---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler allows attackers to execute arbitrary code via the wscDisabled argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7202

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection vulnerability within the setWiFiWpsStart function of the /cgi-bin/cstecgi.cgi handler. The vulnerability permits an unauthenticated remote attacker to inject malicious system commands by manipulating the wscDisabled argument.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows for complete unauthorized control over the networking device. Successful exploitation could lead to total loss of device integrity, interception of network traffic, and a pivot point for further lateral movement within the corporate or home network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink immediately to patch the affected CGI handler.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous command execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to block malicious requests targeting the /cgi-bin/cstecgi.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, public exploit code for this vulnerability is available and active exploitation is possible. Immediate patching is mandatory to prevent compromise.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public exploits, organizations must prioritize patching the affected Totolink hardware. If an update is not immediately feasible, restrict management interface access to trusted administrative networks only.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authorization bypass vulnerability via user-controlled keys in web services affects Progress Sitefinity 15.

Executive Summary:
Progress Sitefinity 15 is vulnerable to an authorization bypass flaw that allows attackers to manipulate user-controlled keys to gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-7201

Affected Software: Progress Sitefinity

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: This vulnerability (CWE-639) occurs in the web services layer, where the application fails to properly validate the relationship between a user's session and the requested resource key, allowing for unauthorized access.

Business Impact

The CVSS score of 8.8 highlights the high severity of this flaw. An attacker could potentially access or modify data they are not authorized to view, leading to a loss of confidentiality and integrity within the Sitefinity platform.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Progress for Sitefinity 15 to remediate the authorization logic error.

Proactive Monitoring: Review application logs for unauthorized attempts to access resources using altered or manipulated identifiers.

Compensating Controls: Implement robust session management and ensure that all API endpoints enforce strict authorization checks independent of client-provided keys.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization bypass vulnerabilities are critical as they often lead to direct data exposure. It is imperative that administrators apply the relevant security updates for Sitefinity 15 immediately to prevent potential exploitation.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: 15.4.8623 before 15.4.8630
---END_METADATA---

Description Summary:
Improper access control in Progress Sitefinity web services allows unauthenticated attackers to access restricted content and fully compromise the installation.

Executive Summary:
A critical access control vulnerability in Progress Sitefinity allows unauthenticated attackers to gain full control over the confidentiality, integrity, and availability of the system.

Vulnerability Details

CVE-ID: CVE-2026-7198

Affected Software: Progress Sitefinity

Affected Versions: 15.4.8623 before 15.4.8630

Vulnerability: This is an improper access control vulnerability within the web services layer, permitting an unauthenticated attacker to bypass authorization checks and access sensitive, restricted content.

Business Impact

This flaw allows for a total compromise of the affected Sitefinity installation, which can lead to data breaches, unauthorized modification of web content, and complete loss of system availability. With a CVSS score of 9.8, this represents an extreme risk to any organization relying on Sitefinity for external-facing web presence.

Remediation Plan

Immediate Action: Update Sitefinity to version 15.4.8630 or later to remediate the access control bypass.

Proactive Monitoring: Monitor web access logs for unauthorized attempts to access restricted directories or administrative endpoints.

Compensating Controls: Temporarily restrict access to web services via IP whitelisting or WAF rules if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update. Organizations should verify their current version against the affected range and apply the 15.4.8630 patch as a matter of urgency.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Improper input validation in web services within Progress Sitefinity 14 may lead to security vulnerabilities.

Executive Summary:
Progress Sitefinity 14 is susceptible to an improper input validation vulnerability within its web services, posing a risk of unauthorized interaction.

Vulnerability Details

CVE-ID: CVE-2026-7195

Affected Software: Progress Sitefinity

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability stems from improper input validation (CWE-20) in the web services layer. An attacker may be able to provide specially crafted inputs to these services to bypass expected processing logic.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant security risk. Successful exploitation could lead to unauthorized data manipulation or service disruption, potentially compromising the integrity of the Sitefinity content management system and the data it hosts.

Remediation Plan

Immediate Action: Update to the latest version of Progress Sitefinity as specified by the vendor’s security advisory to ensure the input validation flaws are corrected.

Proactive Monitoring: Monitor web service traffic for anomalous input payloads that deviate from expected API call structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common input validation attack patterns.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize patching Progress Sitefinity instances. Given the high CVSS score, immediate application of vendor-supplied security updates is strongly recommended to protect against potential exploitation of the web services.

---METADATA---
VENDOR: Proliz Software
PRODUCT: Proliz's OBS
AFFECTED_VERSIONS: 0 up to (excluding) v3.6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Proliz's OBS contains a vulnerability that leads to the unauthorized insertion of sensitive information into outgoing data streams.

Executive Summary:
An unauthenticated information disclosure vulnerability in Proliz's OBS poses a high risk of sensitive data exposure to unauthorized parties.

Vulnerability Details

CVE-ID: CVE-2026-7189

Affected Software: Proliz Software Proliz's OBS

Affected Versions: 0 up to (excluding) v3.6.0

Vulnerability: This is an insertion of sensitive information into sent data vulnerability (CWE-201), which allows an unauthenticated, remote attacker to potentially access sensitive information transmitted by the software.

Business Impact

The exploitation of this flaw could lead to the unauthorized disclosure of proprietary or sensitive business information, potentially resulting in regulatory non-compliance or loss of competitive advantage. With a CVSS score of 7.5, the vulnerability is considered high severity due to the ease of remote access and the potential impact on data confidentiality.

Remediation Plan

Immediate Action: Upgrade Proliz's OBS to version 3.6.0 or higher immediately to address the underlying information leakage.

Proactive Monitoring: Review outbound network traffic and application logs for unusual data patterns or unexpected external communication requests.

Compensating Controls: Implement network-level egress filtering to restrict unauthorized data transmission to untrusted destinations until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, which increases the likelihood of opportunistic scanning by threat actors.

Analyst Recommendation

Given the high CVSS score and the nature of the data exposure, organizations using Proliz's OBS should prioritize the transition to version 3.6.0. Prompt patching is essential to prevent unauthorized access to sensitive data transmitted by the application.

---METADATA---
VENDOR: Universal Software
PRODUCT: UKBS
AFFECTED_VERSIONS: Universal Software Inc. UKBS: 0 through 28072026
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authentication flaw exists in Universal Software UKBS, allowing unauthenticated attackers to perform unauthorized actions on critical functions via adjacent network access.

Executive Summary:
A missing authentication vulnerability in Universal Software UKBS presents a high risk of unauthorized system control and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-7187

Affected Software: Universal Software UKBS

Affected Versions: Universal Software Inc. UKBS: 0 through 28072026

Vulnerability: This vulnerability involves a failure to perform adequate authentication checks for sensitive functions. An unauthenticated attacker positioned on the adjacent network can exploit this to perform unauthorized administrative or operational tasks.

Business Impact

Successful exploitation of this flaw can result in full unauthorized access to system functionality, potentially leading to data exfiltration, service disruption, or total administrative compromise. Given the CVSS score of 8.8, this represents a significant risk to the availability and integrity of the affected infrastructure.

Remediation Plan

Immediate Action: Restrict access to the UKBS interface to trusted network segments only and await further guidance from Universal Software regarding the availability of a security patch.

Proactive Monitoring: Review system and access logs for unusual traffic patterns or unauthorized requests originating from the local network segment.

Compensating Controls: Deploy network-level access control lists (ACLs) to limit exposure of the UKBS service to authorized internal hosts only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is high due to the lack of authentication requirements for critical functions.

Analyst Recommendation

Organizations utilizing UKBS should prioritize restricting network access to the application as a primary defense. Given the severity of the flaw, monitor for vendor updates closely and apply the necessary patches immediately upon release to remediate the authentication bypass.

---METADATA---
VENDOR: Ruby
PRODUCT: JSON
AFFECTED_VERSIONS: >= 2.20.0, < 2.21.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Ruby JSON library, potentially allowing for memory corruption or arbitrary code execution by unauthenticated attackers.

Executive Summary:
A high-severity memory corruption vulnerability in the Ruby JSON library poses a risk of unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-71847

Affected Software: Ruby JSON

Affected Versions: >= 2.20.0, < 2.21.2

Vulnerability: The vulnerability is a CWE-416 (Use After Free) error. It allows an unauthenticated remote attacker to trigger memory corruption, which can lead to application crashes or potentially the execution of arbitrary code within the context of the Ruby application.

Business Impact

This vulnerability is highly dangerous due to the potential for memory corruption. With a CVSS score of 8.7, successful exploitation could result in full system compromise, data theft, or severe service outages. The widespread use of the JSON library in Ruby applications increases the risk profile significantly.

Remediation Plan

Immediate Action: Update the Ruby JSON gem to version 2.21.2 or later immediately.

Proactive Monitoring: Utilize memory debugging tools and monitor application logs for segmentation faults or unusual process terminations.

Compensating Controls: Ensure that applications are running with the principle of least privilege to minimize the impact if the application process is compromised.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Memory corruption flaws are complex to exploit, but they often provide a path for remote code execution.

Analyst Recommendation

Given the availability of a proof-of-concept and the nature of the vulnerability, organizations should treat this as a high-priority update. Update the Ruby JSON dependency to version 2.21.2 across all production environments immediately to eliminate the risk of memory corruption.

---METADATA---
VENDOR: Gaudire
PRODUCT: Assassin game
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Gaudire Assassin game API and local database improperly protect sensitive information, leading to the unauthorized exposure of email addresses, phone numbers, and data regarding minors.

Executive Summary:
An unauthenticated remote vulnerability in the Gaudire Assassin game exposes sensitive user information, including personal data of minors and municipal users.

Vulnerability Details

CVE-ID: CVE-2026-7166

Affected Software: Gaudire Assassin game

Affected Versions: See vendor advisory

Vulnerability: The application fails to implement adequate access controls on its API and local database, allowing unauthenticated remote attackers to retrieve sensitive user data including email addresses and phone numbers.

Business Impact

The exposure of sensitive personal information, particularly involving minors and municipal users, creates a severe privacy and compliance risk. With a CVSS score of 9.2, this vulnerability could lead to large-scale data harvesting, resulting in reputational damage, significant legal liabilities, and potential regulatory fines related to data protection mandates.

Remediation Plan

Immediate Action: Update the Gaudire Assassin game to the latest patched version to implement proper authentication and authorization controls on the API and database.

Proactive Monitoring: Monitor API endpoints for unusual traffic patterns or unauthorized data access attempts by unauthenticated sources.

Compensating Controls: Ensure that sensitive database fields are encrypted at rest and that API access is restricted to authorized clients via robust authentication mechanisms.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of access to PII makes this an attractive target for threat actors.

Analyst Recommendation

This vulnerability represents a critical data privacy failure. Administrators must apply the vendor patch immediately and perform a post-remediation audit to ensure that no unauthorized exfiltration of the database has occurred.

---METADATA---
VENDOR: Gaudire
PRODUCT: Assassin game
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Gaudire Assassin game contains multiple vulnerabilities in the ‘/addJugador’ endpoint, including insecure parameter handling, improper input validation, and unauthorized privilege escalation.

Executive Summary:
A critical set of vulnerabilities in the Gaudire Assassin game allows authenticated attackers to escalate privileges, manipulate game data, and perform server-side request forgery (SSRF).

Vulnerability Details

CVE-ID: CVE-2026-7165

Affected Software: Gaudire Assassin game

Affected Versions: See vendor advisory

Vulnerability: The application fails to validate user input and perform authorization checks on the ‘/addJugador’ endpoint, allowing authenticated attackers to modify user profiles, falsify scores, self-assign administrative privileges, and conduct SSRF attacks.

Business Impact

The exploitation of these vulnerabilities poses a significant risk to the integrity and availability of the application. An attacker can manipulate game outcomes to obtain unauthorized prizes, perform privilege escalation to gain full administrative control, and leverage SSRF to access internal network services and sensitive data. With a CVSS score of 9.4, these flaws represent a critical risk of data breach and service disruption.

Remediation Plan

Immediate Action: Apply the latest security update provided by Gaudire immediately to patch the ‘/addJugador’ endpoint.

Proactive Monitoring: Review application logs for anomalous requests to the ‘/addJugador’ endpoint, particularly those involving unexpected ‘tokens’ or unusual URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block malicious payloads targeting the identified parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the breadth of the flaws and the potential for full administrative takeover, the risk of exploitation is extremely high.

Analyst Recommendation

Given the critical severity of these flaws, immediate patching is required. Organizations should prioritize updating the Gaudire Assassin game and conduct a thorough audit of user accounts to ensure no unauthorized administrative accounts were created while the vulnerability was active.

---METADATA---
VENDOR: WinFsp
PRODUCT: WinFsp
AFFECTED_VERSIONS: 2.2.26112 and lower
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in WinFsp involving an integer overflow may allow a local attacker to achieve system-level access.

Executive Summary:
A high-severity integer overflow vulnerability in WinFsp 2.2.26112 and lower could allow a local attacker to escalate privileges to the system level.

Vulnerability Details

CVE-ID: CVE-2026-7162

Affected Software: WinFsp WinFsp

Affected Versions: 2.2.26112 and lower

Vulnerability: This is an integer overflow vulnerability (CWE-190) that occurs within the software, allowing a local attacker with low privileges to potentially trigger system-level code execution.

Business Impact

Successful exploitation allows an attacker to gain elevated system-level privileges on the host machine. Given the CVSS score of 7.8, this poses a significant risk to the integrity and confidentiality of the host system, potentially leading to a full compromise of the affected machine.

Remediation Plan

Immediate Action: Update to the latest available version of WinFsp immediately as indicated in the vendor release.

Proactive Monitoring: Monitor system logs for unusual process execution or attempts to access restricted system files.

Compensating Controls: Ensure that local access to the machine is restricted to authorized users only, as the vulnerability requires local access to exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for local access and specific attack conditions.

Analyst Recommendation

Due to the severity of the potential impact, organizations should prioritize patching WinFsp installations. Administrators must verify their current version against the affected range and apply the vendor-supplied update immediately to mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: LG
PRODUCT: GV-IP Device Utility
AFFECTED_VERSIONS: 9.0.5
---END_METADATA---

Description Summary:
An insufficient encryption vulnerability in the GeoVision GV-IP Device Utility allows attackers on the same LAN to decrypt administrative credentials from broadcast traffic.

Executive Summary:
A critical vulnerability in the GeoVision GV-IP Device Utility allows local attackers to intercept and decrypt administrative credentials, leading to full control over network-connected devices.

Vulnerability Details

CVE-ID: CVE-2026-7161

Affected Software: GeoVision GV-IP Device Utility

Affected Versions: 9.0.5

Vulnerability: The utility uses a flawed cryptographic implementation where the symmetric key is included in the broadcast packet. An attacker on the same LAN can sniff this traffic and easily decrypt the administrative credentials.

Business Impact

With a CVSS score of 9.3, this flaw enables an attacker to gain full control over Geovision devices on the network. This can lead to the modification of IP addresses, factory resets, and unauthorized access to security camera feeds, severely impacting organizational security.

Remediation Plan

Immediate Action: Update to the latest version of the GV-IP Device Utility and, where possible, transition to more secure, authenticated management protocols.

Proactive Monitoring: Monitor network traffic for suspicious broadcast activity and implement network segmentation to isolate device management traffic from general user traffic.

Compensating Controls: Ensure that management interfaces are restricted to dedicated VLANs and monitor for any unauthorized device configuration changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on insecure encryption for credential management represents a significant security failure. Organizations must update the utility and restrict network access to broadcast traffic to mitigate the risk of credential theft.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Totolink A8000RU CGI handler contains an OS command injection vulnerability in the CsteSystem function reachable via remote HTTP requests.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU allows remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7156

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability exists within the CsteSystem function of the /cgi-bin/cstecgi.cgi component. An attacker can manipulate the HTTP argument to inject and execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to network integrity. An attacker can gain full remote control of the device, which may be used as a pivot point for further lateral movement within the internal network, resulting in total data exposure and persistent unauthorized access.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet and check the vendor website for the latest firmware update to patch the CGI handler.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at /cgi-bin/cstecgi.cgi and inspect device logs for evidence of command execution.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses only, and utilize a WAF to inspect and block malicious payload patterns in CGI parameters.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 27, 2026, public exploits are available for this vulnerability. Given the ease of remote exploitation, the risk of active targeting is extremely high.

Analyst Recommendation

Given the availability of public exploits and the critical nature of command injection, this device must be secured immediately. If a patch is unavailable, the device should be isolated from external networks to prevent exploitation.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Fory
AFFECTED_VERSIONS: 0.14.0 up to (excluding) 1.5.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap type confusion vulnerability in Apache Fory C++ allows remote attackers to trigger denial of service or arbitrary code execution via crafted payloads during polymorphic smart-pointer deserialization.

Executive Summary:
A critical heap type confusion vulnerability in Apache Fory C++ versions 0.14.0 through 1.4.x poses a severe risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-71558

Affected Software: Apache Software Foundation Apache Fory

Affected Versions: 0.14.0 up to (excluding) 1.5.0

Vulnerability: This is a deserialization vulnerability (CWE-502) occurring in the C++ implementation. An unauthenticated attacker can send a crafted input payload that bypasses type compatibility checks, leading to memory corruption and potential code execution.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of remote exploitation. Successful exploitation could lead to full system compromise, loss of data integrity, and significant operational downtime, directly impacting the availability and security of services relying on this library.

Remediation Plan

Immediate Action: Upgrade to Apache Fory version 1.5.0 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor application logs for unusual deserialization errors or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: If upgrading is not immediately possible, disable the use of polymorphic smart-pointer deserialization within the application if it is not strictly required.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for remote code execution without requiring authentication.

Analyst Recommendation

Given the critical CVSS severity of 9.8, organizations should prioritize updating the Apache Fory library to version 1.5.0 across all environments. Failure to address this vulnerability leaves systems exposed to potential remote code execution attacks.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the admpass argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7155

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi, where improper validation of the admpass parameter allows for unauthenticated remote OS command injection.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this flaw. Exploitation allows an attacker to gain administrative control over the router, which can be used to intercept traffic, modify device settings, or deploy malware, leading to severe business and operational impacts.

Remediation Plan

Immediate Action: Update the Totolink A8000RU device to the latest firmware version released by the manufacturer.

Proactive Monitoring: Monitor for unusual login or password change attempts and inspect logs for abnormal command strings directed at the CGI interface.

Compensating Controls: Restrict administrative access to the router to trusted internal subnets and ensure the management interface is not accessible from the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available for this vulnerability. The lack of required authentication and the potential for full system compromise warrant immediate action.

Analyst Recommendation

To ensure the security of the network, administrators must apply the latest firmware update for the Totolink A8000RU without delay. Proactive patching is the most effective way to address this critical vulnerability and prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7154

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw exists in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi, where the tty_server parameter is not properly sanitized, allowing an unauthenticated remote attacker to inject and execute OS commands.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk of complete device takeover. Successful exploitation can result in unauthorized access to sensitive internal network segments, potentially leading to catastrophic security breaches and loss of system availability.

Remediation Plan

Immediate Action: Patch the Totolink A8000RU device immediately by installing the latest vendor-provided firmware update.

Proactive Monitoring: Regularly audit device logs for unexpected process execution or suspicious input parameters sent to the CGI interface.

Compensating Controls: Isolate the management interface from the public internet using firewalls or VPN-only access to mitigate the risk from remote attackers.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available. The ability to execute remote commands without authentication makes this a high-priority target for threat actors.

Analyst Recommendation

Immediate remediation is essential to mitigate the risk of remote compromise. Organizations should apply the latest firmware update provided by Totolink as soon as possible to protect against this known, exploitable vulnerability.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the sys_info argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7153

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability affects the setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi, where insufficient filtering of the sys_info argument permits unauthenticated remote OS command injection.

Business Impact

The CVSS score of 9.8 reflects the high severity of this remote code execution flaw. If exploited, an attacker could gain persistent access to the network, potentially leading to data exfiltration and severe compromise of the internal network integrity.

Remediation Plan

Immediate Action: Update the Totolink A8000RU device to the latest available firmware release.

Proactive Monitoring: Monitor for anomalous traffic patterns directed at the CGI interface and watch for unauthorized command execution attempts in system logs.

Compensating Controls: Use a Web Application Firewall (WAF) or equivalent network security policy to filter malicious payloads targeting the /cgi-bin/cstecgi.cgi URI.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, there is a public exploit available for this vulnerability. The ease of exploitation and the lack of authentication make this a critical threat that necessitates immediate patching.

Analyst Recommendation

Security teams must prioritize the deployment of the latest firmware update to neutralize this vulnerability. Given the availability of public exploits, the window for remediation is narrow, and failure to act may expose the network to unauthorized remote control.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary commands by manipulating the telnet_enabled argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7152

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw resides in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi component, where the telnet_enabled argument fails to sanitize input, enabling remote OS command injection without requiring authentication.

Business Impact

Given the CVSS score of 9.8, this flaw facilitates complete device takeover. Successful exploitation can lead to total loss of control over the router, facilitating man-in-the-middle attacks or lateral movement within the local network, creating significant reputational and security risks.

Remediation Plan

Immediate Action: Update the firmware of the affected Totolink A8000RU device to the latest vendor-supplied version.

Proactive Monitoring: Review system logs for unusual activity originating from the /cgi-bin/cstecgi.cgi endpoint and monitor for unexpected changes to Telnet service configurations.

Compensating Controls: Disable remote management features on the router and implement strict firewall rules to prevent unauthorized access to the CGI interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, exploit code is publicly available. The vulnerability is highly accessible to remote attackers, and organizations should treat this as a high-priority threat to their perimeter security.

Analyst Recommendation

Urgent remediation is required to secure the device against this command injection flaw. Organizations must apply the latest firmware update provided by the vendor to eliminate this vulnerability and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: nrwl
PRODUCT: nx
AFFECTED_VERSIONS: >= 20.8.0, < 22.7.7, >= 23.0.0, < 23.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Nx monorepo solution contains path traversal and link following vulnerabilities, which could allow remote attackers to access or manipulate files outside of intended directories.

Executive Summary:
Path traversal and link following vulnerabilities in the Nx monorepo toolset could allow remote attackers to gain unauthorized access to sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-71476

Affected Software: nrwl nx

Affected Versions: >= 20.8.0, < 22.7.7, >= 23.0.0, < 23.0.2

Vulnerability: This vulnerability involves path traversal (CWE-22) and improper link resolution (CWE-59), allowing a user to access files outside the restricted directory. This typically requires user interaction to trigger the malicious path handling.

Business Impact

Successful exploitation allows an attacker to read or modify arbitrary files on the system, potentially leading to credential theft, configuration tampering, or remote code execution. Given the CVSS score of 8.7, this is a significant security risk for build environments and developer workstations.

Remediation Plan

Immediate Action: Update the Nx package to version 22.7.7 or 23.0.2 to include the necessary path validation fixes.

Proactive Monitoring: Audit file access logs for unexpected read or write operations originating from the Nx build process or associated CLI tools.

Compensating Controls: Run builds in isolated environments, such as containers, with limited filesystem access and non-privileged service accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dependent on how the tool handles paths during build or development tasks.

Analyst Recommendation

Organizations using Nx for monorepo management must apply the security updates immediately. Given the potential for file system manipulation, ensuring that developers and build pipelines are running the patched versions is critical to maintaining the integrity of the development lifecycle.

---METADATA---
VENDOR: ail-project
PRODUCT: ail-framework
AFFECTED_VERSIONS: 0 through 7.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected cross-site scripting vulnerability in the AIL Framework /tag/add_tags endpoint allows authenticated attackers to execute arbitrary scripts in a user session.

Executive Summary:
A reflected cross-site scripting vulnerability in AIL Framework permits authenticated attackers to inject malicious scripts, potentially leading to session theft or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-71445

Affected Software: ail-project ail-framework

Affected Versions: 0 through 7.0.0

Vulnerability: The application contains a reflected cross-site scripting flaw within the /tag/add_tags endpoint (CWE-79). This requires the attacker to be authenticated with low privileges and requires user interaction to execute the malicious payload.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a high risk to user accounts and session integrity. An attacker could potentially steal session cookies or perform unauthorized actions on behalf of a legitimate user, leading to potential data compromise or administrative control within the framework.

Remediation Plan

Immediate Action: Update the AIL Framework to the latest available version provided by the vendor to resolve the input sanitization issue.

Proactive Monitoring: Review web access logs for suspicious input parameters within the /tag/add_tags endpoint that contain script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns targeting application parameters.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this requires authentication, the impact remains significant due to the potential for privilege escalation or session hijacking.

Analyst Recommendation

Security teams should ensure that all instances of AIL Framework are updated to the latest version immediately. Furthermore, users should be trained to exercise caution when interacting with untrusted links that may trigger reflected scripts within the application.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the Totolink A8000RU CGI handler, allowing unauthenticated remote attackers to execute arbitrary system commands via the CsteSystem function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7140

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the CsteSystem function within the /cgi-bin/cstecgi.cgi component, where improper input validation of the HTTP argument enables remote OS command injection. The attack does not require authentication.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to network infrastructure. Successful exploitation allows an attacker to gain full control over the router, potentially leading to unauthorized network access, data exfiltration, or the redirection of traffic, resulting in severe operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Apply the latest security firmware update provided by Totolink immediately.

Proactive Monitoring: Monitor network traffic and device logs for suspicious HTTP requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those containing shell metacharacters.

Compensating Controls: Restrict access to the device's management interface to trusted IP addresses via a firewall or ACL to prevent external exploitation.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available for this vulnerability. Given the ease of remote execution and the availability of functional exploits, the potential for active exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize patching the affected Totolink A8000RU devices to mitigate the risk of remote code execution. If patching is not immediately feasible, ensure the management interface is not exposed to the internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the mode parameter in the setWiFiAclRules function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7139

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability affects the setWiFiAclRules function in /cgi-bin/cstecgi.cgi. The mode parameter is not properly sanitized, facilitating remote OS command injection by an unauthenticated attacker.

Business Impact

The device is susceptible to total compromise, which can result in severe network security breaches. The 9.8 CVSS score confirms the high severity and potential for exploitation.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version and disable Wi-Fi ACL rules if not required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes and suspicious command activity.

Compensating Controls: Use a firewall to block all WAN-side access to the management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

Immediate firmware updates are required to mitigate this threat. If a patch is unavailable, isolate the device from external networks to prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the tz parameter in the setNtpCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7138

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setNtpCfg function of the /cgi-bin/cstecgi.cgi file, where the tz parameter can be used to inject and execute OS commands remotely.

Business Impact

An attacker can gain complete control over the device, threatening network security and integrity. The 9.8 CVSS score indicates an extreme level of risk.

Remediation Plan

Immediate Action: Apply the latest firmware update and disable unnecessary NTP configuration settings.

Proactive Monitoring: Monitor router logs for suspicious command execution patterns.

Compensating Controls: Restrict management access to the router via internal network only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to prevent potential exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the sambaEnabled parameter in the setStorageCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7137

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setStorageCfg function within /cgi-bin/cstecgi.cgi due to insufficient sanitization of the sambaEnabled parameter, enabling remote OS command injection.

Business Impact

The flaw grants an attacker full control over the router, which can lead to data breaches or network-wide compromise. The 9.8 CVSS score emphasizes the severity of this risk.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable Samba/storage sharing features if they are not necessary.

Proactive Monitoring: Review system logs for unexpected system-level command execution.

Compensating Controls: Use a firewall to restrict access to the device's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Urgent firmware updates are necessary to secure the device. If an update is not immediately available, disable all unnecessary features and restrict external access to the device.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the wanIdx parameter in the setDmzCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7136

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setDmzCfg function in the /cgi-bin/cstecgi.cgi file. Improper input validation on the wanIdx parameter allows for remote OS command injection.

Business Impact

The vulnerability provides an attacker with complete control over the device, facilitating unauthorized access to the network. The 9.8 CVSS score confirms the high severity and potential for large-scale impact.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable DMZ features if not strictly required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or anomalous process execution.

Compensating Controls: Block WAN-side access to the management interface using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available.

Analyst Recommendation

Immediate remediation is required. Organizations should ensure all Totolink devices are running the latest firmware to protect against this critical threat.

---METADATA---
VENDOR: Nuxt
PRODUCT: Nuxt
AFFECTED_VERSIONS: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt is susceptible to code and output injection due to improper neutralization of special elements, potentially allowing unauthorized code execution.

Executive Summary:
The Nuxt framework is affected by an injection vulnerability that could allow attackers to execute arbitrary code within the application environment.

Vulnerability Details

CVE-ID: CVE-2026-71320

Affected Software: Nuxt Nuxt

Affected Versions: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10

Vulnerability: This vulnerability involves improper neutralization of special elements used in downstream components, categorized as both code and output injection. The vulnerability does not require authentication to reach the affected components.

Business Impact

Injection vulnerabilities in web frameworks often lead to Cross-Site Scripting (XSS) or remote code execution, depending on the implementation. With a CVSS score of 8.1, this represents a high-risk scenario where an attacker could compromise the integrity of the application and the confidentiality of user data.

Remediation Plan

Immediate Action: Upgrade to Nuxt version 3.21.10 or 4.5.1 to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs for unexpected input patterns or unusual server-side errors that may indicate injection attempts.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation routines to mitigate the impact of potential injection attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous as it affects the core framework, making all downstream applications potentially susceptible.

Analyst Recommendation

Organizations utilizing the Nuxt framework should verify their current version and apply the recommended updates as soon as possible. Failure to patch may expose applications to severe injection-based attacks.

---METADATA---
VENDOR: nuxt
PRODUCT: nuxt
AFFECTED_VERSIONS: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt contains vulnerabilities related to improper handling of case sensitivity and incorrect authorization, which may lead to unauthorized access or information disclosure.

Executive Summary:
A high-severity authorization and case-sensitivity flaw in the Nuxt framework creates a risk of unauthorized data access and integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-71315

Affected Software: nuxt nuxt

Affected Versions: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10

Vulnerability: This issue combines CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). These flaws allow an unauthenticated attacker to bypass authorization checks through case-manipulated requests.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a high risk to applications built on the Nuxt framework. Successful exploitation could result in the disclosure of sensitive information or unauthorized modification of data, potentially leading to a breach of privacy or loss of application control.

Remediation Plan

Immediate Action: Update the Nuxt framework to version 3.21.10 or 4.5.1 as appropriate for your deployment.

Proactive Monitoring: Monitor server access logs for requests using inconsistent casing that may indicate attempts to bypass route-based security controls.

Compensating Controls: Ensure that server-side routing logic is configured to normalize incoming request paths before authorization checks are performed.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of authorization and case-handling flaws suggests a complex, yet highly impactful, attack vector.

Analyst Recommendation

Given the critical role of the Nuxt framework in web applications, immediate patching is required. Organizations should update to the provided fixed versions to ensure that authorization policies are correctly enforced regardless of request case formatting.

---METADATA---
VENDOR: rclone
PRODUCT: rclone
AFFECTED_VERSIONS: >= 1.40.0, < 1.75.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in rclone versions 1.40.0 through 1.74.9 allows authenticated users to read or write files outside of the intended directory via malicious path manipulation.

Executive Summary:
An authenticated path traversal vulnerability in rclone allows unauthorized file system access, requiring an immediate update to version 1.75.0 to secure file operations.

Vulnerability Details

CVE-ID: CVE-2026-71309

Affected Software: rclone rclone

Affected Versions: >= 1.40.0, < 1.75.0

Vulnerability: This vulnerability involves improper limitation of pathnames to a restricted directory (CWE-22), enabling an authenticated attacker to traverse the file system and access or modify files beyond the scope of the configured storage provider.

Business Impact

The CVSS score of 8.6 indicates a critical risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or other critical data stored on the system, potentially resulting in full system compromise.

Remediation Plan

Immediate Action: Upgrade rclone to version 1.75.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit rclone execution logs for unusual file access patterns or attempts to access system directories outside of the designated sync paths.

Compensating Controls: Enforce strict file system permissions for the user account running rclone to limit the impact if a traversal attempt occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable if input sanitization is bypassed during path resolution.

Analyst Recommendation

Given the availability of a proof-of-concept and the high severity of path traversal vulnerabilities, users must upgrade to version 1.75.0 without delay. Failure to patch leaves the underlying file system exposed to unauthorized manipulation by any authenticated user with access to the tool.

---METADATA---
VENDOR: Bolt
PRODUCT: core
AFFECTED_VERSIONS: 0 through 6.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Bolt CMS is vulnerable to a security flaw where content field values are rendered through the Twig environment without a SandboxExtension, potentially allowing unauthorized code execution.

Executive Summary:
Bolt CMS is affected by an improper rendering flaw that could allow an authenticated attacker to compromise system confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-71291

Affected Software: Bolt core

Affected Versions: 0 through 6.1

Vulnerability: The application fails to register a SandboxExtension within the Twig environment, which is classified under CWE-1336. An authenticated attacker can exploit this to perform unauthorized actions within the system.

Business Impact

The vulnerability carries a high CVSS score of 8.8, reflecting the potential for full compromise of the application environment. Successful exploitation could allow an attacker to read or modify sensitive content and potentially disrupt system availability, posing a critical risk to the platform.

Remediation Plan

Immediate Action: Review the Bolt CMS official repository for security patches and upgrade to a version beyond 6.1.

Proactive Monitoring: Monitor server logs for unusual Twig template execution patterns or unexpected changes to content fields.

Compensating Controls: Restrict administrative access to trusted personnel only to minimize the risk of exploitation by authenticated users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of sandboxing in template rendering.

Analyst Recommendation

Due to the severity of this vulnerability, administrators should prioritize updating the Bolt CMS core to a secure version. Organizations should treat this as a high-priority task to prevent potential exploitation of the template rendering mechanism.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: anms
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The NASA-AMMOS ANMS reference implementation exposes its REST API directly to the network without authentication, allowing remote attackers to send unauthorized commands to DTNMA agents.

Executive Summary:
A critical authentication bypass in NASA-AMMOS ANMS exposes the REST API to the network, enabling unauthenticated attackers to execute arbitrary commands and disrupt network management operations.

Vulnerability Details

CVE-ID: CVE-2026-71289

Affected Software: NASA-AMMOS anms and JHUAPL-DTNMA dtnma-tools

Affected Versions: All versions

Vulnerability: The system incorrectly publishes the REST API on the host network without requiring authentication, and the underlying CivetWeb server is configured with a null authentication callback for command-dispatch endpoints.

Business Impact

An attacker can enumerate managed network agents and submit arbitrary command sets, which could lead to unauthorized control over simulated or real ground nodes. This represents a significant risk to the integrity of the network management testbed and associated ground operations.

Remediation Plan

Immediate Action: Update the software to the latest version and ensure the REST API is not exposed to public network interfaces.

Proactive Monitoring: Audit network configurations for any services bound to public interfaces that should be restricted to local or trusted segments.

Compensating Controls: Deploy a firewall or reverse proxy with mandatory authentication to gate access to the REST API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The exposure of sensitive command interfaces without credentials makes the system highly susceptible to unauthorized manipulation.

Analyst Recommendation

While this software is described as a reference implementation, it is vital to secure any instances deployed in operational or testing environments. Administrators must restrict network access and verify that authentication mechanisms are correctly enabled.

---METADATA---
VENDOR: Koha
PRODUCT: Koha
AFFECTED_VERSIONS: 0 through 26.05.01-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Koha's guided report builder contains a SQL injection vulnerability that allows authenticated users to execute arbitrary database commands.

Executive Summary:
A high-severity SQL injection vulnerability in the Koha guided report builder allows authenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-71288

Affected Software: Koha Koha

Affected Versions: 0 through 26.05.01-1

Vulnerability: This vulnerability is a SQL injection (CWE-89) within the guided report builder component, which allows a user with low-level privileges to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to bypass security controls, leading to unauthorized data exfiltration, modification, or complete database destruction. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of sensitive library management data.

Remediation Plan

Immediate Action: Upgrade to a version of Koha beyond 26.05.01-1 to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review application access logs for unusual patterns in the guided reports module and monitor database query logs for suspicious syntax or unexpected execution times.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeting report parameters.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, limiting its exploitability to internal or registered users.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent database-level compromise. Administrators should prioritize updating the Koha installation to the latest patched release to neutralize this injection risk.

---METADATA---
VENDOR: Cacti
PRODUCT: cacti
AFFECTED_VERSIONS: 0 through 1.3.0-dev
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The sanitize_sql_column function in Cacti is vulnerable to SQL injection, potentially allowing an authenticated attacker to manipulate database queries.

Executive Summary:
A SQL injection vulnerability in the Cacti platform allows an authenticated attacker to execute arbitrary database queries, potentially leading to unauthorized data access or modification.

Vulnerability Details

CVE-ID: CVE-2026-71287

Affected Software: Cacti cacti

Affected Versions: 0 through 1.3.0-dev

Vulnerability: The flaw exists in the sanitize_sql_column function (CWE-89), which fails to properly neutralize SQL commands, allowing an authenticated attacker to perform SQL injection attacks.

Business Impact

Successful exploitation permits an attacker to read, modify, or delete sensitive information stored within the Cacti database. Given the CVSS score of 8.8, this vulnerability poses a high risk to data integrity and confidentiality, which could lead to severe operational disruption or loss of administrative control.

Remediation Plan

Immediate Action: Monitor the Cacti project for an official security update and apply it immediately upon release.

Proactive Monitoring: Review database query logs for suspicious patterns or unauthorized SQL syntax, specifically originating from authenticated user sessions.

Compensating Controls: Use a Web Application Firewall to filter malicious SQL injection patterns and ensure database service accounts operate with the minimum necessary permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently critical as it bypasses intended database query sanitization.

Analyst Recommendation

Administrators should treat this SQL injection vulnerability as a high priority. Until a patch is available, it is recommended to audit existing user accounts and limit access to the Cacti interface to trusted personnel only to reduce the attack surface.

---METADATA---
VENDOR: Hugging Face
PRODUCT: peft
AFFECTED_VERSIONS: 0 through 0.19.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The LoRA-GA and CorDA initialization modules in Hugging Face peft are vulnerable to deserialization of untrusted data, which may lead to arbitrary code execution.

Executive Summary:
A high-severity deserialization vulnerability in the Hugging Face peft library could allow an attacker to execute arbitrary code on systems processing malicious model initialization modules.

Vulnerability Details

CVE-ID: CVE-2026-71281

Affected Software: Hugging Face peft

Affected Versions: 0 through 0.19.1

Vulnerability: The vulnerability involves improper deserialization of untrusted data (CWE-502) within the LoRA-GA and CorDA initialization modules, which can be triggered by an unauthenticated attacker via user-assisted interaction.

Business Impact

Exploitation of this vulnerability allows for remote code execution, which could result in complete loss of control over the affected environment. With a CVSS score of 8.8, the potential for unauthorized access to sensitive machine learning models and underlying infrastructure is substantial.

Remediation Plan

Immediate Action: Check the Hugging Face peft repository for the latest security release and update the library to the patched version as soon as it becomes available.

Proactive Monitoring: Monitor applications using the peft library for abnormal execution behavior or unexpected file system modifications during the model loading phase.

Compensating Controls: Implement strict input validation for any model or configuration files loaded by the application and run processes with the least privilege necessary.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently significant because it involves the deserialization of untrusted input, a common vector for code execution.

Analyst Recommendation

Users of the Hugging Face peft library should monitor the official project repository for a security patch. Given the high severity of deserialization flaws, it is critical to restrict the processing of untrusted model files until a fix is applied.

---METADATA---
VENDOR: go-shiori
PRODUCT: shiori
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the DownloadBookmark function of go-shiori allows authenticated attackers to perform unauthorized requests.

Executive Summary:
A high-severity Server-Side Request Forgery vulnerability in the go-shiori bookmarking tool allows authenticated attackers to perform unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-71280

Affected Software: go-shiori shiori

Affected Versions: All versions from 0 and later

Vulnerability: The DownloadBookmark function fails to properly sanitize user-supplied input, leading to a Server-Side Request Forgery (SSRF) vulnerability. An attacker with low-level privileges can leverage this to force the application to interact with internal resources.

Business Impact

An SSRF vulnerability allows an attacker to bypass network access controls, potentially accessing internal services or metadata endpoints that are not exposed to the public internet. Given the CVSS score of 8.5, this vulnerability represents a high risk to organizational infrastructure, as it can be used for internal reconnaissance or to pivot into protected network segments.

Remediation Plan

Immediate Action: Review the official go-shiori repository for available security patches and apply them immediately once released.

Proactive Monitoring: Monitor outgoing network requests from the host running shiori for connections directed toward internal IP addresses or sensitive local services.

Compensating Controls: Deploy the application within a restricted network environment that enforces strict egress filtering to prevent unauthorized internal communication.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for low-level authentication, which serves as an initial barrier to entry.

Analyst Recommendation

While an immediate patch may be pending, the high impact of SSRF necessitates proactive network-level defenses. Administrators should isolate the service from sensitive internal resources and monitor for suspicious outbound traffic until a formal update is deployed.

---METADATA---
VENDOR: iot-ecology
PRODUCT: rust-iot-platform
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The rust-iot-platform software lacks authentication on a calc rule creation endpoint, allowing unauthenticated attackers to execute arbitrary JavaScript code via unsanitized input.

Executive Summary:
An unauthenticated remote code execution vulnerability in rust-iot-platform allows attackers to execute malicious JavaScript within the server process.

Vulnerability Details

CVE-ID: CVE-2026-71278

Affected Software: iot-ecology rust-iot-platform

Affected Versions: 0 and later

Vulnerability: This vulnerability is a Code Injection (CWE-94) flaw where the application fails to perform an authentication check on the POST /calc-rule/create endpoint. An unauthenticated attacker can inject arbitrary JavaScript into a calc rule that the system subsequently executes without sandboxing.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on the server carries a critical risk of full system compromise. With a CVSS score of 9.8, this flaw could lead to complete data exfiltration, unauthorized modification of IoT configurations, or total service disruption, severely impacting business operations and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest available version of rust-iot-platform immediately as provided by the vendor. If a patch is not yet available, restrict network access to the API endpoints to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /calc-rule/create endpoint. Monitor server processes for unexpected child tasks or unusual resource consumption patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the calc-rule management API.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of sandboxing during the evaluation of user-provided scripts makes this target highly susceptible to exploitation once discovered.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention due to the lack of authentication required for exploitation. Administrators must prioritize the application of vendor-supplied updates to neutralize the risk of unauthorized remote code execution.