---METADATA---
VENDOR: Unknown
PRODUCT: Affected Software (setinfo endpoint)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the setinfo endpoint allows attackers to execute malicious SQL UPDATE commands, resulting in total loss of integrity and availability.

Executive Summary:
A critical SQL injection vulnerability in the setinfo endpoint allows unauthenticated remote attackers to manipulate database records, leading to potential data destruction and system failure.

Vulnerability Details

CVE-ID: CVE-2026-33615

Affected Software: Unknown (setinfo endpoint software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from improper neutralization of special elements within a SQL UPDATE command at the "setinfo" endpoint. An unauthenticated remote attacker can submit crafted input to execute arbitrary SQL queries against the backend database.

Business Impact

A successful SQL injection attack can allow for the unauthorized modification or deletion of critical database records, leading to a total loss of data integrity. With a CVSS score of 9.1, this flaw could be used to disable user accounts, alter financial records, or render the entire application unavailable through database corruption.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the software vendor to implement proper input parameterization and sanitization for the setinfo endpoint.

Proactive Monitoring: Enable database activity monitoring to detect anomalous UPDATE patterns or syntax errors that indicate SQL injection attempts.

Compensating Controls: Deploy or update Web Application Firewall (WAF) signatures to detect and block common SQL injection patterns (e.g., ' OR 1=1) targeting the setinfo endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most reliable vectors for attackers to gain initial access or cause widespread data loss.

Analyst Recommendation

Due to the unauthenticated nature of this flaw and its high severity, it is imperative to apply the vendor's remediation immediately. Organizations should also conduct a broader review of their application code to ensure that all database interactions utilize prepared statements to prevent similar vulnerabilities.

---METADATA---
VENDOR: Tranquil IT Systems
PRODUCT: WAPT Server
AFFECTED_VERSIONS: 2.6.0.16767 through 2.6.1.17787
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass vulnerability in WAPT Server allows remote, unauthenticated attackers to forge session tokens via specially crafted packets.

Executive Summary:
A critical authentication bypass vulnerability in Tranquil IT Systems WAPT Server allows unauthenticated attackers to gain full system access, posing a severe risk to organizational infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-33591

Affected Software: Tranquil IT Systems WAPT Server

Affected Versions: 2.6.0.16767 through 2.6.1.17787

Vulnerability: The software suffers from an authentication bypass (CWE-288) that enables unauthenticated remote attackers to retrieve valid session tokens for any account. This flaw occurs due to improper security restrictions during packet processing.

Business Impact

Successful exploitation of this vulnerability allows an attacker to impersonate any user, including administrative accounts, leading to complete compromise of the WAPT Server environment. Given the CVSS score of 10.0, this represents the highest level of risk, potentially allowing attackers to deploy arbitrary software across the managed fleet, exfiltrate sensitive data, or disrupt business operations entirely.

Remediation Plan

Immediate Action: Upgrade all instances of WAPT Server to version 2.6.1.17813 or later immediately to resolve the authentication flaw.

Proactive Monitoring: Review authentication and session management logs for unusual login patterns or multiple successful logins originating from unexpected IP addresses.

Compensating Controls: Implement strict network segmentation to restrict access to the WAPT Server management interface to known, trusted management segments only until patching is completed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated, and automatable nature.

Analyst Recommendation

The severity of this vulnerability cannot be overstated. Administrators must prioritize the deployment of the vendor-provided patch to version 2.6.1.17813 immediately. Failure to address this flaw leaves the entire managed infrastructure susceptible to total takeover by external actors.

---METADATA---
VENDOR: 10Web
PRODUCT: Form Maker
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Form Maker by 10Web WordPress plugin contains an SQL injection vulnerability in the 'inputs' parameter, enabling potential unauthorized database interaction.

Executive Summary:
An SQL injection flaw in the 10Web Form Maker plugin for WordPress allows attackers to potentially compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-3359

Affected Software: 10Web Form Maker

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability manifests as an SQL injection within the 'inputs' parameter. This allows an attacker to manipulate backend database queries, potentially leading to unauthorized data retrieval or modification.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high-risk entry point for attackers to bypass application logic. Successful exploitation can result in full database exposure, leading to severe reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: Apply the latest security update for the Form Maker plugin provided by 10Web immediately.

Proactive Monitoring: Monitor database query logs for unusual activity or signs of unauthorized data access originating from the Form Maker plugin components.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing suspicious SQL injection patterns directed at the 'inputs' parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Urgent patching is required to secure the environment against this SQL injection vector. Administrators must verify that they are running the most recent version of the plugin and audit site logs for any evidence of prior exploitation attempts.

---METADATA---
VENDOR: Open Notebook
PRODUCT: Open Notebook
AFFECTED_VERSIONS: v1.8.3
---END_METADATA---

Description Summary:
A Server-Side Template Injection (SSTI) vulnerability in Open Notebook v1.8.3 allows authenticated users to execute arbitrary Python code and OS commands within the Docker container.

Executive Summary:
A critical Server-Side Template Injection vulnerability in Open Notebook allows attackers to achieve arbitrary code execution within the container environment.

Vulnerability Details

CVE-ID: CVE-2026-33587

Affected Software: Open Notebook

Affected Versions: v1.8.3

Vulnerability: The application fails to sanitize user-provided input during transformations, resulting in SSTI. An authenticated user can leverage this flaw to execute arbitrary Python code, leading to full OS command execution on the host Docker container.

Business Impact

The ability to execute arbitrary commands at the container level poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 10.0, this vulnerability represents the highest level of risk, potentially allowing an attacker to pivot into the internal network, steal sensitive data, or compromise the integrity of the application environment.

Remediation Plan

Immediate Action: Update Open Notebook to the latest available version provided by the vendor to remediate the input sanitization flaw.

Proactive Monitoring: Review application logs for suspicious transformation requests and monitor for anomalous process spawning within the container.

Compensating Controls: Implement strict network segmentation for the Docker container and utilize security tools to restrict execution permissions for the application user.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS 10.0 severity, this vulnerability must be treated as a top priority. Organizations using Open Notebook v1.8.3 should apply the necessary patches immediately to prevent unauthorized code execution and mitigate the risk of a full container compromise.

---METADATA---
VENDOR: Arqit
PRODUCT: Symmetric Key Agreement Platform
AFFECTED_VERSIONS: 0 up to (excluding) 26.03
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Arqit Symmetric Key Agreement Platform is vulnerable to an unauthenticated, unencrypted HTTP GET request, leading to the exposure of QKEY and internal system keys.

Executive Summary:
An unauthenticated information disclosure vulnerability in the Arqit Symmetric Key Agreement Platform exposes critical system and quantum keys.

Vulnerability Details

CVE-ID: CVE-2026-33583

Affected Software: Arqit Symmetric Key Agreement Platform

Affected Versions: 0 up to (excluding) 26.03

Vulnerability: This is an exposure of sensitive keys via an unauthenticated and unencrypted HTTP GET method (CWE-749). The attacker requires no authentication to access these keys, which are used in the 'OTA-Quantum' device registration process.

Business Impact

Successful exploitation results in the total compromise of confidentiality for QKEYs and internal system keys (CVSS 8.7). This could lead to a total breakdown of the platform's security architecture, allowing attackers to intercept or forge encrypted communications, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Arqit Symmetric Key Agreement Platform to version 26.03 or higher immediately.

Proactive Monitoring: Review access logs for unauthorized HTTP GET requests directed at the device registration or key exchange endpoints.

Compensating Controls: Restrict network access to the platform endpoints using IP allowlisting and ensure all traffic is forced over encrypted channels (TLS).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature makes it extremely dangerous as it exposes the core cryptographic material of the system.

Analyst Recommendation

This is a critical security failure. Administrators must treat this as a high-priority incident and apply the vendor-provided updates immediately, as the exposure of root-level keys compromises the entire integrity of the affected platform.

---METADATA---
VENDOR: Apache
PRODUCT: Kafka
AFFECTED_VERSIONS: 4.1.0, 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A JWT validation flaw in Apache Kafka's OAuth bearer authentication allows unauthenticated attackers to impersonate any user by providing forged tokens.

Executive Summary:
Apache Kafka versions 4.1.0 and 4.1.1 are vulnerable to an authentication bypass that permits unauthorized users to gain full access to the broker.

Vulnerability Details

CVE-ID: CVE-2026-33557

Affected Software: Apache Kafka

Affected Versions: 4.1.0, 4.1.1

Vulnerability: The default JWT validator fails to perform cryptographic signature, issuer, or audience verification. This allows an unauthenticated attacker to supply a crafted JWT with arbitrary claims to successfully authenticate as any user.

Business Impact

The exploitation of this vulnerability poses a critical risk to data integrity and confidentiality. With a CVSS score of 9.1, this flaw allows an attacker to masquerade as privileged users, potentially leading to unauthorized data exfiltration, service disruption, or administrative control over the Kafka cluster.

Remediation Plan

Immediate Action: Upgrade to Apache Kafka version 4.1.2 or 4.2.0 or later. If an immediate upgrade is not feasible, explicitly set the sasl.oauthbearer.jwt.validator.class configuration to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.

Proactive Monitoring: Monitor authentication logs for suspicious patterns or unauthorized user sessions that do not align with expected identity provider signatures.

Compensating Controls: Implement strict network-level access controls to limit communication with the Kafka broker to known, trusted IP addresses while the patch is being applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this authentication bypass, organizations must prioritize patching or configuration changes immediately. Failure to address this vulnerability allows trivial impersonation of legitimate users, effectively nullifying the security posture of the Kafka infrastructure.

---METADATA---
VENDOR: Google
PRODUCT: Tinyauth
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Tinyauth, an authentication and authorization server, contains a high-severity vulnerability that may compromise identity management.

Executive Summary:
A high-severity vulnerability in the Google Tinyauth authentication server could allow attackers to compromise authorization protocols and gain unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2026-33544

Affected Software: Google Tinyauth

Affected Versions: See vendor advisory for affected versions

Vulnerability: Tinyauth is an authentication and authorization server; this vulnerability likely involves a failure in how it processes identity tokens or handles authorization logic. While the specific mechanism is not fully detailed, the CVSS score indicates a significant risk of unauthorized access.

Business Impact

As an identity management component, a flaw in Tinyauth impacts the security of every application relying on it for access control. A successful exploit could lead to unauthorized privilege escalation and lateral movement across the network. The CVSS score of 7.7 reflects a high risk to the integrity and confidentiality of the entire authentication ecosystem.

Remediation Plan

Immediate Action: Apply the latest security updates from the vendor immediately to ensure the integrity of the authentication server.

Proactive Monitoring: Monitor authentication logs for anomalous login patterns, credential stuffing attempts, or unauthorized token generation.

Compensating Controls: Ensure that multi-factor authentication (MFA) is strictly enforced for all users to provide a secondary layer of security against compromised credentials.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this affects a core security component, it remains an attractive target for sophisticated actors.

Analyst Recommendation

Securing identity infrastructure is paramount to maintaining a robust security posture. Organizations utilizing Tinyauth should apply vendor updates without delay to mitigate the risk of unauthorized access. Continuous monitoring of authorization events is highly recommended to detect any early signs of attempted exploitation.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: 0.7.2 and prior
---END_METADATA---

Description Summary:
A flawed administrator existence check in the FOSSBilling guest API allows unauthenticated attackers to create new administrator accounts, leading to full system compromise.

Executive Summary:
An unauthenticated administrative account creation vulnerability in FOSSBilling enables attackers to gain full system control, posing a critical risk to organizational data and operations.

Vulnerability Details

CVE-ID: CVE-2026-33543

Affected Software: FOSSBilling FOSSBilling

Affected Versions: 0.7.2 and prior

Vulnerability: This vulnerability occurs due to an improper type check in the /api/guest/staff/create endpoint, which fails to correctly verify if an administrator account already exists. This allows an unauthenticated attacker to inject a new, fully privileged administrative user into the system.

Business Impact

Successful exploitation results in total compromise of the billing and client management system. Given the CVSS score of 9.3, this flaw presents an unacceptable risk of unauthorized data exfiltration, service manipulation, and complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later immediately to resolve the logic error in the guest API endpoint.

Proactive Monitoring: Review system logs for unauthorized account creation events and monitor the administrative user list for accounts not provisioned by authorized staff.

Compensating Controls: Restrict access to the API directory at the web server or WAF level to prevent public access to the /api/guest/ path until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to full administrative access. Organizations utilizing FOSSBilling must prioritize this update as a critical maintenance task to prevent unauthorized system takeover.

---METADATA---
VENDOR: Zserio
PRODUCT: Zserio
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Zserio, a framework for serializing structured data, is affected by a high-severity vulnerability that could impact system data integrity and security.

Executive Summary:
A high-severity vulnerability in the Zserio serialization framework may allow attackers to compromise the integrity of structured data processing.

Vulnerability Details

CVE-ID: CVE-2026-33524

Affected Software: Zserio

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Zserio framework used for data serialization. With a CVSS score of 7.5, the flaw likely relates to improper handling of serialized data streams, which could be exploited to cause memory corruption, denial of service, or potentially arbitrary code execution when processing malicious data packets.

Business Impact

A CVSS score of 7.5 indicates a high risk to applications that rely on Zserio for efficient data communication. Exploitation could lead to unauthorized data manipulation or service disruption, which is particularly concerning in systems where Zserio is used for high-performance data exchange.

Remediation Plan

Immediate Action: Update the Zserio framework to the latest version provided by the project maintainers.

Proactive Monitoring: Review logs for errors occurring during the serialization or deserialization process, which could indicate malformed data or exploitation attempts.

Compensating Controls: Implement input validation for all structured data before it is passed to the Zserio deserialization layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Applications using Zserio should be updated immediately to mitigate this serialization vulnerability. Ensuring the integrity of data processing pipelines is essential to preventing downstream security impacts.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.4, 11.5, 12.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 fails to correctly validate permissions assigned to developer credentials.

Executive Summary:
An authorization flaw in Esri Portal for ArcGIS allows unauthorized access due to improper permission validation for developer credentials, creating a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33519

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.4, 11.5, 12.0

Vulnerability: The application suffers from incorrect authorization, specifically failing to properly verify the permissions associated with developer-level credentials, which can be leveraged to gain unauthorized access.

Business Impact

With a CVSS score of 9.8, this flaw represents a severe risk to organizational data integrity and confidentiality. Successful exploitation could allow attackers to bypass intended access controls, potentially accessing sensitive geospatial data and administrative functions within the ArcGIS environment.

Remediation Plan

Immediate Action: Update the Esri Portal for ArcGIS installation to the latest available version provided by the vendor.

Proactive Monitoring: Audit existing user and developer accounts for unusual activity and review access logs for attempts to access resources outside of assigned permission scopes.

Compensating Controls: Implement the principle of least privilege by auditing and restricting developer credentials until the patch is successfully applied.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to patching the affected ArcGIS Portal instances. Organizations must verify their current versioning and apply the necessary updates to ensure that developer credential permissions are correctly enforced and to prevent unauthorized access to the platform.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Esri Portal for ArcGIS 11.5 contains an incorrect privilege assignment vulnerability allowing highly privileged users to escalate developer credentials beyond intended limits.

Executive Summary:
A critical privilege assignment vulnerability in Esri Portal for ArcGIS 11.5 allows authorized users to escalate their permissions, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-33518

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.5

Vulnerability: This is an incorrect privilege assignment vulnerability where highly privileged users can create developer credentials that grant excessive access rights, exceeding their authorized scope.

Business Impact

The ability for privileged users to grant themselves unauthorized elevated permissions creates a substantial risk of data compromise and unauthorized administrative control. With a CVSS score of 9.8, this flaw represents a critical threat to the security posture of the organization, potentially leading to unauthorized access to sensitive geospatial data and infrastructure management.

Remediation Plan

Immediate Action: Consult the official Esri security advisory for the latest security patches or configuration hardening steps to restrict developer credential creation.

Proactive Monitoring: Review access logs for the creation of new developer credentials and audit the privilege levels assigned to existing administrative accounts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and limit the number of users with administrative or developer-level permissions within the Portal.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this privilege assignment issue, administrators should prioritize auditing current portal accounts and applying vendor-supplied updates immediately. Limiting the scope of highly privileged accounts is essential to preventing potential abuse of this vulnerability.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo's Live plugin allows attackers to probe internal networks and cloud metadata endpoints.

Executive Summary:
WWBN AVideo is vulnerable to a critical SSRF flaw that allows unauthenticated attackers to scan internal infrastructure and potentially steal cloud service credentials.

Vulnerability Details

CVE-ID: CVE-2026-33502

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: The vulnerability exists in plugin/Live/test.php. It allows an unauthenticated remote user to force the server to send HTTP requests to arbitrary URLs, including localhost and internal network resources that are not publicly accessible.

Business Impact

Attackers can use this SSRF to bypass firewall restrictions and access internal services, such as databases or configuration management tools. In cloud environments, this can be used to query the Instance Metadata Service (IMDS) to steal temporary security tokens, leading to a full cloud account compromise. The CVSS score of 9.3 reflects this high potential for lateral movement.

Remediation Plan

Immediate Action: Apply the patch in commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 or update to the latest version.

Proactive Monitoring: Monitor outbound network traffic from the AVideo server for requests to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).

Compensating Controls: Implement egress filtering at the network level to prevent the web server from initiating connections to sensitive internal ports or metadata services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, no active exploitation has been reported. SSRF is a common vector for initial access in cloud-native environments and should be addressed with high urgency.

Analyst Recommendation

Applying the vendor patch is the most effective solution. Organizations running AVideo in AWS, Azure, or GCP should be especially vigilant and ensure that IMDSv2 (or equivalent) is enforced to mitigate the impact of SSRF.

---METADATA---
VENDOR: ORY
PRODUCT: Oathkeeper
AFFECTED_VERSIONS: Versions prior to 26.2.0
---END_METADATA---

Description Summary:
ORY Oathkeeper versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal where raw paths are matched against permissive rules before normalization.

Executive Summary:
ORY Oathkeeper is subject to a critical authorization bypass that allows unauthenticated attackers to access protected administrative endpoints by utilizing path traversal sequences in HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-33494

Affected Software: ORY Oathkeeper

Affected Versions: Versions prior to 26.2.0

Vulnerability: The vulnerability exists in the rule evaluation engine, which uses un-normalized HTTP paths to match access rules. An unauthenticated attacker can craft a URL containing traversal sequences (e.g., /public/../admin) that bypasses restrictive rules but resolves to protected paths after server-side normalization.

Business Impact

This flaw effectively nullifies the security posture of the Identity & Access Proxy, allowing unauthorized access to sensitive internal APIs and administrative secrets. Given the CVSS score of 10.0, the risk is maximum, as it enables complete bypass of the primary security gatekeeper for protected infrastructure.

Remediation Plan

Immediate Action: Upgrade ORY Oathkeeper to version 26.2.0 or later immediately to ensure that path normalization occurs prior to access rule evaluation.

Proactive Monitoring: Review access logs for requests containing dot-dot-slash (../) sequences targeted at known public or permissive endpoints.

Compensating Controls: Ensure that downstream services perform their own secondary authorization checks and utilize a WAF to block requests containing URL-encoded path traversal characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

As an Identity and Access Proxy, the failure of Oathkeeper to correctly normalize paths is a fundamental security failure. Organizations must prioritize this update to prevent unauthorized actors from reaching internal resources that rely on the proxy for protection.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
WWBN AVideo contains a vulnerability chain allowing unauthenticated remote code execution via exposed clone secrets, database dumps, and OS command injection.

Executive Summary:
The WWBN AVideo platform is subject to a critical vulnerability chain that allows unauthenticated attackers to achieve full remote code execution and system takeover.

Vulnerability Details

CVE-ID: CVE-2026-33478

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: This is a multi-step exploit chain. First, clones.json.php leaks secret keys. These keys allow unauthenticated database dumps via cloneServer.json.php. Attackers can then crack MD5 hashes to gain admin access and finally exploit an OS command injection in the rsync command construction.

Business Impact

This vulnerability represents the highest possible risk (CVSS 10.0). An attacker can gain total control over the video platform, access all private content, steal user credentials, and execute arbitrary commands on the underlying host. The ability to dump the entire database unauthenticated makes this an extremely dangerous flaw for data privacy.

Remediation Plan

Immediate Action: Apply the patch provided in commit c85d076375fab095a14170df7ddb27058134d38c or update to the latest version of AVideo.

Proactive Monitoring: Check for unauthorized access to .json.php files in the CloneSite plugin directory and monitor for unusual rsync processes on the server.

Compensating Controls: Disable the CloneSite plugin if it is not strictly required for business operations and restrict access to the administration interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, the complexity of the chain does not lower the risk, as the individual steps are straightforward to automate.

Analyst Recommendation

Given the CVSS 10.0 rating, this is a "patch now" priority. Administrators must update the software immediately and should consider rotating all administrative passwords and secret keys, as they may have been compromised.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

Executive Summary:
A vulnerability in the SiYuan system allows for potential unauthorized access to sensitive knowledge bases, necessitating an immediate security update.

Vulnerability Details

CVE-ID: CVE-2026-33476

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan application, a tool used for private data management. Given the high CVSS severity, the flaw likely permits an attacker to bypass security controls or execute unauthorized commands within the application environment.

Business Impact

A successful exploit could allow an attacker to read, modify, or delete sensitive notes and documents stored within the SiYuan system. For organizations using SiYuan for internal documentation, this could result in the leak of proprietary research or strategic plans. The 7.5 CVSS score indicates that the risk to data confidentiality and availability is substantial.

Remediation Plan

Immediate Action: Immediately update SiYuan to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Monitor system resource usage and file integrity within the SiYuan directory to detect potential unauthorized modifications.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall (WAF) to filter suspicious traffic targeting the knowledge management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of personal knowledge management tools makes them attractive targets for targeted information-gathering attacks.

Analyst Recommendation

Immediate patching is the primary and most effective defense against this vulnerability. Users should not delay in applying updates, as the high severity score suggests that the flaw could be easily leveraged if technical details become public. Ensure that all backups of the knowledge base are encrypted and stored securely during the update process.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: Prior to version 1.9.0
---END_METADATA---

Description Summary:
Unauthenticated remote shell injection in Langflow's GitHub Actions workflows allows attackers to execute arbitrary commands and exfiltrate CI secrets via malicious branch names.

Executive Summary:
Langflow is vulnerable to unauthenticated remote shell injection in its CI/CD pipelines, allowing attackers to steal sensitive secrets and compromise the software supply chain.

Vulnerability Details

CVE-ID: CVE-2026-33475

Affected Software: Langflow

Affected Versions: Prior to version 1.9.0

Vulnerability: This is a shell injection vulnerability in GitHub Actions workflows. It occurs because unsanitized GitHub context variables (like github.head_ref) are directly interpolated into run: shell commands, allowing an unauthenticated attacker to execute commands by submitting a pull request with a malicious branch name.

Business Impact

An attacker can exfiltrate sensitive CI secrets, such as GITHUB_TOKEN, and potentially push malicious code or images to production repositories. This could lead to a massive supply chain compromise affecting all users of the Langflow product. The CVSS score of 9.1 reflects the critical risk to the integrity of the development lifecycle.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.0 or later, which refactors workflows to use environment variables instead of direct interpolation.

Proactive Monitoring: Audit GitHub Actions logs for suspicious activity, such as unusual curl commands or unauthorized access to secrets in workflows triggered by external forks.

Compensating Controls: Restrict GitHub Actions permissions and require manual approval for all workflows triggered by pull requests from external contributors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 24, 2026, a proof-of-concept (PoC) is publicly available demonstrating how to exfiltrate secrets via a malicious branch name. Active exploitation is highly likely given the public nature of the PoC.

Analyst Recommendation

This is a critical supply chain vulnerability. We strongly recommend that all organizations using Langflow immediately update to version 1.9.0 and rotate any secrets that may have been exposed in their CI/CD environments.

---METADATA---
VENDOR: Nimiq
PRODUCT: nimiq-block
AFFECTED_VERSIONS: Prior to 1.3.0
---END_METADATA---

Description Summary:
A logic error in the Nimiq block proof verification process allows attackers to bypass quorum requirements using manipulated BLS signatures.

Executive Summary:
A critical verification flaw in the Nimiq block implementation allows malicious actors to bypass security protocols through signature index collisions.

Vulnerability Details

CVE-ID: CVE-2026-33471

Affected Software: Nimiq Block

Affected Versions: Prior to 1.3.0

Vulnerability: The vulnerability exists in SkipBlockProof::verify, where improper index casting allows multiple out-of-range indices to collide into the same in-range slot, enabling signature multiplication.

Business Impact

This flaw undermines the consensus mechanism of the Nimiq implementation. An attacker could potentially validate fraudulent blocks, leading to double-spending or network instability. The CVSS score of 9.6 highlights the extreme risk to the integrity of the blockchain-based system.

Remediation Plan

Immediate Action: Update to Nimiq block version 1.3.0 or later immediately.

Proactive Monitoring: Monitor consensus logs for any anomalous block verification failures or irregularities in validator signature aggregation.

Compensating Controls: No effective workarounds exist; immediate application of the vendor-provided patch is required to maintain network security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All operators running Nimiq infrastructure must update to version 1.3.0 without delay. The integrity of the consensus mechanism is at stake, and no alternative mitigations can compensate for the underlying logic vulnerability.