---METADATA---
VENDOR: WeGIA Project
PRODUCT: WeGIA
AFFECTED_VERSIONS: Versions 3.6.6 and below
---END_METADATA---

Description Summary:
WeGIA versions 3.6.6 and below are vulnerable to Reflected Cross-Site Scripting (XSS) in the novo_memorandoo.php endpoint, allowing arbitrary JavaScript execution in user browsers.

Executive Summary:
Attackers can execute malicious scripts in the context of a user's session by exploiting a Reflected XSS vulnerability in the WeGIA platform.

Vulnerability Details

CVE-ID: CVE-2026-33135

Affected Software: WeGIA

Affected Versions: Versions 3.6.6 and below

Vulnerability: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the sccs GET parameter of the /html/memorando/novo_memorandoo.php endpoint. The application directly reflects the input into an HTML alert div without sanitization, allowing an attacker to inject arbitrary JavaScript.

Business Impact

Exploitation of this vulnerability can lead to session hijacking, credential theft (via phishing), and the performance of unauthorized actions on behalf of the victim. If an administrator is targeted, the attacker could gain full control over the WeGIA management interface. The CVSS score of 9.3 reflects the high potential for account takeover.

Remediation Plan

Immediate Action: Upgrade WeGIA to version 3.6.7 or later to ensure all dynamic success messages are properly encoded before being rendered.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing <script> tags or other JavaScript event handlers.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and prevent the loading of scripts from untrusted domains.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. Reflected XSS requires an attacker to trick a user into clicking a specially crafted link.

Analyst Recommendation

While XSS is often viewed as less severe than RCE, in a management application like WeGIA, it can lead directly to administrative compromise. Apply the 3.6.7 patch immediately and educate users on the risks of clicking untrusted links.

---METADATA---
VENDOR: WeGIA Project
PRODUCT: WeGIA
AFFECTED_VERSIONS: Versions 3.6.5 and below
---END_METADATA---

Description Summary:
WeGIA versions 3.6.5 and below contain an authenticated SQL injection vulnerability in the restaurar_produto.php endpoint, potentially leading to full database compromise.

Executive Summary:
Authenticated attackers can execute arbitrary SQL commands to compromise the entire database of the WeGIA web manager.

Vulnerability Details

CVE-ID: CVE-2026-33134

Affected Software: WeGIA

Affected Versions: Versions 3.6.5 and below

Vulnerability: This is an authenticated SQL injection vulnerability in the id_produto GET parameter of the /html/matPat/restaurar_produto.php endpoint. The application fails to sanitize or parameterize the input before using it in SQL queries, allowing an attacker to manipulate database operations.

Business Impact

Successful exploitation allows an attacker to read, modify, or delete any data within the database. For a charitable institution manager, this could result in the theft of sensitive donor information, financial records, and institutional data. The CVSS score of 9.3 highlights the severe risk to data integrity and confidentiality.

Remediation Plan

Immediate Action: Upgrade WeGIA to version 3.6.6 or later, which implements parameterized statements to prevent SQL injection.

Proactive Monitoring: Review database logs for unusual query patterns and audit the restaurar_produto.php access logs for suspicious characters (e.g., single quotes, semicolons) in the URL.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious GET parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability requires authentication, which slightly limits the attacker pool to those with valid user credentials.

Analyst Recommendation

SQL injection remains one of the most damaging web vulnerabilities. Administrators of WeGIA should prioritize the update to version 3.6.6 immediately. Additionally, ensure that the database user for the application follows the principle of least privilege to limit the impact of any potential injection.

---METADATA---
VENDOR: Unjs
PRODUCT: H3
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the H3 minimal HTTP framework could allow for unauthorized interactions with web services built on the framework.

Executive Summary:
A security flaw in the H3 HTTP framework could allow attackers to bypass security controls and compromise the availability of web applications.

Vulnerability Details

CVE-ID: CVE-2026-33128

Affected Software: Unjs H3

Affected Versions: See vendor advisory for affected versions

Vulnerability: The H3 framework is affected by a vulnerability in its request handling or routing logic. With a CVSS score of 7.5, the flaw likely involves improper validation of HTTP headers or request parameters, potentially leading to request smuggling, cache poisoning, or unauthorized access to internal routes.

Business Impact

Exploitation could lead to the disruption of web services, the exposure of sensitive user data, or the bypassing of authentication mechanisms. This poses a significant risk to organizations using H3 as the foundation for their modern web applications and APIs.

Remediation Plan

Immediate Action: Upgrade the H3 framework to the latest version via your JavaScript package manager immediately.

Proactive Monitoring: Monitor web server logs for malformed HTTP requests or unusual patterns in request headers that may indicate an exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter incoming HTTP traffic for framework-specific attack vectors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. Framework-level vulnerabilities require rapid response as they affect all downstream applications.

Analyst Recommendation

Developers should prioritize updating the H3 framework to the latest patched version to ensure the security of their web services. Continuous monitoring and the use of a WAF are also recommended to provide defense-in-depth against potential exploits.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure SDK for Java
AFFECTED_VERSIONS: Microsoft Azure SDK for Java: 1.0.0 up to (excluding) 4.10.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authentication vulnerability in the Microsoft Azure SDK for Java allows unauthenticated remote attackers to bypass security features.

Executive Summary:
A critical authentication bypass vulnerability in the Microsoft Azure SDK for Java exposes applications to unauthorized access and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-33117

Affected Software: Microsoft Azure SDK for Java

Affected Versions: 1.0.0 up to (excluding) 4.10.6

Vulnerability: The vulnerability involves improper authentication and cryptographic signature verification mechanisms (CWE-287/CWE-347). It allows an unauthenticated attacker to bypass security controls over a network, potentially leading to unauthorized operations within the scope of the SDK.

Business Impact

Successful exploitation allows an attacker to bypass security features, leading to unauthorized access to sensitive data managed by Azure Key Vault or other integrated services. Given the CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality and integrity, potentially resulting in significant data breaches and non-compliance with security standards.

Remediation Plan

Immediate Action: Update the affected library to com.azure:azure-security-keyvault-keys version 4.10.6 or higher.

Proactive Monitoring: Review application access logs for unusual requests or authentication failures associated with Azure SDK service calls.

Compensating Controls: Implement strict network segmentation and ensure that Azure Key Vault instances are protected by robust firewall rules (VNet service endpoints or Private Links) to limit exposure.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly critical due to its "automatable" nature and the ability for an unauthenticated attacker to impact core security functions.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Organizations utilizing the Microsoft Azure SDK for Java must prioritize updating their dependencies to the patched version, 4.10.6, to prevent potential unauthorized access to sensitive cryptographic keys and secrets.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office SharePoint
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016: < 16.0.5552.1002; SharePoint Server 2019: < 16.0.10417.20128; SharePoint Server Subscription Edition: < 16.0.19725.20280
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Microsoft Office SharePoint is vulnerable to remote code execution due to the insecure deserialization of untrusted data.

Executive Summary:
An authenticated remote code execution vulnerability in Microsoft SharePoint allows attackers to compromise server integrity via deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2026-33112

Affected Software: Microsoft Office SharePoint

Affected Versions: SharePoint Enterprise Server 2016 (pre-16.0.5552.1002), SharePoint Server 2019 (pre-16.0.10417.20128), and SharePoint Server Subscription Edition (pre-16.0.19725.20280).

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502). The attacker must be authenticated to trigger the vulnerable function, but once authenticated, they can execute arbitrary code over the network.

Business Impact

With a CVSS score of 8.8, this vulnerability allows for total system compromise, including loss of confidentiality, integrity, and availability. Successful exploitation enables an attacker to move laterally within the network or exfiltrate sensitive documents stored in SharePoint, posing a catastrophic risk to organizational data.

Remediation Plan

Immediate Action: Apply the relevant security updates for your specific SharePoint version as listed in the Microsoft security guidance.

Proactive Monitoring: Monitor for unexpected process creation or unauthorized file system modifications on SharePoint servers.

Compensating Controls: Limit access to SharePoint management interfaces and ensure that service accounts are running with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. However, the high EPSS score suggests that the vulnerability is attractive to threat actors and should be patched without delay.

Analyst Recommendation

Organizations must prioritize patching SharePoint environments. Given the potential for remote code execution, this update should be deployed during the next available maintenance window to mitigate the risk of full server takeover.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016 (16.0.0 to <16.0.5552.1002), SharePoint Server 2019 (16.0.0 to <16.0.10417.20128), SharePoint Server Subscription Edition (16.0.0 to <16.0.19725.20280)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Deserialization of untrusted data in Microsoft SharePoint allows an authorized attacker to execute arbitrary code over a network.

Executive Summary:
An authenticated remote code execution vulnerability in Microsoft SharePoint poses a critical risk to internal infrastructure by allowing attackers to execute arbitrary code with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-33110

Affected Software: Microsoft SharePoint

Affected Versions: SharePoint Enterprise Server 2016 (16.0.0 to <16.0.5552.1002), SharePoint Server 2019 (16.0.0 to <16.0.10417.20128), and SharePoint Server Subscription Edition (16.0.0 to <16.0.19725.20280).

Vulnerability: This is a deserialization vulnerability (CWE-502) in Microsoft SharePoint. An attacker with low-level authenticated access can leverage this flaw to achieve remote code execution (RCE) over the network.

Business Impact

The CVSS score of 8.8 (High) reflects the severity of this vulnerability, as it allows for full system compromise if exploited successfully. Successful exploitation could lead to total loss of confidentiality, integrity, and availability of the SharePoint environment, potentially serving as a pivot point for further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update to the patched versions provided by Microsoft in the security update guide: SharePoint 2016 (16.0.5552.1002), SharePoint 2019 (16.0.10417.20128), or Subscription Edition (16.0.19725.20280).

Proactive Monitoring: Audit SharePoint server logs for unusual process execution or unauthorized deserialization attempts.

Compensating Controls: Ensure strict access control lists (ACLs) are applied to limit the number of users who can interact with the vulnerable SharePoint interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the nature of deserialization flaws often makes them high-value targets for attackers seeking persistence.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize the deployment of the vendor-supplied security patches to all affected SharePoint instances immediately. Failure to patch leaves the internal SharePoint infrastructure vulnerable to compromise by any authenticated user.

---METADATA---
VENDOR: Apache
PRODUCT: Cassandra
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute arbitrary code.

Executive Summary:
A critical access control vulnerability in Azure Managed Instance for Apache Cassandra allows authorized attackers to execute arbitrary code, necessitating immediate action.

Vulnerability Details

CVE-ID: CVE-2026-33109

Affected Software: Apache Cassandra (Azure Managed Instance)

Affected Versions: See vendor advisory

Vulnerability: The vulnerability arises from improper access controls, allowing an authenticated user to perform actions exceeding their intended privileges, specifically leading to remote code execution (RCE).

Business Impact

With a CVSS score of 9.9, this is a highly critical vulnerability. Successful exploitation permits full remote code execution on the database instance, which could result in complete data loss, unauthorized access to the underlying storage, and total compromise of the database environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Azure Managed Instance for Apache Cassandra service.

Proactive Monitoring: Monitor database query logs for suspicious command execution and unusual administrative activity.

Compensating Controls: Restrict database access to known and trusted IP addresses and enforce the principle of least privilege for all database users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation. The severity of the CVSS score warrants immediate attention.

Analyst Recommendation

Prioritize the application of all available patches for the Cassandra managed instance. Verify that security configurations are hardened and that access logs are monitored for any signs of exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Databricks
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Azure Databricks allows unauthenticated attackers to elevate privileges and access internal network resources.

Executive Summary:
Azure Databricks is affected by a critical SSRF vulnerability that allows unauthenticated attackers to escalate privileges and gain unauthorized access to internal systems.

Vulnerability Details

CVE-ID: CVE-2026-33107

Affected Software: Microsoft Azure Databricks

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a Server-Side Request Forgery (SSRF) flaw where the application can be coerced into making unauthorized requests. An unauthenticated attacker can leverage this to gain elevated privileges and interact with internal metadata services or other protected network resources.

Business Impact

A successful SSRF attack against Databricks can lead to the exposure of sensitive cloud credentials and internal network mapping. Given the CVSS score of 10.0, the risk includes full privilege escalation, allowing attackers to access, modify, or delete high-value data processed within Databricks clusters, leading to significant regulatory and operational risks.

Remediation Plan

Immediate Action: Update Azure Databricks to the latest version as specified in the Microsoft security advisory to remediate the SSRF vector.

Proactive Monitoring: Review outbound network logs from Databricks clusters for requests to internal IP addresses or metadata services (e.g., 169.254.169.254).

Compensating Controls: Implement egress filtering to restrict clusters from communicating with sensitive internal endpoints and use Azure Policy to enforce secure workspace configurations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 3, 2026, no public exploits are known to be in use. SSRF in cloud environments is a high-value target for attackers looking to extract instance metadata and credentials.

Analyst Recommendation

The CVSS score of 10.0 demands immediate remediation. Administrators must ensure that their Databricks workspaces are updated and that network-level protections are in place to prevent SSRF-based credential theft. This is a critical security update that should be handled as an emergency change.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Kubernetes Service (AKS)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical improper authorization vulnerability in Microsoft Azure Kubernetes Service allows unauthenticated attackers to elevate privileges over a network, potentially gaining full cluster control.

Executive Summary:
An unauthorized attacker can exploit improper authorization within Microsoft Azure Kubernetes Service to achieve remote privilege escalation, posing a critical risk to cloud infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-33105

Affected Software: Microsoft Azure Kubernetes Service (AKS)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability stems from improper authorization checks within the AKS environment. An unauthenticated attacker can exploit this flaw over a network to escalate their privileges, potentially gaining administrative access to the Kubernetes cluster without valid credentials.

Business Impact

A successful exploit could lead to a complete compromise of the Azure Kubernetes environment, allowing unauthorized access to sensitive containerized workloads and data. The CVSS score of 10.0 reflects the highest possible severity, as it enables remote attackers to bypass security boundaries and take full control of critical cloud infrastructure, resulting in significant operational downtime and data exposure.

Remediation Plan

Immediate Action: Update Microsoft Azure Kubernetes Service components to the latest available version immediately and consult the official Microsoft security advisory for specific patching instructions.

Proactive Monitoring: Review Azure activity logs and Kubernetes audit logs for unusual identity and access management (IAM) changes or unauthorized administrative requests.

Compensating Controls: Implement strict Network Security Group (NSG) rules and utilize Azure Policy to enforce the principle of least privilege across the Kubernetes environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the CVSS score of 10.0 and the nature of privilege escalation in cloud environments, the potential for exploitation is extremely high once technical details become public.

Analyst Recommendation

This vulnerability represents a maximum-risk scenario for organizations utilizing Azure Kubernetes Service. It is imperative that administrators prioritize the application of vendor-provided patches and configuration updates. Failure to secure these clusters could lead to total infrastructure takeover by remote threat actors.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft 365 Copilot
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Microsoft 365 Copilot is affected by an open redirect vulnerability, which can be leveraged by attackers to facilitate privilege escalation.

Executive Summary:
Microsoft 365 Copilot contains an open redirect vulnerability that can be exploited by an attacker to facilitate unauthorized privilege escalation within the network.

Vulnerability Details

CVE-ID: CVE-2026-33102

Affected Software: Microsoft Microsoft 365 Copilot

Affected Versions: See vendor advisory

Vulnerability: This is a URL Redirection to Untrusted Site (CWE-601) vulnerability. By manipulating the redirect mechanism, an unauthenticated attacker can deceive users into visiting malicious sites, potentially resulting in privilege escalation.

Business Impact

An open redirect vulnerability can be used as a vector for phishing and credential harvesting, ultimately leading to unauthorized access to sensitive corporate data stored within the M365 environment. With a CVSS score of 9.3, the potential for privilege escalation makes this a high-priority concern for any organization relying on Copilot for sensitive business workflows.

Remediation Plan

Immediate Action: Review the Microsoft Security Update Guide for CVE-2026-33102 and apply all recommended updates or configuration mitigations provided by Microsoft.

Proactive Monitoring: Monitor for anomalous traffic patterns involving redirected URLs and conduct user awareness training regarding suspicious links in Copilot-generated content.

Compensating Controls: Utilize security solutions that perform URL reputation filtering and block access to unverified or newly registered domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk stems from the potential for the vulnerability to be chained with other attacks to increase the attacker's foothold within the enterprise identity perimeter.

Analyst Recommendation

Organizations should treat this high-severity vulnerability with urgency. Ensure all Microsoft 365 environment updates are deployed automatically and verify that security policies are in place to restrict unauthorized external redirections.

---METADATA---
VENDOR: Mesop
PRODUCT: Mesop
AFFECTED_VERSIONS: 1.2.2 and below
---END_METADATA---

Description Summary:
Mesop versions 1.2.2 and below contain an unauthenticated remote code execution (RCE) vulnerability in a debugging endpoint within the AI testing module.

Executive Summary:
The Mesop UI framework is vulnerable to a critical, unauthenticated remote code execution flaw that allows attackers to gain full host-machine command rights.

Vulnerability Details

CVE-ID: CVE-2026-33057

Affected Software: Mesop (Python-based UI framework)

Affected Versions: 1.2.2 and below

Vulnerability: An explicit web endpoint (/exec-py) in the ai/ testing module infrastructure unconditionally ingests and executes base64-encoded Python code strings. This endpoint lacks authentication, allowing any individual who can route HTTP traffic to the server to execute arbitrary commands on the host machine.

Business Impact

This is a worst-case scenario vulnerability with a CVSS score of 9.8. An attacker can gain complete control over the server running the Mesop application, leading to total data compromise, installation of malware, or use of the host for lateral movement. The presence of a "debugging" endpoint in production environments poses an extreme risk.

Remediation Plan

Immediate Action: Update Mesop to version 1.2.3 immediately. If an update is not possible, disable or remove the ai/sandbox/wsgi_app.py module from the deployment.

Proactive Monitoring: Scan for the presence of the /exec-py route in your environment and monitor for any POST requests to this endpoint, which are likely malicious.

Compensating Controls: Use network-level filtering to block access to internal testing or debugging routes and ensure that development frameworks are not deployed with testing modules enabled in production.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the nature of this vulnerability—a direct execution endpoint—makes it trivial to exploit once discovered.

Analyst Recommendation

The severity of this RCE flaw cannot be overstated. IT teams must ensure that no Mesop applications are running version 1.2.2 or below in any accessible environment. Immediate patching to version 1.2.3 is mandatory to prevent total system compromise.

---METADATA---
VENDOR: Mesop
PRODUCT: Mesop
AFFECTED_VERSIONS: 1.2.2 and below
---END_METADATA---

Description Summary:
Mesop versions 1.2.2 and below are vulnerable to path traversal, allowing unauthorized users to manipulate or delete arbitrary files on the host disk.

Executive Summary:
A critical path traversal vulnerability in the Mesop framework allows unauthenticated attackers to arbitrarily target, manipulate, or delete files on the server.

Vulnerability Details

CVE-ID: CVE-2026-33054

Affected Software: Mesop (Python-based UI framework)

Affected Versions: 1.2.2 and below

Vulnerability: The vulnerability exists in the handling of the state_token through the UI stream payload. Unauthorized actors can supply crafted tokens to target files outside the application bounds when the FileStateSessionBackend is utilized, leading to arbitrary file manipulation or denial of service.

Business Impact

With a CVSS score of 10.0, this vulnerability represents a total compromise of system integrity and availability. Attackers can delete critical service resources or overwrite configurations, causing permanent data loss or persistent denial of service. This level of access to the underlying filesystem is a critical threat to any organization hosting Mesop-based applications.

Remediation Plan

Immediate Action: Update Mesop to version 1.2.3 immediately to fix the path traversal logic and secure the session backend.

Proactive Monitoring: Monitor for unexpected file system changes or application crash loops that may indicate an attempted exploit of the file-based runtime backend.

Compensating Controls: If using the FileStateSessionBackend, switch to a more secure session management backend or implement strict filesystem permissions to limit the application's write access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. Given the CVSS score of 10.0, this vulnerability is a prime candidate for automated exploit attempts.

Analyst Recommendation

The ability to manipulate arbitrary files on the host system requires immediate corrective action. Organizations must prioritize the update to Mesop 1.2.3. Failure to do so leaves the server highly vulnerable to both data destruction and system instability.

---METADATA---
VENDOR: Nginx UI (Open Source)
PRODUCT: Nginx UI
AFFECTED_VERSIONS: 2.3.5 and prior
---END_METADATA---

Description Summary:
Nginx UI versions 2.3.5 and prior are vulnerable to an authentication bypass on the /mcp_message endpoint, allowing unauthenticated attackers to take full control of the Nginx service.

Executive Summary:
A critical authentication bypass in Nginx UI allows unauthenticated network attackers to modify configurations and take over the Nginx service due to an empty default IP whitelist.

Vulnerability Details

CVE-ID: CVE-2026-33032

Affected Software: Nginx UI Nginx UI

Affected Versions: 2.3.5 and prior

Vulnerability: The /mcp_message endpoint in the Nginx UI MCP integration lacks mandatory authentication. While it relies on an IP whitelist, the default configuration is empty, which the software interprets as "allow all." This allows any network-adjacent attacker to invoke tools for restarting Nginx or modifying its configuration files without credentials.

Business Impact

A successful exploit grants an attacker full control over the Nginx web server's configuration and operational state. This can lead to service downtime, unauthorized redirection of web traffic, and potential exposure of backend services. The CVSS score of 9.8 highlights the severity of allowing unauthenticated administrative actions.

Remediation Plan

Immediate Action: Since no patch is currently available, administrators should immediately restrict access to the /mcp_message and /mcp endpoints via firewall rules or a reverse proxy.

Proactive Monitoring: Monitor Nginx configuration files for unauthorized changes and review Nginx UI logs for unexpected requests to the /mcp_message endpoint.

Compensating Controls: Manually configure the IP whitelist in the Nginx UI settings to include only trusted administrative IP addresses, ensuring it is not left empty.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. However, the lack of a patch at the time of publication significantly increases the risk for organizations running the default configuration.

Analyst Recommendation

In the absence of a vendor patch, organizations must implement strict network-level access controls to isolate the Nginx UI management interface. Restricting access to trusted internal IPs is a mandatory step to prevent unauthenticated takeover of the Nginx service.

---METADATA---
VENDOR: MCP (Model Context Protocol)
PRODUCT: mcp-memory-service
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the mcp-memory-service, an open-source memory backend for multi-agent systems, could lead to unauthorized memory access or data leakage.

Executive Summary:
A security flaw in the mcp-memory-service could allow attackers to access or manipulate the memory state of AI agents, compromising the integrity of multi-agent systems.

Vulnerability Details

CVE-ID: CVE-2026-33010

Affected Software: MCP mcp-memory-service

Affected Versions: See vendor advisory for affected versions

Vulnerability: The mcp-memory-service contains a vulnerability in its memory backend management. With a CVSS score of 8.1, the flaw likely permits unauthorized retrieval or modification of stored context in AI systems, potentially allowing an attacker to influence agent behavior or extract sensitive information from the agent's memory.

Business Impact

Exploitation could lead to the exposure of sensitive data handled by AI agents or the "poisoning" of agent memory to cause incorrect or malicious actions. This poses a significant risk to organizations deploying multi-agent AI systems, as it directly impacts the reliability and confidentiality of automated processes.

Remediation Plan

Immediate Action: Apply the latest security updates to the mcp-memory-service and review access control policies for the memory backend.

Proactive Monitoring: Audit memory access logs for unusual retrieval patterns or unauthorized attempts to write to the memory service from unknown agents.

Compensating Controls: Implement strong authentication and encryption for all communications between AI agents and the memory service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. As AI infrastructure becomes a more prominent target, securing memory backends is critical.

Analyst Recommendation

Immediate patching of the mcp-memory-service is essential to protect the integrity of AI-driven workflows. Organizations should ensure that only authorized agents can access the memory service and that all stored data is protected against unauthorized tampering.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: 6.1c.1353_B20190305
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink N300RH Web Management Interface due to improper handling of the webWlanIdx parameter.

Executive Summary:
A critical command injection vulnerability in the Totolink N300RH router allows remote attackers to execute arbitrary OS commands and gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-3301

Affected Software: Totolink N300RH

Affected Versions: 6.1c.1353_B20190305

Vulnerability: The vulnerability exists in the setWebWlanIdx function within /cgi-bin/cstecgi.cgi. By manipulating the webWlanIdx argument, a remote, unauthenticated attacker can trigger an OS command injection flaw.

Business Impact

Compromise of edge networking equipment like the N300RH can lead to traffic interception, DNS poisoning, and unauthorized access to the internal network. Attackers can utilize the device as a persistent foothold for further attacks or incorporate it into a botnet. The CVSS score of 9.8 and the availability of a public exploit significantly elevate the risk profile.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink or replace the device if it has reached End-of-Life (EOL) and no patch is available.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and check for unauthorized changes to the router's configuration.

Compensating Controls: Disable the Web Management Interface on the WAN side and restrict LAN-side access to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Feb 27, 2026, a public exploit has been released. This drastically increases the likelihood of active exploitation by script kiddies and automated botnets.

Analyst Recommendation

Due to the availability of a public exploit and the critical nature of remote command execution, this vulnerability must be addressed immediately. Administrators should assume any device exposed to the internet is already at risk and should prioritize firmware updates or hardware replacement.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi OS
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An improper input validation vulnerability in Ubiquiti UniFi OS allows high-privileged, network-adjacent users to execute arbitrary system commands.

Executive Summary:
A high-severity command injection flaw in Ubiquiti UniFi OS allows authenticated, high-privileged users to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-33000

Affected Software: Ubiquiti UniFi OS

Affected Versions: See vendor advisory

Vulnerability: This is a command injection vulnerability requiring a high-privileged, authenticated user on the network. The flaw arises from inadequate input validation, which allows the execution of arbitrary commands when supplied through specific system interfaces.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a significant risk to internal security by facilitating privilege escalation or lateral movement. Even though it requires high privileges, the potential for a compromised administrative account to gain full control of the underlying OS remains a severe threat to business continuity.

Remediation Plan

Immediate Action: Update all UniFi OS devices to the latest firmware to sanitize input handling processes.

Proactive Monitoring: Audit administrative activity and review command logs for suspicious use of system utilities.

Compensating Controls: Enforce the principle of least privilege for all administrative users and implement multi-factor authentication (MFA) to prevent account compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this as a high-priority update. Limiting the number of users with administrative access and ensuring those accounts are protected by strong authentication will significantly reduce the risk surface.

---METADATA---
VENDOR: WPEverest
PRODUCT: Everest Forms Pro (WordPress plugin)
AFFECTED_VERSIONS: Up to and including 1.9.12
---END_METADATA---

Description Summary:
Everest Forms Pro is vulnerable to unauthenticated Remote Code Execution via PHP Code Injection in its Calculation Addon, allowing attackers to execute code through unsanitized form fields.

Executive Summary:
Unauthenticated attackers can achieve full server compromise by injecting malicious PHP code into Everest Forms Pro fields that utilize the "Complex Calculation" feature.

Vulnerability Details

CVE-ID: CVE-2026-3300

Affected Software: WPEverest Everest Forms Pro

Affected Versions: Up to and including 1.9.12

Vulnerability: The Calculation Addon's process_filter() function insecurely concatenates user-submitted form values into a string passed to the eval() function. Because the application fails to escape single quotes or PHP control characters, an unauthenticated attacker can break out of the string context and execute arbitrary PHP code.

Business Impact

This vulnerability allows for complete unauthorized access to the WordPress environment and the underlying operating system. Attackers can steal sensitive user data, modify site content, or use the server as a pivot point for further internal network attacks. The CVSS score of 9.8 indicates a critical threat to the organization's digital assets.

Remediation Plan

Immediate Action: Update the Everest Forms Pro plugin and the Calculation Addon to the latest available version immediately to ensure user input is no longer passed to eval() unsafely.

Proactive Monitoring: Review form submission logs for entries containing PHP tags (<?php), backticks, or unusual character sequences in text and select fields.

Compensating Controls: Implement a WAF to block common PHP injection payloads and restrict the use of the "Complex Calculation" feature to trusted administrative users only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 31, 2026, there is no public information indicating active exploitation. The simplicity of the eval() injection makes this a high-priority target for attackers seeking to exploit WordPress environments.

Analyst Recommendation

Applying the vendor-provided patch is the only effective way to mitigate this critical risk. Administrators must ensure that both the core plugin and all associated addons are updated to the latest versions to protect against unauthenticated remote code execution.

---METADATA---
VENDOR: WebPros
PRODUCT: cPanel and WP Squared
AFFECTED_VERSIONS: cPanel 11.132.0.0 to <11.132.0.32, 11.134.0.0 to <11.134.0.26, 11.136.0.0 to <11.136.0.10; WP Squared 11.132.1.0 to <11.136.1.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper sanitization of the status query parameter in the /unprotected/nova_error endpoint allows unauthenticated attackers to perform CRLF injection.

Executive Summary:
An unauthenticated CRLF injection vulnerability in cPanel and WP Squared enables attackers to inject arbitrary HTTP headers into server responses, facilitating cache poisoning and cross-site scripting.

Vulnerability Details

CVE-ID: CVE-2026-32993

Affected Software: WebPros cPanel and WP Squared

Affected Versions: cPanel versions 11.132.0.0–11.132.0.31, 11.134.0.0–11.134.0.25, 11.136.0.0–11.136.0.9; WP Squared versions 11.132.1.0–11.136.1.11.

Vulnerability: The vulnerability is a CRLF injection (CWE-93) located in the status parameter of the /unprotected/nova_error endpoint. Because the endpoint does not require authentication, an attacker can manipulate HTTP responses to facilitate various web-based attacks.

Business Impact

With a CVSS score of 8.3 (High), this vulnerability poses a significant risk to web infrastructure. CRLF injection can lead to cache poisoning, session hijacking, or cross-site scripting (XSS), potentially impacting the integrity and security of the services managed by cPanel or WP Squared.

Remediation Plan

Immediate Action: Update cPanel and WP Squared installations to the latest patched versions as detailed in the WebPros security advisory.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing carriage return (%0D) or line feed (%0A) characters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing CRLF sequences in the status query parameter of the affected endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated, remote nature.

Analyst Recommendation

Administrators must update their cPanel and WP Squared environments immediately to eliminate this injection vector. Given the ease of exploitation, testing and applying the security update should be prioritized to prevent potential web-based attacks.

---METADATA---
VENDOR: WebPros
PRODUCT: cPanel and WP Squared
AFFECTED_VERSIONS: cPanel 11.126.0.0 to <11.136.0.10; WP Squared 11.126.1.0 to <11.136.1.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SSL verification is disabled in the DNS Cluster system within cPanel and WP Squared, allowing for potential man-in-the-middle attacks.

Executive Summary:
A critical failure in SSL certificate validation within the cPanel and WP Squared DNS Cluster system exposes communications to man-in-the-middle interception and data tampering.

Vulnerability Details

CVE-ID: CVE-2026-32992

Affected Software: WebPros cPanel and WP Squared

Affected Versions: cPanel versions 11.126.0.0–11.136.0.9; WP Squared versions 11.126.1.0–11.136.1.11.

Vulnerability: This is an improper certificate validation vulnerability (CWE-295) affecting the DNS Cluster system. Because the software fails to verify SSL certificates, it is susceptible to man-in-the-middle (MitM) attacks where an attacker can impersonate a DNS cluster node.

Business Impact

With a CVSS score of 8.2 (High), this flaw undermines the fundamental security of DNS cluster communications. An attacker positioned in the network path could intercept or modify sensitive DNS traffic, potentially leading to unauthorized redirection of traffic or credential theft.

Remediation Plan

Immediate Action: Apply the vendor security updates immediately to ensure proper SSL certificate validation is re-enabled across all cluster nodes.

Proactive Monitoring: Review DNS cluster communication logs for signs of connection errors or unusual traffic patterns that might indicate a MitM attempt.

Compensating Controls: Restrict DNS cluster network access to trusted internal IP ranges only, reducing the likelihood of an attacker positioning themselves for a MitM attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it effectively bypasses the encryption layer intended to protect cluster communications.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update. Organizations relying on cPanel or WP Squared DNS clustering must patch to ensure that all inter-node communication is properly authenticated and encrypted, preventing trivial interception by network-level attackers.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.13
---END_METADATA---

Description Summary:
OpenClaw's device pairing process is vulnerable to a replay attack where bootstrap setup codes can be reused to escalate pairing scopes to administrative levels.

Executive Summary:
OpenClaw versions before 2026.3.13 are vulnerable to a critical bootstrap code replay flaw that allows attackers to escalate privileges to administrative levels during device pairing.

Vulnerability Details

CVE-ID: CVE-2026-32987

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.13

Vulnerability: The flaw exists in src/infra/device-bootstrap.ts, where bootstrap setup codes can be replayed during the verification phase. An attacker can exploit this by submitting a valid code multiple times before final approval, effectively escalating pending pairing scopes to operator.admin status.

Business Impact

This vulnerability allows an attacker to bypass the intended security controls of the device pairing process, gaining unauthorized administrative access to the platform. With a CVSS score of 9.8, the risk is critical as it facilitates unauthorized control over the device management infrastructure and potential data exposure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.13 or later to ensure bootstrap codes are invalidated immediately after their first use or during the verification process.

Proactive Monitoring: Monitor device pairing logs for multiple verification attempts using the same bootstrap code and investigate any unauthorized elevations to operator.admin status.

Compensating Controls: Implement time-limited bootstrap codes and require multi-factor authentication for administrative device pairing approvals.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation. The replay nature of this vulnerability makes it a high-priority target for attackers looking to gain a foothold in OpenClaw environments.

Analyst Recommendation

Replay attacks against authentication and pairing mechanisms are high-impact vulnerabilities. Immediate patching to version 2026.3.13 is required to prevent unauthorized administrative access and maintain the integrity of the device bootstrap process.

---METADATA---
VENDOR: Xerte
PRODUCT: Xerte Online Toolkits
AFFECTED_VERSIONS: Versions 3.14 and earlier
---END_METADATA---

Description Summary:
Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability, enabling remote code execution via malicious ZIP archives.

Executive Summary:
Unauthenticated attackers can execute arbitrary code on the host server by exploiting a file upload vulnerability in Xerte Online Toolkits.

Vulnerability Details

CVE-ID: CVE-2026-32985

Affected Software: Xerte Online Toolkits

Affected Versions: Versions 3.14 and earlier

Vulnerability: This is an unauthenticated arbitrary file upload vulnerability located in the template import functionality (import.php). Attackers can bypass authentication checks to upload a crafted ZIP archive containing PHP payloads, which are then extracted to a web-accessible directory for execution.

Business Impact

Successful exploitation allows an attacker to gain unauthorized shell access to the web server. This leads to the potential for complete data exfiltration, system downtime, and long-term persistence within the environment. The CVSS score of 9.8 indicates a critical risk to any organization hosting Xerte Online Toolkits.

Remediation Plan

Immediate Action: Upgrade Xerte Online Toolkits to the latest version (3.15 or higher) to resolve the authentication bypass and secure the file import logic.

Proactive Monitoring: Inspect the media and template directories for unexpected PHP files and monitor for unusual outbound network connections from the web server.

Compensating Controls: Disable PHP execution in directories where user-uploaded content is stored and implement strict file extension filtering at the web server level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The high CVSS score and the relative ease of exploiting arbitrary file uploads make this a likely target for threat actors.

Analyst Recommendation

Immediate remediation is required to prevent server compromise. Administrators should apply the latest security updates and verify that the import.php file is no longer accessible to unauthenticated users. A full compromise assessment is recommended if the software has been exposed to the internet without updates.