from the untrusted pull request, creating a code injection vector. An attacker can exploit this by submitting a pull request containing malicious commands, which are then executed within the trusted CI/CD environment, granting them access to repository secrets and write permissions to packages, pages, and the repository itself.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10, indicating the highest possible risk. Successful exploitation could lead to severe business consequences, including a full-scale supply chain attack where malicious packages are published under the trusted Eclipse Theia organization name, impacting downstream users. An attacker could also deface the official website, causing significant reputational damage, or inject backdoors into the source code, compromising the integrity of the product. The exfiltration of repository secrets could lead to further compromise of related infrastructure and services, resulting in significant data breaches and financial loss.

Remediation Plan

Immediate Action: Update In the Eclipse Theia Website Multiple Products to the latest version immediately to apply the necessary security patch that corrects the flawed GitHub Actions workflow. After patching, conduct a thorough review of access logs and GitHub audit logs for any signs of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring: Monitor GitHub Actions workflow logs for any unusual commands, unexpected script executions, or outbound network connections to suspicious endpoints. Implement alerts for pull requests submitted by new or unknown contributors that modify workflow files. Regularly scan public package repositories for any unauthorized or malicious packages published under the organization's name.

Compensating Controls: If immediate patching is not feasible, temporarily disable the vulnerable .github/workflows/preview.yml workflow to close the attack vector. Rotate all secrets stored in the repository's GitHub secrets configuration as they should be considered compromised. Implement a policy requiring manual review and approval by a trusted maintainer before any workflows are run on external pull requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the published date, Jan 30, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, the attack pattern involving the misuse of pull_request_target is well-documented, and proof-of-concept exploits can be developed with minimal effort by skilled threat actors.

Analyst Recommendation

Given the critical CVSS score of 10 and the potential for a complete compromise of the CI/CD pipeline and repository, organizations must treat this vulnerability with the highest urgency. The primary recommendation is to apply the vendor-supplied patches immediately. Following the update, a comprehensive security audit is crucial to identify any signs of historical compromise, including unauthorized code commits, malicious package publications, or secret exfiltration. Although not currently on the CISA KEV list, the severity of this vulnerability warrants immediate and decisive action to prevent a potentially devastating security incident.

Executive Summary:
A high-severity vulnerability has been identified in multiple Totolink networking products, including the A3600R model. This flaw can be exploited by an attacker to gain control over the affected device, potentially leading to a full network compromise, data theft, or service disruption. Organizations using the affected Totolink products are at significant risk and should take immediate action.

Vulnerability Details

CVE-ID: CVE-2026-1686

Affected Software: Totolink Multiple Products

Affected Versions: A3600R version 5 and potentially other products. See vendor advisory for a complete list of affected versions.

Vulnerability: Based on the high CVSS score, this vulnerability is likely a critical flaw such as an unauthenticated remote code execution (RCE) or command injection vulnerability in the device's web management interface. An attacker on the network could likely send a specially crafted HTTP request to a vulnerable endpoint on the device. This could allow the attacker to execute arbitrary operating system commands with root-level privileges, granting them complete control over the device's functions and access to the network it manages.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Successful exploitation could result in a complete compromise of the network infrastructure managed by the Totolink device. This would provide an attacker with a strategic foothold inside the network, from which they could intercept sensitive data, pivot to attack other internal systems, disrupt internet connectivity, or install persistent malware. The specific risks to the organization include data breaches, significant business interruption, reputational damage, and the potential for financial loss.

Remediation Plan

Immediate Action: Immediately apply the security updates provided by Totolink to all affected devices as the primary mitigation strategy. After patching, it is crucial to review system and access logs for any anomalous activity or indicators of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Implement enhanced monitoring of network traffic originating from the affected devices. Look for unusual outbound connections, unexpected DNS queries, or communication with known malicious IP addresses. Security teams should review web access logs on the devices for malformed requests or repeated attempts to access system-level files or functions.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Restrict access to the device's web management interface to a dedicated, trusted administrative network or specific IP addresses.
• Ensure the management interface is not exposed to the public internet.
• Implement network segmentation to limit the lateral movement of an attacker should the device become compromised.
• Use an Intrusion Prevention System (IPS) with rules capable of detecting and blocking exploit attempts targeting this vulnerability.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of February 1, 2026, there are no known public exploits or active, widespread exploitation campaigns targeting this vulnerability. However, given the high severity score (CVSS 8.8) and the commonality of networking devices as targets, it is highly probable that both security researchers and threat actors will develop exploit code in the near future.

Analyst Recommendation

Given the high severity of this vulnerability, we strongly recommend that all affected Totolink devices be patched immediately. The potential for complete network compromise presents an unacceptable risk. Although CVE-2026-1686 is not currently listed on the CISA KEV catalog, vulnerabilities of this nature in perimeter network devices are prime candidates for future inclusion and are frequently targeted by threat actors. Organizations must prioritize the deployment of the vendor-supplied patch within their critical vulnerability remediation timelines.

---METADATA---
VENDOR: Zephyr Project
PRODUCT: Zephyr RTOS
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A buffer management flaw in dns_unpack_name() allows unauthenticated attackers to trigger an out-of-bounds write via malicious DNS responses when CONFIG_DNS_RESOLVER is enabled.

Executive Summary:
A critical out-of-bounds write vulnerability in the Zephyr RTOS DNS resolver could allow unauthenticated attackers to compromise affected IoT devices via malicious DNS traffic.

Vulnerability Details

CVE-ID: CVE-2026-1678

Affected Software: Zephyr RTOS (DNS Resolver Component)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The dns_unpack_name() function incorrectly caches buffer tailroom while appending DNS labels. This leads to an incorrect size calculation as the buffer grows, allowing a final null terminator to be written past the buffer boundaries. An unauthenticated remote attacker can exploit this by sending a malicious DNS response to a device with CONFIG_DNS_RESOLVER enabled.

Business Impact

With a CVSS score of 9.4, this vulnerability poses a severe risk to embedded and IoT systems. Successful exploitation can lead to memory corruption, system crashes, or potentially remote code execution (RCE). In industrial or medical contexts, such a compromise could result in significant operational disruption or safety risks, as the attacker gains control over low-level system memory.

Remediation Plan

Immediate Action: Update the Zephyr RTOS kernel to the latest version that includes the fix for the DNS unpacking logic.

Proactive Monitoring: Monitor for unusual DNS traffic patterns or frequent crashes of embedded devices that utilize the Zephyr DNS resolver.

Compensating Controls: Use a secure DNS proxy or firewall to inspect and sanitize DNS responses before they reach the affected IoT devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, memory corruption flaws in common RTOS components are frequently targeted once details become public.

Analyst Recommendation

Organizations deploying devices based on Zephyr RTOS must verify if CONFIG_DNS_RESOLVER is active and apply the necessary kernel updates immediately. Because this vulnerability is triggered by incoming network traffic (DNS responses), it is highly reachable and requires urgent remediation to protect the device fleet.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated API endpoint exposure allows remote attackers to modify the "forgot password" recovery email address, facilitating account takeover.

Executive Summary:
The affected software contains a critical unauthenticated API vulnerability that allows attackers to hijack user accounts by changing password recovery email addresses.

Vulnerability Details

CVE-ID: CVE-2026-1670

Affected Software: The affected software (Multiple Products)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the exposure of a sensitive API endpoint that does not require authentication. An unauthenticated remote attacker can call this endpoint to change the recovery email associated with any user account.

Business Impact

Successful exploitation leads to widespread account takeovers, potentially including administrative accounts. The CVSS score of 9.8 underscores the critical risk of unauthorized access to sensitive data and the total loss of user identity integrity.

Remediation Plan

Immediate Action: Update the affected software to the latest version to secure the API endpoint and enforce proper authentication checks.

Proactive Monitoring: Audit account modification logs for unexpected changes to recovery email addresses and monitor API traffic for unauthorized requests to sensitive endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block access to the vulnerable API endpoint until a permanent patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for unauthenticated attackers to redirect password resets makes this a high-priority threat. Organizations must apply the vendor-provided security updates immediately to prevent large-scale account compromises.

---METADATA---
VENDOR: Synectix
PRODUCT: LAN 232 TRIO
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Synectix LAN 232 TRIO serial to ethernet adapter exposes its web management interface without authentication, allowing unauthenticated users to modify settings or factory reset the device.

Executive Summary:
Synectix LAN 232 TRIO adapters possess a critical security flaw where the web management interface is completely unprotected, allowing unauthenticated remote attackers to disrupt serial communications.

Vulnerability Details

CVE-ID: CVE-2026-1633

Affected Software: Synectix LAN 232 TRIO

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device exposes its web-based configuration dashboard without requiring any credentials. This allows an unauthenticated attacker to change critical device settings, network configurations, or trigger a factory reset.

Business Impact

With a CVSS score of 10.0, the impact is catastrophic for industrial or commercial environments relying on serial-to-ethernet connectivity. An attacker can disconnect critical serial hardware, redirect data streams, or render the adapter inoperable. This leads to immediate operational downtime and potential loss of control over connected legacy equipment.

Remediation Plan

Immediate Action: Update the device firmware to the latest version and immediately restrict network access to the management interface.

Proactive Monitoring: Audit network traffic for any unauthorized HTTP/HTTPS requests directed at the adapter’s IP address.

Compensating Controls: Place the serial adapters on a dedicated, isolated management VLAN and use a firewall to permit access only from trusted administrative IPs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation. However, hardware adapters are frequently targeted by botnets once such vulnerabilities become public knowledge.

Analyst Recommendation

The Synectix LAN 232 TRIO must be secured immediately through network isolation and firmware updates. Because these devices often sit at the junction of IT and OT networks, the risk of lateral movement or process disruption is extremely high.

---METADATA---
VENDOR: MOMA
PRODUCT: Seismic Station
AFFECTED_VERSIONS: v2.4.2520 and prior
---END_METADATA---

Description Summary:
MOMA Seismic Station exposes its web management interface without authentication, allowing unauthenticated attackers to modify configurations, steal data, or reset the device remotely.

Executive Summary:
MOMA Seismic Station devices suffer from a critical authentication bypass vulnerability that grants unauthenticated attackers full control over device configurations and sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-1632

Affected Software: MOMA Seismic Station

Affected Versions: v2.4.2520 and prior

Vulnerability: The web management interface of the MOMA Seismic Station lacks any authentication requirements. This allows an unauthenticated, remote attacker to access the administrative dashboard directly.

Business Impact

The exposure of critical infrastructure management interfaces leads to significant operational risks. Attackers can modify seismic monitoring parameters, exfiltrate proprietary device data, or perform a factory reset, resulting in total loss of monitoring capabilities and data integrity. The CVSS score of 9.1 reflects the high impact on availability and confidentiality for industrial monitoring environments.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by the vendor and ensure the web interface is placed behind a secure VPN or firewall.

Proactive Monitoring: Monitor network traffic for unauthorized access to the management IP address and review device logs for unexpected configuration changes or reset commands.

Compensating Controls: Restrict access to the management interface using Access Control Lists (ACLs) to ensure only authorized administrative workstations can communicate with the device.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of authentication on a web interface makes this an extremely easy target for automated scanning tools.

Analyst Recommendation

Organizations using MOMA Seismic Stations must immediately isolate these devices from the public internet. The primary remediation is to apply the latest firmware patches and enforce strict network-level authentication. Immediate action is required to prevent unauthorized physical or logical disruption of seismic data collection.

---METADATA---
VENDOR: Universal Software Inc
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An authentication bypass vulnerability exists in multiple products from Universal Software Inc due to the use of an alternate path or channel.

Executive Summary:
Multiple Universal Software Inc products are affected by a critical authentication bypass vulnerability that allows unauthorized users to access restricted system areas.

Vulnerability Details

CVE-ID: CVE-2026-1618

Affected Software: Universal Software Inc Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is an Authentication Bypass Using an Alternate Path or Channel. It allows an unauthenticated attacker to circumvent standard security checks by accessing the application through a different communication path or logical channel, granting them access to restricted resources without valid credentials.

Business Impact

The impact of an authentication bypass is severe, potentially leading to a total loss of confidentiality, integrity, and availability. Attackers could gain full control over the affected systems, leading to massive data breaches and operational disruption. The CVSS score of 8.8 places this in the High (bordering on Critical) severity range.

Remediation Plan

Immediate Action: Apply all security updates provided by Universal Software Inc immediately. If patches are not yet available, restrict access to the affected products to trusted networks only.

Proactive Monitoring: Review access logs for any unauthorized attempts to access administrative or non-standard paths and monitor for unusual account activity.

Compensating Controls: Implement strict network segmentation and Multi-Factor Authentication (MFA) where possible to provide additional layers of security against unauthorized access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, authentication bypass flaws in core software are often prioritized by sophisticated threat actors for initial entry.

Analyst Recommendation

The CVSS score of 8.8 indicates a critical risk to the organization's security posture. Universal Software Inc products should be updated to the latest secure versions as the highest priority. Administrators must verify that all alternate access paths are properly secured or disabled to prevent unauthorized entry.

Executive Summary:
A high-severity vulnerability has been identified in The's Multiple Products, specifically within the Open Security Issue Management (OSIM) component. This flaw stems from an insecure server configuration that could allow a remote attacker to bypass security controls and access sensitive information. Organizations using affected versions are urged to apply security updates immediately to mitigate the risk of a potential data breach or application compromise.

Vulnerability Details

CVE-ID: CVE-2026-1616

Affected Software: The Multiple Products

Affected Versions: Open Security Issue Management (OSIM) versions prior to v2025

Vulnerability: The vulnerability exists due to the insecure concatenation of the $uri and $args variables within the nginx configuration file. An unauthenticated, remote attacker can exploit this by sending a specially crafted HTTP request containing URL-encoded characters (such as newlines) in the URI. When the vulnerable nginx server processes this request and forwards it to a backend application, the backend may misinterpret the request boundaries, leading to HTTP Request Smuggling, cache poisoning, or the bypassing of security rules.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could have a significant negative impact on the business by allowing an attacker to gain unauthorized access to sensitive corporate or customer data, modify application data, or deface web properties through cache poisoning. These actions could lead to regulatory fines, reputational damage, financial loss, and a loss of customer trust. The vulnerability exposes the organization to risks of data breaches and business process disruption.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected systems without delay. After patching, administrators should review nginx and backend application access logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Implement enhanced logging and monitoring to detect potential exploitation. Security teams should search web server access logs for unusual URI patterns, such as those containing URL-encoded newline characters (%0a, %0d) or other non-standard characters. Anomaly detection on backend application requests that appear malformed or inconsistent with frontend requests can also indicate an attack.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules to inspect and block HTTP requests containing malformed URIs or suspicious character encoding.
• If direct access to the nginx configuration is possible, modify the configuration to use the safer $request_uri variable instead of the $uri$args concatenation, after thorough testing in a non-production environment.
• Restrict network access to the affected applications to only trusted IP ranges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of January 30, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities related to nginx misconfigurations are well-understood, and proof-of-concept (PoC) exploits could be developed easily by threat actors. The absence of a public exploit should not diminish the urgency of remediation.

Analyst Recommendation

Given the High severity rating (CVSS 7.5) and the potential for an attacker to bypass security controls, this vulnerability presents a significant risk to the organization. Although this CVE is not currently listed on the CISA KEV list, we strongly recommend that organizations prioritize the immediate deployment of the vendor-supplied patches across all affected assets. Where patching is delayed, the compensating controls and proactive monitoring detailed above should be implemented as an urgent priority to mitigate risk.

---METADATA---
VENDOR: jsonpath
PRODUCT: jsonpath (Node.js/Browser Package)
AFFECTED_VERSIONS: All versions
---END_METADATA---

Description Summary:
All versions of the jsonpath library are vulnerable to arbitrary code injection via unsafe evaluation of user-supplied JSON Path expressions.

Executive Summary:
The jsonpath library is subject to a critical code injection vulnerability that allows unauthenticated attackers to execute arbitrary code in Node.js or perform XSS in browsers.

Vulnerability Details

CVE-ID: CVE-2026-1615

Affected Software: jsonpath

Affected Versions: All versions

Vulnerability: The library relies on the static-eval module to process JSON Path input, which fails to safely handle untrusted data. An attacker can supply a malicious JSON Path expression to any method (e.g., .query, .nodes) to execute arbitrary JavaScript code on the host system or within a user's browser context.

Business Impact

This vulnerability poses a severe risk to any application using the jsonpath library to process external input. In Node.js environments, it leads to Remote Code Execution (RCE), while in browsers, it enables Cross-Site Scripting (XSS). The CVSS score of 9.8 reflects the high likelihood of total system compromise and data theft.

Remediation Plan

Immediate Action: Developers should immediately update the jsonpath dependency to the latest patched version or migrate to a more secure alternative.

Proactive Monitoring: Audit codebases to identify where user-supplied input is passed directly to jsonpath evaluation methods.

Compensating Controls: Implement strict input validation or sanitization for all JSON Path expressions before they are processed by the library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. However, because this affects all versions of a popular library, the attack surface is vast.

Analyst Recommendation

The vulnerability in the jsonpath library is a critical supply-chain risk. Organizations must identify all internal and customer-facing applications utilizing this package and apply updates or mitigations immediately to prevent unauthenticated remote code execution.