---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout Help Desk
AFFECTED_VERSIONS: < 1.8.217
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-q3fh-rj9h-jfrc","name":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-q3fh-rj9h-jfrc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217","name":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:28:09.470Z
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in FreeScout prior to version 1.8.217 allows authenticated users with updateAutoReply permissions to inject malicious payloads into auto-reply messages.

Executive Summary:
A stored cross-site scripting vulnerability in FreeScout affects versions prior to 1.8.217, creating significant risks of client-side code execution for customers receiving automated emails.

Vulnerability Details

CVE-ID: CVE-2026-41904

Affected Software: FreeScout FreeScout Help Desk

Affected Versions: < 1.8.217

Vulnerability: This is a stored cross-site scripting flaw classified under CWE-79, triggered when an authenticated user with updateAutoReply permissions stores a malicious payload that executes in the context of the customer's webmail client.

Business Impact

A successful exploit allows attackers to execute arbitrary scripts within the email clients of customers who contact the help desk. This can lead to unauthorized actions, session hijacking, or data exfiltration via the victim mail client. The CVSS score of 7.6 reflects a high severity level due to the potential for confidentiality and integrity impacts against external users.

Remediation Plan

Immediate Action: Update FreeScout to version 1.8.217 or later where this vulnerability has been patched.

Proactive Monitoring: Review administrative audit logs for suspicious modifications to auto-reply messages or unusual privilege assignments.

Compensating Controls: Enforce strict access controls to limit the updateAutoReply permission exclusively to trusted administrative accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Organizations utilizing FreeScout should prioritize upgrading to version 1.8.217 immediately to eliminate the underlying cross-site scripting flaw. Reviewing user permissions to ensure strict adherence to the principle of least privilege will further reduce the likelihood of unauthorized payload injection.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Prior to 1.8.217
---END_METADATA---

Description Summary:
FreeScout contains a flaw in the user-setup endpoint where invite hashes do not expire, allowing unauthenticated attackers to perform permanent account takeovers.

Executive Summary:
A critical vulnerability in FreeScout enables unauthenticated account takeover due to improper expiration controls on user invitation hashes.

Vulnerability Details

CVE-ID: CVE-2026-41902

Affected Software: FreeScout

Affected Versions: Prior to 1.8.217

Vulnerability: The /user-setup/{hash} endpoint fails to invalidate invite hashes, allowing them to remain valid indefinitely. An unauthenticated attacker can exploit this via leaked hashes to gain unauthorized access, including administrative privileges if the target account is an admin.

Business Impact

This vulnerability carries a 9.1 CVSS score, reflecting the ease of account takeover and the potential for full administrative compromise. Successful exploitation could lead to unauthorized access to sensitive help desk data, customer communications, and internal workflows, resulting in significant reputational and data privacy risks.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.217 or later immediately to enforce proper hash expiration and lifecycle management.

Proactive Monitoring: Audit existing user accounts for suspicious activity and review access logs for unexpected logins originating from the user-setup endpoint.

Compensating Controls: Ensure that invitation emails are not forwarded or stored in insecure locations and implement multi-factor authentication (MFA) to prevent unauthorized account access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of permanent account takeover is severe. Administrators must prioritize updating to version 1.8.217 to ensure that invitation hashes are properly invalidated and to secure the administrative interface against unauthorized access.

---METADATA---
VENDOR: Thymeleaf
PRODUCT: Java Template Engine
AFFECTED_VERSIONS: Prior to 3.1.5.RELEASE
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Template Injection (SSTI) vulnerability in the Thymeleaf template engine allows for unauthorized expression execution when unsanitized input is processed in sandboxed contexts.

Executive Summary:
The Thymeleaf Java template engine is affected by a critical SSTI vulnerability that enables unauthorized expression execution when processing unsanitized user inputs.

Vulnerability Details

CVE-ID: CVE-2026-41901

Affected Software: Thymeleaf Java Template Engine

Affected Versions: Prior to 3.1.5.RELEASE

Vulnerability: This is a Server-Side Template Injection (SSTI) vulnerability occurring within the expression execution mechanism. It occurs when application developers pass unsanitized variables into sandboxed template contexts, allowing an attacker to bypass security restrictions and execute arbitrary expressions.

Business Impact

Successful exploitation of this vulnerability could lead to full remote code execution on the underlying server hosting the application. Given the CVSS score of 9.0, this represents a critical risk to data confidentiality, integrity, and system availability, potentially allowing attackers to compromise the entire application environment.

Remediation Plan

Immediate Action: Upgrade the Thymeleaf library to version 3.1.5.RELEASE or later immediately to incorporate the necessary security neutralization fixes.

Proactive Monitoring: Inspect application logs for unusual template rendering patterns or attempts to inject expression language syntax into user-controllable input fields.

Compensating Controls: Implement strict input validation and sanitization policies for all data passed to template engines, and ensure the application runs with the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this SSTI vulnerability necessitates an immediate audit of all applications utilizing the Thymeleaf engine. Developers must prioritize updating to version 3.1.5.RELEASE to mitigate the risk of remote code execution and potential full system compromise.

---METADATA---
VENDOR: th30d4y
PRODUCT: OpenLearnX
AFFECTED_VERSIONS: < 2.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenLearnX is vulnerable to OS command and code injection due to improper neutralization of input, potentially leading to unauthorized system access.

Executive Summary:
OpenLearnX versions prior to 2.0.3 are susceptible to OS command and code injection, allowing authenticated attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-41900

Affected Software: th30d4y OpenLearnX

Affected Versions: < 2.0.3

Vulnerability: The software suffers from OS command injection (CWE-78) and code injection (CWE-94) due to improper input handling. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that an authenticated user can exploit this vulnerability to achieve total technical impact.

Business Impact

Successful exploitation allows an attacker to execute arbitrary system commands, which could result in full server compromise, data exfiltration, or the installation of persistent backdoors. With a CVSS score of 8.8, the potential for total system takeover makes this a critical risk for any organization hosting the OpenLearnX platform.

Remediation Plan

Immediate Action: Update the OpenLearnX package to version 2.0.3 via npm to apply the security fix.

Proactive Monitoring: Inspect server logs for suspicious system calls or unexpected processes spawned by the OpenLearnX application service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns in HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a public PoC exists on GitHub (Christbowel/CVE-2026-41900-POC).

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation in the wild. However, the availability of a public proof-of-concept increases the likelihood of opportunistic attacks, necessitating prompt patching.

Analyst Recommendation

Given the availability of a public proof-of-concept and the severity of the injection vulnerabilities, users of OpenLearnX must update to version 2.0.3 immediately. Failure to patch leaves the platform exposed to trivial remote code execution by authenticated users.

---METADATA---
VENDOR: JawherKl
PRODUCT: node-api-postgres
AFFECTED_VERSIONS: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5
CONFIDENCE: high
MISSING: patch
CREDITS: yeee3642 (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351097","name":"VDB-351097 | JawherKl node-api-postgres user.js User.getAll sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351097","name":"VDB-351097 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.770001","name":"Submit #770001 | Jawher Kl node-api-postgres 2.5 SQL Injection","tags":["third-party-advisory"]},{"url":"https://hackmd.io/@YzU_KiOzT86cEbFQdBceVg/Bk56LQQYbe","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.314Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the node-api-postgres User.getAll function allows remote, unauthenticated attackers to exfiltrate sensitive database information via the sort parameter.

Executive Summary:
A critical SQL injection vulnerability in the JawherKl node-api-postgres library enables unauthenticated attackers to perform unauthorized database exfiltration and account takeover.

Vulnerability Details

CVE-ID: CVE-2026-4190

Affected Software: JawherKl node-api-postgres

Affected Versions: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5

Vulnerability: The vulnerability exists within the models/user.js file where the User.getAll function improperly sanitizes the sort argument before concatenating it into a SQL query. This flaw allows an unauthenticated attacker to inject malicious SQL commands, leading to the exposure of sensitive user data including bcrypt password hashes.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the application database. An attacker can extract user credentials, session information, and administrative data, which directly facilitates full system compromise and account takeover. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, developers must manually implement an allowlist for the sort parameter in models/user.js to restrict input to predefined, safe fields.

Proactive Monitoring: Security teams should review application access logs for anomalous GET requests to the /users endpoint that contain SQL syntax or unexpected characters in the sort parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to detect and block SQL injection patterns, specifically targeting the sort parameter in HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is documented in the referenced security research write-up on HackMD.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input validation on a publicly accessible API endpoint.

Analyst Recommendation

The severity of this SQL injection vulnerability necessitates immediate attention from engineering teams. Because the vendor has not provided an official fix, developers must apply the recommended code-level mitigation by implementing strict input sanitization and parameter allowlisting. Failure to address this flaw leaves the application exposed to database exfiltration and potential administrative compromise by unauthenticated remote actors.

---METADATA---
VENDOR: Coolify
PRODUCT: Coolify
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Coolify platform that may affect the security posture of self-hosted managed environments.

Executive Summary:
Coolify is affected by a high-severity vulnerability that could allow unauthorized actors to compromise the security of managed applications and databases.

Vulnerability Details

CVE-ID: CVE-2026-41896

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is associated with the Coolify management tool, which facilitates server and database administration. The flaw potentially exposes the management layer to unauthorized manipulation, though specific attack vectors depend on the current deployment configuration.

Business Impact

The CVSS score of 7.5 highlights a significant risk profile. Successful exploitation of this vulnerability could result in unauthorized administrative control over the Coolify interface, leading to the modification of hosted application environments, database compromise, and potential exfiltration of sensitive organizational data.

Remediation Plan

Immediate Action: Verify the version of Coolify in use and apply the latest vendor-supplied patches as soon as they become available.

Proactive Monitoring: Monitor application logs for unauthorized login attempts or unexpected changes to server configuration parameters within the Coolify dashboard.

Compensating Controls: Implement strict firewall rules to ensure the Coolify administration interface is only accessible from trusted, internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that Coolify serves as a central hub for infrastructure management, vulnerabilities in this software are critical. Organizations are urged to monitor vendor security bulletins closely and apply the necessary updates to prevent unauthorized access to their managed infrastructure.

---METADATA---
VENDOR: locize
PRODUCT: locize
AFFECTED_VERSIONS: < 4.0.21
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2","name":"https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/locize/locize/releases/tag/v4.0.21","name":"https://github.com/locize/locize/releases/tag/v4.0.21","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:22:28.049Z
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability in the locize client SDK fails to validate the origin of postMessage events, allowing third-party sites to trigger internal handlers.

Executive Summary:
An origin validation vulnerability in the locize localization platform affects versions prior to 4.0.21, exposing host applications to unauthorized actions and cross-site scripting risks.

Vulnerability Details

CVE-ID: CVE-2026-41886

Affected Software: locize locize

Affected Versions: < 4.0.21

Vulnerability: This is an origin validation error classified under CWE-346 and CWE-79, where the locize client SDK registers a message event listener without validating event.origin. Unauthenticated attackers require user interaction to exploit this flaw via crafted postMessage payloads from third-party sites.

Business Impact

Successful exploitation can lead to unauthorized actions within the context of the user session, potentially compromising user data and application integrity. With a CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent malicious manipulation of localization workflows.

Remediation Plan

Immediate Action: Update the locize npm package to version 4.0.21 or later.

Proactive Monitoring: Monitor web application error logs and network traffic for anomalous postMessage payloads targeting localization endpoints.

Compensating Controls: Implement strict Content Security Policy directives to restrict frame embedding and message communication origins.

Exploitation Status

Public Exploit Available: No - As of May 10, 2026, there is no confirmed public exploit available in the provided data.

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires user interaction and specific frame contexts to be successfully triggered.

Analyst Recommendation

This high-severity vulnerability poses significant risks to applications utilizing affected versions of the locize client SDK. Administrators and developers must apply the vendor-supplied update to version 4.0.21 immediately to eliminate the underlying origin validation flaw and secure client-side communication channels.

---METADATA---
VENDOR: OmniFaces
PRODUCT: OmniFaces
AFFECTED_VERSIONS: omnifaces omnifaces: < 1.14.2, >= 2.0-RC1, < 2.7.32, >= 3.0-RC1, < 3.14.16, >= 4.0-M1, < 4.7.5, >= 5.0-M1, < 5.2.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-vp6r-9m58-5xv8","name":"https://github.com/omnifaces/omnifaces/security/advisories/GHSA-vp6r-9m58-5xv8","tags":["x_refsource_CONFIRM"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:22:35.729Z
---END_METADATA---

Description Summary:
OmniFaces contains a server-side EL injection vulnerability leading to Remote Code Execution via CDNResourceHandler with wildcard mappings.

Executive Summary:
An unauthenticated server-side Expression Language injection vulnerability in the OmniFaces utility library allows remote attackers to achieve Remote Code Execution via crafted resource requests.

Vulnerability Details

CVE-ID: CVE-2026-41883

Affected Software: OmniFaces OmniFaces

Affected Versions: omnifaces omnifaces: < 1.14.2, >= 2.0-RC1, < 2.7.32, >= 3.0-RC1, < 3.14.16, >= 4.0-M1, < 4.7.5, >= 5.0-M1, < 5.2.3

Vulnerability: This flaw is an Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917), triggered when using CDNResourceHandler with a wildcard mapping where unauthenticated attackers can supply an evaluated EL expression in a resource request URL.

Business Impact

A successful exploit grants an attacker complete control over the underlying server, resulting in total compromise of confidentiality, integrity, and availability. Although the CVSS score is 8.1 due to attack complexity requirements, the potential impact is catastrophic because it leads directly to arbitrary code execution within the application context.

Remediation Plan

Immediate Action: Update the OmniFaces library to version 1.14.2, 2.7.32, 3.14.16, 4.7.5, 5.2.3, or later depending on your active branch.

Proactive Monitoring: Monitor application access logs for suspicious resource request URLs containing unexpected expression syntax or function calls indicative of EL injection attempts.

Compensating Controls: Implement strict Web Application Firewall rules to inspect incoming resource request parameters and block requests containing Expression Language delimiters.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in the tracked intelligence sources.

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires specific configurations involving wildcard CDN mappings to be exploitable in practice.

Analyst Recommendation

Given the severe impact of Remote Code Execution, administrators must prioritize updating the OmniFaces library across all affected Java applications immediately. Review application configurations to ensure wildcard CDN resource handlers are either patched or properly restricted if immediate patching is delayed.

---METADATA---
VENDOR: JetBrains
PRODUCT: IntelliJ IDEA
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in JetBrains IntelliJ IDEA before 2024 may impact system integrity.

Executive Summary:
A high-severity vulnerability in JetBrains IntelliJ IDEA requires immediate attention to ensure the security of the development environment.

Vulnerability Details

CVE-ID: CVE-2026-41882

Affected Software: JetBrains IntelliJ IDEA

Affected Versions: See vendor advisory for affected versions

Vulnerability: Specific details regarding the vulnerability type remain limited, but it affects the integrity of the IntelliJ IDEA environment.

Business Impact

The CVSS score of 7.4 indicates a high severity. Vulnerabilities in development environments like IntelliJ IDEA can lead to supply chain attacks or the compromise of source code and developer credentials, which can have downstream impacts on business software releases.

Remediation Plan

Immediate Action: Update IntelliJ IDEA to the latest version recommended by the vendor.

Proactive Monitoring: Monitor developer workstations for unusual behavior or unauthorized modifications to project files.

Compensating Controls: Ensure that development environments are isolated and that software dependencies are audited regularly.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no evidence of active exploitation. However, maintaining updated development tools is a standard security best practice.

Analyst Recommendation

Security teams should coordinate with development teams to ensure that all instances of IntelliJ IDEA are updated to the latest secure version provided by JetBrains.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-619L
AFFECTED_VERSIONS: 2.06B01
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351094","name":"VDB-351094 | D-Link DIR-619L boa formSchedule stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351094","name":"VDB-351094 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769833","name":"Submit #769833 | D-Link DIR619L 2.06B01 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_89/89.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the boa component of D-Link DIR-619L version 2.06B01 allows remote attackers to execute arbitrary code via the curTime argument in the /goform/formSchedule endpoint.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-619L routers allows remote attackers to trigger memory corruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-4188

Affected Software: D-Link DIR-619L

Affected Versions: 2.06B01

Vulnerability: The vulnerability exists in the formSchedule function within the boa component, where the curTime parameter is copied to a local stack variable without sufficient bounds checking. This flaw allows a low-privileged authenticated attacker to overwrite the function return address and achieve code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and availability. Because the affected device is a router, an attacker gaining code execution could intercept traffic, redirect internal network requests, or permanently disable the device, leading to significant operational downtime. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized control of network infrastructure.

Remediation Plan

Immediate Action: As the affected product is no longer supported by the vendor, there is no official patch available. Owners must immediately decommission the affected hardware and replace it with a supported device.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests targeting the /goform/formSchedule endpoint, particularly those containing abnormally long strings in the curTime parameter.

Compensating Controls: If the device cannot be immediately replaced, implement network-level access control lists (ACLs) to restrict access to the management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the vulnerable parameter.

Analyst Recommendation

Given that the D-Link DIR-619L is at end-of-life status and no security updates will be provided, the only effective remediation is the immediate retirement of the device from the production environment. Continued use of this hardware exposes the network to trivial remote compromise. Organizations should prioritize the migration to modern, vendor-supported networking equipment to eliminate this risk.

---METADATA---
VENDOR: R-SOFT
PRODUCT: DMS
AFFECTED_VERSIONS: 0 up to (excluding) v3.17-2000
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
R-SOFT DMS stores superadmin credentials using an insecure, non-salted nested MD5 hash, rendering them susceptible to offline cracking attacks.

Executive Summary:
R-SOFT DMS suffers from a weak credential storage vulnerability where superadmin passwords are protected by non-salted nested MD5 hashes, facilitating potential unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-41879

Affected Software: R-SOFT SERWIS DMS

Affected Versions: 0 up to (excluding) v3.17-2000

Vulnerability: The application utilizes a weak cryptographic hash function (CWE-328) to store administrative passwords. By failing to use a unique salt, the system is highly vulnerable to precomputed hash attacks (rainbow tables) or brute-force cracking if the database is accessed.

Business Impact

A successful compromise of the superadmin credentials grants an attacker full control over the DMS platform, leading to unauthorized data access, system configuration changes, and potential administrative takeover. The CVSS score of 8.2 underscores the severity of this design flaw, which directly undermines the security foundation of the application.

Remediation Plan

Immediate Action: Update the R-SOFT DMS software to version 3.17-2000 or later, which addresses the credential storage implementation.

Proactive Monitoring: Audit database access logs for unauthorized queries and monitor for any unusual administrative activity that could indicate account compromise.

Compensating Controls: Ensure the database containing the hashes is protected with strict access controls and encryption at rest to mitigate the risk of the database being exfiltrated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw makes it a primary target for attackers seeking administrative persistence.

Analyst Recommendation

Weak cryptographic practices pose a fundamental risk to any system. Administrators must treat this as a high-priority update to ensure that administrative credentials are stored using modern, secure hashing algorithms, thereby preventing unauthorized access to the application.

---METADATA---
VENDOR: R-SOFT
PRODUCT: SERWIS DMS
AFFECTED_VERSIONS: 0 up to (excluding) v3.19-2752, 0 up to (excluding) v3.17-2580
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
R-SOFT SERWIS DMS is vulnerable to OS Command Injection via the konwertujAction() function, potentially allowing an authenticated attacker to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in R-SOFT SERWIS DMS allows authenticated attackers to execute arbitrary system commands, posing a critical risk to underlying server integrity.

Vulnerability Details

CVE-ID: CVE-2026-41876

Affected Software: R-SOFT SERWIS DMS

Affected Versions: 0 up to (excluding) v3.19-2752, 0 up to (excluding) v3.17-2580

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) occurring within the konwertujAction() function. It requires the attacker to have an authenticated session to trigger the injection point.

Business Impact

Successful exploitation of this vulnerability allows for remote code execution on the host server with the privileges of the application process. Given the CVSS score of 8.7, this represents a high risk of complete system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update R-SOFT SERWIS DMS to version v3.19-2752 or v3.17-2580 or later as specified by the vendor.

Proactive Monitoring: Review application and system access logs for anomalous execution patterns or unexpected shell commands originating from the web application user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious input containing command-line characters or shell metacharacters in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their instances of R-SOFT SERWIS DMS to the versions specified to eliminate the command injection vector.

---METADATA---
VENDOR: Pony Mail
PRODUCT: Pony Mail (Lua Implementation)
AFFECTED_VERSIONS: All versions of the Lua implementation
---END_METADATA---

Description Summary:
A request smuggling vulnerability in the retired Lua version of Pony Mail allows for unauthorized administrative account takeover.

Executive Summary:
The legacy Lua implementation of Pony Mail is vulnerable to HTTP request smuggling, enabling unauthenticated attackers to hijack administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-41873

Affected Software: Pony Mail (Lua implementation)

Affected Versions: All versions

Vulnerability: The application incorrectly interprets HTTP requests, leading to request smuggling that can be leveraged by an unauthenticated attacker to bypass authentication and seize administrative control.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to any remaining instances of the legacy software. Since the project is retired and no patch will be issued, the business impact includes full system takeover and persistent unauthorized access to archived communication data.

Remediation Plan

Immediate Action: Migrate all data to a supported alternative or the "Pony Mail Foal" implementation immediately, as no patch will be released.

Proactive Monitoring: Review access logs for suspicious administrative logins and unusual HTTP request patterns that deviate from standard usage.

Compensating Controls: Restrict access to the affected instance to a limited, trusted set of users via a VPN or IP-based firewall filtering.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because the maintainers have officially retired this version, it is fundamentally insecure. Immediate decommissioning or migration is the only effective remediation strategy for this vulnerability.

---METADATA---
VENDOR: EPG, Inc.
PRODUCT: Kura Sushi Official App
AFFECTED_VERSIONS: 2.0.11 to 3.9.10 (Android and iOS)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Kura Sushi Official App for Android and iOS contains an improper certificate validation vulnerability, potentially exposing user data to man-in-the-middle attacks.

Executive Summary:
Improper certificate validation in the Kura Sushi Official App (v2.0.11-3.9.10) exposes users to potential man-in-the-middle attacks and data interception.

Vulnerability Details

CVE-ID: CVE-2026-41872

Affected Software: EPG, Inc. Kura Sushi Official App

Affected Versions: 2.0.11 to 3.9.10

Vulnerability: The application fails to properly validate SSL/TLS certificates (CWE-295), allowing attackers to intercept or manipulate encrypted communications. This vulnerability can be exploited by an unauthenticated attacker, provided they can position themselves within the network path of the victim.

Business Impact

This vulnerability poses a risk of credential theft, session hijacking, or the exposure of personal user information transmitted through the app. Given the CVSS score of 7.4, the risk of total technical impact to the application's data integrity and confidentiality is significant for affected mobile users.

Remediation Plan

Immediate Action: Users should check for and install the latest version of the Kura Sushi Official App from the Google Play Store or Apple App Store.

Proactive Monitoring: Security teams should monitor for suspicious network traffic originating from mobile devices running the application.

Compensating Controls: Use of a secure VPN or avoiding the use of the application on untrusted public Wi-Fi networks can reduce the likelihood of a successful man-in-the-middle attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it bypasses the primary security mechanism for network communication.

Analyst Recommendation

All users of the Kura Sushi Official App should update to the latest available version immediately. Developers must ensure that certificate validation is strictly enforced in all network requests to prevent interception of sensitive data.

---METADATA---
VENDOR: Spring
PRODUCT: Spring Statemachine
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Spring Statemachine's persistence backends fail to enforce a class allowlist during deserialization, enabling potential remote code execution.

Executive Summary:
A critical deserialization vulnerability in Spring Statemachine allows remote attackers to execute arbitrary code within the application JVM.

Vulnerability Details

CVE-ID: CVE-2026-41862

Affected Software: Spring Spring Statemachine

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software uses Kryo-based persistence backends (JPA, MongoDB, Redis, and ZooKeeper) to process state-machine contexts without enforcing a class allowlist. This insecure deserialization of untrusted data (CWE-502) allows attackers to manipulate serialized objects to achieve remote code execution.

Business Impact

The ability for an attacker to execute arbitrary code within the application JVM represents a critical risk. With a CVSS score of 8.8, this vulnerability could lead to total system compromise, unauthorized data access, and the deployment of malicious payloads, jeopardizing the confidentiality and integrity of the entire application environment.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Spring Statemachine immediately to implement class allowlisting.

Proactive Monitoring: Review application logs for unexpected deserialization errors or unusual class instantiation attempts. Monitor JVM performance and outbound network connections for signs of unauthorized activity.

Compensating Controls: Implement strict network segmentation to limit access to persistence backends (Redis, MongoDB, etc.) and utilize WAF rules to inspect traffic for serialized object payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the potential for remote code execution. Organizations utilizing Spring Statemachine must treat this as a high-priority incident and apply vendor-provided patches as soon as they become available.

---METADATA---
VENDOR: BOSH
PRODUCT: BOSH
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A cryptographic weakness (CWE-326) in BOSH allows local attackers to perform MITM attacks to steal credentials or redirect token requests.

Executive Summary:
A cryptographic flaw in BOSH exposes the system to local man-in-the-middle attacks, potentially leading to the theft of Basic-auth credentials or UAA token redirection.

Vulnerability Details

CVE-ID: CVE-2026-41860

Affected Software: BOSH

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is classified as CWE-326, indicating inadequate cryptographic protection. This flaw enables a local attacker to intercept or manipulate traffic, specifically allowing for the theft of Basic-auth credentials or the redirection of UAA token requests via a man-in-the-middle (MITM) attack.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of unauthorized access and session hijacking. The compromise of credentials and token redirection capabilities could allow an attacker to impersonate legitimate users or gain administrative control over the BOSH environment.

Remediation Plan

Immediate Action: Review the BOSH vendor advisory and apply the recommended security updates or configuration changes to strengthen cryptographic implementations.

Proactive Monitoring: Monitor for unexpected authentication traffic or anomalous token request patterns within the environment.

Compensating Controls: Ensure that all communication is encapsulated within encrypted tunnels and enforce strict local access controls to mitigate the risk of local attackers performing MITM operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Cryptographic weaknesses of this nature are severe and require immediate attention. Organizations should prioritize updating their BOSH deployments to the latest secure version to prevent credential theft and unauthorized access via token manipulation.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: ActiveMQ (JMS)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been identified in JMS (Java Message Service) environments, potentially allowing for remote code execution or unauthorized operations.

Executive Summary:
A high-severity flaw in JMS-based messaging environments poses a critical risk of remote code execution if not properly secured.

Vulnerability Details

CVE-ID: CVE-2026-41855

Affected Software: Apache ActiveMQ (or related JMS implementation)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the handling of messages in an untrusted JMS environment, where insufficient validation of serialized objects could lead to arbitrary code execution by an unauthenticated attacker.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a major risk of total system compromise. In messaging-heavy architectures, successful exploitation could allow an attacker to gain full control over the application server, resulting in data theft, service interruption, and potential propagation to downstream systems.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of the JMS provider as specified in the vendor security advisory.

Proactive Monitoring: Monitor for unusual system calls or unexpected outbound network connections originating from the messaging server.

Compensating Controls: Disable the deserialization of untrusted data in the JMS configuration and implement strict class filtering to prevent the execution of malicious objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is typical of deserialization flaws, which are frequently targeted by attackers. Organizations should treat this as a high-priority patching requirement and ensure that all messaging middleware is hardened against untrusted input.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The D-Link DIR-816 is susceptible to a remote stack-based buffer overflow via the pskValue argument in the form2Wl5BasicSetup.cgi script.

Executive Summary:
A critical stack-based buffer overflow in the D-Link DIR-816 allows remote, unauthenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-4184

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: The vulnerability resides in the goahead component within the /goform/form2Wl5BasicSetup.cgi file. By manipulating the pskValue argument, an unauthenticated remote attacker can trigger a stack-based buffer overflow.

Business Impact

A CVSS score of 9.8 reflects the potential for full system compromise, including the execution of arbitrary code with high privileges. Since the product is no longer supported, this vulnerability remains a permanent risk to any network utilizing these legacy devices.

Remediation Plan

Immediate Action: Because the product is end-of-life and unsupported, the only effective remediation is to replace the device with a currently supported model.

Proactive Monitoring: Monitor traffic for unexpected crash patterns in the web interface and inspect logs for unusually long or malformed input strings in web requests.

Compensating Controls: Place the device behind a robust firewall and disable remote management interfaces to minimize exposure to external attack vectors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 16, 2026, public exploit code is available for this vulnerability. Given that the device is no longer supported by D-Link, there is no expectation of an official patch.

Analyst Recommendation

The reliance on an end-of-life product with a critical, publicly exploitable vulnerability is unacceptable for secure operations. Immediate decommissioning and replacement of the D-Link DIR-816 is strongly advised to eliminate this exposure.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A remote stack-based buffer overflow exists in the D-Link DIR-816 via the pskValue argument in the form2WlanBasicSetup.cgi script.

Executive Summary:
A critical stack-based buffer overflow in the D-Link DIR-816 allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-4183

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability affects the goahead component in the /goform/form2WlanBasicSetup.cgi file. An unauthenticated attacker can exploit this via the pskValue argument to overflow the stack, potentially hijacking the execution flow.

Business Impact

The severity of this flaw (CVSS 9.8) indicates a high likelihood of successful system takeover. As an unsupported legacy device, the risk of permanent, unpatchable exposure makes this a critical threat to the confidentiality, integrity, and availability of the network.

Remediation Plan

Immediate Action: Retire the affected hardware immediately, as the manufacturer no longer provides security updates for the D-Link DIR-816.

Proactive Monitoring: Observe network logs for suspicious HTTP POST requests directed at the /goform/ directory and monitor for device instability or unexpected reboots.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block requests containing abnormally long strings in the pskValue parameter if immediate replacement is not feasible.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 16, 2026, active public exploit information is available. The lack of vendor support for this device necessitates an urgent migration to modern, supported hardware.

Analyst Recommendation

The combination of a 9.8 CVSS score and the lack of vendor support creates an extreme risk profile. Security teams must prioritize the removal of these devices from all production environments immediately.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-816 goahead component allows remote attackers to execute arbitrary code via manipulated arguments in form2Wl5RepeaterStep2.cgi.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-816 routers enables remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-4182

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the goahead component's handling of the form2Wl5RepeaterStep2.cgi file. An unauthenticated remote attacker can trigger this condition by supplying malicious input to the key1, key2, key3, key4, or pskValue arguments.

Business Impact

Successful exploitation of this vulnerability allows for remote code execution, which could result in complete loss of device control, unauthorized network access, and potential lateral movement into internal systems. Given the CVSS score of 9.8, this represents a critical risk that could lead to significant operational disruption and data breach.

Remediation Plan

Immediate Action: As the affected product is end-of-life and no patch is available, the primary remediation is to retire the device and replace it with a supported alternative.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the /goform/form2Wl5RepeaterStep2.cgi endpoint.

Compensating Controls: Implement strict firewall rules to prevent external access to the administrative interface of the router.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, public exploit code is available for this vulnerability. Because the vendor no longer supports this hardware, users are at permanent risk of exploitation.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of vendor-supplied patches, we strongly recommend the immediate decommissioning of affected D-Link DIR-816 units. If replacement is not immediately feasible, ensure the device is isolated from the public internet using robust perimeter security controls.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the D-Link DIR-816 goahead component allows remote attackers to execute arbitrary code via manipulated arguments in form2RepeaterStep2.cgi.

Executive Summary:
A critical stack-based buffer overflow in D-Link DIR-816 routers enables remote code execution, creating a high risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-4181

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability involves a stack-based buffer overflow in the goahead component, specifically within the form2RepeaterStep2.cgi file. An unauthenticated remote attacker can exploit this by sending specially crafted input to the key1, key2, key3, key4, or pskValue parameters.

Business Impact

The severity of this flaw, rated at 9.8, indicates that unauthorized parties could potentially gain full control over the router. This access facilitates the interception of network traffic, redirection of user sessions, and broad reconnaissance of the internal network, posing a severe threat to organizational security.

Remediation Plan

Immediate Action: Since the product has reached end-of-life status, the recommended course of action is to replace the hardware immediately.

Proactive Monitoring: Review system and firewall logs for suspicious web requests targeting the /goform/form2RepeaterStep2.cgi file.

Compensating Controls: Restrict access to the router's web interface to trusted internal IP addresses only via a secure gateway.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, public exploit code is available for this vulnerability. As the vendor has ceased support for this product, no security updates will be provided.

Analyst Recommendation

The presence of a publicly available exploit necessitates immediate action to mitigate the risk. Organizations should prioritize replacing these unsupported devices as they cannot be secured against this critical vulnerability.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-816
AFFECTED_VERSIONS: 1.10CNB05
CONFIDENCE: high
MISSING: patch
CREDITS: pjqwudi (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351084","name":"VDB-351084 | D-Link DIR-816 goahead redirect.asp access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351084","name":"VDB-351084 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769828","name":"Submit #769828 | D-Link DIR816 1.10CNB05 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_84/84.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.314Z
---END_METADATA---

Description Summary:
An unauthenticated access control vulnerability in the D-Link DIR-816 goahead component allows attackers to retrieve token IDs via redirect.asp, enabling full unauthorized device configuration.

Executive Summary:
A critical, unauthenticated access control vulnerability in the D-Link DIR-816 router allows remote attackers to bypass authentication and modify device configurations.

Vulnerability Details

CVE-ID: CVE-2026-4180

Affected Software: D-Link DIR-816

Affected Versions: 1.10CNB05

Vulnerability: This vulnerability involves improper access controls within the goahead component, specifically the redirect.asp file. An unauthenticated remote attacker can access this file to obtain valid authentication tokens, which allows them to bypass security controls and perform unauthorized administrative actions, such as resetting Wi-Fi credentials.

Business Impact

Successful exploitation of this vulnerability results in a total compromise of the affected router's management and wireless security. Because the device is end-of-life and unsupported by the vendor, there is no path for official security patches, leaving the device permanently exposed to unauthorized configuration changes and potential lateral movement within the network. With a CVSS score of 7.3, this represents a high-risk scenario for any environment still utilizing this hardware.

Remediation Plan

Immediate Action: As this product is no longer supported by D-Link and no patch is available, the immediate recommendation is to decommission and replace the affected device with a currently supported router.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the router's management interface, particularly requests targeting the redirect.asp endpoint.

Compensating Controls: If immediate replacement is not feasible, isolate the router from the public internet using a robust firewall and restrict management access to a dedicated, secure local management VLAN.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up provided by Jiaqian Peng.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it allows unauthenticated attackers to trivially harvest authentication tokens and seize control of the device.

Analyst Recommendation

The D-Link DIR-816 is confirmed to be end-of-life and contains a critical, unauthenticated vulnerability for which no vendor fix will be provided. Organizations must treat these devices as inherently compromised if they remain exposed to the network. We strongly recommend immediate retirement and replacement of all units to mitigate the risk of unauthorized network access and potential data exfiltration.

---METADATA---
VENDOR: TRENDnet
PRODUCT: TEW-632BRP
AFFECTED_VERSIONS: 1.010B32
CONFIDENCE: high
MISSING: patch
CREDITS: iC0rner (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351079","name":"VDB-351079 | TRENDnet TEW-632BRP HTTP POST Request ping_response.cgi stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351079","name":"VDB-351079 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769770","name":"Submit #769770 | TRENDnet TEW-632BRP v1.010B32 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/i-Corner/cve/issues/40","name":null,"tags":["exploit","issue-tracking"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.314Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the TRENDnet TEW-632BRP router firmware, specifically within the ping_ipaddr parameter of the ping_response.cgi endpoint, allowing for potential code execution.

Executive Summary:
A stack-based buffer overflow vulnerability in the TRENDnet TEW-632BRP router allows an authenticated attacker to trigger memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-4172

Affected Software: TRENDnet TEW-632BRP

Affected Versions: 1.010B32

Vulnerability: The vulnerability exists in the HTTP POST request handler of the ping_response.cgi file, where the ping_ipaddr parameter is processed using an unsafe strcpy function. This flaw requires the attacker to have administrative privileges to reach the vulnerable function and successfully trigger the overflow.

Business Impact

Successful exploitation of this vulnerability could lead to a complete denial of service or the execution of arbitrary code with high privileges on the affected network device. Given the CVSS score of 7.2, this represents a significant risk to network integrity, as compromised routers can be used as pivot points for lateral movement or to intercept sensitive traffic within the organization.

Remediation Plan

Immediate Action: Since no vendor patch is currently available, immediately restrict access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous POST requests to ping_response.cgi, particularly those containing unusually long ping_ipaddr strings.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to inspect and drop malformed HTTP requests directed at the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's technical write-up on GitHub.

Analyst Notes: As of March 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it involves memory corruption via a standard administrative interface.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, users must treat this device as high risk. Organizations should prioritize isolating the management interface from the internal network and plan for the eventual decommissioning or replacement of this hardware if the vendor fails to provide a firmware update.

---METADATA---
VENDOR: VMware
PRODUCT: Spring AI
AFFECTED_VERSIONS: 1.0.0 up to 1.0.7, 1.1.0 up to 1.1.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper neutralization vulnerability in VMware Spring AI allows unauthenticated attackers to inject malicious input into conversation memory, causing unintended model interpretation.

Executive Summary:
A template injection vulnerability in VMware Spring AI enables unauthenticated attackers to manipulate model interpretation through conversation memory, posing a significant risk of data integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-41713

Affected Software: VMware Spring AI

Affected Versions: 1.0.0 up to 1.0.7, 1.1.0 up to 1.1.6

Vulnerability: This vulnerability (CWE-1336) involves improper neutralization of special elements within a template engine, allowing unauthenticated remote attackers to trigger unintended behavior via crafted inputs stored in the application's conversation memory.

Business Impact

Successful exploitation allows an attacker to manipulate the output or behavior of the AI model, potentially leading to unauthorized information disclosure or the injection of malicious instructions. With a CVSS score of 8.2, this vulnerability represents a high risk to application integrity and data security, necessitating prompt remediation to prevent potential misuse of AI-driven workflows.

Remediation Plan

Immediate Action: Update the org.springframework.ai:spring-ai-client-chat library to version 1.0.7 or 1.1.6 as specified by the vendor.

Proactive Monitoring: Review application logs for unusual input patterns in chat history or unexpected model responses that deviate from expected operational parameters.

Compensating Controls: Implement strict input validation and sanitization filters on all user-supplied data entering the conversation memory to neutralize template-specific special elements.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to manipulate downstream AI logic without requiring authentication.

Analyst Recommendation

Given the high severity and the potential for direct manipulation of AI model inputs, organizations using VMware Spring AI must prioritize upgrading to the patched versions immediately. Failure to address this vulnerability could allow unauthorized parties to compromise the integrity of AI-assisted decision-making processes.

---METADATA---
VENDOR: Spring
PRODUCT: Spring AI
AFFECTED_VERSIONS: Spring AI 1.0.0 up to (excluding) 1.0.7, 1.1.0 up to (excluding) 1.1.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://spring.io/security/cve-2026-41705","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:22:43.213Z
---END_METADATA---

Description Summary:
Spring AI is vulnerable to expression language injection via unsanitized document IDs in the MilvusVectorStore delete implementation.

Executive Summary:
Spring AI contains an expression language injection vulnerability in the MilvusVectorStore component that allows unauthenticated attackers to manipulate filter expressions and compromise backend integrity.

Vulnerability Details

CVE-ID: CVE-2026-41705

Affected Software: Spring Spring AI

Affected Versions: Spring AI 1.0.0 up to (excluding) 1.0.7, 1.1.0 up to (excluding) 1.1.6

Vulnerability: This is an improper neutralization of special elements used in an expression language statement, specifically CWE-917, triggered via unsanitized document IDs in the MilvusVectorStore#doDelete(List) method by unauthenticated users over the network.

Business Impact

A successful exploit allows attackers to execute arbitrary filter expressions, potentially leading to unauthorized data access, modification, or deletion within the vector database. With a CVSS score of 8.6, this high severity vulnerability poses significant risk to application confidentiality and integrity, particularly in environments handling sensitive vector embeddings and AI data stores.

Remediation Plan

Immediate Action: Update Spring AI components by upgrading spring-ai-milvus-store and spring-ai-typesense-store to version 1.0.7 or 1.1.6 respectively.

Proactive Monitoring: Monitor application logs for unusual document deletion patterns or anomalous inputs containing expression syntax characters within vector store API requests.

Compensating Controls: Deploy a Web Application Firewall with rules to inspect vector store API parameters for unexpected expression language syntax or injection payloads.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in tracking data).

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA SSVC assessment classifies exploitation as none, though the automatable nature of the flaw warrants prompt attention.

Analyst Recommendation

Organizations utilizing Spring AI must treat this high severity vulnerability with urgency due to the potential for remote filter manipulation. Apply the provided vendor updates immediately to affected Maven packages to mitigate potential exploitation risks.

---METADATA---
VENDOR: VMware
PRODUCT: Cloud Foundation, ESX, Workstation, Fusion
AFFECTED_VERSIONS: See vendor advisory for specific version ranges
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
VMware products, including Cloud Foundation, ESX, Workstation, and Fusion, are affected by an out-of-bounds read vulnerability that could be exploited by an authenticated user.

Executive Summary:
Critical virtualization products from VMware are susceptible to an out-of-bounds read vulnerability that could be leveraged by attackers with high privileges to impact system stability.

Vulnerability Details

CVE-ID: CVE-2026-41703

Affected Software: VMware Cloud Foundation, vSphere Foundation, ESX, Workstation, Fusion, and Telco Cloud Platform

Affected Versions: Various versions, including Cloud Foundation 5.x prior to 5.2.3 and specific builds of ESXi 9.1, 9.0, and 8.0.

Vulnerability: This is an out-of-bounds read vulnerability (CWE-125). It requires an attacker to possess high privileges to successfully exploit the flaw, potentially resulting in unauthorized information disclosure or system instability.

Business Impact

The CVSS score of 7.6 indicates a high-severity threat to business operations. Exploitation could allow an attacker to read sensitive memory contents or cause a denial of service, potentially impacting the integrity and availability of virtualized workloads across the enterprise.

Remediation Plan

Immediate Action: Apply the specific security patches provided by Broadcom/VMware for your respective product version as listed in the official security advisory.

Proactive Monitoring: Monitor virtual machine and hypervisor logs for unexpected crashes or error messages related to memory access violations.

Compensating Controls: Restrict administrative access to the hypervisor management interface to a limited set of trusted personnel and secure management networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the requirement for high privileges mitigates the risk for external attackers, it remains a critical concern for insider threats or compromised administrative accounts.

Analyst Recommendation

Given the broad impact across VMware's product portfolio, administrators should consult the Broadcom support portal to identify and apply the correct patches for their environment. Immediate remediation is necessary to prevent potential exploitation of the hypervisor layer.

---METADATA---
VENDOR: VMware
PRODUCT: Fusion
AFFECTED_VERSIONS: 2025H2 up to (excluding) 2026H1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
VMware Fusion is affected by a Time-of-check Time-of-use (TOCTOU) race condition in a SETUID binary, potentially leading to unauthorized privilege escalation.

Executive Summary:
A TOCTOU race condition in VMware Fusion's SETUID binary could allow a local attacker to achieve unauthorized elevation of privilege.

Vulnerability Details

CVE-ID: CVE-2026-41702

Affected Software: VMware Fusion

Affected Versions: 2025H2 up to (excluding) 2026H1

Vulnerability: The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367) occurring within a SETUID binary. This allows a local, authenticated user to manipulate the execution flow during the window between the security check and the subsequent operation.

Business Impact

With a CVSS score of 7.8 (High), this vulnerability poses a severe threat to local system integrity. An attacker who has already gained low-privileged access to the host machine could exploit this race condition to escalate privileges, potentially leading to full system compromise or unauthorized access to virtualized guest environments.

Remediation Plan

Immediate Action: Apply the vendor-provided security update immediately to patch the affected SETUID binary.

Proactive Monitoring: Monitor system logs for unexpected process execution or errors related to VMware binary operations that may indicate race condition exploitation attempts.

Compensating Controls: Limit local user access to the host system and ensure that only trusted users have the ability to execute VMware Fusion operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TOCTOU vulnerabilities often require precise timing, making them complex to exploit reliably.

Analyst Recommendation

Security teams must prioritize the deployment of the vendor's patch to address the TOCTOU vulnerability in VMware Fusion. Ensuring the host environment is hardened against local privilege escalation is critical to mitigating the risk posed by this flaw.

---METADATA---
VENDOR: Spring
PRODUCT: GraphQL
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Spring for GraphQL applications utilizing WebSocket transport are susceptible to Cross-Site WebSocket Hijacking (CSWSH) attacks.

Executive Summary:
Spring for GraphQL applications are at risk of Cross-Site WebSocket Hijacking, which may allow unauthorized parties to intercept or interact with WebSocket sessions.

Vulnerability Details

CVE-ID: CVE-2026-41700

Affected Software: Spring GraphQL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly validate the origin of WebSocket upgrade requests, allowing an attacker to perform Cross-Site WebSocket Hijacking. This requires the application to have the WebSocket transport functionality enabled.

Business Impact

The CVSS score of 8.1 (High) indicates a significant risk of unauthorized interaction with user sessions. Exploitation could lead to the theft of sensitive session data or the execution of unauthorized actions within the context of an authenticated user's session, resulting in a potential compromise of application integrity.

Remediation Plan

Immediate Action: Update to the latest version of Spring for GraphQL as soon as a security patch is released by the vendor.

Proactive Monitoring: Monitor WebSocket traffic logs for connections originating from unexpected or suspicious domains.

Compensating Controls: Configure strict CORS (Cross-Origin Resource Sharing) policies and origin validation on the WebSocket endpoint to ensure only authorized clients can establish connections.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately audit their Spring for GraphQL implementations to determine if WebSocket transport is enabled. Until a patch is available, enforcing strict origin checks is essential to prevent unauthorized session hijacking.

---METADATA---
VENDOR: Topsec
PRODUCT: TopACM
AFFECTED_VERSIONS: 3.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Topsec TopACM 3.0 allows remote attackers to execute arbitrary commands via the template_path parameter in nmc_sync.php.

Executive Summary:
A critical OS command injection vulnerability in Topsec TopACM 3.0 permits unauthenticated remote code execution, exposing the system to full compromise.

Vulnerability Details

CVE-ID: CVE-2026-4170

Affected Software: Topsec TopACM

Affected Versions: 3.0

Vulnerability: This vulnerability is an OS command injection flaw found in the HTTP Request Handler component, specifically within /view/systemConfig/management/nmc_sync.php. An unauthenticated remote attacker can manipulate the template_path argument to execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme threat to business operations. Successful exploitation grants an attacker full control over the affected appliance, enabling data exfiltration, service disruption, and the potential to use the compromised unit as a pivot point into the internal infrastructure.

Remediation Plan

Immediate Action: Contact Topsec support for guidance on security patches or mitigation, as the vendor has not responded to public disclosure.

Proactive Monitoring: Inspect web server logs for anomalous patterns in URL parameters, specifically looking for shell metacharacters in the template_path argument.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing malicious command injection sequences targeting the nmc_sync.php file.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, public exploit code is available. Given the vendor's lack of response to the disclosure, users should assume the vulnerability is actively targeted.

Analyst Recommendation

The combination of critical severity and the existence of public exploit code makes this an urgent security issue. If a patch is unavailable, prioritize isolating the appliance from the network and restricting access to the absolute minimum required for operations.

---METADATA---
VENDOR: Spring
PRODUCT: Spring for GraphQL
AFFECTED_VERSIONS: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8
---END_METADATA---

Description Summary:
Spring for GraphQL applications are vulnerable to unsafe deserialization during the processing of paginated queries, which can lead to remote code execution.

Executive Summary:
A high-severity unsafe deserialization vulnerability in Spring for GraphQL allows attackers to achieve remote code execution through malicious paginated queries.

Vulnerability Details

CVE-ID: CVE-2026-41699

Affected Software: Spring for GraphQL

Affected Versions: Spring for GraphQL 2.0.x (2.0.0-2.0.3), 1.4.x (1.4.0-1.4.5), and 1.3.x (1.3.0-1.3.8)

Vulnerability: The application is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request that triggers the execution of arbitrary code if the application environment includes specific exploitable classes.

Business Impact

A CVSS score of 8.1 indicates a high risk of total system compromise. If exploited, an attacker could achieve remote code execution (RCE), potentially resulting in full system takeover, data exfiltration, or the deployment of ransomware within the application environment.

Remediation Plan

Immediate Action: Update to the patched versions: 2.0.4, 1.4.6, or 1.3.9, depending on the current version in use.

Proactive Monitoring: Monitor GraphQL request logs for unusual or malformed queries, particularly those related to pagination (Connection fields).

Compensating Controls: Implement a Web Application Firewall (WAF) with rules to inspect and filter suspicious GraphQL payloads and restrict input to trusted sources.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for RCE makes this a high-priority remediation item.

Analyst Recommendation

Developers and system administrators should immediately update all instances of Spring for GraphQL to the latest secure versions. Review the application classpath to identify and remove any unnecessary classes that could be leveraged in a deserialization attack.

---METADATA---
VENDOR: i18next
PRODUCT: i18next-fs-backend
AFFECTED_VERSIONS: i18next-fs-backend < 2.6.4
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-8847-338w-5hcj","name":"https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-8847-338w-5hcj","tags":["x_refsource_CONFIRM"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:22:50.749Z
---END_METADATA---

Description Summary:
An unauthenticated path traversal vulnerability in i18next-fs-backend prior to version 2.6.4 allows attackers to read or overwrite arbitrary files.

Executive Summary:
An unauthenticated path traversal vulnerability in the i18next-fs-backend package for Node.js and Deno allows remote attackers to read or overwrite arbitrary files on the filesystem, presenting a high risk to application integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-41693

Affected Software: i18next i18next-fs-backend

Affected Versions: i18next-fs-backend < 2.6.4

Vulnerability: This is a path traversal and external control of file name or path vulnerability, driven by unvalidated substitution of language and namespace parameters into filesystem templates, allowing unauthenticated remote access.

Business Impact

A successful exploit could allow malicious actors to read sensitive system files, access internal configuration data, or overwrite application files to achieve persistence or compromise system operations. With a CVSS score of 8.2, this high severity vulnerability reflects the danger of unauthenticated remote file access against underlying server environments.

Remediation Plan

Immediate Action: Update the i18next-fs-backend package to version 2.6.4 or later immediately.

Proactive Monitoring: Monitor application error logs and file access patterns for anomalous traversal attempts or unexpected file read operations originating from web requests.

Compensating Controls: Implement strict input validation and sanitization on request parameters handling language selection to reject characters such as dot-dot sequences or path separators before they reach the backend layer.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or proof-of-concept exists in the available data).

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's unauthenticated nature makes it highly automatable if exposed to untrusted input sources.

Analyst Recommendation

Organizations utilizing the i18next-fs-backend library must treat this issue with high urgency due to the potential for arbitrary file access. Applying the official vendor patch to version 2.6.4 is the definitive remediation step to eliminate the exposure surface.

---METADATA---
VENDOR: i18next
PRODUCT: i18next-http-middleware
AFFECTED_VERSIONS: < 3.9.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw","name":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw","tags":["x_refsource_CONFIRM"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:22:58.101Z
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in i18next-http-middleware allows unauthenticated attackers to corrupt Object.prototype and potentially achieve remote code execution.

Executive Summary:
An unauthenticated prototype pollution vulnerability in the i18next-http-middleware package for Node.js allows remote attackers to compromise application integrity and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-41690

Affected Software: i18next i18next-http-middleware

Affected Versions: < 3.9.3

Vulnerability: The software suffers from improper control of object prototype attributes via unvalidated entry points in getResourcesHandler and missingKeyHandler, allowing an unauthenticated HTTP client to pollute Object.prototype in the hosting Node.js process.

Business Impact

A successful exploit compromises the entire Node.js runtime process integrity, potentially breaking authorization checks, causing denial of service, or allowing attackers to achieve remote code execution. With a CVSS score of 8.6, this vulnerability presents a high risk to business operations, application availability, and data confidentiality.

Remediation Plan

Immediate Action: Update the npm package i18next-http-middleware to version 3.9.3 or later.

Proactive Monitoring: Monitor application logs for unusual request patterns targeting translation endpoints or unexpected property modifications within application objects.

Compensating Controls: Deploy a Web Application Firewall to inspect incoming HTTP payloads for prototype pollution attack vectors and suspicious query parameters.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in our curated intelligence sources).

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of unvalidated entry points makes remote exploitation straightforward if left unpatched.

Analyst Recommendation

This vulnerability carries a high severity rating due to its potential for privilege escalation and remote code execution in backend Node.js applications. Administrators must apply the version 3.9.3 update immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: ellite
PRODUCT: Wallos
AFFECTED_VERSIONS: <= 4.8.4
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g","name":"https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef","name":"https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:28:16.754Z
---END_METADATA---

Description Summary:
Wallos <= 4.8.4 contains an incomplete SSRF fix in webhook URL validation, allowing potential DNS rebinding attacks.

Executive Summary:
An incomplete Server-Side Request Forgery fix in Wallos personal subscription tracker allows attackers to bypass validation and potentially access internal resources via DNS rebinding.

Vulnerability Details

CVE-ID: CVE-2026-41688

Affected Software: ellite Wallos

Affected Versions: <= 4.8.4

Vulnerability: This is a Server-Side Request Forgery vulnerability stemming from inadequate URL validation and a lack of CURLOPT_RESOLVE pinning, requiring low-privileged user authentication.

Business Impact

A successful exploitation of this vulnerability could allow malicious actors to interact with internal network services normally protected from external access, leading to unauthorized information disclosure. While the CVSS score is 7.7, the exposure of internal architecture poses significant risk to confidential data housed within the private network.

Remediation Plan

Immediate Action: Review the official vendor advisory and apply the referenced commit or upcoming patches as soon as they become available.

Proactive Monitoring: Monitor outbound HTTP requests originating from the Wallos application server for anomalies targeting internal IP addresses or local services.

Compensating Controls: Implement egress filtering and strict network segmentation to restrict outbound connections from the Wallos server to internal metadata endpoints and sensitive local subnets.

Exploitation Status

Public Exploit Available: No — no confirmed public exploit or weaponized module is currently cataloged in available sources.

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Security teams must treat this SSRF vulnerability with high urgency due to the potential for internal network reconnaissance and data exposure. Administrators should restrict application network permissions and apply vendor-supplied patches immediately upon release.

---METADATA---
VENDOR: i18next
PRODUCT: i18next-http-middleware
AFFECTED_VERSIONS: i18next-http-middleware < 3.9.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg","name":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg","tags":["x_refsource_CONFIRM"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:23:05.406Z
---END_METADATA---

Description Summary:
i18next-http-middleware before 3.9.3 is vulnerable to HTTP Response Splitting via CRLF injection in the language parameter.

Executive Summary:
An unauthenticated HTTP response splitting vulnerability in i18next-http-middleware prior to version 3.9.3 allows attackers to manipulate HTTP headers via crafted language parameters.

Vulnerability Details

CVE-ID: CVE-2026-41683

Affected Software: i18next i18next-http-middleware

Affected Versions: i18next-http-middleware < 3.9.3

Vulnerability: This vulnerability involves improper neutralization of CRLF sequences in HTTP headers and cross-site scripting risks, affecting the language parameter processed by unauthenticated users through the middleware.

Business Impact

A successful exploit could allow attackers to conduct cross-site scripting attacks, poison web caches, or hijack user sessions by injecting arbitrary HTTP headers. Based on a CVSS score of 8.6, this vulnerability represents a high severity risk that could lead to significant data compromise and integrity violations in affected Node.js applications.

Remediation Plan

Immediate Action: Update the i18next-http-middleware package to version 3.9.3 or later where the CRLF injection issue is resolved.

Proactive Monitoring: Monitor application logs for unusual HTTP requests containing carriage return or line feed characters within language parameters or URL query strings.

Compensating Controls: Deploy a Web Application Firewall to inspect and block incoming HTTP requests containing CRLF sequences in sensitive parameters.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or proof-of-concept exists in the available data).

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA SSVC assessment indicates that exploitation is currently none, though the flaw is easily automatable.

Analyst Recommendation

Given the high CVSS score of 8.6 and the potential for header manipulation attacks, administrators should prioritize updating the i18next-http-middleware package immediately. Applying the official fix in version 3.9.3 will effectively neutralize the injection vector and secure web applications against response splitting.

---METADATA---
VENDOR: Paperclip
PRODUCT: Paperclip
AFFECTED_VERSIONS: Prior to 2026.416.0
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability exists in Paperclip due to improper handling of API calls in default configurations.

Executive Summary:
A critical remote code execution vulnerability in Paperclip allows unauthenticated attackers to gain full system control without user interaction.

Vulnerability Details

CVE-ID: CVE-2026-41679

Affected Software: Paperclip

Affected Versions: Prior to 2026.416.0

Vulnerability: This is a remote code execution (RCE) vulnerability stemming from a chain of six API calls that can be exploited by an unauthenticated attacker to execute arbitrary code on instances running in default configurations.

Business Impact

Successful exploitation grants an attacker full remote control over the affected server. This facilitates complete data exfiltration, total system compromise, and the potential for lateral movement across the network. Given the CVSS score of 10.0, this represents the highest level of risk to operational integrity and data confidentiality.

Remediation Plan

Immediate Action: Upgrade all Paperclip instances to version 2026.416.0 or later immediately.

Proactive Monitoring: Review API access logs for sequences of six consecutive, unauthorized requests targeting internal orchestration endpoints.

Compensating Controls: Restrict network access to the Paperclip management interface using IP allowlisting or VPN-only access until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated. Organizations must prioritize the deployment of the 2026.416.0 update across all production environments. Failure to patch leaves the system exposed to trivial, automated exploitation by unauthenticated actors.

---METADATA---
VENDOR: Admidio
PRODUCT: Admidio
AFFECTED_VERSIONS: < 5.0.9
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-p9w9-87c8-m235","name":"https://github.com/Admidio/admidio/security/advisories/GHSA-p9w9-87c8-m235","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","name":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:39:04.754Z
---END_METADATA---

Description Summary:
A SAML authentication vulnerability in Admidio prior to version 5.0.9 allows attackers to redirect signed SAML responses to arbitrary URLs.

Executive Summary:
An improper input validation vulnerability in Admidio prior to version 5.0.9 allows unauthenticated remote attackers to redirect signed SAML responses containing sensitive user attributes to arbitrary external URLs via crafted authentication requests.

Vulnerability Details

CVE-ID: CVE-2026-41670

Affected Software: Admidio Admidio

Affected Versions: < 5.0.9

Vulnerability: This is an improper input validation and open redirect vulnerability residing in the SAML Single Sign-On module, which can be triggered by unauthenticated attackers supplying arbitrary Assertion Consumer Service URLs in incoming SAML request messages.

Business Impact

A successful exploit allows malicious actors to intercept sensitive user identity attributes, including login names, email addresses, roles, and profile fields, leading to credential exposure and potential account compromise. With a CVSS score of 8.2, this high-severity flaw threatens user data confidentiality and organization trust, requiring prompt remediation to prevent data exfiltration.

Remediation Plan

Immediate Action: Update Admidio to version 5.0.9 or later to properly validate Assertion Consumer Service URLs against registered service provider configurations.

Proactive Monitoring: Monitor authentication and SSO logs for anomalous SAML request patterns containing unexpected Assertion Consumer Service URLs.

Compensating Controls: Implement strict network egress filtering and Web Application Firewalls to inspect and block outbound SAML traffic destined for unapproved endpoints if patching is delayed.

Exploitation Status

Public Exploit Available: No - unknown

Analyst Notes: As of May 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Given the high severity rating and potential exposure of sensitive user identity attributes, organizations must prioritize patching this vulnerability. Administrators should upgrade immediately to version 5.0.9 to secure the SAML Single Sign-On module against redirection attacks.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: 1.00.33
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter); VulDB (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.351074","name":"VDB-351074 | Belkin F9K1122 formReboot stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.351074","name":"VDB-351074 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769727","name":"Submit #769727 | Belkin F9K1122 1.00.33 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/Belkin/vul_152/README.md","name":null,"tags":["related"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/Belkin/vul_152/README.md#proof-of-concept-poc","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.286Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Belkin F9K1122 router allows remote attackers to trigger denial of service or remote code execution via the webpage parameter in the formReboot function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Belkin F9K1122 firmware version 1.00.33 exposes devices to potential remote code execution and denial of service.

Vulnerability Details

CVE-ID: CVE-2026-4167

Affected Software: Belkin F9K1122

Affected Versions: 1.00.33

Vulnerability: The device suffers from a stack-based buffer overflow in the formReboot function, located within the /goform/formReboot endpoint. By providing a malicious webpage parameter, an authenticated attacker can trigger memory corruption through an unchecked strcpy operation.

Business Impact

The ability for an attacker to achieve remote code execution poses a severe risk to network integrity and confidentiality. Successful exploitation could allow an unauthorized party to gain control over the router, facilitate lateral movement within the network, or cause persistent system instability. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: As there is currently no official patch from the vendor, users should restrict access to the router management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /goform/formReboot endpoint and investigate any unexpected router reboots or service interruptions.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to filter malicious POST payloads containing excessively long webpage parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking during the processing of the webpage parameter.

Analyst Recommendation

Due to the lack of a vendor-provided security update, users must treat this device as high-risk and implement rigorous network segmentation. Organizations should prioritize replacing or isolating these routers from internet-facing environments to mitigate the threat of remote code execution until a definitive patch is released.

---METADATA---
VENDOR: Admidio
PRODUCT: Admidio
AFFECTED_VERSIONS: < 5.0.9
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-25cw-98hg-g3cg","name":"https://github.com/Admidio/admidio/security/advisories/GHSA-25cw-98hg-g3cg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","name":"https://github.com/Admidio/admidio/releases/tag/v5.0.9","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:39:12.474Z
---END_METADATA---

Description Summary:
Admidio prior to version 5.0.9 suffers from an improper verification of cryptographic signatures in its SAML implementation.

Executive Summary:
An improper verification of cryptographic signature vulnerability in Admidio prior to version 5.0.9 allows unauthenticated remote attackers to bypass SAML authentication requirements, presenting a high risk to organizational data integrity.

Vulnerability Details

CVE-ID: CVE-2026-41669

Affected Software: Admidio Admidio

Affected Versions: < 5.0.9

Vulnerability: This is an improper verification of cryptographic signature vulnerability, classified under CWE-347, affecting the SAML Identity Provider implementation. The application discards the return value of the validateSignature method, causing the smc_require_auth_signed configuration option to be ineffective against unauthenticated remote attackers.

Business Impact

The exploitation of this vulnerability allows unauthorized entities to process unsigned or invalidly-signed SAML authentication and logout requests, potentially leading to unauthorized access and severe integrity compromise of user management systems. With a CVSS score of 8.2, this high-severity flaw threatens organizational confidentiality and integrity by undermining core identity federation controls.

Remediation Plan

Immediate Action: Update the Admidio package to version 5.0.9 or later via Packagist to resolve the signature verification flaw.

Proactive Monitoring: Monitor authentication logs and SAML traffic for anomalous or unsigned request patterns indicating validation bypass attempts.

Compensating Controls: Implement strict Web Application Firewall rules to inspect and validate incoming SAML metadata and request signatures at the perimeter if immediate updating is impractical.

Exploitation Status

Public Exploit Available: No - As of the available data, there is no confirmed public exploit or weaponized module.

Analyst Notes: As of May 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from a developer oversight where method return values are discarded instead of throwing exceptions.

Analyst Recommendation

Given the high CVSS score and the presence of a proof-of-concept assessment, administrators must treat this vulnerability with urgency. Apply the official vendor update to version 5.0.9 immediately to restore proper cryptographic validation and secure the authentication boundary.

---METADATA---
VENDOR: PackageKit
PRODUCT: PackageKit
AFFECTED_VERSIONS: 1.0.2 to 1.3.4
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv","name":"https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277","name":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277","tags":["x_refsource_MISC"]},{"url":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036","name":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036","tags":["x_refsource_MISC"]},{"url":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882","name":"https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882","tags":["x_refsource_MISC"]},{"url":"https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html","name":"https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.559Z
---END_METADATA---

Description Summary:
PackageKit is vulnerable to a time-of-check time-of-use race condition that allows unprivileged local users to install packages as root, leading to local privilege escalation.

Executive Summary:
A high-severity local privilege escalation vulnerability in PackageKit (versions 1.0.2 to 1.3.4) allows unprivileged users to execute arbitrary code as root.

Vulnerability Details

CVE-ID: CVE-2026-41651

Affected Software: PackageKit PackageKit

Affected Versions: 1.0.2 to 1.3.4

Vulnerability: This vulnerability is a time-of-check time-of-use (TOCTOU) race condition within the transaction flag handling logic in src/pk-transaction.c. An unprivileged local attacker can trigger this flaw to bypass security checks and install arbitrary RPM packages with root privileges.

Business Impact

The ability for an unprivileged user to gain root access constitutes a critical security failure, as it allows for complete system compromise, data theft, and persistence establishment. With a CVSS score of 8.8, this flaw represents a significant risk to host integrity and confidentiality. Organizations relying on PackageKit for system updates must prioritize remediation to prevent lateral movement or full host takeover by malicious actors.

Remediation Plan

Immediate Action: Update the PackageKit software to version 1.3.5 or later, which includes the necessary patches to address the race condition.

Proactive Monitoring: Review system audit logs and package manager logs for unusual installation activity or frequent, failed transaction attempts that may indicate exploitation testing.

Compensating Controls: Restrict access to the D-Bus interface and limit the ability of non-privileged users to invoke package installation commands if the update cannot be applied immediately.

Exploitation Status

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

Analyst Notes: As of April 24, 2026, there is no confirmed active exploitation in the wild; however, multiple public proof-of-concept implementations are available on GitHub, which significantly lowers the barrier to entry for attackers. The flaw is inherently dangerous due to the ease with which a local user can manipulate the state-machine of the transaction process to achieve root execution.

Analyst Recommendation

Given the availability of public proof-of-concept code and the high potential impact of total system compromise, this vulnerability poses a substantial threat to local environment security. Administrators should treat this as a high-priority patching task and deploy the 1.3.5 update across all affected Linux distributions immediately to eliminate the risk of privilege escalation.

---METADATA---
VENDOR: Outline
PRODUCT: Outline
AFFECTED_VERSIONS: >= 0.86.0, < 1.7.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7","name":"https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460","name":"https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460","tags":["x_refsource_MISC"]},{"url":"https://github.com/outline/outline/releases/tag/v1.7.0","name":"https://github.com/outline/outline/releases/tag/v1.7.0","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.679Z
---END_METADATA---

Description Summary:
An insecure direct object reference in the Outline shares.create API allows authenticated attackers to generate share links for documents they are not authorized to access.

Executive Summary:
A critical authorization bypass vulnerability in Outline enables authenticated attackers to exfiltrate private documentation across workspaces, necessitating an immediate update to version 1.7.0.

Vulnerability Details

CVE-ID: CVE-2026-41649

Affected Software: Outline

Affected Versions: >= 0.86.0, < 1.7.0

Vulnerability: The vulnerability is an Insecure Direct Object Reference (CWE-639) located in the shares.create API endpoint. The system fails to validate document-level permissions when both collectionId and documentId are provided, allowing an authenticated user to bypass access controls.

Business Impact

The exploitation of this flaw leads to the unauthorized disclosure of sensitive organizational documentation. Given the CVSS score of 7.7, this represents a high-severity risk that could result in significant data breaches, loss of intellectual property, and potential regulatory non-compliance regarding internal data privacy.

Remediation Plan

Immediate Action: Upgrade the Outline service to version 1.7.0 or later to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for anomalous patterns, specifically looking for repeated calls to shares.create or documents.info originating from unauthorized user accounts.

Compensating Controls: Implement strict network access controls and ensure that the Outline instance is not exposed to the public internet unless necessary, as the flaw requires an authenticated session to trigger.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it allows for the programmatic enumeration and retrieval of internal documentation without requiring elevated administrative privileges.

Analyst Recommendation

The risk posed by CVE-2026-41649 is significant due to the potential for large-scale document exfiltration. Organizations utilizing the Outline platform must prioritize the deployment of version 1.7.0 to remediate the authorization logic flaw. Failure to patch allows any authenticated user to potentially access sensitive information across the entire platform, regardless of their intended permission level.

---METADATA---
VENDOR: osrg
PRODUCT: GoBGP
AFFECTED_VERSIONS: < 4.3.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q","name":"https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/osrg/gobgp/releases/tag/v4.3.0","name":"https://github.com/osrg/gobgp/releases/tag/v4.3.0","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:28:24.182Z
---END_METADATA---

Description Summary:
A remote Denial of Service vulnerability in GoBGP prior to version 4.3.0 allows unauthenticated attackers to trigger a runtime panic via malformed BGP UPDATE messages.

Executive Summary:
A remote Denial of Service vulnerability exists in the GoBGP routing implementation prior to version 4.3.0, allowing unauthenticated attackers to disrupt network infrastructure services.

Vulnerability Details

CVE-ID: CVE-2026-41643

Affected Software: osrg GoBGP

Affected Versions: < 4.3.0

Vulnerability: This flaw involves improper validation of array index values within CWE-129, triggered by a malformed 4-byte AS attribute in a BGP UPDATE message that causes an index out of range panic, requiring no attacker authentication.

Business Impact

A successful exploit of this vulnerability results in a complete crash of the routing daemon, leading to potential network disruption and service downtime. Given the CVSS score of 7.5, the severity is high due to the potential for unauthenticated remote attackers to trigger a high-impact availability disruption against critical routing infrastructure.

Remediation Plan

Immediate Action: Update osrg GoBGP to version 4.3.0 or later where the array indexing issue is fully patched.

Proactive Monitoring: Monitor network routing logs and daemon process health for unexpected restarts or crash events indicating potential attack attempts.

Compensating Controls: Implement strict BGP peer authentication and edge filtering to limit BGP traffic sources to trusted neighbors only.

Exploitation Status

Public Exploit Available: No — exploit_available (false / unknown).

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from insufficient bounds checking when handling slice index shifts during 4-byte AS attribute processing.

Analyst Recommendation

Organizations running vulnerable versions of GoBGP face a credible risk of remote service disruption from unauthenticated attackers. Administrators must apply the version 4.3.0 update immediately to ensure robust input validation and maintain continuous network availability.

---METADATA---
VENDOR: osrg
PRODUCT: GoBGP
AFFECTED_VERSIONS: osrg gobgp: = 4.3.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px","name":"https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/osrg/gobgp/releases/tag/v4.4.0","name":"https://github.com/osrg/gobgp/releases/tag/v4.4.0","tags":["x_refsource_MISC"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:28:31.562Z
---END_METADATA---

Description Summary:
A remote Denial of Service vulnerability in GoBGP version 4.3.0 allows unauthenticated attackers to crash the BGP daemon via malformed UPDATE messages.

Executive Summary:
A remote denial of service vulnerability in GoBGP version 4.3.0 allows unauthenticated attackers to crash the BGP daemon via a NULL pointer dereference, resulting in service disruption.

Vulnerability Details

CVE-ID: CVE-2026-41642

Affected Software: osrg GoBGP

Affected Versions: osrg gobgp: = 4.3.0

Vulnerability: This flaw is a NULL Pointer Dereference (CWE-476) occurring when a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as Well-known, with an unauthenticated attacker able to trigger the panic remotely over the network.

Business Impact

A successful exploitation of this vulnerability leads to a complete process crash of the BGP daemon, causing routing disruptions and potential network downtime. With a CVSS score of 7.5, the high severity rating reflects the ability of unauthenticated remote attackers to repeatedly crash critical routing infrastructure without prior access or user interaction.

Remediation Plan

Immediate Action: Update GoBGP to version 4.4.0 where this issue has been officially patched.

Proactive Monitoring: Monitor BGP daemon service status, system logs, and crash reports for unexpected restarts or nil pointer panic signatures.

Compensating Controls: Implement strict BGP peer authentication and edge filtering to limit untrusted BGP update traffic until the software update can be applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from improper error handling of unrecognized well-known path attributes in BGP messages.

Analyst Recommendation

Given the critical role of Border Gateway Protocol implementations in network routing, organizations running vulnerable instances face significant availability risks. Administrators must apply the version 4.4.0 patch immediately to prevent potential remote denial of service attacks against core infrastructure.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-WN578W2
AFFECTED_VERSIONS: 221110
---END_METADATA---

Description Summary:
Wavlink WL-WN578W2 firmware contains a command injection vulnerability in the Delete_Mac_list/SetName/GuestWifi functions, enabling remote attackers to execute arbitrary commands.

Executive Summary:
A critical command injection vulnerability in Wavlink WL-WN578W2 devices allows remote attackers to execute arbitrary code and fully compromise the network hardware.

Vulnerability Details

CVE-ID: CVE-2026-4164

Affected Software: Wavlink WL-WN578W2

Affected Versions: 221110

Vulnerability: The flaw resides in the POST request handler for /cgi-bin/wireless.cgi, specifically affecting the Delete_Mac_list, SetName, and GuestWifi functions. Attackers can inject malicious commands through these parameters without requiring local access.

Business Impact

This vulnerability leads to total device compromise, allowing attackers to monitor unencrypted traffic and redirect users to malicious sites. With a CVSS score of 9.8, the risk is Critical, as these devices often serve as the primary security barrier for small office and home networks.

Remediation Plan

Immediate Action: Immediately install the latest firmware update provided by Wavlink to patch the vulnerable CGI components.

Proactive Monitoring: Audit the device for any unfamiliar MAC addresses in the allowed list or unauthorized Guest Wi-Fi accounts.

Compensating Controls: Implement strict firewall rules to prevent access to the router's web management interface from external networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, the exploit for this vulnerability has been published. The availability of public exploit code makes it highly likely that automated scans are currently targeting these devices.

Analyst Recommendation

The presence of a public exploit and the Critical severity of the flaw necessitate immediate action. Update the firmware now. If an update is not available, the device should be taken offline or replaced to prevent it from becoming a bridgehead for attackers.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Thrift Node.js bindings
AFFECTED_VERSIONS: Apache Thrift versions before 0.23.0
CONFIDENCE: high
MISSING: none
CREDITS: 박시온 (L3G4CY Security Research) (finder)
SOURCES_JSON: [{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.679Z
---END_METADATA---

Description Summary:
An uncontrolled recursion vulnerability exists in the Apache Thrift Node.js bindings, potentially allowing for remote denial of service conditions.

Executive Summary:
An uncontrolled recursion vulnerability in Apache Thrift Node.js bindings allows unauthenticated attackers to cause a denial of service via resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-41636

Affected Software: Apache Software Foundation Apache Thrift Node.js bindings

Affected Versions: Versions before 0.23.0

Vulnerability: This vulnerability is an uncontrolled recursion (CWE-674) issue within the Node.js bindings that can be triggered by an unauthenticated attacker, leading to significant service instability or crash.

Business Impact

The successful exploitation of this vulnerability results in a denial of service, which can cause system downtime and interrupt critical business operations. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to availability, as it requires no authentication to trigger and can be exploited remotely.

Remediation Plan

Immediate Action: Update the Apache Thrift Node.js package to version 0.23.0 or later to resolve the recursion flaw.

Proactive Monitoring: Monitor application logs and server resource utilization for sudden spikes in memory or CPU usage that may indicate recursion-based crash attempts.

Compensating Controls: Implement rate limiting and input validation at the network edge or via a Web Application Firewall to restrict malformed requests that could trigger the recursive call chain.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is inherently dangerous due to its potential to crash server-side processes with minimal effort from an attacker.

Analyst Recommendation

This vulnerability represents a high risk to the availability of services utilizing Apache Thrift Node.js. Administrators should prioritize updating to version 0.23.0 immediately to eliminate the underlying recursive logic error and prevent potential service disruption.

---METADATA---
VENDOR: Apache
PRODUCT: MINA
AFFECTED_VERSIONS: 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, 2.2.0 <= 2.2.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache MINA contains an insecure deserialization vulnerability in AbstractIoBuffer.resolveClass() that allows bypassing the classname allowlist for arbitrary code execution.

Executive Summary:
A critical deserialization vulnerability in Apache MINA allows attackers to bypass security filters and execute arbitrary code on affected applications.

Vulnerability Details

CVE-ID: CVE-2026-41635

Affected Software: Apache MINA

Affected Versions: 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5

Vulnerability: The AbstractIoBuffer.resolveClass() method fails to properly validate classes before instantiation, bypassing the defined allowlist. This allows an attacker to force the application to deserialize malicious objects, leading to arbitrary code execution when IoBuffer.getObject() is called.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this vulnerability. Successful exploitation permits an attacker to execute arbitrary code within the context of the application, potentially leading to full server compromise, data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Apache MINA to version 2.0.28, 2.1.11, or 2.2.6 immediately to implement the corrected classname allowlist validation.

Proactive Monitoring: Monitor application logs for unexpected deserialization errors or unusual class-loading activities that may indicate an exploitation attempt.

Compensating Controls: Ensure that the application is running with the principle of least privilege to minimize the impact of successful code execution if patching is delayed.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security vulnerability affecting core functionality in Apache MINA. All development teams using these versions of MINA should prioritize upgrading to the patched versions to ensure adequate protection against deserialization-based attacks.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-WN579A3
AFFECTED_VERSIONS: 220323
---END_METADATA---

Description Summary:
A command injection vulnerability in the SetName/GuestWifi function of Wavlink WL-WN579A3 firmware allows remote attackers to execute arbitrary commands via POST requests.

Executive Summary:
Wavlink WL-WN579A3 routers are vulnerable to a critical remote command injection flaw that allows attackers to take full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-4163

Affected Software: Wavlink WL-WN579A3

Affected Versions: 220323

Vulnerability: The vulnerability is located in the SetName/GuestWifi function within /cgi-bin/wireless.cgi. By manipulating POST requests, a remote attacker can bypass input validation and execute arbitrary system commands on the device.

Business Impact

A successful exploit allows an attacker to intercept network traffic, change DNS settings, or enlist the device into a botnet. Given the CVSS score of 9.8, the impact is Critical, as it compromises the gateway of the local network, potentially exposing all connected devices to further attacks.

Remediation Plan

Immediate Action: Upgrade the Wavlink WL-WN579A3 firmware to the latest available version immediately.

Proactive Monitoring: Check router logs for suspicious POST requests directed at /cgi-bin/wireless.cgi and monitor for unauthorized changes to Wi-Fi configurations.

Compensating Controls: Disable remote management interfaces and ensure that the administrative interface is not accessible from the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of March 16, 2026, a public exploit is available. This significantly increases the risk of active exploitation, as the barrier to entry for attackers is now minimal.

Analyst Recommendation

Because a public exploit exists, this vulnerability must be remediated with the highest urgency. Administrators should flash the updated firmware immediately and verify that the device has not already been compromised by checking for unauthorized persistent scripts.

---METADATA---
VENDOR: RocketGenius
PRODUCT: Gravity SMTP
AFFECTED_VERSIONS: 0 through 2.1.4
CONFIDENCE: high
MISSING: none
CREDITS: Osvaldo Noe Gonzalez Del Rio (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9d18a4-262b-4011-91e9-b29a27a76470?source=cve","name":null,"tags":[]},{"url":"https://www.gravityforms.com/brand-new-release-gravity-smtp-2-1-5/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.887Z
---END_METADATA---

Description Summary:
The Gravity SMTP plugin for WordPress is vulnerable to missing authorization, allowing authenticated attackers with subscriber-level access to uninstall the plugin and modify sensitive settings.

Executive Summary:
The Gravity SMTP plugin for WordPress contains a critical authorization flaw that permits authenticated users to perform unauthorized administrative actions, including plugin uninstallation.

Vulnerability Details

CVE-ID: CVE-2026-4162

Affected Software: RocketGenius Gravity SMTP

Affected Versions: 0 through 2.1.4

Vulnerability: This vulnerability is a missing authorization flaw (CWE-862) caused by the failure to verify user permissions for specific plugin actions. Attackers with subscriber-level access or higher can exploit this to deactivate or uninstall the plugin and delete plugin configurations, with the risk further compounded by a potential Cross-Site Request Forgery vector.

Business Impact

The ability for low-privileged users to uninstall security or utility plugins poses a significant risk to site integrity and operational continuity. With a CVSS score of 7.1, this high-severity vulnerability could lead to unauthorized service disruption and the removal of critical email configuration settings, potentially impacting business communications and security posture.

Remediation Plan

Immediate Action: Update the Gravity SMTP plugin to version 2.1.5 or later, as provided by the vendor.

Proactive Monitoring: Review audit logs for unexpected plugin deactivation events or unauthorized changes to administrative plugin settings.

Compensating Controls: Ensure that WordPress user registration is restricted or monitored, and utilize a Web Application Firewall (WAF) to block suspicious requests targeting plugin administrative endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the low barrier to entry for authenticated attackers makes it a priority for remediation.

Analyst Recommendation

Given the high CVSS score and the ease with which low-privileged users can disrupt plugin functionality, organizations should prioritize updating the Gravity SMTP plugin immediately. Failure to apply the available security update leaves the environment susceptible to unauthorized configuration changes and potential service outages.

---METADATA---
VENDOR: Microsoft
PRODUCT: Authenticator
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in Microsoft Authenticator allows an unauthorized attacker to disclose sensitive information over the network.

Executive Summary:
A critical information disclosure vulnerability in Microsoft Authenticator allows unauthorized attackers to access sensitive data over the network.

Vulnerability Details

CVE-ID: CVE-2026-41615

Affected Software: Microsoft Authenticator

Affected Versions: See vendor advisory

Vulnerability: An unauthorized attacker can exploit a flaw in the application's communication handling to access sensitive information, potentially compromising authentication security.

Business Impact

The compromise of information within the Microsoft Authenticator application could lead to the exposure of multi-factor authentication secrets or user identity data. With a CVSS score of 9.6, this vulnerability poses a severe risk to the entire identity security posture of an organization.

Remediation Plan

Immediate Action: Check the official Microsoft security advisory and update the Authenticator application to the latest available version immediately.

Proactive Monitoring: Monitor authentication logs for anomalous access patterns or unexpected device registration events that could indicate an attempt to exploit this information disclosure.

Compensating Controls: Enforce additional layers of identity protection, such as Conditional Access policies and FIDO2-based hardware security keys, to reduce reliance on vulnerable software-based MFA.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of Microsoft Authenticator in securing enterprise access, this patch must be treated with high urgency. Organizations should ensure all users update their applications to the latest version to prevent unauthorized data exposure.

---METADATA---
VENDOR: Microsoft
PRODUCT: Visual Studio Code
AFFECTED_VERSIONS: 1.0.0 up to 1.119.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A session fixation and OS command injection vulnerability in Microsoft Visual Studio Code allows remote attackers to elevate privileges via network-based exploitation.

Executive Summary:
A critical session fixation and OS command injection flaw in Microsoft Visual Studio Code permits unauthorized attackers to achieve privilege escalation over a network.

Vulnerability Details

CVE-ID: CVE-2026-41613

Affected Software: Microsoft Visual Studio Code

Affected Versions: 1.0.0 up to 1.119.1

Vulnerability: This vulnerability combines session fixation (CWE-384) and OS command injection (CWE-78), allowing an attacker to manipulate session states and execute arbitrary commands on the underlying host. The vulnerability requires user interaction (UI:R) but does not require prior authentication (PR:N).

Business Impact

The ability to execute arbitrary OS commands leads to a total compromise of the affected system, including full unauthorized access and potential lateral movement within the network. The CVSS score of 8.8 reflects the high potential for system-wide impact, making this a critical priority for security teams.

Remediation Plan

Immediate Action: Update Microsoft Visual Studio Code to version 1.119.1 or later as soon as the update becomes available via the vendor's release channel.

Proactive Monitoring: Monitor system and process logs for anomalous command execution or unexpected child processes originating from the Visual Studio Code application.

Compensating Controls: Restrict network access to development environments and ensure that Visual Studio Code instances are executed with the minimum necessary system privileges to limit the potential impact of command injection.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of command injection and session fixation makes this a high-risk vector for persistent compromise.

Analyst Recommendation

The criticality of this vulnerability cannot be overstated, as it provides a path for full remote code execution and privilege escalation. Administrators must ensure all Visual Studio Code installations are updated to the secure version immediately upon release to mitigate the risk of system-wide compromise.

---METADATA---
VENDOR: Apache
PRODUCT: Thrift
AFFECTED_VERSIONS: Apache Thrift versions prior to 0.23.0
CONFIDENCE: high
MISSING: none
CREDITS: Hasnain Lakhani (finder)
SOURCES_JSON: [{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.679Z
---END_METADATA---

Description Summary:
Apache Thrift is affected by an integer overflow or wraparound vulnerability that could allow for unauthorized impacts.

Executive Summary:
Apache Thrift versions prior to 0.23.0 are vulnerable to an integer overflow flaw that could lead to partial impact on system integrity, availability, and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-41605

Affected Software: Apache Thrift

Affected Versions: Apache Thrift versions prior to 0.23.0

Vulnerability: This vulnerability is an integer overflow or wraparound (CWE-190) that can be triggered by an unauthenticated remote attacker. The flaw resides within the Apache Thrift framework and allows for potential manipulation of data processing flows.

Business Impact

The exploitation of this integer overflow can result in partial compromise of system confidentiality, integrity, and availability. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to applications relying on Thrift for inter-service communication, potentially leading to application crashes or unauthorized data processing.

Remediation Plan

Immediate Action: Upgrade to Apache Thrift version 0.23.0 or later, which contains the necessary security patch to remediate this vulnerability.

Proactive Monitoring: Review application and system logs for unexpected crashes or abnormal memory usage patterns that may indicate attempts to trigger an integer overflow.

Compensating Controls: Implement strict input validation and boundary checks at the application layer to sanitize incoming data before it is processed by Thrift components.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically exploitable by unauthenticated remote actors, no weaponized exploit code has been identified in public repositories.

Analyst Recommendation

Given the high CVSS score and the fundamental nature of the Apache Thrift library in distributed systems, organizations should prioritize upgrading to version 0.23.0 immediately. Failure to patch may expose backend services to memory-related vulnerabilities that could be leveraged for service disruption or data manipulation.