---METADATA---
VENDOR: TUBITAK BILGEM
PRODUCT: Pardus Domain Joiner
AFFECTED_VERSIONS: 0.5.2 up to (excluding) 0.5.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pardus Domain Joiner is susceptible to an information disclosure vulnerability where sensitive data is exposed during process invocation, enabling potential excavation.

Executive Summary:
A high-severity vulnerability in Pardus Domain Joiner exposes sensitive information during process invocation, increasing the risk of credential or configuration theft.

Vulnerability Details

CVE-ID: CVE-2026-12250

Affected Software: TUBITAK BILGEM Pardus Domain Joiner

Affected Versions: 0.5.2 up to (excluding) 0.5.4

Vulnerability: The application is vulnerable to the invocation of a process using visible sensitive information (CWE-214). This occurs when sensitive parameters or credentials are exposed in plain view, such as in process command lines, during the domain joining operation.

Business Impact

The exposure of sensitive information during system operations can lead to the compromise of domain credentials or other security-sensitive configurations. With a CVSS score of 7.9, this vulnerability poses a high risk of identity theft or unauthorized network access, potentially affecting the integrity and confidentiality of the entire enterprise domain environment.

Remediation Plan

Immediate Action: Update Pardus Domain Joiner to version 0.5.4 or the latest available vendor patch.

Proactive Monitoring: Monitor process execution logs and command-line auditing tools to identify instances where sensitive strings might be exposed by the application.

Compensating Controls: Implement strict environment-level security to limit the visibility of running processes to only those users with a legitimate business need for that information.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the update of this software to ensure that sensitive domain-joining credentials are not inadvertently exposed to local users. Promptly applying the patch is the most effective method to prevent potential credential theft and subsequent lateral movement within the network.

---METADATA---
VENDOR: Canonical
PRODUCT: ADSys
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unspecified vulnerability exists in Canonical ADSys upstream versions through v0, requiring immediate review of vendor security disclosures.

Executive Summary:
A high-severity vulnerability has been identified in the Canonical ADSys utility, necessitating immediate attention from system administrators to prevent potential security compromise.

Vulnerability Details

CVE-ID: CVE-2026-12249

Affected Software: Canonical ADSys

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a security issue found in the Canonical ADSys upstream code. Technical details regarding the exploit vector are currently limited, and administrators should consult the vendor's official security bulletin for the specific scope of the flaw.

Business Impact

As a component often involved in Active Directory integration and system management, a vulnerability in ADSys could lead to unauthorized system configuration changes or privilege escalation. With a CVSS score of 8.3, this issue is classified as high-severity and warrants immediate remediation to protect the integrity of managed Ubuntu environments.

Remediation Plan

Immediate Action: Consult the Canonical security advisory and apply all available patches for ADSys immediately.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unexpected configuration changes on machines utilizing ADSys.

Compensating Controls: Restrict access to configuration management interfaces and ensure that administrative accounts are highly protected until the patch is verified.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this high-severity advisory with urgency. Canonical frequently updates their security notices; ensure that your patch management systems are configured to pull the latest security updates for ADSys to mitigate this risk.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: NSD (Name Server Daemon)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the NLnet Labs NSD software, potentially allowing for significant service disruption or unauthorized control.

Executive Summary:
The NSD authoritative DNS server is affected by a high-severity vulnerability that could lead to significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2026-12245

Affected Software: NLnet Labs NSD

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a critical flaw in the NSD authoritative DNS server. While specific exploitation vectors are currently limited, such flaws typically involve memory corruption or packet handling errors that can be triggered by unauthenticated remote attackers.

Business Impact

The exploitation of a DNS server presents a severe risk to organizational availability and security posture. Given the CVSS score of 8.7, a successful attack could lead to denial-of-service conditions, resulting in the inability of internal and external clients to resolve critical domain names, thereby causing widespread system downtime and potential redirection of traffic.

Remediation Plan

Immediate Action: Monitor official NLnet Labs security bulletins and apply the latest security patch as soon as it is released.

Proactive Monitoring: Review DNS server logs for anomalous request patterns or sudden spikes in traffic that may indicate exploitation attempts.

Compensating Controls: Ensure the DNS infrastructure is protected by rate-limiting and access control lists (ACLs) to restrict traffic to known, trusted sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of DNS in network operations, this vulnerability poses a significant risk to infrastructure stability. Organizations should prioritize patching as soon as the vendor provides an update and maintain rigorous monitoring of DNS traffic to detect any signs of compromise.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: NSD (Name Server Daemon)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
NSD is vulnerable to a heap overflow during AXFR zone transfers when processing maliciously crafted SVCB resource records.

Executive Summary:
A heap overflow vulnerability in the NSD name server allows a malicious primary zone authority to trigger a crash or potentially execute arbitrary code on a secondary DNS server.

Vulnerability Details

CVE-ID: CVE-2026-12244

Affected Software: NLnet Labs NSD

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from improper handling of SVCB resource record rdata sizes during AXFR transfers, which causes an integer wrap-around in a (uint16_t) variable. This leads to an insufficient memory allocation and a subsequent heap overflow, which can be triggered by an attacker controlling the primary zone.

Business Impact

A successful exploit of this vulnerability could lead to a denial-of-service (DoS) condition by crashing the DNS service, potentially impacting name resolution for the entire organization. With a CVSS score of 8.7, the risk of arbitrary code execution cannot be ruled out, which would allow an attacker to gain a foothold on critical DNS infrastructure.

Remediation Plan

Immediate Action: Update the NSD installation to the latest patched version released by NLnet Labs as soon as it becomes available.

Proactive Monitoring: Monitor DNS server logs for unexpected service crashes and review traffic patterns for large or malformed AXFR requests.

Compensating Controls: Restrict zone transfers (AXFR/IXFR) to trusted IP addresses only to prevent unauthorized primary servers from interacting with your secondary instances.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining stable DNS infrastructure is critical to overall network availability. Security teams should prioritize patching NSD instances to prevent both service disruption and potential system-level compromise. Regularly audit the list of authorized primary servers for all secondary zone configurations to minimize the attack surface.

---METADATA---
VENDOR: NLTK Project
PRODUCT: NLTK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in NLTK version 3 that may lead to potential system compromise.

Executive Summary:
The NLTK library (version 3) is susceptible to a high-severity vulnerability that could result in arbitrary code execution or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-12243

Affected Software: NLTK Project NLTK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the processing logic of NLTK version 3. It may allow an attacker to trigger malicious behavior through specially crafted inputs, regardless of the authentication state of the user.

Business Impact

With a CVSS score of 7.5, this vulnerability poses a substantial risk to applications relying on NLTK for natural language processing. Successful exploitation could lead to unauthorized data access or the execution of arbitrary commands, potentially compromising the confidentiality and integrity of the underlying host system.

Remediation Plan

Immediate Action: Update the NLTK library to the latest secure version recommended by the NLTK Project as soon as it becomes available.

Proactive Monitoring: Monitor application logs for unexpected input patterns or unusual system process execution associated with NLTK workloads.

Compensating Controls: Implement input validation and sanitization layers to filter untrusted data before it is processed by the NLTK library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the library's widespread use in data processing pipelines, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately audit their software dependencies to identify the use of vulnerable NLTK versions. Prioritize the application of vendor-provided patches or library updates to eliminate this vector of attack and protect critical data processing environments.

---METADATA---
VENDOR: WordPress
PRODUCT: AdRotate Banner Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection, potentially allowing remote code execution.

Executive Summary:
The AdRotate Banner Manager plugin for WordPress contains a critical PHP Code Injection vulnerability that could allow unauthenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-12242

Affected Software: WordPress AdRotate Banner Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an improper input validation flaw that permits PHP Code Injection. The vulnerability is exploitable by unauthenticated users, as the plugin fails to properly sanitize inputs before processing them in a dangerous manner.

Business Impact

A successful exploit of this vulnerability results in full server compromise, allowing attackers to read, modify, or delete sensitive application data. Given the CVSS score of 8.8, this represents a high-severity risk to business continuity and data integrity, potentially leading to total system takeover and lateral movement within the WordPress environment.

Remediation Plan

Immediate Action: Update the AdRotate Banner Manager plugin to the latest available version provided by the vendor.

Proactive Monitoring: Inspect web server access logs for suspicious POST requests containing PHP syntax or unexpected file modification timestamps.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block common code injection patterns and restrict access to the plugin's administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Organizations utilizing the AdRotate Banner Manager plugin must prioritize applying the latest security patches to mitigate the risk of remote code execution. If a patch is not immediately available, administrators should consider disabling the plugin until a secure version is released.

---METADATA---
VENDOR: WordPress
PRODUCT: Export User Data Plugin
AFFECTED_VERSIONS: All versions up to, and including, 2
---END_METADATA---

Description Summary:
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to improper file path validation in the unserialize function.

Executive Summary:
A critical arbitrary file deletion vulnerability in the Export User Data WordPress plugin allows attackers to remove essential system files, potentially leading to a complete site outage.

Vulnerability Details

CVE-ID: CVE-2026-12240

Affected Software: WordPress Export User Data Plugin

Affected Versions: All versions up to, and including, 2

Vulnerability: The plugin fails to adequately sanitize input before processing it through the unserialize function, allowing an attacker to manipulate file paths. This vulnerability likely requires elevated privileges, though the impact is significant due to the potential for permanent data loss or site destruction.

Business Impact

The ability to delete arbitrary files on the server can result in complete site downtime, loss of configuration, or the removal of critical security files. With a CVSS score of 8.0, this high-severity vulnerability poses an immediate threat to the operational continuity and integrity of the affected WordPress site.

Remediation Plan

Immediate Action: Update the Export User Data plugin to the latest available version, or deactivate and remove the plugin if it is not strictly necessary for business operations.

Proactive Monitoring: Monitor file system integrity and review WordPress administrative audit logs for unusual file deletion activity or unauthorized plugin configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious serialized input and restrict file system access permissions to the minimum necessary for the web server user.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the ease of triggering file deletion, the potential for exploitation is high.

Analyst Recommendation

Site administrators should treat this vulnerability with urgency. If an update is not immediately available, the safest course of action is to disable the plugin entirely to prevent potential site destruction by unauthorized parties.

---METADATA---
VENDOR: WordPress
PRODUCT: Dokan Pro
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via the update_capabilities REST endpoint, allowing unauthorized users to elevate their access levels.

Executive Summary:
The Dokan Pro plugin for WordPress contains a critical privilege escalation flaw that could allow an attacker to gain unauthorized administrative control over the site.

Vulnerability Details

CVE-ID: CVE-2026-12224

Affected Software: WordPress Dokan Pro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an insecure REST API endpoint, update_capabilities, which fails to properly validate user permissions. An attacker can exploit this to escalate their current user privileges, potentially gaining full administrative access to the WordPress installation.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to the entire web application. Privilege escalation allows an attacker to bypass standard security controls, leading to total site compromise, data exfiltration, or the injection of malicious code, which could result in significant reputational damage and loss of customer trust.

Remediation Plan

Immediate Action: Update the Dokan Pro plugin to the latest version immediately to patch the vulnerable REST endpoint.

Proactive Monitoring: Monitor WordPress user role changes and administrative login activity for any unexpected modifications to user capabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests targeting the update_capabilities REST endpoint until the plugin can be updated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in plugins are frequently targeted by automated botnets. It is critical to patch the Dokan Pro plugin immediately. Organizations should also perform a security audit of current administrative users to ensure no unauthorized accounts were created during the period the site remained vulnerable.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A buffer overflow in the Yealink SIP-T46U Web FastCGI service allows local network attackers to trigger a crash or potentially execute arbitrary code.

Executive Summary:
A stack-based buffer overflow in the Yealink SIP-T46U Web FastCGI service poses a significant security risk for devices accessible via the local network.

Vulnerability Details

CVE-ID: CVE-2026-12222

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the mod_webd.BlueToothTest function within the /api/inner/bttest file. An attacker with local network access can exploit this by sending specially crafted btMac, pin, or reserved arguments to the Web FastCGI service.

Business Impact

The CVSS score of 8.0 indicates a high potential for impact. Successful exploitation could lead to a denial-of-service or arbitrary code execution, resulting in the loss of device confidentiality, integrity, or availability.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware updates. Restrict network access to the device to prevent unauthorized parties from reaching the Web FastCGI interface.

Proactive Monitoring: Monitor for anomalous traffic directed at the /api/inner/bttest endpoint and investigate any unexpected device reboots.

Compensating Controls: Use a firewall or VLAN configuration to ensure the device's management interface is not reachable from untrusted network segments.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit exists. The vulnerability is highly exploitable by any attacker with access to the local network, necessitating immediate defensive measures.

Analyst Recommendation

The combination of a public exploit and the high CVSS score makes this a critical security issue. Organizations using Yealink SIP-T46U devices should verify their firmware versions and restrict management interface access to prevent exploitation.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Yealink SIP-T46U firmware upgrade handler allows local network attackers to disrupt service or execute arbitrary code.

Executive Summary:
A stack-based buffer overflow in the Yealink SIP-T46U upgrade handler exposes the device to potential compromise by attackers with local network access.

Vulnerability Details

CVE-ID: CVE-2026-12221

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the sprintf function located in the /api/upgrade/upgrade file. Exploitation is possible by manipulating the uid/start_offset arguments within the Firmware Chunk Upload Handler.

Business Impact

The CVSS score of 8.0 confirms the high severity of this vulnerability. Successful exploitation could lead to full device compromise, potentially enabling an attacker to intercept communications or use the device as a pivot point within the local network.

Remediation Plan

Immediate Action: Apply firmware updates from Yealink as soon as they become available. Segment the management network to prevent unauthorized access to device API endpoints.

Proactive Monitoring: Review device access logs for frequent or malformed requests to the /api/upgrade/ path.

Compensating Controls: Implement network-level access control lists (ACLs) to ensure only authorized workstations can communicate with the SIP phone's management interface.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit is available. The requirement for local network access does not significantly diminish the risk, as an attacker already present on the network can leverage this to escalate their presence.

Analyst Recommendation

Due to the public availability of an exploit, this vulnerability must be treated with high urgency. Administrators should isolate the device management interfaces and monitor for any suspicious traffic targeting the firmware upgrade handlers.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Yealink SIP-T46U firmware upgrade component allows local network attackers to potentially achieve remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Yealink SIP-T46U firmware handling could allow attackers on the local network to compromise the device.

Vulnerability Details

CVE-ID: CVE-2026-12220

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the mod_upgrade.SparePartsUpload function within the /api/upgrade/accupgradebychunk component. An attacker with local network access can trigger this by sending malicious data to the Firmware Chunk Upload handler.

Business Impact

With a CVSS score of 8.0, this vulnerability presents a high risk of unauthorized device control. Exploitation could allow an attacker to gain persistent access to telecommunications hardware, facilitating eavesdropping or further network lateral movement.

Remediation Plan

Immediate Action: Apply the latest firmware security updates provided by Yealink. If no update is available, isolate the device management interface from the general network.

Proactive Monitoring: Monitor network traffic for anomalous firmware upload attempts or unexpected API calls to the /api/upgrade/ endpoint.

Compensating Controls: Restrict access to the device's web management interface to trusted administrative IP addresses using network segmentation or ACLs.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit exists for this vulnerability. While exploitation requires local network access, the potential for device compromise is high and warrants immediate attention.

Analyst Recommendation

Given the availability of a public exploit and the potential for full device compromise, users must restrict access to the affected SIP phone's management interface immediately. Apply any available firmware patches from the manufacturer as soon as they are released.

Executive Summary:
A high-severity vulnerability has been identified in the BROWAN COMMUNICATIONS PrismX MX100 AP controller. This flaw allows a remote attacker with existing privileges to upload malicious files, which can then be executed to gain complete control over the affected server. Successful exploitation could lead to data theft, network disruption, and further unauthorized access into the corporate network.

Vulnerability Details

CVE-ID: CVE-2026-1222

Affected Software: BROWAN COMMUNICATIONS PrismX MX100 AP controller

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an Arbitrary File Upload vulnerability. An attacker who has already obtained privileged credentials for the device's management interface can exploit this flaw by uploading a specially crafted file, such as a web shell. The application fails to properly validate the uploaded file's type or content, allowing the malicious file to be saved to a web-accessible directory on the server. The attacker can then execute the code within the file by navigating to its URL, resulting in arbitrary code execution with the permissions of the web server process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.2. A successful exploit would result in a complete compromise of the PrismX MX100 AP controller. This could allow an attacker to intercept or manipulate network traffic, steal sensitive configuration data, disable wireless network services, or use the compromised controller as a pivot point to launch further attacks against the internal network. The specific risks to the organization include data breaches, operational downtime, and a loss of integrity for the managed network environment.

Remediation Plan

Immediate Action: Apply the security updates provided by BROWAN COMMUNICATIONS to all affected PrismX MX100 AP controllers immediately. Before and after patching, closely monitor devices for any signs of compromise and review historical access and system logs for indicators of exploitation.

Proactive Monitoring: Monitor web server and application logs for suspicious file upload events, particularly files with executable extensions (e.g., .php, .jsp, .sh, .aspx). Scrutinize network traffic for unexpected outbound connections originating from the AP controller. Implement file integrity monitoring on the device's web directories to detect the creation of unauthorized files.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Restrict access to the device's management interface to a limited set of trusted IP addresses or a dedicated management VLAN.
• Deploy a Web Application Firewall (WAF) with rules to inspect and block malicious or unexpected file types from being uploaded.
• Ensure all administrative credentials for the device are strong, unique, and not default.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 20, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability requires the attacker to be authenticated with privileges, which reduces the risk of widespread, opportunistic attacks. However, threat actors who have already gained a foothold in a network may leverage this vulnerability for privilege escalation or lateral movement.

Analyst Recommendation
Given the high severity score and the potential for complete system compromise, it is strongly recommended that organizations prioritize the immediate application of vendor-supplied patches to all affected controllers. Although this vulnerability is not currently on the CISA KEV list and requires prior authentication, the impact of a successful exploit is severe. If patching is delayed, the compensating controls outlined above, particularly restricting network access to the management interface, should be implemented as a critical interim measure to reduce the attack surface.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Yealink SIP-T46U IP phone firmware, potentially allowing for unauthorized system impact.

Executive Summary:
A critical security vulnerability in Yealink SIP-T46U firmware poses a significant risk to enterprise communication infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-12218

Affected Software: Yealink SIP-T46U

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Yealink SIP-T46U firmware; while specific authentication requirements are currently undisclosed, such flaws often involve improper input validation or insufficient access controls within the device's management interface.

Business Impact

Successful exploitation of this high-severity vulnerability (CVSS 8.0) could lead to unauthorized access to enterprise communication devices. This may result in call interception, eavesdropping, or the pivot of attackers into internal voice-over-IP (VoIP) networks, causing substantial reputational damage and operational disruption.

Remediation Plan

Immediate Action: Administrators should verify the current firmware version of all deployed SIP-T46U units and apply the latest security updates provided by Yealink immediately.

Proactive Monitoring: Review device access logs for unusual login attempts or unexpected configuration changes originating from unauthorized IP addresses.

Compensating Controls: Isolate VoIP devices on a dedicated, firewalled VLAN to restrict management access to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Yealink SIP-T46U devices must prioritize this update. Ensure that all firmware management is conducted over secure, segmented networks to minimize exposure while awaiting vendor-specific patching guidance.

---METADATA---
VENDOR: DVDFab
PRODUCT: Virtual Drive
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in DVDFab Virtual Drive, which may permit unauthorized system-level interactions.

Executive Summary:
A high-severity vulnerability in DVDFab Virtual Drive poses a risk of unauthorized access or system instability on affected hosts.

Vulnerability Details

CVE-ID: CVE-2026-12217

Affected Software: DVDFab Virtual Drive

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the DVDFab Virtual Drive software, potentially involving improper validation of virtual image files or system drivers that could be exploited to cause system-level impact.

Business Impact

With a CVSS score of 7.8, this flaw represents a significant risk to endpoint integrity. Exploitation could allow an attacker to execute arbitrary code or gain unauthorized control over the system, potentially leading to data exfiltration or system-wide compromise.

Remediation Plan

Immediate Action: Update the DVDFab Virtual Drive software to the most current version available from the vendor.

Proactive Monitoring: Review system logs for unusual driver activity or unexpected application crashes that may indicate an exploitation attempt.

Compensating Controls: Use application control policies to restrict the execution of untrusted software or the mounting of unauthorized virtual drive images.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should audit their environments for the presence of DVDFab Virtual Drive and apply the necessary patches. If the software is not required for business operations, consider uninstalling it to reduce the attack surface.

---METADATA---
VENDOR: Qihoo 360
PRODUCT: Total Security
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in Qihoo 360 Total Security, potentially impacting the effectiveness of the endpoint protection suite.

Executive Summary:
A high-severity vulnerability in Qihoo 360 Total Security could allow attackers to bypass security protections or compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-12214

Affected Software: Qihoo 360 Total Security

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a security flaw within the Qihoo 360 Total Security suite, potentially allowing an attacker to manipulate the software's protective mechanisms or execute code with elevated permissions.

Business Impact

A CVSS score of 7.8 indicates a high risk to organizational security. Successful exploitation could render the security software ineffective, leaving the host vulnerable to further attacks, malware delivery, or unauthorized access to sensitive local data.

Remediation Plan

Immediate Action: Apply the latest security updates released by Qihoo 360 to all systems running the Total Security suite immediately.

Proactive Monitoring: Monitor security logs for alerts indicating the deactivation or modification of the antivirus software or unexpected system behavior.

Compensating Controls: Ensure that additional layers of security, such as network-level filtering and host-based firewalls, are active to mitigate the risk of exploit delivery.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize updating endpoint protection software to ensure that the security suite itself does not become an attack vector. Verify that automatic updates are enabled and functioning across the environment.

Executive Summary:
A critical vulnerability has been identified in multiple PrismX products, allowing unauthenticated remote attackers to gain full access to the device's database. This is due to hard-coded credentials stored within the device firmware, which could lead to a complete compromise of data confidentiality, integrity, and availability. Immediate patching is required to prevent potential data breaches and system takeover.

Vulnerability Details

CVE-ID: CVE-2026-1221

Affected Software: PrismX Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The PrismX MX100 AP controller firmware contains static, hard-coded database credentials. A remote, unauthenticated attacker can extract these credentials by analyzing the firmware file. Once obtained, the attacker can use these credentials to directly log in to the device's database, bypassing all authentication mechanisms and gaining privileged access to the stored data.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation grants an attacker direct administrative access to the database, posing a significant risk to the organization. Potential consequences include unauthorized access to sensitive configuration data, customer information, or network credentials; modification or deletion of critical data leading to service disruption; and using the compromised device as a pivot point for further attacks within the network. This can result in severe financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Organizations must immediately apply the security updates provided by the vendor to all affected PrismX products. After patching, it is crucial to monitor systems for any signs of compromise that may have occurred prior to the update and review all database access logs for unauthorized connections.

Proactive Monitoring: Implement enhanced monitoring for database access attempts originating from untrusted or unexpected IP addresses. Network traffic should be monitored for unusual data flows from the database server, which could indicate data exfiltration. System logs should be reviewed for authentication attempts using the now-public hard-coded credentials.

Compensating Controls: If immediate patching is not feasible, implement network segmentation to restrict access to the database port from untrusted networks, such as the internet. Deploy an Intrusion Prevention System (IPS) or Web Application Firewall (WAF) with rules to detect and block login attempts using the known hard-coded credentials. If possible, manually change the default database password on the device, though this may not be supported on all firmware versions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of Jan 20, 2026, there are no known public exploits actively targeting this vulnerability. However, due to the trivial nature of exploiting hard-coded credentials, it is highly likely that threat actors will reverse-engineer the firmware to discover the credentials and weaponize this vulnerability in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the ease of exploitation, this vulnerability presents a clear and present danger to the organization. We strongly recommend that all affected PrismX products be patched immediately, treating this as the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, its high impact and low attack complexity make it a prime candidate for future inclusion and widespread exploitation. Organizations should assume they are being targeted and act decisively to mitigate this risk.

---METADATA---
VENDOR: ShopXO
PRODUCT: ShopXO
AFFECTED_VERSIONS: ShopXO up to 6.7.1
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability in the ShopXO Crontab.php controller allows attackers to manipulate scheduled tasks and bypass authorization.

Executive Summary:
An unauthenticated vulnerability in ShopXO allows remote attackers to bypass authorization mechanisms by manipulating scheduled tasks in the Crontab controller.

Vulnerability Details

CVE-ID: CVE-2026-12204

Affected Software: ShopXO

Affected Versions: ShopXO up to 6.7.1

Vulnerability: This vulnerability stems from improper access control in the Crontab.php controller, which allows an unauthenticated remote attacker to trigger or manipulate scheduled tasks. By bypassing existing authorization checks, an attacker can potentially execute unauthorized actions.

Business Impact

The CVSS score of 7.3 (High) highlights the significant risk of unauthorized access and potential system compromise. If exploited, an attacker could gain control over administrative tasks, leading to data tampering, unauthorized site modifications, or complete system takeover.

Remediation Plan

Immediate Action: Upgrade to the latest version of ShopXO that includes the security patch for Crontab.php authorization vulnerabilities.

Proactive Monitoring: Review web server logs for suspicious requests directed at the Crontab.php controller or unexpected execution of administrative scheduled tasks.

Compensating Controls: Restrict access to administrative controllers and cron-related endpoints using IP whitelisting or by requiring authentication at the web server (e.g., Nginx/Apache) level.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit is available for this vulnerability. The lack of authentication requirements makes this a high-risk target for automated exploitation.

Analyst Recommendation

This vulnerability is highly critical due to the availability of a public exploit and the lack of required authentication. Organizations running ShopXO should treat this as a high-priority remediation task and apply necessary updates immediately to secure their platform from unauthorized access.

---METADATA---
VENDOR: Ritlabs
PRODUCT: TinyWeb Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the Ritlabs TinyWeb Server, affecting versions up to 1.

Executive Summary:
The Ritlabs TinyWeb Server is subject to a high-severity security vulnerability that could lead to unauthorized system access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-12200

Affected Software: Ritlabs TinyWeb Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of the TinyWeb Server, potentially allowing for remote exploitation by unauthorized parties. The exact mechanism of the flaw requires careful review of the vendor’s security bulletin.

Business Impact

The CVSS score of 7.3 highlights the significant risk posed to web services hosted on TinyWeb. Successful exploitation could result in full service compromise, unauthorized data disclosure, or total system downtime, severely impacting business continuity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Ritlabs immediately to secure the web server environment.

Proactive Monitoring: Review server access logs for anomalous requests or attempts to execute unauthorized commands on the host.

Compensating Controls: Place the TinyWeb server behind a robust reverse proxy or WAF that can filter malicious requests before they reach the server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This server software is critical to web operations and should be patched immediately. Ensure that the web server is not exposed to the public internet unless absolutely necessary.

---METADATA---
VENDOR: Microweber
PRODUCT: Microweber CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in versions of Microweber CMS, potentially allowing for unauthorized system interaction.

Executive Summary:
A security vulnerability in Microweber CMS requires immediate attention to protect against potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-12198

Affected Software: Microweber CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified weakness within the Microweber CMS platform. Without further disclosure, administrators should treat this as a potential entry point for unauthenticated or partially authenticated attackers to influence system operations.

Business Impact

With a CVSS score of 7.3, this high-severity vulnerability could lead to compromise of website integrity or data exposure. Successful exploitation may allow an attacker to bypass security controls, resulting in unauthorized content modification or administrative actions.

Remediation Plan

Immediate Action: Update Microweber CMS to the latest patched version available from the official vendor website.

Proactive Monitoring: Perform a comprehensive review of administrative access logs and monitor for unexpected changes to site configuration or core files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns targeting CMS administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score suggests that exploitation would be impactful.

Analyst Recommendation

Administrators must verify their current installation version and apply the vendor's patch immediately. Maintaining an up-to-date CMS is critical to defending against known and unknown web-based attack vectors.

---METADATA---
VENDOR: Ruijie
PRODUCT: EG105G-P
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in the Ruijie EG105G-P network gateway, potentially compromising device security.

Executive Summary:
A critical security flaw in the Ruijie EG105G-P network gateway exposes the device to potential unauthorized access or control.

Vulnerability Details

CVE-ID: CVE-2026-12197

Affected Software: Ruijie EG105G-P

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the Ruijie EG105G-P gateway. Given the nature of network hardware vulnerabilities, it is likely that this issue could be exploited by remote, unauthenticated attackers to gain unauthorized control over the gateway device.

Business Impact

The CVSS score of 7.2 indicates a high-severity risk. A compromised gateway can serve as a pivot point for attackers to intercept network traffic, launch man-in-the-middle attacks, or gain unauthorized access to the internal network, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Check the Ruijie support website for firmware updates and apply them to all affected EG105G-P units.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempts to access the management interface from unauthorized subnets.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses and disable unnecessary management services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the device's role as a network perimeter gateway, the potential for exploitation is extremely high.

Analyst Recommendation

Urgent action is required to patch this network gateway. Failure to secure the perimeter device could lead to a full compromise of the internal network infrastructure. Ensure all management consoles are isolated from public access.

---METADATA---
VENDOR: HestiaCP
PRODUCT: HestiaCP
AFFECTED_VERSIONS: 0 up to (excluding) 8be23943c7e3231f66d226ca931c76f93be98412
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The HestiaCP panel cronjob feature contains a broken access control vulnerability that allows authenticated users to escalate privileges.

Executive Summary:
HestiaCP versions prior to the commit 8be23943c7e3231f66d226ca931c76f93be98412 contain a broken access control vulnerability allowing for unauthorized administrative actions.

Vulnerability Details

CVE-ID: CVE-2026-12196

Affected Software: HestiaCP

Affected Versions: 0 up to (excluding) 8be23943c7e3231f66d226ca931c76f93be98412

Vulnerability: This vulnerability is categorized as an improper authentication/broken access control issue within the cronjob management feature. An attacker with a low-privileged account can manipulate the cronjob scheduling functionality to perform unauthorized administrative actions, effectively leading to full panel takeover.

Business Impact

The CVSS score of 8.3 reflects the significant danger of administrative takeover. A successful exploit allows an attacker to gain full control over the HestiaCP panel, enabling them to compromise hosted websites, modify server configurations, and access sensitive user data, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update HestiaCP to the latest version or apply the specific patch referenced in the vendor's repository (commit 8be23943c7e3231f66d226ca931c76f93be98412).

Proactive Monitoring: Audit existing cronjobs for unauthorized entries and monitor server access logs for anomalous requests directed at the panel's management interface.

Compensating Controls: Restrict access to the HestiaCP administration panel to trusted IP addresses only and enforce multi-factor authentication (MFA) where available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in control panels are critical. Administrators must apply the provided patch or upgrade immediately to prevent attackers from seizing administrative control of the server environment.

---METADATA---
VENDOR: myVesta
PRODUCT: vesta
AFFECTED_VERSIONS: 0 up to (excluding) 95d7e43bf286d6881ca753dac93cb42d98cc7422
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The myVesta control panel contains an authenticated remote code execution vulnerability due to improper neutralization of special elements in OS commands.

Executive Summary:
An authenticated remote code execution vulnerability in myVesta allows attackers with low-level privileges to gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-12195

Affected Software: myVesta vesta

Affected Versions: 0 up to (excluding) 95d7e43bf286d6881ca753dac93cb42d98cc7422

Vulnerability: This is an OS command injection (CWE-78) vulnerability that can be exploited by an authenticated attacker. By injecting malicious input, an attacker can execute arbitrary code on the underlying server hosting the control panel.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high risk of server compromise. Successful exploitation grants an attacker the ability to execute code with the privileges of the web application, leading to potential data theft, server-wide malware installation, or full administrative takeover of the hosting environment.

Remediation Plan

Immediate Action: Update the myVesta installation to the latest version or apply the specific commit referenced in the vendor documentation to remediate the command injection vector.

Proactive Monitoring: Inspect system logs for suspicious shell activity or unexpected process spawning initiated by the web service user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block OS command injection attempts in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution vulnerabilities are critical. Administrators should treat this as a priority update, especially for internet-facing installations. Ensure that all web application components are updated and that the underlying OS is hardened to limit the impact of a potential compromise.

---METADATA---
VENDOR: VS Revo Group
PRODUCT: Revo Uninstaller
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Revo Uninstaller, which may allow for unauthorized manipulation of system processes.

Executive Summary:
A high-severity vulnerability in Revo Uninstaller could allow local attackers to gain elevated privileges or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-12193

Affected Software: VS Revo Group Revo Uninstaller

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Revo Uninstaller application, likely involving insecure handling of system calls or service permissions that could be leveraged by an authenticated user to perform unauthorized actions.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a significant risk to endpoint security. Exploitation could allow an attacker to bypass standard security controls, leading to total system compromise, data theft, or the installation of persistent malicious software on affected workstations.

Remediation Plan

Immediate Action: Update Revo Uninstaller to the latest version released by the vendor to ensure all security patches are applied.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution, particularly those involving installer services or unauthorized privilege escalation attempts.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) solutions to block unauthorized modification of system-level binaries or sensitive registry keys.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should immediately inventory all instances of Revo Uninstaller. Given the potential for privilege escalation, applying the vendor-provided patch is essential to maintain the integrity of the host operating system.

---METADATA---
VENDOR: GALAYOU
PRODUCT: Y4
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the GALAYOU Y4 device, which could be leveraged to compromise device security.

Executive Summary:
A high-severity vulnerability in the GALAYOU Y4 device exposes the system to potential unauthorized access and exploitation.

Vulnerability Details

CVE-ID: CVE-2026-12192

Affected Software: GALAYOU Y4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security flaw has been determined in the GALAYOU Y4 hardware/firmware interface. This vulnerability could permit unauthorized interactions with the device’s administrative or data-handling functions.

Business Impact

The CVSS score of 8.8 indicates a critical threat level for the affected device. Successful exploitation could allow an attacker to gain control over the device, leading to privacy loss or the device being utilized as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Check the manufacturer’s support portal for firmware updates and apply them to all affected devices immediately.

Proactive Monitoring: Monitor the device's network traffic for unusual outbound connections or unauthorized access attempts.

Compensating Controls: Isolate affected devices on a dedicated network segment or VLAN to minimize the potential blast radius of a successful compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Device owners should prioritize the installation of the latest firmware patches provided by GALAYOU. If a patch is not yet available, the device should be restricted from external network access to prevent remote exploitation.

---METADATA---
VENDOR: Comma AI
PRODUCT: Openpilot
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been identified in Comma AI Openpilot that may pose a security risk to the affected system.

Executive Summary:
A vulnerability in Comma AI Openpilot requires immediate attention to prevent potential unauthorized system impacts.

Vulnerability Details

CVE-ID: CVE-2026-12191

Affected Software: Comma AI Openpilot

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified flaw within the Openpilot software platform. Due to the limited technical disclosure, the authentication requirements remain indeterminate; users should assume a risk of unauthorized interaction.

Business Impact

The identified vulnerability carries a CVSS score of 7.8, indicating a high level of severity. Successful exploitation could lead to unauthorized system access or functional disruption, potentially impacting the safety and operational integrity of the host vehicle's driver assistance systems.

Remediation Plan

Immediate Action: Consult the official Comma AI security portal to identify and apply the latest security patches or firmware updates.

Proactive Monitoring: Monitor system logs for anomalous execution patterns or unauthorized configuration changes.

Compensating Controls: Ensure the device is isolated from untrusted networks to minimize the attack surface while awaiting vendor patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of driver-assist systems, the potential for exploitation is considered high.

Analyst Recommendation

Given the high CVSS score, organizations and individual users should treat this as a priority update. Apply the latest vendor-supplied patches as soon as they become available to mitigate the risk of unauthorized system manipulation.

---METADATA---
VENDOR: GL
PRODUCT: Unknown
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in GL software, requiring immediate attention to prevent unauthorized system exploitation.

Executive Summary:
A high-severity security vulnerability in GL software poses a substantial risk to system security and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-12187

Affected Software: GL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security vulnerability has been detected within the GL software architecture. While specific mechanics are currently under investigation, the flaw is categorized with a high impact on the target environment.

Business Impact

The CVSS score of 8.8 underscores the severity of this issue, indicating a high potential for successful exploitation by malicious actors. Failure to address this vulnerability may result in unauthorized data access, service outages, and potential reputational damage to the organization.

Remediation Plan

Immediate Action: Apply all available security patches provided by the vendor to the affected GL software components.

Proactive Monitoring: Implement enhanced logging and monitoring for any unusual activity or unauthorized configuration changes within the application.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for patterns that may exploit known vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high CVSS score, it is imperative that organizations treat this as a high-priority task. Administrators should ensure that all instances are updated to the latest secure version immediately.

---METADATA---
VENDOR: GL
PRODUCT: Unknown
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in GL software, which may lead to unauthorized system access or information disclosure.

Executive Summary:
A high-severity security weakness in GL software has been identified, potentially exposing the system to unauthorized access or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-12186

Affected Software: GL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A weakness has been identified in the internal logic of the GL software. Further technical details remain limited, but the flaw generally allows for unauthorized interactions with the application.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality and integrity of the system. Unauthorized access to the affected environment could lead to the theft of sensitive data or the disruption of critical business processes.

Remediation Plan

Immediate Action: Review vendor communication channels for security bulletins and apply all relevant patches or firmware updates.

Proactive Monitoring: Review access logs for anomalous behavior or unauthorized administrative actions occurring within the GL environment.

Compensating Controls: Restrict network access to the affected service using firewall rules, ensuring only authorized users can interact with the management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the remediation of this vulnerability due to its high severity. We recommend immediate patching and the enforcement of strict network segmentation until updates are successfully deployed.

---METADATA---
VENDOR: Nefteprodukttekhnika
PRODUCT: BUK TS-G Gas Station Automation System
AFFECTED_VERSIONS: Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux
---END_METADATA---

Description Summary:
The BUK TS-G automation system contains an authentication bypass vulnerability that allows remote, unauthenticated attackers to execute arbitrary administrative actions.

Executive Summary:
A critical authentication bypass vulnerability in the Nefteprodukttekhnika BUK TS-G system allows unauthenticated attackers to gain full administrative control over gas station operations.

Vulnerability Details

CVE-ID: CVE-2026-12183

Affected Software: Nefteprodukttekhnika BUK TS-G Gas Station Automation System

Affected Versions: Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux

Vulnerability: The system suffers from an improper authentication flaw (CWE-287) where the /php/ajax-login.php endpoint fails to validate credentials and improperly grants administrative access. Subsequent privileged endpoints do not validate server-side sessions, allowing a remote unauthenticated attacker to manipulate sensitive industrial components.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to operational technology (OT) environments. An attacker could remotely manipulate fuel tank gauges, dispensers, cash registers, and pricing rules, potentially leading to significant financial loss, physical safety hazards at gas stations, and complete compromise of industrial control integrity.

Remediation Plan

Immediate Action: Update the BUK TS-G automation system to the latest version as specified in the vendor advisory.

Proactive Monitoring: Monitor network traffic for unauthorized access to the /php/ directory and review system logs for unexpected administrative changes or login attempts.

Compensating Controls: Isolate the automation system from the public internet using a firewall and ensure access is restricted to authorized VPN connections only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 13, 2026, a public exploit is available, and the lack of session validation makes this vulnerability trivial to exploit. Immediate mitigation is required to prevent unauthorized industrial control.

Analyst Recommendation

Given the critical severity and the availability of functional exploit code, this vulnerability represents an urgent threat to facility operations. Administrators must apply the vendor-provided updates immediately and verify that the affected systems are not exposed to the public internet.

---METADATA---
VENDOR: D-Link
PRODUCT: DCS-935L
AFFECTED_VERSIONS: D-Link DCS-935L 1.10.01.
---END_METADATA---

Description Summary:
A format string vulnerability in the D-Link DCS-935L HTTP handler allows remote attackers to compromise the device via the snprintf function in the CGI binary.

Executive Summary:
A critical remote format string vulnerability in D-Link DCS-935L cameras could allow an unauthenticated attacker to execute arbitrary commands on the device.

Vulnerability Details

CVE-ID: CVE-2026-12174

Affected Software: D-Link DCS-935L

Affected Versions: D-Link DCS-935L 1.10.01.

Vulnerability: The vulnerability exists in the snprintf function within the /web/cgi-bin/greece/rhea file of the HTTP Handler component. It is a classic format string flaw that can be triggered remotely without authentication.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical. Successful exploitation allows for remote code execution, granting an attacker full control over the surveillance camera. This poses severe risks, including unauthorized access to video feeds, lateral movement into the local network, and the potential for the device to be recruited into a botnet.

Remediation Plan

Immediate Action: Update the device firmware to the version provided by D-Link that addresses the format string vulnerability in the HTTP handler.

Proactive Monitoring: Inspect network traffic for unusual HTTP GET or POST requests directed at the camera's CGI interface.

Compensating Controls: Isolate affected cameras on a dedicated VLAN and restrict access via firewall rules to known, trusted management IP addresses.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 14, 2026, a public exploit is available for this vulnerability. Organizations using this hardware should consider it at immediate risk of exploitation.

Analyst Recommendation

Given the availability of a public exploit and the remote nature of this vulnerability, immediate patching is required. If a firmware update cannot be applied immediately, the device should be disconnected from the public internet or placed behind a robust firewall/VPN gateway to prevent unauthorized access.

---METADATA---
VENDOR: Little
PRODUCT: GameFirst Anti-Cheat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper validation vulnerability exists in the GFAC_Sys_x64 driver for GameFirst Anti-Cheat, which could lead to unauthorized system-level actions.

Executive Summary:
An improper validation flaw in the GameFirst Anti-Cheat driver presents a high-severity risk, potentially allowing local attackers to escalate privileges or interact with the kernel.

Vulnerability Details

CVE-ID: CVE-2026-12168

Affected Software: Little GameFirst Anti-Cheat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an improper validation issue within the GFAC_Sys_x64 driver. Because this is a kernel-level driver, successful exploitation typically allows an attacker to bypass security restrictions or achieve elevated privileges on the host system.

Business Impact

The CVSS score of 7.8 indicates a high-severity risk, specifically regarding the potential for privilege escalation on local machines. If exploited, an attacker could gain control over the host system, bypass security software, or maintain persistence, resulting in a total compromise of the affected workstation.

Remediation Plan

Immediate Action: Update the GameFirst Anti-Cheat software to the latest version provided by the vendor to ensure the driver is patched.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor for suspicious driver loading or kernel-level modifications.

Compensating Controls: Restrict local administrative privileges to prevent unauthorized software installation or driver manipulation on workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Vulnerabilities in anti-cheat drivers are highly attractive to threat actors due to their elevated system permissions. Administrators should ensure that all systems utilizing this software are patched immediately, and consider limiting the use of software that requires kernel-level drivers in high-security environments.

---METADATA---
VENDOR: Little (GameFirst)
PRODUCT: GameFirst Anti-Cheat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Minifilter communication port for the GameFirst Anti-Cheat driver, GFAC_Sys_x64, may expose the system to unauthorized interactions.

Executive Summary:
The GameFirst Anti-Cheat driver contains a vulnerability in its communication port that could potentially be leveraged to impact system security.

Vulnerability Details

CVE-ID: CVE-2026-12167

Affected Software: Little GameFirst Anti-Cheat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Minifilter communication port used by the GFAC_Sys_x64 driver. Such vulnerabilities typically involve improper validation of input or insufficient access control, which could allow local attackers to interact with or disrupt the driver's operations.

Business Impact

With a CVSS score of 7.8, this High-severity vulnerability could allow an attacker with local access to interact with a kernel-mode driver. This poses a risk of system instability, potential privilege escalation, or bypassing security controls enforced by the anti-cheat software, which could undermine the integrity of the host machine.

Remediation Plan

Immediate Action: Update the GameFirst Anti-Cheat software to the latest version recommended by the vendor.

Proactive Monitoring: Monitor system logs for unexpected driver behavior or errors related to the GFAC_Sys_x64 component.

Compensating Controls: Ensure that local user permissions are strictly limited to prevent unauthorized software execution that could interact with kernel-mode drivers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel-mode vulnerabilities are inherently dangerous due to the level of access they afford. It is critical that security teams apply the vendor's updates immediately to ensure the GameFirst Anti-Cheat driver is properly secured against potential local exploitation.

---METADATA---
VENDOR: Contest Gallery
PRODUCT: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Contest Gallery WordPress plugin is vulnerable to privilege escalation, allowing authenticated attackers to elevate their access level within the application.

Executive Summary:
A high-severity privilege escalation vulnerability in the Contest Gallery WordPress plugin allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-12165

Affected Software: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin suffers from a privilege escalation flaw due to insufficient authorization checks. An authenticated attacker can leverage this vulnerability to gain higher-level permissions than those originally assigned to their account.

Business Impact

Successful exploitation allows an attacker to gain administrative control over the WordPress site. This can lead to complete site takeover, unauthorized data access, modification of content, and potential injection of malicious scripts, resulting in significant reputational and operational damage. The CVSS score of 8.8 reflects the high severity of unauthorized privilege acquisition.

Remediation Plan

Immediate Action: Update the Contest Gallery plugin to the latest version provided by the vendor immediately.

Proactive Monitoring: Review WordPress user account logs for suspicious account activity or unauthorized elevation of roles.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to detect and block suspicious administrative requests or unauthorized parameter manipulation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete site compromise, administrators should treat this vulnerability with high urgency. Immediately audit existing user roles and apply available plugin updates to mitigate the risk of unauthorized privilege escalation.

---METADATA---
VENDOR: Devolutions
PRODUCT: Remote Desktop Manager
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An input validation vulnerability in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026 allows for potential security compromise.

Executive Summary:
Improper input validation in Devolutions Remote Desktop Manager's SSH Elevate Shell feature presents a high-severity risk to administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-12161

Affected Software: Devolutions Remote Desktop Manager

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from improper input validation within the SSH Elevate Shell component. This allows an attacker to bypass security constraints when initiating elevated shell sessions.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical for environments where administrative access is managed through this software. Exploitation could allow an attacker to gain unauthorized elevated privileges, potentially leading to total control over remote systems managed by the application.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Devolutions to the affected Remote Desktop Manager installation.

Proactive Monitoring: Review audit logs for suspicious SSH shell elevation requests and monitor for unexpected administrative activities.

Compensating Controls: Limit the use of the SSH Elevate Shell feature and enforce the principle of least privilege for accounts using Remote Desktop Manager.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability targets an administrative utility, it provides a high-value target for attackers. Users should verify their version against the vendor's security advisory and apply the necessary updates immediately to secure their remote management infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: RegistrationMagic – User Registration Forms Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 6.

Executive Summary:
A critical Cross-Site Request Forgery vulnerability in the RegistrationMagic WordPress plugin allows unauthenticated attackers to perform unauthorized actions on behalf of a logged-in user.

Vulnerability Details

CVE-ID: CVE-2026-12158

Affected Software: WordPress RegistrationMagic – User Registration Forms Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to trick an authenticated user into executing unwanted actions within the application. The vulnerability stems from insufficient anti-CSRF token validation within the plugin's administrative or user-facing forms.

Business Impact

Successful exploitation could lead to unauthorized administrative actions, such as modifying plugin configurations or creating unauthorized user accounts. Given the CVSS score of 8.8, this poses a significant risk to the integrity and security of the WordPress instance, potentially leading to full site compromise.

Remediation Plan

Immediate Action: Audit the WordPress environment for the presence of the RegistrationMagic plugin and ensure it is updated to the latest available version provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious POST requests originating from unexpected referrers that target plugin-specific administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common CSRF patterns and unauthorized requests directed at the WordPress backend.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score of 8.8 underscores the necessity for prompt mitigation. Administrators should prioritize updating this plugin immediately. If a patch is not yet available, consider disabling or removing the plugin until a secure version is released to maintain the security posture of the site.

---METADATA---
VENDOR: Red Hat
PRODUCT: Satellite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the foreman-mcp-server component of Red Hat Satellite may allow for unauthorized system interaction.

Executive Summary:
A high-severity flaw in Red Hat Satellite's foreman-mcp-server poses a significant risk of unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-12112

Affected Software: Red Hat Satellite

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the foreman-mcp-server component, which handles communication protocols for system management. While specific authentication requirements are not detailed, flaws in management components often allow authenticated users to escalate privileges or bypass intended controls.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over infrastructure managed by Red Hat Satellite. Given the CVSS score of 7.8, this represents a high risk to organizational security, potentially enabling lateral movement or full compromise of managed endpoints, leading to significant operational downtime and data integrity loss.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the release of a patch and apply it to all Satellite instances immediately.

Proactive Monitoring: Inspect system access logs for anomalous behavior related to the foreman-mcp-server process or unexpected administrative activity.

Compensating Controls: Restrict network access to the Satellite management interface to trusted administrative segments only to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from IT security teams. Administrators should prioritize identifying vulnerable instances and applying vendor-supplied updates as soon as they become available to prevent potential system compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: Admin and Site Enhancements (ASE)
AFFECTED_VERSIONS: 7.6.3 up to (excluding) 8.8.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Admin and Site Enhancements (ASE) WordPress plugin is susceptible to an Improper Privilege Management vulnerability, which can lead to unauthorized access or privilege escalation.

Executive Summary:
An Improper Privilege Management vulnerability in the Admin and Site Enhancements (ASE) plugin, rated 8.1, creates a significant risk of unauthorized privilege escalation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12083

Affected Software: WordPress Admin and Site Enhancements (ASE)

Affected Versions: 7.6.3 up to (excluding) 8.8.4

Vulnerability: This vulnerability relates to improper privilege management (CWE-269), which may allow an unauthenticated attacker to manipulate security settings or gain elevated privileges due to flaws in the plugin's access control logic.

Business Impact

Successful exploitation could allow an attacker to bypass intended access controls, potentially gaining administrative control over the WordPress site. The CVSS score of 8.1 justifies an urgent response, as the impact includes total loss of confidentiality, integrity, and availability of the affected WordPress instance.

Remediation Plan

Immediate Action: Update the Admin and Site Enhancements (ASE) plugin to version 8.8.4 or the latest available version immediately.

Proactive Monitoring: Review user account creation logs and audit administrative privilege assignments for any unauthorized changes or anomalous activities.

Compensating Controls: Restrict access to the WordPress administrative dashboard by IP address and ensure that critical security plugins are kept updated to maintain restrictive access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege management vulnerabilities are high-risk targets for attackers seeking to establish persistence. Administrators should verify their current version of ASE and apply the patch to version 8.8.4 to ensure that access controls remain secure and effective.

---METADATA---
VENDOR: Raytha
PRODUCT: Raytha CMS
AFFECTED_VERSIONS: 1.5.2 (potentially others)
---END_METADATA---

Description Summary:
Raytha CMS contains an SQL injection vulnerability in its OData filter parsing pipeline, enabling unauthenticated remote attackers to execute arbitrary SQL statements against the backend database.

Executive Summary:
A critical SQL injection vulnerability in the Raytha CMS OData pipeline permits unauthenticated attackers to gain full database compromise and extract sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-12076

Affected Software: Raytha Raytha

Affected Versions: 1.5.2 (may affect other versions)

Vulnerability: The vulnerability exists within the OData filter parsing pipeline, where unsanitized input is used to construct database queries. This allows an unauthenticated attacker to manipulate queries and execute arbitrary SQL against the PostgreSQL database.

Business Impact

The CVSS score of 9.3 reflects the high severity of this flaw, as it grants attackers broad access to the backend database. Successful exploitation could result in the total compromise of stored data, including user credentials and proprietary information, leading to severe regulatory and operational consequences.

Remediation Plan

Immediate Action: Update Raytha to the latest version as soon as a patch is available; consult the vendor advisory for specific versioning details.

Proactive Monitoring: Monitor database query performance and audit logs for unusual OData filter syntax or unexpected data extraction attempts.

Compensating Controls: Implement WAF rules to filter and sanitize OData query parameters and limit database permissions for the service account used by the CMS.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to organizational data. Administrators should monitor the vendor's security channels closely for patch releases and apply updates immediately upon availability to prevent unauthorized database access.

---METADATA---
VENDOR: metagauss
PRODUCT: ProfileGrid – User Profiles, Groups and Communities
AFFECTED_VERSIONS: Up to and including 5.9.9.5
---END_METADATA---

Description Summary:
The ProfileGrid WordPress plugin is vulnerable to unauthenticated account takeover due to improper validation of registration parameters, allowing attackers to hijack administrator accounts.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the ProfileGrid WordPress plugin allows remote attackers to hijack the administrator account via email address modification.

Vulnerability Details

CVE-ID: CVE-2026-12073

Affected Software: metagauss ProfileGrid – User Profiles, Groups and Communities

Affected Versions: Up to and including 5.9.9.5

Vulnerability: The plugin fails to correctly validate the user_login parameter during registration, allowing an unauthenticated attacker to manipulate the email address associated with the primary administrator account (ID=1). This facilitates a password reset request to an attacker-controlled email address, resulting in full unauthorized access.

Business Impact

This vulnerability allows for a complete compromise of the WordPress site. Given the CVSS score of 9.8, the business impact includes total loss of site control, potential data theft, and the ability for the attacker to inject malicious code, leading to long-term reputational damage and site blacklisting.

Remediation Plan

Immediate Action: Update the ProfileGrid plugin to the latest available version released by metagauss that addresses this registration logic flaw.

Proactive Monitoring: Review WordPress user audit logs for any unexpected changes to administrator email addresses or suspicious registration activity.

Compensating Controls: Disable user registration on the WordPress site as a temporary measure if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the attack vector makes it a high-risk target for automated exploitation.

Analyst Recommendation

Site administrators must treat this as a critical priority. Update the plugin immediately to prevent complete site takeover and ensure that administrative account security is maintained.

---METADATA---
VENDOR: Cellopoint
PRODUCT: CelloOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper access control vulnerability in the CelloOS SSH service allows authenticated remote attackers to bypass command restrictions and execute unauthorized OS commands.

Executive Summary:
An improper access control flaw in the CelloOS SSH service allows authenticated attackers to escape restricted command shells and execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-12059

Affected Software: Cellopoint CelloOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The SSH service fails to properly enforce command restrictions, allowing an authenticated remote attacker to bypass intended limitations and execute arbitrary commands outside the authorized scope.

Business Impact

Successful exploitation allows an authenticated attacker to gain unauthorized control over the underlying operating system. With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and integrity of the affected appliance, potentially leading to total system takeover.

Remediation Plan

Immediate Action: Contact Cellopoint support or check the official vendor portal for available security patches or configuration guidance.

Proactive Monitoring: Audit SSH command history logs for commands that deviate from authorized baseline usage patterns.

Compensating Controls: Restrict SSH access to known, trusted IP addresses and enforce the principle of least privilege for all user accounts accessing the service.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using CelloOS should prioritize reviewing their SSH access policies and applying any relevant updates provided by Cellopoint. Until a patch is applied, ensure that only highly trusted users have SSH access to the system.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit AI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A sandbox bypass vulnerability in Foxit AI allows remote code execution when processing malicious PDF files containing embedded JavaScript.

Executive Summary:
Foxit AI contains a critical remote code execution vulnerability that allows attackers to escape the sandbox via malicious PDF files.

Vulnerability Details

CVE-ID: CVE-2026-12057

Affected Software: Foxit AI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists because the application fails to properly intercept dangerous interfaces when executing embedded JavaScript within a PDF. This failure allows remote scripts to be loaded, resulting in arbitrary code execution within the context of the application.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a major risk. An attacker could exploit this by enticing a user to open a specially crafted PDF document, leading to code execution that could compromise the user's workstation or gain a foothold within the corporate network.

Remediation Plan

Immediate Action: Update Foxit AI software to the latest version as recommended by the Foxit security bulletin.

Proactive Monitoring: Monitor for suspicious PDF activity and utilize endpoint protection solutions to block the execution of unauthorized scripts spawned by document readers.

Compensating Controls: Disable JavaScript execution within PDF readers via group policy or application settings to prevent the exploitation of this and similar vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution vulnerabilities in document readers are highly effective attack vectors. Organizations should deploy the latest patches immediately and consider disabling PDF JavaScript execution as a proactive security measure.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab EE
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GitLab EE contains a security vulnerability in versions 19 and later that necessitates an immediate update.

Executive Summary:
GitLab EE is susceptible to a high-severity vulnerability in versions 19 and later, which could lead to unauthorized actions and compromise of development infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-12053

Affected Software: GitLab GitLab EE

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the GitLab EE platform and requires an authenticated session to execute. The flaw allows for potential security bypasses that could impact the confidentiality and integrity of the platform.

Business Impact

A successful exploit of this vulnerability could result in the exposure of proprietary code and sensitive CI/CD secrets. Based on the CVSS score of 8.6, this is a major security concern that could lead to widespread reputational damage and the loss of sensitive development data if left unpatched.

Remediation Plan

Immediate Action: Update all instances of GitLab EE to the latest version recommended by the vendor.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unauthorized API calls that deviate from standard developer behavior.

Compensating Controls: Utilize network-level access controls to restrict access to the GitLab interface to known, trusted IP ranges while the patching process is underway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must treat this vulnerability with high priority. The potential for unauthorized access to development pipelines makes immediate patching the only viable strategy to ensure the integrity of the software supply chain. Please consult the official GitLab security advisory for the specific patch version and deployment instructions.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: pgAdmin 4
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in pgAdmin 4 within dialog templates that render the "COMMENT ON" command, potentially allowing unauthorized database manipulation.

Executive Summary:
A high-severity SQL injection vulnerability in pgAdmin 4 could allow attackers to execute arbitrary database commands, compromising the integrity of the underlying PostgreSQL environment.

Vulnerability Details

CVE-ID: CVE-2026-12044

Affected Software: PostgreSQL pgAdmin 4

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability involves SQL injection flaws present in dialog templates that process the "COMMENT ON" SQL command. This allows an attacker to inject malicious SQL queries through the interface, bypassing standard sanitization protocols.

Business Impact

Successful exploitation of this flaw can result in unauthorized data access, modification, or destruction within the database managed by pgAdmin 4. With a CVSS score of 8.8, this vulnerability presents a significant threat to data confidentiality and integrity, requiring immediate attention to prevent potential service-wide impacts.

Remediation Plan

Immediate Action: Consult the vendor advisory to identify and apply the latest security patches for pgAdmin 4.

Proactive Monitoring: Enable detailed database query logging and monitor for unusual or malformed SQL queries that deviate from standard administrative operations.

Compensating Controls: Restrict access to the pgAdmin 4 interface to internal networks or VPNs only, and enforce multi-factor authentication for all database administrative users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Database management tools are high-value targets for attackers. Administrators are urged to monitor vendor channels for the official patch release and apply it immediately upon availability to mitigate the risk of SQL injection.

---METADATA---
VENDOR: AWS
PRODUCT: aws-c-http
AFFECTED_VERSIONS: aws-c-http >= 0.4.22 AND <= 0.10.15
---END_METADATA---

Description Summary:
A double free memory corruption vulnerability in the AWS Common Runtime aws-c-http library may lead to arbitrary code execution when processing crafted HTTP/2 HEADERS frames.

Executive Summary:
A high-severity memory corruption vulnerability in the AWS Common Runtime aws-c-http library could allow remote attackers to achieve arbitrary code execution on client applications.

Vulnerability Details

CVE-ID: CVE-2026-12043

Affected Software: AWS aws-c-http

Affected Versions: aws-c-http >= 0.4.22 AND <= 0.10.15

Vulnerability: The vulnerability stems from improper handling of HPACK dynamic table size updates within HTTP/2 HEADERS frames. A malicious server can send a crafted sequence of frames to trigger a double-free condition in the client, potentially resulting in memory corruption and arbitrary code execution.

Business Impact

The CVSS score of 8.8 reflects the high potential for remote code execution, which could lead to full system compromise of any client application utilizing the vulnerable library. This poses a severe threat to the integrity and availability of client-side operations that interact with potentially untrusted HTTP/2 servers.

Remediation Plan

Immediate Action: Update the aws-c-http library to version 0.11.0 or later.

Proactive Monitoring: Monitor client application logs for crashes or unexpected process behavior that may indicate memory corruption attempts.

Compensating Controls: Restrict client-side connections to trusted, verified servers and employ memory protection features (e.g., ASLR, DEP) on host systems.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—memory corruption leading to potential code execution—the risk is considered high and requires prompt remediation.

Analyst Recommendation

Given the potential for arbitrary code execution, this library should be updated across all affected client applications immediately. Security teams should prioritize identifying all software dependencies that include the AWS Common Runtime to ensure comprehensive coverage.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Views component of Google Chrome on Windows allows for potential memory corruption and arbitrary code execution.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome's Views component on Windows poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12035

Affected Software: Google Chrome on Windows

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is a use-after-free error located within the Views component. An attacker could potentially exploit this memory management flaw to trigger a crash or execute arbitrary code in the context of the browser process.

Business Impact

With a CVSS score of 8.8, this vulnerability is highly significant for enterprise environments. Successful exploitation could allow an attacker to bypass browser security boundaries, leading to unauthorized code execution on the host machine, which could result in data theft or further system compromise.

Remediation Plan

Immediate Action: Update Google Chrome to the latest stable release as specified by the vendor’s security bulletin.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for suspicious process behavior or abnormal memory access patterns originating from the browser.

Compensating Controls: Ensure users are operating with the least privilege necessary and utilize browser-based security policies to limit the impact of potential exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser vulnerabilities are common targets for exploitation. Organizations should enforce automated patching for Google Chrome to ensure all endpoints are running the most secure version available to mitigate this threat.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome on Linux prior to 149.0.7827.102
---END_METADATA---

Description Summary:
Google Chrome on Linux contains a vulnerability due to insufficient validation of untrusted input within the Linux Toolkit Theming component.

Executive Summary:
A high-severity input validation vulnerability in Google Chrome on Linux could allow for potential security degradation.

Vulnerability Details

CVE-ID: CVE-2026-12034

Affected Software: Google Chrome

Affected Versions: Google Chrome on Linux prior to 149.0.7827.102

Vulnerability: This vulnerability involves insufficient validation of untrusted input in the Linux Toolkit Theming component. The flaw does not explicitly require prior authentication and can be triggered via specially crafted content handled by the browser.

Business Impact

With a CVSS score of 8.3, this vulnerability is classified as High severity. Exploitation could potentially lead to unauthorized access or instability within the browser environment, posing a risk to data privacy and system integrity for users operating on Linux distributions.

Remediation Plan

Immediate Action: Update Google Chrome on all Linux systems to version 149.0.7827.102 or later as provided by the vendor.

Proactive Monitoring: Review system logs for anomalous browser behavior or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that browser-based security settings are enforced and utilize endpoint protection solutions to detect malicious activity originating from web-based processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score underscores the necessity of prioritizing this update. Organizations should ensure that all Linux-based workstations are patched to the latest version immediately to eliminate the risk of exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 149.0.7827.115
---END_METADATA---

Description Summary:
An inappropriate implementation in the Views component of Google Chrome on Windows allows for a sandbox escape.

Executive Summary:
A high-severity sandbox escape vulnerability in Google Chrome's Views component on Windows could lead to unauthorized system-level access.

Vulnerability Details

CVE-ID: CVE-2026-12031

Affected Software: Google Chrome

Affected Versions: prior to 149.0.7827.115

Vulnerability: This vulnerability stems from an inappropriate implementation within the Views component. A remote attacker who has successfully compromised the renderer process can leverage this flaw to perform a sandbox escape using a crafted HTML page.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a major security threat to Windows environments. Successful exploitation allows an attacker to break out of the browser's sandbox, potentially leading to unauthorized data access and persistence on the host machine.

Remediation Plan

Immediate Action: Update Google Chrome to version 149.0.7827.115 or later immediately.

Proactive Monitoring: Monitor host-based security logs for signs of process injection or unauthorized privilege escalation attempts by the browser.

Compensating Controls: Implement robust EDR (Endpoint Detection and Response) policies that monitor for suspicious child processes spawned by browser applications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of Windows-based workstations in corporate environments, the risk posed by this sandbox escape is substantial. Organizations should prioritize updating all instances of Chrome to version 149.0.7827.115 or later to maintain endpoint security.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 149.0.7827.115
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in the GPU component of Google Chrome on Android allows for potential sandbox escapes.

Executive Summary:
A high-severity out-of-bounds write vulnerability in Google Chrome's GPU process on Android poses a significant risk of sandbox escape.

Vulnerability Details

CVE-ID: CVE-2026-12030

Affected Software: Google Chrome

Affected Versions: prior to 149.0.7827.115

Vulnerability: This vulnerability is an out-of-bounds write flaw located in the GPU component. A remote attacker who has compromised the renderer process can exploit this to perform a sandbox escape through a crafted HTML page.

Business Impact

The CVSS score of 8.3 underscores the criticality of this flaw. Exploitation on mobile devices could lead to complete device compromise, exposing corporate data, credentials, and internal resources accessed via the mobile browser.

Remediation Plan

Immediate Action: Update Google Chrome on all Android devices to version 149.0.7827.115 or later immediately.

Proactive Monitoring: Track mobile endpoint security alerts for unusual application behavior or unexpected crashes related to browser processes.

Compensating Controls: Use Mobile Device Management (MDM) to enforce compliance and ensure that all managed devices remain on the latest version of the browser.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mobile devices are frequent targets for browser-based attacks. Security teams must ensure that the update cycle for mobile browsers is as rigorous as that for desktop environments to mitigate this critical GPU-related risk.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome on Windows prior to 149.0.7827.115
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Video component of Google Chrome for Windows allows for potential sandbox escape via crafted HTML content.

Executive Summary:
A high-severity use-after-free vulnerability in the Video component of Google Chrome for Windows could enable remote attackers to escape the browser sandbox.

Vulnerability Details

CVE-ID: CVE-2026-12029

Affected Software: Google Chrome

Affected Versions: Google Chrome on Windows prior to 149.0.7827.115

Vulnerability: This is a use-after-free vulnerability within the Video component. A remote attacker could exploit this by tricking a user into visiting a malicious website, potentially allowing them to escape the browser sandbox after compromising the renderer process.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant risk to Windows-based endpoints. A successful exploit could allow an attacker to bypass browser protections, potentially leading to unauthorized code execution on the host system and compromise of corporate data.

Remediation Plan

Immediate Action: Update all Google Chrome instances on Windows to version 149.0.7827.115 immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning or abnormal video-related memory usage within the browser.

Compensating Controls: Ensure that Windows Defender or other endpoint security software is fully updated to identify and block known exploit patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the pervasive use of Chrome on Windows, this update should be deployed across the organization with urgency. Patching is the only effective way to mitigate the risk of sandbox escape associated with this vulnerability.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome on Android prior to 149.0.7827.115
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the GPU component of Google Chrome for Android could allow a remote attacker to perform a sandbox escape.

Executive Summary:
A high-severity use-after-free vulnerability in the GPU component of Google Chrome for Android poses a risk of sandbox escape for mobile device users.

Vulnerability Details

CVE-ID: CVE-2026-12028

Affected Software: Google Chrome

Affected Versions: Google Chrome on Android prior to 149.0.7827.115

Vulnerability: This vulnerability involves a use-after-free error in the GPU component. A remote attacker could trigger this vulnerability by enticing a user to navigate to a crafted HTML page, potentially escaping the browser sandbox after compromising the renderer process.

Business Impact

The CVSS score of 8.3 underscores the criticality of this flaw for mobile security. Exploitation on an Android device could result in the compromise of application data, unauthorized access to system resources, or further malicious activity on the mobile device.

Remediation Plan

Immediate Action: Update Google Chrome on all Android devices to version 149.0.7827.115 via the Google Play Store as soon as the update is available.

Proactive Monitoring: Ensure mobile device management (MDM) policies are in place to track and enforce application version compliance across the mobile fleet.

Compensating Controls: Advise users to avoid clicking on untrusted links and ensure that the "Safe Browsing" feature is enabled within the Chrome settings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should prioritize the deployment of the latest Chrome version on all managed Android devices. Ensuring mobile browser security is critical to defending against modern web-based threats.