---METADATA---
VENDOR: jdx
PRODUCT: mise
AFFECTED_VERSIONS: Prior to 2026.3.10
---END_METADATA---

Description Summary:
The mise development tool manager improperly processes .tool-versions files using the Tera template engine, allowing unauthenticated remote attackers to achieve arbitrary command execution.

Executive Summary:
A critical arbitrary command execution vulnerability in jdx mise exposes developers to potential system compromise via malicious .tool-versions files.

Vulnerability Details

CVE-ID: CVE-2026-33646

Affected Software: jdx mise

Affected Versions: Prior to 2026.3.10

Vulnerability: The application incorrectly exposes the exec() function within the Tera template engine when parsing .tool-versions files; this allows an unauthenticated attacker to execute arbitrary commands by placing a crafted file in a repository.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk of full system compromise for any developer or automated system using the affected software. Successful exploitation could lead to unauthorized data exfiltration, lateral movement within the development environment, and the potential for supply chain attacks if malicious code is introduced into build pipelines.

Remediation Plan

Immediate Action: Upgrade jdx mise to version 2026.3.10 or later immediately to patch the template engine processing logic.

Proactive Monitoring: Monitor developer workstations and CI/CD pipelines for unexpected process execution originating from the mise tool.

Compensating Controls: Implement strict repository trust policies and avoid executing mise in directories from untrusted sources until the update is applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this arbitrary code execution flaw, organizations should prioritize the update of all instances of jdx mise. The vulnerability is particularly dangerous as it triggers automatically upon navigating into a directory, leaving little room for user error to prevent exploitation.

---METADATA---
VENDOR: Kovid Goyal
PRODUCT: Kitty
AFFECTED_VERSIONS: 0.46.2 and below
---END_METADATA---

Description Summary:
An integer wrapping vulnerability in the Kitty terminal emulator can lead to heap-based buffer corruption, allowing for potential arbitrary code execution.

Executive Summary:
A critical heap buffer overflow in the Kitty terminal emulator allows unauthenticated attackers to achieve remote code execution through malicious output.

Vulnerability Details

CVE-ID: CVE-2026-33642

Affected Software: Kovid Goyal Kitty

Affected Versions: 0.46.2 and below

Vulnerability: The handle_compose_command() function in kitty/graphics.c fails to properly validate composition offsets due to integer wrapping. An unauthenticated attacker can trigger this by sending crafted escape sequences to a terminal window.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely dangerous as it allows for full control of the host machine. The lack of required user interaction or specific configurations makes this a high-risk vector for attackers who can influence terminal output, such as through SSH banners or piped logs.

Remediation Plan

Immediate Action: Upgrade all installations of Kitty to version 0.47.0 or higher immediately.

Proactive Monitoring: Audit terminal environments and restrict the ability of untrusted sources to write to terminal outputs where possible.

Compensating Controls: Use terminal wrappers or security-hardened terminal configurations that sanitize input sequences if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this remote code execution vulnerability cannot be overstated. Organizations utilizing Kitty for terminal operations must prioritize this update as part of their urgent security maintenance cycle to prevent host system compromise.

---METADATA---
VENDOR: Nicolargo
PRODUCT: Glances
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Glances, a cross-platform system monitoring tool, is affected by a vulnerability that may allow for unauthorized information disclosure or system interference.

Executive Summary:
A high-severity vulnerability in the Glances monitoring tool poses a risk of unauthorized system observation and potential remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-33641

Affected Software: Nicolargo Glances

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw resides in Glances, an open-source system monitoring tool. The vulnerability likely involves the web interface or API component, which could allow an attacker to gain system insights or execute unauthorized commands depending on the configuration.

Business Impact

The exposure of system-level metrics through Glances can facilitate reconnaissance for further attacks. With a CVSS score of 7.8, the vulnerability presents a significant risk to system confidentiality and integrity. If exploited, an attacker could monitor real-time resource usage to identify vulnerable windows for more complex exploits.

Remediation Plan

Immediate Action: Update Glances to the latest version immediately and ensure that the web server component is properly secured with strong authentication.

Proactive Monitoring: Monitor network traffic for unauthorized connections to the Glances default port (61208) and review system logs for unusual monitoring activity.

Compensating Controls: Disable the Glances web server if it is not strictly necessary, or bind it to the localhost interface to prevent remote access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, monitoring tools are frequently targeted by attackers seeking to map internal networks.

Analyst Recommendation

Organizations using Glances should immediately verify their deployment configuration and apply the latest security updates. Ensuring that monitoring tools are not exposed to the public internet is a critical step in mitigating the risk associated with this CVSS 7.8 vulnerability.

---METADATA---
VENDOR: kovidgoyal
PRODUCT: kitty
AFFECTED_VERSIONS: < 0.47.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Kitty terminal emulator is susceptible to a heap-based buffer overflow, which can be triggered via specially crafted inputs.

Executive Summary:
A heap-based buffer overflow in the Kitty terminal emulator could allow a remote, unauthenticated attacker to cause a crash or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-33633

Affected Software: kovidgoyal kitty

Affected Versions: < 0.47.0

Vulnerability: This is a heap-based buffer overflow (CWE-122) vulnerability. The flaw exists in the memory management of the terminal emulator, potentially allowing an attacker to overwrite heap memory when processing maliciously crafted data.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a High-severity risk. Successful exploitation could lead to arbitrary code execution, resulting in full system compromise for the user running the terminal, or cause a denial-of-service condition that disrupts development and administrative workflows.

Remediation Plan

Immediate Action: Update the Kitty terminal emulator to version 0.47.0 or later immediately.

Proactive Monitoring: Monitor for unexpected crashes or segmentation faults in terminal processes, which may indicate attempted exploitation.

Compensating Controls: Limit the execution of untrusted terminal commands or sequences from unknown sources until the software can be patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Memory corruption flaws of this nature are highly dangerous and often targeted for remote code execution.

Analyst Recommendation

Users and administrators of the Kitty terminal should treat this as a high-priority update. Upgrading to version 0.47.0 is the only effective way to remediate the underlying memory safety issue and prevent potential exploitation.

---METADATA---
VENDOR: ClearanceKit
PRODUCT: ClearanceKit for macOS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
ClearanceKit for macOS contains a vulnerability in its file-system access event interception, potentially allowing bypass of per-process access policies.

Executive Summary:
A vulnerability in ClearanceKit on macOS could allow an attacker to bypass file-system access policies, leading to unauthorized data access or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-33631

Affected Software: ClearanceKit for macOS

Affected Versions: See vendor advisory for affected versions

Vulnerability: ClearanceKit is designed to intercept file-system access events on macOS to enforce security policies. The vulnerability exists in the interception mechanism, which may fail to correctly identify or block unauthorized requests, allowing processes to access files they should be restricted from based on the defined security policy.

Business Impact

This vulnerability is assigned a CVSS score of 8.7, indicating a High-severity risk. If exploited, it undermines the core security function of the software, potentially allowing malicious applications to access sensitive user data, configuration files, or system resources. This could lead to a total compromise of the endpoint's data confidentiality and integrity.

Remediation Plan

Immediate Action: Update ClearanceKit to the latest version provided by the developer to ensure the file-system interception and policy enforcement engine is properly secured.

Proactive Monitoring: Monitor macOS system logs and Endpoint Detection and Response (EDR) alerts for unauthorized file access attempts or modifications to ClearanceKit configuration files.

Compensating Controls: Use macOS native security features, such as Transparency, Consent, and Control (TCC) and Sandbox profiles, to provide redundant layers of file-system protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation. The high severity stems from the fact that this software is used specifically for security enforcement, and a bypass renders the entire policy framework ineffective.

Analyst Recommendation

Security tools that fail to enforce their primary policies create a false sense of security. Organizations should prioritize the update of ClearanceKit across all macOS endpoints to ensure that file-system access remains strictly controlled and monitored.

---METADATA---
VENDOR: Unknown
PRODUCT: Affected Software (setinfo endpoint)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the setinfo endpoint allows attackers to execute malicious SQL UPDATE commands, resulting in total loss of integrity and availability.

Executive Summary:
A critical SQL injection vulnerability in the setinfo endpoint allows unauthenticated remote attackers to manipulate database records, leading to potential data destruction and system failure.

Vulnerability Details

CVE-ID: CVE-2026-33615

Affected Software: Unknown (setinfo endpoint software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from improper neutralization of special elements within a SQL UPDATE command at the "setinfo" endpoint. An unauthenticated remote attacker can submit crafted input to execute arbitrary SQL queries against the backend database.

Business Impact

A successful SQL injection attack can allow for the unauthorized modification or deletion of critical database records, leading to a total loss of data integrity. With a CVSS score of 9.1, this flaw could be used to disable user accounts, alter financial records, or render the entire application unavailable through database corruption.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the software vendor to implement proper input parameterization and sanitization for the setinfo endpoint.

Proactive Monitoring: Enable database activity monitoring to detect anomalous UPDATE patterns or syntax errors that indicate SQL injection attempts.

Compensating Controls: Deploy or update Web Application Firewall (WAF) signatures to detect and block common SQL injection patterns (e.g., ' OR 1=1) targeting the setinfo endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most reliable vectors for attackers to gain initial access or cause widespread data loss.

Analyst Recommendation

Due to the unauthenticated nature of this flaw and its high severity, it is imperative to apply the vendor's remediation immediately. Organizations should also conduct a broader review of their application code to ensure that all database interactions utilize prepared statements to prevent similar vulnerabilities.

---METADATA---
VENDOR: Tranquil IT Systems
PRODUCT: WAPT Server
AFFECTED_VERSIONS: 2.6.0.16767 through 2.6.1.17787
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass vulnerability in WAPT Server allows remote, unauthenticated attackers to forge session tokens via specially crafted packets.

Executive Summary:
A critical authentication bypass vulnerability in Tranquil IT Systems WAPT Server allows unauthenticated attackers to gain full system access, posing a severe risk to organizational infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-33591

Affected Software: Tranquil IT Systems WAPT Server

Affected Versions: 2.6.0.16767 through 2.6.1.17787

Vulnerability: The software suffers from an authentication bypass (CWE-288) that enables unauthenticated remote attackers to retrieve valid session tokens for any account. This flaw occurs due to improper security restrictions during packet processing.

Business Impact

Successful exploitation of this vulnerability allows an attacker to impersonate any user, including administrative accounts, leading to complete compromise of the WAPT Server environment. Given the CVSS score of 10.0, this represents the highest level of risk, potentially allowing attackers to deploy arbitrary software across the managed fleet, exfiltrate sensitive data, or disrupt business operations entirely.

Remediation Plan

Immediate Action: Upgrade all instances of WAPT Server to version 2.6.1.17813 or later immediately to resolve the authentication flaw.

Proactive Monitoring: Review authentication and session management logs for unusual login patterns or multiple successful logins originating from unexpected IP addresses.

Compensating Controls: Implement strict network segmentation to restrict access to the WAPT Server management interface to known, trusted management segments only until patching is completed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated, and automatable nature.

Analyst Recommendation

The severity of this vulnerability cannot be overstated. Administrators must prioritize the deployment of the vendor-provided patch to version 2.6.1.17813 immediately. Failure to address this flaw leaves the entire managed infrastructure susceptible to total takeover by external actors.

---METADATA---
VENDOR: 10Web
PRODUCT: Form Maker
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Form Maker by 10Web WordPress plugin contains an SQL injection vulnerability in the 'inputs' parameter, enabling potential unauthorized database interaction.

Executive Summary:
An SQL injection flaw in the 10Web Form Maker plugin for WordPress allows attackers to potentially compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-3359

Affected Software: 10Web Form Maker

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability manifests as an SQL injection within the 'inputs' parameter. This allows an attacker to manipulate backend database queries, potentially leading to unauthorized data retrieval or modification.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high-risk entry point for attackers to bypass application logic. Successful exploitation can result in full database exposure, leading to severe reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: Apply the latest security update for the Form Maker plugin provided by 10Web immediately.

Proactive Monitoring: Monitor database query logs for unusual activity or signs of unauthorized data access originating from the Form Maker plugin components.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing suspicious SQL injection patterns directed at the 'inputs' parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Urgent patching is required to secure the environment against this SQL injection vector. Administrators must verify that they are running the most recent version of the plugin and audit site logs for any evidence of prior exploitation attempts.

---METADATA---
VENDOR: Open Notebook
PRODUCT: Open Notebook
AFFECTED_VERSIONS: v1.8.3
---END_METADATA---

Description Summary:
A Server-Side Template Injection (SSTI) vulnerability in Open Notebook v1.8.3 allows authenticated users to execute arbitrary Python code and OS commands within the Docker container.

Executive Summary:
A critical Server-Side Template Injection vulnerability in Open Notebook allows attackers to achieve arbitrary code execution within the container environment.

Vulnerability Details

CVE-ID: CVE-2026-33587

Affected Software: Open Notebook

Affected Versions: v1.8.3

Vulnerability: The application fails to sanitize user-provided input during transformations, resulting in SSTI. An authenticated user can leverage this flaw to execute arbitrary Python code, leading to full OS command execution on the host Docker container.

Business Impact

The ability to execute arbitrary commands at the container level poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 10.0, this vulnerability represents the highest level of risk, potentially allowing an attacker to pivot into the internal network, steal sensitive data, or compromise the integrity of the application environment.

Remediation Plan

Immediate Action: Update Open Notebook to the latest available version provided by the vendor to remediate the input sanitization flaw.

Proactive Monitoring: Review application logs for suspicious transformation requests and monitor for anomalous process spawning within the container.

Compensating Controls: Implement strict network segmentation for the Docker container and utilize security tools to restrict execution permissions for the application user.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS 10.0 severity, this vulnerability must be treated as a top priority. Organizations using Open Notebook v1.8.3 should apply the necessary patches immediately to prevent unauthorized code execution and mitigate the risk of a full container compromise.

---METADATA---
VENDOR: Arqit
PRODUCT: Symmetric Key Agreement Platform
AFFECTED_VERSIONS: 0 up to (excluding) 26.03
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Arqit Symmetric Key Agreement Platform is vulnerable to an unauthenticated, unencrypted HTTP GET request, leading to the exposure of QKEY and internal system keys.

Executive Summary:
An unauthenticated information disclosure vulnerability in the Arqit Symmetric Key Agreement Platform exposes critical system and quantum keys.

Vulnerability Details

CVE-ID: CVE-2026-33583

Affected Software: Arqit Symmetric Key Agreement Platform

Affected Versions: 0 up to (excluding) 26.03

Vulnerability: This is an exposure of sensitive keys via an unauthenticated and unencrypted HTTP GET method (CWE-749). The attacker requires no authentication to access these keys, which are used in the 'OTA-Quantum' device registration process.

Business Impact

Successful exploitation results in the total compromise of confidentiality for QKEYs and internal system keys (CVSS 8.7). This could lead to a total breakdown of the platform's security architecture, allowing attackers to intercept or forge encrypted communications, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Arqit Symmetric Key Agreement Platform to version 26.03 or higher immediately.

Proactive Monitoring: Review access logs for unauthorized HTTP GET requests directed at the device registration or key exchange endpoints.

Compensating Controls: Restrict network access to the platform endpoints using IP allowlisting and ensure all traffic is forced over encrypted channels (TLS).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature makes it extremely dangerous as it exposes the core cryptographic material of the system.

Analyst Recommendation

This is a critical security failure. Administrators must treat this as a high-priority incident and apply the vendor-provided updates immediately, as the exposure of root-level keys compromises the entire integrity of the affected platform.

---METADATA---
VENDOR: Apache
PRODUCT: Kafka
AFFECTED_VERSIONS: 4.1.0, 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A JWT validation flaw in Apache Kafka's OAuth bearer authentication allows unauthenticated attackers to impersonate any user by providing forged tokens.

Executive Summary:
Apache Kafka versions 4.1.0 and 4.1.1 are vulnerable to an authentication bypass that permits unauthorized users to gain full access to the broker.

Vulnerability Details

CVE-ID: CVE-2026-33557

Affected Software: Apache Kafka

Affected Versions: 4.1.0, 4.1.1

Vulnerability: The default JWT validator fails to perform cryptographic signature, issuer, or audience verification. This allows an unauthenticated attacker to supply a crafted JWT with arbitrary claims to successfully authenticate as any user.

Business Impact

The exploitation of this vulnerability poses a critical risk to data integrity and confidentiality. With a CVSS score of 9.1, this flaw allows an attacker to masquerade as privileged users, potentially leading to unauthorized data exfiltration, service disruption, or administrative control over the Kafka cluster.

Remediation Plan

Immediate Action: Upgrade to Apache Kafka version 4.1.2 or 4.2.0 or later. If an immediate upgrade is not feasible, explicitly set the sasl.oauthbearer.jwt.validator.class configuration to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.

Proactive Monitoring: Monitor authentication logs for suspicious patterns or unauthorized user sessions that do not align with expected identity provider signatures.

Compensating Controls: Implement strict network-level access controls to limit communication with the Kafka broker to known, trusted IP addresses while the patch is being applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this authentication bypass, organizations must prioritize patching or configuration changes immediately. Failure to address this vulnerability allows trivial impersonation of legitimate users, effectively nullifying the security posture of the Kafka infrastructure.

---METADATA---
VENDOR: Google
PRODUCT: Tinyauth
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Tinyauth, an authentication and authorization server, contains a high-severity vulnerability that may compromise identity management.

Executive Summary:
A high-severity vulnerability in the Google Tinyauth authentication server could allow attackers to compromise authorization protocols and gain unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2026-33544

Affected Software: Google Tinyauth

Affected Versions: See vendor advisory for affected versions

Vulnerability: Tinyauth is an authentication and authorization server; this vulnerability likely involves a failure in how it processes identity tokens or handles authorization logic. While the specific mechanism is not fully detailed, the CVSS score indicates a significant risk of unauthorized access.

Business Impact

As an identity management component, a flaw in Tinyauth impacts the security of every application relying on it for access control. A successful exploit could lead to unauthorized privilege escalation and lateral movement across the network. The CVSS score of 7.7 reflects a high risk to the integrity and confidentiality of the entire authentication ecosystem.

Remediation Plan

Immediate Action: Apply the latest security updates from the vendor immediately to ensure the integrity of the authentication server.

Proactive Monitoring: Monitor authentication logs for anomalous login patterns, credential stuffing attempts, or unauthorized token generation.

Compensating Controls: Ensure that multi-factor authentication (MFA) is strictly enforced for all users to provide a secondary layer of security against compromised credentials.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this affects a core security component, it remains an attractive target for sophisticated actors.

Analyst Recommendation

Securing identity infrastructure is paramount to maintaining a robust security posture. Organizations utilizing Tinyauth should apply vendor updates without delay to mitigate the risk of unauthorized access. Continuous monitoring of authorization events is highly recommended to detect any early signs of attempted exploitation.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: 0.7.2 and prior
---END_METADATA---

Description Summary:
A flawed administrator existence check in the FOSSBilling guest API allows unauthenticated attackers to create new administrator accounts, leading to full system compromise.

Executive Summary:
An unauthenticated administrative account creation vulnerability in FOSSBilling enables attackers to gain full system control, posing a critical risk to organizational data and operations.

Vulnerability Details

CVE-ID: CVE-2026-33543

Affected Software: FOSSBilling FOSSBilling

Affected Versions: 0.7.2 and prior

Vulnerability: This vulnerability occurs due to an improper type check in the /api/guest/staff/create endpoint, which fails to correctly verify if an administrator account already exists. This allows an unauthenticated attacker to inject a new, fully privileged administrative user into the system.

Business Impact

Successful exploitation results in total compromise of the billing and client management system. Given the CVSS score of 9.3, this flaw presents an unacceptable risk of unauthorized data exfiltration, service manipulation, and complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later immediately to resolve the logic error in the guest API endpoint.

Proactive Monitoring: Review system logs for unauthorized account creation events and monitor the administrative user list for accounts not provisioned by authorized staff.

Compensating Controls: Restrict access to the API directory at the web server or WAF level to prevent public access to the /api/guest/ path until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to full administrative access. Organizations utilizing FOSSBilling must prioritize this update as a critical maintenance task to prevent unauthorized system takeover.

---METADATA---
VENDOR: Zserio
PRODUCT: Zserio
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Zserio, a framework for serializing structured data, is affected by a high-severity vulnerability that could impact system data integrity and security.

Executive Summary:
A high-severity vulnerability in the Zserio serialization framework may allow attackers to compromise the integrity of structured data processing.

Vulnerability Details

CVE-ID: CVE-2026-33524

Affected Software: Zserio

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Zserio framework used for data serialization. With a CVSS score of 7.5, the flaw likely relates to improper handling of serialized data streams, which could be exploited to cause memory corruption, denial of service, or potentially arbitrary code execution when processing malicious data packets.

Business Impact

A CVSS score of 7.5 indicates a high risk to applications that rely on Zserio for efficient data communication. Exploitation could lead to unauthorized data manipulation or service disruption, which is particularly concerning in systems where Zserio is used for high-performance data exchange.

Remediation Plan

Immediate Action: Update the Zserio framework to the latest version provided by the project maintainers.

Proactive Monitoring: Review logs for errors occurring during the serialization or deserialization process, which could indicate malformed data or exploitation attempts.

Compensating Controls: Implement input validation for all structured data before it is passed to the Zserio deserialization layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Applications using Zserio should be updated immediately to mitigate this serialization vulnerability. Ensuring the integrity of data processing pipelines is essential to preventing downstream security impacts.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.4, 11.5, 12.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 fails to correctly validate permissions assigned to developer credentials.

Executive Summary:
An authorization flaw in Esri Portal for ArcGIS allows unauthorized access due to improper permission validation for developer credentials, creating a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33519

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.4, 11.5, 12.0

Vulnerability: The application suffers from incorrect authorization, specifically failing to properly verify the permissions associated with developer-level credentials, which can be leveraged to gain unauthorized access.

Business Impact

With a CVSS score of 9.8, this flaw represents a severe risk to organizational data integrity and confidentiality. Successful exploitation could allow attackers to bypass intended access controls, potentially accessing sensitive geospatial data and administrative functions within the ArcGIS environment.

Remediation Plan

Immediate Action: Update the Esri Portal for ArcGIS installation to the latest available version provided by the vendor.

Proactive Monitoring: Audit existing user and developer accounts for unusual activity and review access logs for attempts to access resources outside of assigned permission scopes.

Compensating Controls: Implement the principle of least privilege by auditing and restricting developer credentials until the patch is successfully applied.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to patching the affected ArcGIS Portal instances. Organizations must verify their current versioning and apply the necessary updates to ensure that developer credential permissions are correctly enforced and to prevent unauthorized access to the platform.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Esri Portal for ArcGIS 11.5 contains an incorrect privilege assignment vulnerability allowing highly privileged users to escalate developer credentials beyond intended limits.

Executive Summary:
A critical privilege assignment vulnerability in Esri Portal for ArcGIS 11.5 allows authorized users to escalate their permissions, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-33518

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.5

Vulnerability: This is an incorrect privilege assignment vulnerability where highly privileged users can create developer credentials that grant excessive access rights, exceeding their authorized scope.

Business Impact

The ability for privileged users to grant themselves unauthorized elevated permissions creates a substantial risk of data compromise and unauthorized administrative control. With a CVSS score of 9.8, this flaw represents a critical threat to the security posture of the organization, potentially leading to unauthorized access to sensitive geospatial data and infrastructure management.

Remediation Plan

Immediate Action: Consult the official Esri security advisory for the latest security patches or configuration hardening steps to restrict developer credential creation.

Proactive Monitoring: Review access logs for the creation of new developer credentials and audit the privilege levels assigned to existing administrative accounts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and limit the number of users with administrative or developer-level permissions within the Portal.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this privilege assignment issue, administrators should prioritize auditing current portal accounts and applying vendor-supplied updates immediately. Limiting the scope of highly privileged accounts is essential to preventing potential abuse of this vulnerability.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo's Live plugin allows attackers to probe internal networks and cloud metadata endpoints.

Executive Summary:
WWBN AVideo is vulnerable to a critical SSRF flaw that allows unauthenticated attackers to scan internal infrastructure and potentially steal cloud service credentials.

Vulnerability Details

CVE-ID: CVE-2026-33502

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: The vulnerability exists in plugin/Live/test.php. It allows an unauthenticated remote user to force the server to send HTTP requests to arbitrary URLs, including localhost and internal network resources that are not publicly accessible.

Business Impact

Attackers can use this SSRF to bypass firewall restrictions and access internal services, such as databases or configuration management tools. In cloud environments, this can be used to query the Instance Metadata Service (IMDS) to steal temporary security tokens, leading to a full cloud account compromise. The CVSS score of 9.3 reflects this high potential for lateral movement.

Remediation Plan

Immediate Action: Apply the patch in commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 or update to the latest version.

Proactive Monitoring: Monitor outbound network traffic from the AVideo server for requests to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).

Compensating Controls: Implement egress filtering at the network level to prevent the web server from initiating connections to sensitive internal ports or metadata services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, no active exploitation has been reported. SSRF is a common vector for initial access in cloud-native environments and should be addressed with high urgency.

Analyst Recommendation

Applying the vendor patch is the most effective solution. Organizations running AVideo in AWS, Azure, or GCP should be especially vigilant and ensure that IMDSv2 (or equivalent) is enforced to mitigate the impact of SSRF.

---METADATA---
VENDOR: ORY
PRODUCT: Oathkeeper
AFFECTED_VERSIONS: Versions prior to 26.2.0
---END_METADATA---

Description Summary:
ORY Oathkeeper versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal where raw paths are matched against permissive rules before normalization.

Executive Summary:
ORY Oathkeeper is subject to a critical authorization bypass that allows unauthenticated attackers to access protected administrative endpoints by utilizing path traversal sequences in HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-33494

Affected Software: ORY Oathkeeper

Affected Versions: Versions prior to 26.2.0

Vulnerability: The vulnerability exists in the rule evaluation engine, which uses un-normalized HTTP paths to match access rules. An unauthenticated attacker can craft a URL containing traversal sequences (e.g., /public/../admin) that bypasses restrictive rules but resolves to protected paths after server-side normalization.

Business Impact

This flaw effectively nullifies the security posture of the Identity & Access Proxy, allowing unauthorized access to sensitive internal APIs and administrative secrets. Given the CVSS score of 10.0, the risk is maximum, as it enables complete bypass of the primary security gatekeeper for protected infrastructure.

Remediation Plan

Immediate Action: Upgrade ORY Oathkeeper to version 26.2.0 or later immediately to ensure that path normalization occurs prior to access rule evaluation.

Proactive Monitoring: Review access logs for requests containing dot-dot-slash (../) sequences targeted at known public or permissive endpoints.

Compensating Controls: Ensure that downstream services perform their own secondary authorization checks and utilize a WAF to block requests containing URL-encoded path traversal characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

As an Identity and Access Proxy, the failure of Oathkeeper to correctly normalize paths is a fundamental security failure. Organizations must prioritize this update to prevent unauthorized actors from reaching internal resources that rely on the proxy for protection.