---METADATA---
VENDOR: Nexcess
PRODUCT: Kadence WooCommerce Email Designer
AFFECTED_VERSIONS: n/a through 1.5.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Kadence WooCommerce Email Designer plugin for WordPress contains a missing authorization vulnerability that allows unauthenticated attackers to escalate privileges.

Executive Summary:
This critical privilege escalation vulnerability in the Kadence WooCommerce Email Designer plugin allows unauthenticated attackers to achieve full administrative control over the affected WordPress installation.

Vulnerability Details

CVE-ID: CVE-2026-28005

Affected Software: Nexcess Kadence WooCommerce Email Designer

Affected Versions: n/a through 1.5.19

Vulnerability: The plugin fails to perform necessary capability checks, resulting in a CWE-862 Missing Authorization flaw. This allows an unauthenticated attacker to execute unauthorized actions, effectively bypassing security controls.

Business Impact

A successful exploit grants an attacker administrative privileges, leading to complete site compromise, data theft, and potential malware distribution. Given the CVSS score of 9.8, this vulnerability represents an existential threat to the integrity and availability of the affected web application.

Remediation Plan

Immediate Action: Update the Nexcess Kadence WooCommerce Email Designer plugin to version 1.5.19.1 or later immediately.

Proactive Monitoring: Review administrative user accounts for unauthorized creations or modifications and monitor server logs for suspicious POST requests targeting plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized administrative requests and suspicious traffic patterns directed at the WordPress plugin directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication, making it trivial to exploit if reachable by external traffic.

Analyst Recommendation

This vulnerability carries a critical severity rating and requires immediate attention from security teams. Organizations using this plugin must prioritize applying the vendor-provided patch to prevent unauthorized access and potential full system takeover.

---METADATA---
VENDOR: Mozilla
PRODUCT: DOM: Core & HTML component
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the DOM: Core & HTML component could allow for memory corruption and potential code execution via malicious web content.

Executive Summary:
A critical use-after-free vulnerability in the DOM component of web browsers allows unauthenticated attackers to execute arbitrary code through specially crafted web pages.

Vulnerability Details

CVE-ID: CVE-2026-2798

Affected Software: Mozilla DOM: Core & HTML component

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a use-after-free vulnerability occurring within the DOM: Core & HTML component. An unauthenticated remote attacker can exploit this by enticing a user to visit a malicious website, leading to memory corruption and potentially arbitrary code execution within the context of the browser.

Business Impact

Exploitation of this vulnerability can lead to the total compromise of the user's workstation, allowing for data theft, malware installation, and further lateral movement within the corporate network. With a CVSS score of 8.8, this represents a high risk to organizational security, particularly for employees accessing the internet from corporate devices.

Remediation Plan

Immediate Action: Update all affected web browsers to the latest versions provided by the vendor to patch the underlying memory management flaw.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for suspicious browser child processes or unexpected memory access patterns.

Compensating Controls: Implement web filtering to block access to known malicious domains and use browser isolation technologies to execute untrusted web content in a secure sandbox.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Use-after-free flaws in browser engines are frequently targeted by advanced persistent threat (APT) groups for initial access.

Analyst Recommendation

Browser vulnerabilities are a primary vector for initial entry into corporate environments. It is vital to ensure that all client-side software is automatically updated and that robust endpoint security measures are in place to detect and block exploitation attempts.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: Prior to version 1.8.0
---END_METADATA---

Description Summary:
Langflow's CSV Agent node improperly enables dangerous code execution by default, allowing unauthenticated attackers to achieve remote code execution via prompt injection.

Executive Summary:
The hardcoded enablement of dangerous code execution in Langflow's CSV Agent node allows unauthenticated attackers to execute arbitrary commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-27966

Affected Software: Langflow

Affected Versions: Prior to version 1.8.0

Vulnerability: The CSV Agent node in Langflow hardcodes the allow_dangerous_code parameter to True, which exposes LangChain’s Python REPL tool. An unauthenticated attacker can leverage prompt injection to execute arbitrary Python and operating system commands.

Business Impact

A successful exploit results in full Remote Code Execution (RCE) on the underlying server, potentially leading to complete system takeover. Attackers could steal proprietary AI models, access sensitive datasets, or use the server as a pivot point for lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this unauthenticated execution flaw.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.8.0 or later, which disables the dangerous default configuration.

Proactive Monitoring: Audit Langflow logs for suspicious prompt patterns or unexpected Python execution errors within the CSV Agent node.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block prompt injection patterns aimed at LLM-integrated tools.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing prevalence of prompt injection attacks against AI frameworks, exploitation is likely if systems remain unpatched.

Analyst Recommendation

The exposure of a Python REPL tool to unauthenticated input constitutes a severe security failure. Organizations utilizing Langflow must prioritize the update to version 1.8.0 to mitigate the risk of full server compromise and data exfiltration.

---METADATA---
VENDOR: Authlib
PRODUCT: Authlib
AFFECTED_VERSIONS: Prior to version 1.6.9
---END_METADATA---

Description Summary:
A JWK Header Injection vulnerability in Authlib's JWS implementation allows unauthenticated attackers to forge arbitrary JWT tokens by embedding a malicious public key in the header.

Executive Summary:
Authlib is vulnerable to a critical authentication bypass that allows unauthenticated attackers to forge cryptographically valid tokens and gain unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2026-27962

Affected Software: Authlib

Affected Versions: Prior to version 1.6.9

Vulnerability: This is a JWK Header Injection vulnerability occurring when the library extracts cryptographic keys directly from attacker-controlled JWT headers. An unauthenticated attacker can sign a token with their own private key and embed the matching public key, tricking the server into validating the forged token.

Business Impact

A successful exploit results in a total bypass of the authentication and authorization framework. Attackers can impersonate any user, including administrators, leading to full data compromise and unauthorized system control. The CVSS score of 9.1 reflects the critical nature of this flaw, as it undermines the core security trust model of the OAuth and OpenID Connect implementation.

Remediation Plan

Immediate Action: Update the Authlib library to version 1.6.9 or later immediately to ensure the JWS deserialization functions no longer accept untrusted keys from headers.

Proactive Monitoring: Review application logs for unusual token signatures or unexpected administrative logins and monitor for any JWS deserialization calls where the key parameter is explicitly set to None.

Compensating Controls: Implement strict validation of the "iss" (issuer) and "aud" (audience) claims and restrict allowed signing algorithms at the application layer until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this flaw allows for a complete authentication bypass with minimal effort, the potential for exploitation is extremely high for any public-facing OIDC/OAuth server.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for the creation of "golden tokens" that bypass all security checks. IT teams must prioritize updating the Authlib Python package to version 1.6.9 immediately. Failure to remediate this flaw leaves the entire identity infrastructure exposed to trivial compromise.

---METADATA---
VENDOR: OpenCTI
PRODUCT: OpenCTI Platform
AFFECTED_VERSIONS: 6.6.0 through 6.9.12
---END_METADATA---

Description Summary:
OpenCTI contains a privilege escalation vulnerability allowing unauthenticated attackers to query the API as any user, including the default administrator.

Executive Summary:
This critical privilege escalation vulnerability in OpenCTI enables unauthenticated attackers to gain administrative control over the platform, posing a severe risk to threat intelligence data.

Vulnerability Details

CVE-ID: CVE-2026-27960

Affected Software: OpenCTI Platform

Affected Versions: 6.6.0 through 6.9.12

Vulnerability: This is a privilege escalation vulnerability within the OpenCTI API authentication logic. It allows an unauthenticated remote attacker to bypass authorization checks and perform actions as any user, including the primary administrator.

Business Impact

The ability for an unauthenticated actor to assume administrative privileges allows for full data exfiltration, deletion of threat intelligence, and potential persistent backdooring of the platform. With a CVSS score of 9.8, the impact is considered critical as it compromises the integrity and confidentiality of sensitive cybersecurity intelligence workflows.

Remediation Plan

Immediate Action: Upgrade the OpenCTI platform to version 6.9.13 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Audit API access logs for anomalous requests, particularly those originating from unknown IPs attempting to access administrative endpoints.

Compensating Controls: If patching is delayed, disable the default admin account using the APP__ADMIN__EXTERNALLY_MANAGED configuration setting to limit the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the security of your threat intelligence operations. Organizations should prioritize the deployment of the vendor-provided patch immediately to prevent unauthorized administrative access and potential platform compromise.

---METADATA---
VENDOR: Coolify
PRODUCT: Coolify
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Coolify self-hosted server and application management platform.

Executive Summary:
A critical security vulnerability in the Coolify management platform poses a high risk of unauthorized system control and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-27957

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Coolify platform, which is designed for managing servers, applications, and databases. The nature of the flaw allows for potential unauthorized actions that could compromise the integrity of the entire managed environment.

Business Impact

Because Coolify is used to manage critical server infrastructure and databases, a successful exploit could grant an attacker full control over the underlying assets. The CVSS score of 8.8 highlights the severity of this risk, which could result in complete system takeover, data exfiltration, and significant operational downtime for all services managed by the Coolify instance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Coolify project immediately to mitigate risks of unauthorized access.

Proactive Monitoring: Monitor server and database logs for unauthorized configuration changes or unexpected administrative sessions initiated from unknown IP addresses.

Compensating Controls: Isolate the Coolify management instance within a secure network segment and restrict access to authorized personnel via secure administrative gateways.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with the highest priority, as Coolify serves as a central point of control for multiple infrastructure components. Immediate patching is required to prevent potential lateral movement and full-scale compromise of the managed server environment.

---METADATA---
VENDOR: Nginx UI Team
PRODUCT: Nginx UI
AFFECTED_VERSIONS: Prior to version 2.3.3
---END_METADATA---

Description Summary:
Nginx UI prior to 2.3.3 allows unauthenticated access to the backup endpoint, exposing encryption keys in response headers and enabling full system backup decryption and theft.

Executive Summary:
An unauthenticated remote attacker can download and decrypt full system backups of Nginx UI, resulting in the total compromise of sensitive credentials, SSL private keys, and server configurations.

Vulnerability Details

CVE-ID: CVE-2026-27944

Affected Software: Nginx UI Team Nginx UI

Affected Versions: Prior to version 2.3.3

Vulnerability: This vulnerability is an authentication bypass and sensitive information disclosure located at the /api/backup endpoint. An unauthenticated attacker can retrieve encryption keys from the X-Backup-Security response header, allowing for the immediate decryption of hijacked system backups.

Business Impact

A successful exploit poses a catastrophic risk to organizational security, as backups contain session tokens, user credentials, and SSL private keys. Exposure of this data allows for impersonation, man-in-the-middle attacks, and persistent unauthorized access to the Nginx infrastructure. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and the high impact on confidentiality and integrity.

Remediation Plan

Immediate Action: Update Nginx UI to version 2.3.3 or later immediately to close the unauthenticated endpoint and secure the backup process.

Proactive Monitoring: Review web server access logs for unauthorized GET requests to the /api/backup endpoint and inspect headers in historical traffic if possible.

Compensating Controls: Restrict access to the Nginx UI management interface using IP allowlisting or a VPN to prevent exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows for unauthenticated remote data exfiltration of critical secrets, the potential for rapid exploitation by threat actors is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to full system compromise. IT administrators must prioritize the update to version 2.3.3 immediately. Following the update, it is strongly recommended to rotate all SSL keys and user credentials that were stored within the Nginx UI environment, as they should be considered compromised.

---METADATA---
VENDOR: OpenLIT
PRODUCT: OpenLIT
AFFECTED_VERSIONS: Prior to version 1.37.1
---END_METADATA---

Description Summary:
OpenLIT GitHub Actions workflows are vulnerable to unauthorized code execution via forked pull requests, leading to the potential theft of sensitive secrets and cloud service keys.

Executive Summary:
A critical security flaw in OpenLIT's CI/CD pipeline allows external attackers to execute malicious code and exfiltrate sensitive API keys and Google Cloud service credentials.

Vulnerability Details

CVE-ID: CVE-2026-27941

Affected Software: OpenLIT OpenLIT

Affected Versions: Prior to version 1.37.1

Vulnerability: The vulnerability stems from the improper use of the pull_request_target event in GitHub Actions, which executes untrusted code from forked repositories within the security context of the base repository. This provides an unauthenticated attacker with access to a write-privileged GITHUB_TOKEN and various sensitive secrets.

Business Impact

Exploitation of this vulnerability could lead to the total compromise of the OpenLIT repository and linked cloud environments. The exposure of Google Cloud service account keys and vector store tokens allows attackers to manipulate or steal proprietary AI engineering data and infrastructure. The CVSS score of 9.9 reflects the catastrophic potential for unauthorized resource access and data exfiltration.

Remediation Plan

Immediate Action: Update OpenLIT to version 1.37.1 immediately and audit all GitHub Actions workflows for the insecure use of the pull_request_target trigger.

Proactive Monitoring: Monitor GitHub Action logs for suspicious workflow runs initiated from forked repositories and review Google Cloud audit logs for unauthorized service account activity.

Compensating Controls: Restrict the permissions of the GITHUB_TOKEN to read-only by default and use OpenID Connect (OIDC) for cloud authentication instead of long-lived service account keys.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the misconfiguration of CI/CD pipelines is a common target for supply chain attacks, making the risk of exploitation significant.

Analyst Recommendation

This vulnerability poses a direct threat to the integrity of the OpenLIT project and its users' cloud environments. It is imperative to apply the update immediately and rotate all secrets, including Google Cloud keys and database tokens, that were stored as GitHub Actions secrets.

---METADATA---
VENDOR: Statamic
PRODUCT: Statamic CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Statamic CMS, a Laravel and Git-powered content management system, contains a high-severity vulnerability that could allow for unauthorized system manipulation.

Executive Summary:
A high-severity vulnerability in Statamic CMS poses a significant risk to web application integrity and data confidentiality, potentially allowing attackers to compromise the underlying Laravel framework.

Vulnerability Details

CVE-ID: CVE-2026-27939

Affected Software: Statamic Statamic CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Statamic CMS, a platform built on the Laravel framework. While the specific flaw type is not detailed in the summary, the CVSS score of 8.8 indicates a high-impact issue likely involving significant access bypass or remote execution capabilities, potentially accessible to unauthenticated or low-privileged users.

Business Impact

A successful exploit of this vulnerability could lead to a total compromise of the CMS environment, resulting in unauthorized content modification, data exfiltration, or complete site downtime. With a CVSS score of 8.8, the risk is categorized as High, as it directly threatens the integrity of the web presence and any sensitive data managed within the Laravel-based architecture.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Statamic development team immediately to patch the core CMS files.

Proactive Monitoring: Review web server and application logs for unusual POST requests or unauthorized changes to the Git-managed content repository.

Compensating Controls: Implement a Web Application Firewall (WAF) with rulesets configured to block common Laravel and CMS-specific exploit patterns to mitigate risk during the update window.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score of 8.8, the potential for rapid exploit development is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention from IT security teams. Organizations utilizing Statamic should prioritize the application of vendor-supplied patches to prevent potential unauthorized access and ensure the continued security of their web infrastructure.

---METADATA---
VENDOR: Isaacs
PRODUCT: minimatch
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability in the minimatch JavaScript library could lead to system resource exhaustion or security bypasses when processing glob expressions.

Executive Summary:
The minimatch library is affected by an additional high-severity flaw that enables attackers to disrupt application availability or circumvent security filters via malicious input strings.

Vulnerability Details

CVE-ID: CVE-2026-27904

Affected Software: minimatch

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to other flaws in glob-matching utilities, this vulnerability likely stems from inefficient processing of complex patterns. An unauthenticated attacker could provide a malicious string that causes the library to consume excessive resources or fail to match patterns as expected.

Business Impact

The high CVSS score of 7.5 highlights the potential for this vulnerability to cause significant service disruptions. For enterprises relying on Node.js for customer-facing applications, an exploit could lead to service outages and financial loss. Furthermore, if minimatch is used for access control lists (ACLs), an attacker might bypass security boundaries to access restricted files.

Remediation Plan

Immediate Action: Update all instances of the minimatch dependency to the latest patched version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review application logs for failed requests or timeouts associated with file uploads or path-based queries.

Compensating Controls: Use rate-limiting on endpoints that accept user-defined search patterns or file paths to reduce the impact of potential resource exhaustion attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Utility library flaws are often exploited silently in automated attacks, making proactive patching essential.

Analyst Recommendation

Given the high CVSS score and the widespread use of this library, administrators and developers must act swiftly. Ensure that all package-lock.json or yarn.lock files are updated to include the remediated version of minimatch to prevent the introduction of this vulnerability during automated builds.

---METADATA---
VENDOR: Isaacs
PRODUCT: minimatch
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The minimatch library, a JavaScript utility for glob matching, is vulnerable to a flaw that could result in application instability or unauthorized processing of malicious expressions.

Executive Summary:
The minimatch JavaScript library contains a high-severity vulnerability that could allow attackers to trigger a denial-of-service or compromise application logic through malformed glob expressions.

Vulnerability Details

CVE-ID: CVE-2026-27903

Affected Software: minimatch

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the way the minimatch utility converts glob expressions into JavaScript Regular Expressions. An attacker providing a specially crafted input string could potentially trigger a Regular Expression Denial of Service (ReDoS) or bypass intended matching logic.

Business Impact

Because minimatch is a foundational dependency in many Node.js applications and build tools, a vulnerability here has a wide-reaching impact. Exploitation could result in significant application downtime, increased CPU consumption on servers, or the bypassing of security filters that rely on glob matching for file or path authorization. The CVSS score of 7.5 reflects these substantial operational risks.

Remediation Plan

Immediate Action: Update the minimatch package to the latest version via npm or your preferred package manager and redeploy affected applications.

Proactive Monitoring: Monitor application performance for sudden spikes in CPU usage, which may indicate an attempt to exploit a ReDoS vulnerability.

Compensating Controls: Implement input validation to sanitize and limit the length and complexity of user-provided strings that are passed to glob-matching functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in widely used utility libraries are often targeted quickly once details are released to the developer community.

Analyst Recommendation

It is critical to identify all internal applications and CI/CD pipelines that utilize the minimatch library. Immediate updates are required to ensure that these applications remain resilient against denial-of-service attacks and to maintain the integrity of path-matching security controls.

---METADATA---
VENDOR: Vociferous
PRODUCT: Vociferous
AFFECTED_VERSIONS: Prior to 4.4.2
---END_METADATA---

Description Summary:
Vociferous prior to 4.4.2 contains an unauthenticated directory traversal vulnerability in the export_file route, enabling arbitrary file writes to any location accessible by the application.

Executive Summary:
Vociferous versions prior to 4.4.2 are vulnerable to a critical unauthenticated directory traversal attack that allows remote actors to overwrite system files or deploy malicious payloads.

Vulnerability Details

CVE-ID: CVE-2026-27897

Affected Software: Vociferous

Affected Versions: Prior to 4.4.2

Vulnerability: The vulnerability exists in src/api/system.py within the export_file route. Because the API is unauthenticated and lacks filename validation, an attacker can use directory traversal sequences (e.g., ../) to bypass the intended UI and write arbitrary data to any path reachable by the user running the application.

Business Impact

With a CVSS score of 10.0, this is a maximum-severity vulnerability. Attackers can achieve full system compromise by overwriting critical configuration files or placing executable scripts in startup directories. The overly permissive CORS configuration further increases the risk of exploitation via cross-site requests.

Remediation Plan

Immediate Action: Update Vociferous to version 4.4.2 or later immediately to resolve the lack of input validation in the filesystem logic.

Proactive Monitoring: Review filesystem integrity for unauthorized changes in sensitive directories and monitor API logs for requests containing directory traversal patterns in the JSON payload.

Compensating Controls: Restrict network access to the Vociferous API using a firewall and modify the CORS configuration to disallow wildcard origins, limiting the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, the combination of unauthenticated access and arbitrary file write makes this an extremely attractive target for attackers.

Analyst Recommendation

The ability to write arbitrary files as an unauthenticated user is a critical failure in the application's security architecture. The urgency to apply the 4.4.2 patch cannot be overstated; failure to do so leaves the host system entirely exposed to remote compromise.

---METADATA---
VENDOR: NeoRazorX
PRODUCT: FacturaScripts
AFFECTED_VERSIONS: < 2026.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FacturaScripts is susceptible to improper input validation and unrestricted file uploads, which could allow an authenticated administrator to execute arbitrary code.

Executive Summary:
An authenticated administrator-level vulnerability in FacturaScripts allows for arbitrary file uploads, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27891

Affected Software: NeoRazorX FacturaScripts

Affected Versions: < 2026.1

Vulnerability: The application fails to properly validate input and restricts file uploads, allowing an authenticated user with administrative privileges to upload and execute malicious files on the host server.

Business Impact

Successful exploitation allows an attacker with administrative access to achieve remote code execution, potentially leading to total system compromise, data exfiltration, or complete disruption of accounting services. With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of sensitive financial data.

Remediation Plan

Immediate Action: Update FacturaScripts to version 2026.1 or later immediately to address the underlying input validation and file upload flaws.

Proactive Monitoring: Review web server and application logs for suspicious file uploads or access to non-standard executable files within the upload directories.

Compensating Controls: Implement strict file type validation at the Web Application Firewall (WAF) level and restrict administrative access to the application to trusted, internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from insufficient server-side validation of user-supplied files.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize patching FacturaScripts to version 2026.1. While the vulnerability requires administrative authentication, the impact of a breach in an accounting system is severe and warrants immediate remediation.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Piwigo photo gallery application, potentially impacting web-based image hosting security.

Executive Summary:
An additional high-severity security vulnerability in Piwigo requires immediate administrative review to ensure the integrity of web-hosted content.

Vulnerability Details

CVE-ID: CVE-2026-27885

Affected Software: Piwigo Photo Gallery

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An unspecified security vulnerability exists within the Piwigo application. Further technical details remain pending; however, the severity necessitates proactive patching.

Business Impact

With a CVSS score of 7.2, this vulnerability poses a high risk to organizational web assets. Successful exploitation could facilitate unauthorized access to private content or administrative functions, potentially leading to data loss or service disruption.

Remediation Plan

Immediate Action: Update all Piwigo instances to the latest available version provided by the vendor.

Proactive Monitoring: Review application logs for any irregular activity or unauthorized configuration changes to the photo gallery.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rulesets to protect against potential web-based attack vectors targeting Piwigo.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency. Ensure that all instances of Piwigo are patched and that security configurations are reviewed to defend against potential exploitation.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana
AFFECTED_VERSIONS: See vendor advisory; affects OSS and Enterprise versions
---END_METADATA---

Description Summary:
A chained attack involving SQL Expressions and a Grafana Enterprise plugin enables remote arbitrary code execution (RCE) when the sqlExpressions feature toggle is active.

Executive Summary:
Grafana instances with the sqlExpressions feature enabled are at critical risk of Remote Code Execution (RCE) through a chained vulnerability in Enterprise plugins.

Vulnerability Details

CVE-ID: CVE-2026-27876

Affected Software: Grafana (OSS and Enterprise)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a chained vulnerability where the "sqlExpressions" feature toggle in Grafana OSS interacts with a Grafana Enterprise plugin to allow Remote Code Execution. An attacker can exploit this chain to execute arbitrary code on the host system.

Business Impact

The CVSS score of 9.1 indicates a critical risk to the organization. Successful exploitation allows an attacker to gain full control over the Grafana server, potentially leading to lateral movement within the network, data exfiltration, and complete compromise of the monitoring infrastructure. This could result in prolonged service outages and significant security remediation costs.

Remediation Plan

Immediate Action: Update Grafana and all Enterprise plugins to the latest versions immediately. If patching is not possible, disable the sqlExpressions feature toggle in the Grafana configuration.

Proactive Monitoring: Monitor system logs for unauthorized shell execution or unexpected network connections originating from the Grafana server.

Compensating Controls: Restrict access to the Grafana web interface to authorized internal users only and ensure the service is running with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of the chain may limit widespread exploitation, but the RCE impact makes it a high-priority target.

Analyst Recommendation

Due to the potential for Remote Code Execution, this vulnerability must be addressed with the highest urgency. Administrators should prioritize upgrading their Grafana environment and verifying that the sqlExpressions feature is only enabled if absolutely necessary and properly secured.