---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
WWBN AVideo contains a vulnerability chain allowing unauthenticated remote code execution via exposed clone secrets, database dumps, and OS command injection.

Executive Summary:
The WWBN AVideo platform is subject to a critical vulnerability chain that allows unauthenticated attackers to achieve full remote code execution and system takeover.

Vulnerability Details

CVE-ID: CVE-2026-33478

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: This is a multi-step exploit chain. First, clones.json.php leaks secret keys. These keys allow unauthenticated database dumps via cloneServer.json.php. Attackers can then crack MD5 hashes to gain admin access and finally exploit an OS command injection in the rsync command construction.

Business Impact

This vulnerability represents the highest possible risk (CVSS 10.0). An attacker can gain total control over the video platform, access all private content, steal user credentials, and execute arbitrary commands on the underlying host. The ability to dump the entire database unauthenticated makes this an extremely dangerous flaw for data privacy.

Remediation Plan

Immediate Action: Apply the patch provided in commit c85d076375fab095a14170df7ddb27058134d38c or update to the latest version of AVideo.

Proactive Monitoring: Check for unauthorized access to .json.php files in the CloneSite plugin directory and monitor for unusual rsync processes on the server.

Compensating Controls: Disable the CloneSite plugin if it is not strictly required for business operations and restrict access to the administration interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, the complexity of the chain does not lower the risk, as the individual steps are straightforward to automate.

Analyst Recommendation

Given the CVSS 10.0 rating, this is a "patch now" priority. Administrators must update the software immediately and should consider rotating all administrative passwords and secret keys, as they may have been compromised.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

Executive Summary:
A vulnerability in the SiYuan system allows for potential unauthorized access to sensitive knowledge bases, necessitating an immediate security update.

Vulnerability Details

CVE-ID: CVE-2026-33476

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan application, a tool used for private data management. Given the high CVSS severity, the flaw likely permits an attacker to bypass security controls or execute unauthorized commands within the application environment.

Business Impact

A successful exploit could allow an attacker to read, modify, or delete sensitive notes and documents stored within the SiYuan system. For organizations using SiYuan for internal documentation, this could result in the leak of proprietary research or strategic plans. The 7.5 CVSS score indicates that the risk to data confidentiality and availability is substantial.

Remediation Plan

Immediate Action: Immediately update SiYuan to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Monitor system resource usage and file integrity within the SiYuan directory to detect potential unauthorized modifications.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall (WAF) to filter suspicious traffic targeting the knowledge management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of personal knowledge management tools makes them attractive targets for targeted information-gathering attacks.

Analyst Recommendation

Immediate patching is the primary and most effective defense against this vulnerability. Users should not delay in applying updates, as the high severity score suggests that the flaw could be easily leveraged if technical details become public. Ensure that all backups of the knowledge base are encrypted and stored securely during the update process.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: Prior to version 1.9.0
---END_METADATA---

Description Summary:
Unauthenticated remote shell injection in Langflow's GitHub Actions workflows allows attackers to execute arbitrary commands and exfiltrate CI secrets via malicious branch names.

Executive Summary:
Langflow is vulnerable to unauthenticated remote shell injection in its CI/CD pipelines, allowing attackers to steal sensitive secrets and compromise the software supply chain.

Vulnerability Details

CVE-ID: CVE-2026-33475

Affected Software: Langflow

Affected Versions: Prior to version 1.9.0

Vulnerability: This is a shell injection vulnerability in GitHub Actions workflows. It occurs because unsanitized GitHub context variables (like github.head_ref) are directly interpolated into run: shell commands, allowing an unauthenticated attacker to execute commands by submitting a pull request with a malicious branch name.

Business Impact

An attacker can exfiltrate sensitive CI secrets, such as GITHUB_TOKEN, and potentially push malicious code or images to production repositories. This could lead to a massive supply chain compromise affecting all users of the Langflow product. The CVSS score of 9.1 reflects the critical risk to the integrity of the development lifecycle.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.0 or later, which refactors workflows to use environment variables instead of direct interpolation.

Proactive Monitoring: Audit GitHub Actions logs for suspicious activity, such as unusual curl commands or unauthorized access to secrets in workflows triggered by external forks.

Compensating Controls: Restrict GitHub Actions permissions and require manual approval for all workflows triggered by pull requests from external contributors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 24, 2026, a proof-of-concept (PoC) is publicly available demonstrating how to exfiltrate secrets via a malicious branch name. Active exploitation is highly likely given the public nature of the PoC.

Analyst Recommendation

This is a critical supply chain vulnerability. We strongly recommend that all organizations using Langflow immediately update to version 1.9.0 and rotate any secrets that may have been exposed in their CI/CD environments.

---METADATA---
VENDOR: Nimiq
PRODUCT: nimiq-block
AFFECTED_VERSIONS: Prior to 1.3.0
---END_METADATA---

Description Summary:
A logic error in the Nimiq block proof verification process allows attackers to bypass quorum requirements using manipulated BLS signatures.

Executive Summary:
A critical verification flaw in the Nimiq block implementation allows malicious actors to bypass security protocols through signature index collisions.

Vulnerability Details

CVE-ID: CVE-2026-33471

Affected Software: Nimiq Block

Affected Versions: Prior to 1.3.0

Vulnerability: The vulnerability exists in SkipBlockProof::verify, where improper index casting allows multiple out-of-range indices to collide into the same in-range slot, enabling signature multiplication.

Business Impact

This flaw undermines the consensus mechanism of the Nimiq implementation. An attacker could potentially validate fraudulent blocks, leading to double-spending or network instability. The CVSS score of 9.6 highlights the extreme risk to the integrity of the blockchain-based system.

Remediation Plan

Immediate Action: Update to Nimiq block version 1.3.0 or later immediately.

Proactive Monitoring: Monitor consensus logs for any anomalous block verification failures or irregularities in validator signature aggregation.

Compensating Controls: No effective workarounds exist; immediate application of the vendor-provided patch is required to maintain network security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All operators running Nimiq infrastructure must update to version 1.3.0 without delay. The integrity of the consensus mechanism is at stake, and no alternative mitigations can compensate for the underlying logic vulnerability.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 3.0.0 before 4.14.6, 4.15.0 before 4.18.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Camel-Mail component fails to properly filter inbound MIME headers, allowing attackers to inject Camel-specific headers that can alter downstream application behavior.

Executive Summary:
A critical message header injection vulnerability in Apache Camel allows unauthenticated attackers to manipulate application routing and potentially execute unauthorized operations.

Vulnerability Details

CVE-ID: CVE-2026-33454

Affected Software: Apache Camel

Affected Versions: 3.0.0 through 4.14.5; 4.15.0 through 4.18.0

Vulnerability: This is a message header injection vulnerability occurring in the MailHeaderFilterStrategy component. The flaw arises because inbound filter checks are skipped, allowing an unauthenticated attacker to inject malicious headers into the Exchange when the application processes email via IMAP or POP3.

Business Impact

The ability to inject headers that influence downstream components like camel-bean or camel-exec poses a severe risk to system integrity. With a CVSS score of 9.4, this vulnerability could be leveraged to alter business logic, gain unauthorized access to data, or facilitate remote execution of processes, leading to significant operational disruption and data exposure.

Remediation Plan

Immediate Action: Upgrade to Apache Camel version 4.19.0, or apply the specific security patches 4.14.6 or 4.18.1 depending on your current release stream.

Proactive Monitoring: Inspect application logs for unexpected header configurations or anomalous execution requests originating from the mail consumer components.

Compensating Controls: Ensure that mail servers and application gateways are strictly configured to inspect incoming traffic and sanitize MIME headers before they reach the Camel consumer.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this header injection flaw, administrators must prioritize patching affected Camel instances immediately. Failure to update allows potential attackers to manipulate the internal message exchange, which may result in full system compromise.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 4.14.0 through 4.14.5, 4.18.0, 4.19.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel CoAP component lacks header filtering, allowing unauthenticated attackers to inject headers and achieve Remote Code Execution (RCE) via sensitive producers.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Apache Camel CoAP component allows attackers to inject malicious headers via UDP packets to compromise host systems.

Vulnerability Details

CVE-ID: CVE-2026-33453

Affected Software: Apache Camel

Affected Versions: 4.14.0 through 4.14.5, 4.18.0, 4.19.0

Vulnerability: This vulnerability is an improper control of object attributes resulting from a lack of HeaderFilterStrategy in the camel-coap component. An unauthenticated attacker can send crafted CoAP UDP packets to inject headers that cause downstream producers (e.g., camel-exec) to execute arbitrary OS commands.

Business Impact

With a CVSS score of 10.0, this represents a critical risk to any environment running the CoAP component. Successful exploitation grants an attacker full command execution privileges under the service account running the Camel process, potentially leading to total system compromise, exfiltration of sensitive data, and complete loss of service availability.

Remediation Plan

Immediate Action: Upgrade to Apache Camel versions 4.18.1 or 4.19.0 immediately to implement necessary header filtering.

Proactive Monitoring: Monitor network traffic for CoAP packets (default port 5683) and review system logs for suspicious process spawning or command-line activity originating from the Java process.

Compensating Controls: Since CoAP is UDP-based, traditional HTTP WAFs are ineffective; network-level access control lists (ACLs) should be used to restrict access to the CoAP port to authorized sources only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is of the highest severity and requires immediate remediation. Because CoAP lacks native authentication and the attack surface is exposed via UDP, any internet-facing or internally accessible CoAP endpoint is at extreme risk until patched.

---METADATA---
VENDOR: Absolute Security
PRODUCT: Secure Access
AFFECTED_VERSIONS: 0 up to (excluding) 14.55
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory management vulnerability in Absolute Security Secure Access allows for potential denial of service conditions.

Executive Summary:
A critical memory management vulnerability in Absolute Security Secure Access versions prior to 14.55 poses a significant risk of service disruption.

Vulnerability Details

CVE-ID: CVE-2026-33445

Affected Software: Absolute Security Secure Access

Affected Versions: 0 up to (excluding) 14.55

Vulnerability: This is a memory management vulnerability that can be triggered by an unauthenticated attacker over the network. The flaw allows for remote exploitation to cause a denial of service by exhausting server resources.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting its potential to cause severe availability impact on critical infrastructure. Successful exploitation could lead to unexpected system crashes or service outages, resulting in significant operational downtime and potential loss of productivity for organizations relying on Secure Access.

Remediation Plan

Immediate Action: Update all instances of Absolute Security Secure Access to version 14.55 or later immediately.

Proactive Monitoring: Monitor system resource utilization, specifically memory consumption, to detect abnormal spikes that may indicate exploitation attempts.

Compensating Controls: Ensure that network traffic to the Secure Access server is restricted to trusted IP addresses via firewall rules to limit the attack surface while the patching process is completed.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for automated scanning and denial of service attacks.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for complete service interruption, administrators must prioritize the update to version 14.55. Testing should be performed in a staging environment if necessary, but the urgency of this fix warrants an expedited deployment schedule across the production environment.

---METADATA---
VENDOR: Stirling-Tools
PRODUCT: Stirling-PDF
AFFECTED_VERSIONS: < 2.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Stirling-PDF contains a cross-site scripting vulnerability that allows attackers to execute arbitrary scripts in the context of a user session.

Executive Summary:
Stirling-PDF is vulnerable to a cross-site scripting attack, which could allow an unauthenticated attacker to compromise user sessions and perform unauthorized actions within the application.

Vulnerability Details

CVE-ID: CVE-2026-33437

Affected Software: Stirling-Tools Stirling-PDF

Affected Versions: < 2.0.0

Vulnerability: The application fails to properly neutralize input during web page generation, leading to a cross-site scripting (XSS) vulnerability. An attacker can leverage this flaw without authentication by convincing a user to interact with a malicious link or crafted input.

Business Impact

The CVSS score of 8.1 indicates a high risk to the confidentiality and integrity of the application. Exploitation could result in session hijacking, unauthorized access to sensitive PDF documents processed by the tool, or the execution of malicious actions on behalf of authenticated users.

Remediation Plan

Immediate Action: Upgrade to Stirling-PDF version 2.0.0 or later to resolve the underlying input neutralization flaw.

Proactive Monitoring: Review web application logs for suspicious script injection patterns or unusual redirection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to block malicious input vectors until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is a common web application security issue that is highly susceptible to automated scanning and exploitation if left unpatched.

Analyst Recommendation

Due to the nature of cross-site scripting and the high CVSS score, immediate patching is required to protect users. Organizations should update to version 2.0.0 immediately and encourage users to avoid clicking suspicious links while using the application.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Versions prior to 10.0.35
---END_METADATA---

Description Summary:
OneUptime versions prior to 10.0.35 allow low-privileged users to achieve remote code execution on the Probe container by escaping the Playwright sandbox via unblocked internal properties.

Executive Summary:
A critical sandbox escape in OneUptime allows authenticated, low-privileged users to execute arbitrary commands on the underlying host or container by abusing the Synthetic Monitor feature.

Vulnerability Details

CVE-ID: CVE-2026-33396

Affected Software: OneUptime

Affected Versions: Versions prior to 10.0.35

Vulnerability: The vulnerability involves an incomplete denylist in the VMRunner.runCodeInNodeVM sandbox. A low-privileged authenticated user (ProjectMember) can use a live Playwright page object to traverse to _browserType.launchServer, allowing them to spawn arbitrary processes outside the intended sandbox.

Business Impact

This vulnerability facilitates lateral movement and full container compromise from a low-privileged account. With a CVSS score of 9.9, the impact is severe, potentially leading to the theft of monitoring data, credential harvesting from the host, and disruption of observability services.

Remediation Plan

Immediate Action: Update OneUptime to version 10.0.35 or higher to apply the corrected sandbox restrictions.

Proactive Monitoring: Audit Synthetic Monitor scripts for any use of internal Playwright properties or attempts to access the browser() or context() methods in ways that deviate from standard monitoring.

Compensating Controls: Implement strict container escape protections, such as AppArmor or SELinux profiles, and ensure the Probe containers run with the least possible privileges on the host.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to execute code on the infrastructure represents a significant insider threat and lateral movement risk. Application of the 10.0.35 patch is critical to restoring the integrity of the script execution sandbox.

---METADATA---
VENDOR: Nozomi Networks
PRODUCT: Guardian and CMC
AFFECTED_VERSIONS: Nozomi Networks Guardian: 0 up to (excluding) 26.2.0; Nozomi Networks CMC: 0 up to (excluding) 26.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in the synchronization functionality allows Arc sensors to receive CLI permissions.

Executive Summary:
A high-severity privilege assignment vulnerability in Nozomi Networks Guardian and CMC products could allow unauthorized CLI access, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-33390

Affected Software: Nozomi Networks Guardian and CMC

Affected Versions: 0 up to (excluding) 26.2.0

Vulnerability: This vulnerability involves an incorrect privilege assignment within the system's synchronization mechanism. An authenticated user (via Arc sensor integration) may gain unauthorized Command Line Interface (CLI) permissions, which they should not possess.

Business Impact

The ability for non-privileged sensors to obtain CLI access represents a major security breach, potentially allowing an attacker to modify system configurations or disrupt industrial monitoring operations. With a CVSS score of 8.1, this flaw is categorized as high-severity, as it compromises the administrative control plane of critical infrastructure security appliances.

Remediation Plan

Immediate Action: Upgrade both Nozomi Networks Guardian and CMC deployments to version 26.2.0 or later immediately to resolve the privilege assignment flaw.

Proactive Monitoring: Review system access logs for any unauthorized CLI activity or unusual synchronization events originating from Arc sensors.

Compensating Controls: Restrict network access to the management interface of affected devices to only trusted administrative workstations until the update can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the affected industrial security software, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized administrative access, organizations should prioritize the deployment of version 26.2.0. Failure to patch these appliances could allow lateral movement or unauthorized control over the security monitoring environment.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana OSS
AFFECTED_VERSIONS: 11.6.0-11.6.14, 12.2.0-12.2.8, 12.3.0-12.3.6, 12.4.0-12.4.3, 13.0.0-13.0.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Several Grafana OSS API endpoints fail to limit the size of request bodies before processing, leading to potential resource exhaustion and denial-of-service.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in Grafana OSS allows attackers to trigger denial-of-service conditions by sending oversized request bodies to vulnerable API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-33382

Affected Software: Grafana OSS

Affected Versions: 11.6.0-11.6.14, 12.2.0-12.2.8, 12.3.0-12.3.6, 12.4.0-12.4.3, 13.0.0-13.0.1

Vulnerability: The vulnerability is a classic CWE-400 (Uncontrolled Resource Consumption). By sending excessively large request bodies to specific API endpoints—some of which do not require authentication—an attacker can force the server to consume excessive memory or CPU, resulting in a denial-of-service (DoS) state.

Business Impact

The impact of this vulnerability is primarily focused on availability. Successful exploitation can render the Grafana dashboard and its associated alerting or monitoring services inaccessible. With a CVSS score of 7.5, the risk to business operations is significant, particularly for organizations that rely on Grafana for real-time observability and incident response.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Grafana OSS as specified in the vendor security advisory.

Proactive Monitoring: Monitor server metrics such as memory usage, CPU load, and API response times for sudden spikes indicative of an exhaustion attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or reverse proxy to enforce request body size limits before the traffic reaches the Grafana service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, making it a prime candidate for opportunistic DoS attacks.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency, as the unauthenticated nature of the affected endpoints makes it easily exploitable from the public internet. Patching the affected Grafana instances is the most effective way to prevent resource exhaustion and ensure the continued availability of your monitoring infrastructure.

---METADATA---
VENDOR: Meari
PRODUCT: IoT SDK
AFFECTED_VERSIONS: Meari com.meari.sdk: firmID=8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Meari IoT SDK builds embedded in CloudEdge 5 contain hard-coded cryptographic keys, potentially allowing attackers to bypass encryption mechanisms.

Executive Summary:
The Meari IoT SDK contains hard-coded cryptographic keys that expose devices to unauthorized data decryption and potential compromise.

Vulnerability Details

CVE-ID: CVE-2026-33362

Affected Software: Meari IoT SDK

Affected Versions: Meari com.meari.sdk: firmID=8

Vulnerability: This vulnerability involves the use of hard-coded cryptographic keys (CWE-321), which are embedded directly within the SDK. The attack vector is network-based and requires no authentication (AV:N/AC:L/PR:N/UI:N), allowing unauthenticated remote attackers to potentially intercept and decrypt sensitive communications.

Business Impact

The use of hard-coded keys fundamentally breaks the security model of the affected IoT devices, leading to potential unauthorized data access and loss of confidentiality. With a CVSS score of 8.6, this represents a high-severity risk that could facilitate large-scale surveillance or man-in-the-middle attacks, damaging user trust and organizational security posture.

Remediation Plan

Immediate Action: Organizations using devices with the affected Meari IoT SDK must contact their hardware vendor to request firmware updates that rotate or remove these hard-coded keys.

Proactive Monitoring: Monitor network traffic for unusual patterns originating from IoT devices, specifically looking for attempts to decrypt or intercept traffic.

Compensating Controls: Implement network segmentation to isolate vulnerable IoT devices from critical internal networks, limiting the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as hard-coded secrets cannot be easily remediated without a full firmware update from the manufacturer.

Analyst Recommendation

Given the critical nature of hard-coded credentials in IoT infrastructure, this vulnerability warrants immediate attention. Security teams should prioritize identifying all devices running the vulnerable SDK version and coordinate with vendors to ensure that remediation via firmware update is applied as soon as it becomes available.

---METADATA---
VENDOR: Meari
PRODUCT: IoT SDK (libmrplayer)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Meari IoT SDK's image handling library, libmrplayer, potentially leading to memory corruption or arbitrary code execution.

Executive Summary:
The Meari IoT SDK contains a high-severity vulnerability in its image handling library, which may allow for memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33361

Affected Software: Meari IoT SDK (libmrplayer)

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists in the image processing logic of the libmrplayer library. Improper handling of malformed image data can trigger memory corruption, which may be leveraged by an attacker to execute arbitrary code.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to devices utilizing the Meari IoT SDK. Successful exploitation could lead to full device compromise, allowing attackers to intercept data, disrupt service, or integrate the device into a botnet, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Identify all products utilizing the Meari IoT SDK and apply vendor-provided security updates immediately upon release.

Proactive Monitoring: Monitor network traffic for anomalous behavior originating from IoT devices using the vulnerable SDK, particularly traffic patterns associated with unexpected shell activity.

Compensating Controls: Implement network segmentation to isolate IoT devices from critical business infrastructure, limiting the potential reach of a compromised device.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of memory corruption flaws in embedded SDKs often leads to widespread exploitation once proof-of-concept code is released.

Analyst Recommendation

Organizations should conduct an inventory of all IoT devices to determine exposure to this SDK. Once identified, maintain close communication with hardware vendors to ensure patches are applied as soon as they become available.

---METADATA---
VENDOR: Meari
PRODUCT: IoT Cloud (Alibaba OSS)
AFFECTED_VERSIONS: April 2026
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authorization vulnerability in Meari IoT Cloud storage allows unauthenticated access to motion snapshot images hosted on Alibaba OSS.

Executive Summary:
Unauthenticated access to motion snapshots in Meari IoT Cloud storage (April 2026) presents a critical privacy risk due to missing authorization controls.

Vulnerability Details

CVE-ID: CVE-2026-33359

Affected Software: Meari IoT Cloud (Alibaba OSS hosted)

Affected Versions: April 2026

Vulnerability: This vulnerability involves missing authorization (CWE-862) where motion snapshots can be retrieved by any user without authentication, signed URLs, or expiry enforcement. This is an unauthenticated vulnerability accessible via the network (AV:N).

Business Impact

The exposure of motion snapshots could lead to significant privacy violations and the unauthorized disclosure of visual data captured by IoT devices. With a CVSS score of 7.5, the vulnerability is classified as high severity due to the ease of exploitation and the direct impact on user privacy.

Remediation Plan

Immediate Action: Immediately restrict public access to the Alibaba OSS bucket associated with Meari IoT Cloud and verify that all objects require proper authentication.

Proactive Monitoring: Review access logs for Alibaba OSS to identify any unauthorized requests for motion snapshot files.

Compensating Controls: Implement strict IAM policies on the cloud storage service to enforce private access and ensure that all generated URLs are time-limited and signed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable as it requires no authentication to access the cloud-hosted resources.

Analyst Recommendation

The vendor must urgently implement authorization checks for all cloud-hosted media files. Users and administrators should treat the affected storage environment as compromised until proper access controls are verified and enforced.

---METADATA---
VENDOR: Meari
PRODUCT: Client Applications (SDK)
AFFECTED_VERSIONS: Meari com.meari.sdk: firmID=8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Meari client applications utilizing the Meari SDK are vulnerable to a missing authorization flaw, allowing unauthenticated access to sensitive device functions.

Executive Summary:
A missing authorization vulnerability in the Meari SDK allows unauthenticated attackers to access restricted device functions, posing a high risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-33357

Affected Software: Meari Client Applications (SDK)

Affected Versions: Meari com.meari.sdk: firmID=8

Vulnerability: The application fails to perform adequate authorization checks (CWE-862) within the Meari SDK, enabling unauthenticated attackers to interact with device APIs without prior validation.

Business Impact

Successful exploitation allows unauthorized entities to gain access to sensitive device information or control functions. Given the CVSS score of 7.5, this high-severity vulnerability could lead to significant privacy breaches and loss of control over connected IoT infrastructure, directly impacting operational integrity.

Remediation Plan

Immediate Action: Monitor vendor communication channels for the release of an updated SDK version; currently, no specific patch is documented.

Proactive Monitoring: Review application access logs for unusual API requests or unauthorized access attempts targeting device endpoints.

Compensating Controls: Implement strict network-level segmentation or a Web Application Firewall (WAF) to restrict access to the affected API endpoints from untrusted sources.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which lowers the barrier for automated exploitation.

Analyst Recommendation

Organizations utilizing Meari-based SDKs must treat this as a significant security risk. Until an official patch is provided, minimize exposure by restricting network access to the affected services and monitor logs for anomalous traffic patterns to detect potential exploitation attempts.

---METADATA---
VENDOR: Meari
PRODUCT: IoT Cloud MQTT Broker (EMQX)
AFFECTED_VERSIONS: Meari IoT Cloud MQTT Broker EMQX: 4.x
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Meari IoT Cloud MQTT Broker deployments using EMQX 4.x contain an authorization bypass vulnerability allowing authenticated users to access data outside their intended scope.

Executive Summary:
An authorization bypass in Meari’s EMQX 4.x MQTT broker allows authenticated users to access unauthorized device data, leading to potential information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-33356

Affected Software: Meari IoT Cloud MQTT Broker (EMQX)

Affected Versions: EMQX 4.x

Vulnerability: The broker suffers from an authorization bypass (CWE-639) where user-controlled keys are not properly validated, allowing authenticated users to subscribe to or access data streams belonging to other devices.

Business Impact

The vulnerability allows for horizontal privilege escalation, where one authenticated user can access the data of another, compromising the confidentiality of the entire IoT ecosystem. With a CVSS score of 7.7, this represents a severe risk to data privacy and could result in the leakage of sensitive telemetry or user data.

Remediation Plan

Immediate Action: Contact Meari support regarding the availability of security updates for EMQX 4.x deployments, as no fix is currently public.

Proactive Monitoring: Audit MQTT broker logs for unauthorized subscription attempts or cross-device data access patterns.

Compensating Controls: Enforce strict per-client Access Control Lists (ACLs) within the MQTT broker configuration to limit the scope of what each authenticated user can access.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's potential to bypass per-device ACLs makes it a critical concern for multi-tenant IoT environments.

Analyst Recommendation

Administrators must prioritize the review of MQTT broker configurations to ensure that ACLs are as restrictive as possible. Given the lack of a verified patch, isolating affected broker instances from public networks is the most effective way to limit exposure to this authorization bypass.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Prior to version 26.0
---END_METADATA---

Description Summary:
WWBN AVideo is vulnerable to an unauthenticated SQL injection in the getAllCategories() method due to insufficient sanitization of the doNotShowCats parameter.

Executive Summary:
A critical SQL injection vulnerability in WWBN AVideo allows unauthenticated attackers to extract sensitive data from the database by bypassing simple character filtering.

Vulnerability Details

CVE-ID: CVE-2026-33352

Affected Software: WWBN AVideo

Affected Versions: Prior to version 26.0

Vulnerability: The doNotShowCats parameter in objects/category.php is only sanitized by removing single quotes. An unauthenticated attacker can bypass this using backslash escapes to manipulate SQL query boundaries, leading to full SQL injection.

Business Impact

An attacker can exploit this flaw to read sensitive information from the database, including user credentials, configuration settings, and private video metadata. Depending on the database configuration, this could also lead to remote code execution on the database server. The CVSS score of 9.8 highlights the critical risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade WWBN AVideo to version 26.0 or later, which contains the official patch for this vulnerability.

Proactive Monitoring: Review database logs for unusual query patterns or errors involving the categories table and the doNotShowCats parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection enabled to detect and block malicious payloads containing SQL syntax.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, SQL injection remains one of the most reliable and frequently used attack vectors for data breaches.

Analyst Recommendation

Immediate upgrading to version 26.0 is the only reliable way to mitigate this risk. Ensure that all application components are regularly audited for similar bypasses of basic sanitization routines.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo (Live plugin)
AFFECTED_VERSIONS: Prior to version 26.0
---END_METADATA---

Description Summary:
WWBN AVideo is vulnerable to unauthenticated Server-Side Request Forgery (SSRF) via the webSiteRootURL parameter. Attackers can use the server to fetch internal resources.

Executive Summary:
An unauthenticated SSRF vulnerability in the WWBN AVideo Live plugin allows remote attackers to use the server as a proxy to probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-33351

Affected Software: WWBN AVideo

Affected Versions: Prior to version 26.0

Vulnerability: The plugin/Live/standAloneFiles/saveDVR.json.php file uses the webSiteRootURL parameter in a file_get_contents() call without any authentication or URL validation. This allows an unauthenticated attacker to trigger arbitrary outbound HTTP requests from the server.

Business Impact

This SSRF vulnerability poses a significant risk to internal infrastructure. Attackers can bypass firewalls to scan internal ports, access metadata services (such as AWS IMDS), or interact with internal APIs that are not exposed to the internet. The CVSS score of 9.1 reflects the high potential for lateral movement and internal data exfiltration.

Remediation Plan

Immediate Action: Update WWBN AVideo to version 26.0 or later, which includes necessary origin validation and URL allowlisting.

Proactive Monitoring: Monitor egress traffic from the AVideo server for unusual requests to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16) or cloud provider metadata endpoints.

Compensating Controls: Implement strict outbound firewall rules (Egress Filtering) to prevent the web server from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation of this vulnerability. SSRF vulnerabilities are frequently targeted by advanced attackers to gain a foothold in cloud environments.

Analyst Recommendation

Given the critical nature of SSRF in modern infrastructure, this vulnerability should be remediated immediately. Updating to version 26.0 is the only way to ensure the code properly validates request origins. Administrators should also ensure the server follows the principle of least privilege regarding network access.

---METADATA---
VENDOR: ParisNeo
PRODUCT: lollms-webui
AFFECTED_VERSIONS: All versions prior to publication
---END_METADATA---

Description Summary:
A critical Server-Side Request Forgery (SSRF) in lollms-webui allows unauthenticated attackers to force arbitrary GET requests, potentially exfiltrating sensitive cloud metadata and IAM tokens.

Executive Summary:
An unauthenticated SSRF vulnerability in lollms-webui poses a critical risk to cloud infrastructure by allowing attackers to exfiltrate sensitive IAM credentials and scan internal networks.

Vulnerability Details

CVE-ID: CVE-2026-33340

Affected Software: ParisNeo lollms-webui

Affected Versions: All known existing versions

Vulnerability: This vulnerability is a Server-Side Request Forgery (SSRF) residing in the @router.post("/api/proxy") endpoint. It allows an unauthenticated remote attacker to coerce the server into performing arbitrary GET requests against internal or external resources.

Business Impact

A successful exploit could lead to the total compromise of cloud-hosted environments through the exfiltration of AWS or GCP IAM metadata tokens. Furthermore, attackers can use the vulnerable instance as a pivot point to map and attack internal network services that are not exposed to the public internet. The CVSS score of 9.1 reflects the critical nature of this flaw and the high potential for unauthorized access to sensitive infrastructure.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately disable public access to the lollms-webui interface or implement strict IP whitelisting.

Proactive Monitoring: Review web server access logs for unusual POST requests directed at the /api/proxy endpoint and monitor outbound traffic for connections to cloud metadata services (e.g., 169.254.169.254).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to block requests containing internal IP addresses or metadata service URLs in the proxy payload.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the increasing popularity of LLM interfaces, the potential for exploitation is high.

Analyst Recommendation

The severity of this SSRF vulnerability cannot be overstated, particularly for deployments in cloud environments. Organizations should consider the software "at-risk" until a formal patch is released. Immediate network-level isolation is the only effective way to mitigate the risk of credential theft and lateral movement at this time.