---METADATA---
VENDOR: F5
PRODUCT: BIG-IP
AFFECTED_VERSIONS: 21.0.0 up to 21.0.0.2, 17.5.0 up to 17.5.1.6, 17.1.0 up to 17.1.3.2, 16.1.0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in F5 BIG-IP scripted monitors allows authenticated users with administrative privileges to execute arbitrary system commands with elevated permissions.

Executive Summary:
An authenticated privilege escalation vulnerability in F5 BIG-IP scripted monitors poses a significant risk of unauthorized system command execution.

Vulnerability Details

CVE-ID: CVE-2026-32673

Affected Software: F5 BIG-IP

Affected Versions: 21.0.0 up to 21.0.0.2, 17.5.0 up to 17.5.1.6, 17.1.0 up to 17.1.3.2, 16.1.0 and later

Vulnerability: The flaw relates to improper privilege management (CWE-250) within BIG-IP scripted monitors. An attacker who has already gained authenticated access as a Resource Administrator or Administrator can leverage this flaw to execute arbitrary commands with higher system privileges.

Business Impact

Successful exploitation allows an already-privileged user to gain full control over the underlying operating system of the BIG-IP device. Given the CVSS score of 8.7, this represents a high-severity risk to infrastructure integrity, as it facilitates lateral movement, data exfiltration, or complete system compromise.

Remediation Plan

Immediate Action: Upgrade to version 21.1.0 or later as recommended by the vendor.

Proactive Monitoring: Review administrative audit logs for unusual command execution patterns or unauthorized modifications to monitor scripts.

Compensating Controls: Restrict administrative access to the BIG-IP management interface to known, trusted management subnets and enforce multi-factor authentication (MFA).

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires existing administrative access, the potential for total system compromise makes it an urgent priority.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their F5 BIG-IP appliances to the fixed versions provided by the vendor to prevent privileged users from escalating their access to full system control.

---METADATA---
VENDOR: Automated Logic
PRODUCT: WebCTRL
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
WebCTRL systems using the BACnet protocol are vulnerable to unauthorized access due to a lack of network-layer authentication inherent in the protocol.

Executive Summary:
WebCTRL building automation systems are at risk of unauthorized control and manipulation because the BACnet protocol lacks essential network-layer authentication.

Vulnerability Details

CVE-ID: CVE-2026-32666

Affected Software: Automated Logic WebCTRL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: WebCTRL systems inherit a significant security weakness from the BACnet protocol, which does not require authentication at the network layer. An unauthenticated attacker with network access to the BACnet broadcast domain can send spoofed or unauthorized commands to building controllers.

Business Impact

Exploitation of this vulnerability could allow an attacker to take control of critical building systems, including HVAC, lighting, and physical access controls. This poses a direct threat to physical security, operational continuity, and occupant safety. The CVSS score of 7.5 reflects the high impact on availability and integrity within industrial and building control environments.

Remediation Plan

Immediate Action: Isolate BACnet traffic to a dedicated, secure VLAN and apply all available vendor security patches for WebCTRL and associated hardware.

Proactive Monitoring: Use Industrial Control System (ICS) monitoring tools to detect unauthorized BACnet read/write requests or anomalous traffic patterns on the building automation network.

Compensating Controls: Implement BACnet/SC (Secure Connect) where supported or utilize hardware-based VPNs and firewalls to encapsulate and authenticate BACnet traffic between segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of authentication in legacy BACnet is a well-known issue frequently targeted in ICS-specific research and attacks.

Analyst Recommendation

The risk to building operations is severe; therefore, organizations must move beyond relying on the inherent insecurity of the BACnet protocol. Immediate network segmentation is required to prevent unauthenticated access. We strongly recommend transitioning to BACnet/SC or implementing robust compensating network security measures to ensure that only authorized administrative workstations can communicate with WebCTRL controllers.

---METADATA---
VENDOR: SOLAS (formerly Transware)
PRODUCT: GUARDIANWALL MailSuite/Mail Security Cloud
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in GUARDIANWALL MailSuite and Mail Security Cloud, potentially allowing arbitrary code execution.

Executive Summary:
A critical stack-based buffer overflow in GUARDIANWALL email security products allows remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-32661

Affected Software: GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a stack-based buffer overflow in the web service. It can be triggered by a remote, unauthenticated attacker sending a crafted request, leading to code execution under the context of the grdnwww user.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe risk to organizational email security. Successful exploitation could lead to full compromise of the email appliance, enabling the interception of sensitive communications, internal network reconnaissance, and persistent malware deployment.

Remediation Plan

Immediate Action: Check the official vendor advisory for the latest security patch and apply it immediately to all vulnerable GUARDIANWALL instances.

Proactive Monitoring: Monitor network traffic for malformed or unusually large requests directed at the GUARDIANWALL web interface.

Compensating Controls: Restrict access to the GUARDIANWALL administrative and web interfaces to trusted IP addresses only, and deploy a WAF to inspect incoming traffic for buffer overflow patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability in an email security gateway, immediate patching is required. Organizations should treat this as a high-priority remediation to prevent potential interception of confidential business communications.

---METADATA---
VENDOR: Dell
PRODUCT: Automation Platform
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dell Automation Platform versions prior to 2.0.0.0 are affected by a missing authorization vulnerability, allowing authenticated users to perform unauthorized actions.

Executive Summary:
Dell Automation Platform versions prior to 2.0.0.0 are vulnerable to a missing authorization flaw, enabling unauthorized access to sensitive system functions.

Vulnerability Details

CVE-ID: CVE-2026-32658

Affected Software: Dell Automation Platform

Affected Versions: 0 up to (excluding) 2.0.0.0

Vulnerability: The software fails to implement proper authorization checks (CWE-862), allowing an authenticated user with low privileges to perform actions that should be restricted. The vulnerability is accessible via the network and requires user interaction (AV:N/AC:L/PR:L/UI:R).

Business Impact

The lack of proper authorization can lead to unauthorized access to system resources, potential data manipulation, or complete system compromise, depending on the scope of the affected functions. With a CVSS score of 8.0, this vulnerability poses a significant risk to the integrity and availability of the automation workflows managed by the platform.

Remediation Plan

Immediate Action: Update the Dell Automation Platform to version 2.0.0.0 or later as specified in the vendor security advisory (DSA-2026-193).

Proactive Monitoring: Review audit logs for unauthorized access attempts or suspicious activity performed by low-privileged service accounts.

Compensating Controls: Enforce strict Role-Based Access Control (RBAC) and implement Principle of Least Privilege (PoLP) to minimize the potential impact of an authenticated user abusing this authorization flaw.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where insufficient internal access controls are present.

Analyst Recommendation

Organizations should treat this update as a high priority, especially in production environments where the Automation Platform manages critical business processes. Applying the patch to version 2.0.0.0 or later is necessary to eliminate the authorization gap and prevent potential privilege escalation.

---METADATA---
VENDOR: the affected software
PRODUCT: the affected software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An administrative endpoint is exposed without authentication, allowing remote attackers to access sensitive device management functions.

Executive Summary:
A high-severity authentication bypass vulnerability allows unauthenticated remote attackers to gain full administrative access to device management functions.

Vulnerability Details

CVE-ID: CVE-2026-32646

Affected Software: the affected software

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is characterized by a complete lack of authentication on a specific administrative endpoint. An unauthenticated attacker can directly access management interfaces, allowing them to modify configurations or control the device remotely.

Business Impact

Unauthorized administrative access is one of the most severe security failures possible. With a CVSS score of 7.5, the impact includes total loss of device control, potential data exfiltration, and the ability for an attacker to use the device as a foothold within the internal network.

Remediation Plan

Immediate Action: Apply the vendor security patch immediately to enforce authentication on all administrative endpoints.

Proactive Monitoring: Scan for exposed management interfaces on the network and review access logs for any unauthorized hits to administrative URLs.

Compensating Controls: Place the administrative interface behind a management VLAN or a firewall that restricts access to a limited set of trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, unauthenticated administrative access is a "low-hanging fruit" for attackers and is likely to be targeted rapidly.

Analyst Recommendation

This vulnerability represents a critical failure in security architecture. Due to the unauthenticated nature of the flaw and the CVSS score of 7.5, you must apply the patch immediately or disable the affected management interface until remediation is complete.

---METADATA---
VENDOR: Milesight
PRODUCT: AIOT Cameras
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Milesight AIOT cameras use SSL certificates with default private keys, enabling potential man-in-the-middle attacks.

Executive Summary:
Milesight AIOT cameras are vulnerable to traffic interception due to the use of hardcoded, default SSL private keys in specific firmware versions.

Vulnerability Details

CVE-ID: CVE-2026-32644

Affected Software: Milesight AIOT Cameras

Affected Versions: See vendor advisory

Vulnerability: The firmware utilizes default private keys for SSL/TLS communication, allowing an unauthenticated attacker to decrypt encrypted traffic or perform sophisticated man-in-the-middle (MitM) attacks.

Business Impact

The CVSS score of 9.8 reflects the high risk of traffic interception and unauthorized access to sensitive video feeds and administrative credentials. This flaw undermines the entire security architecture of the camera deployment, potentially leading to unauthorized surveillance or credential theft.

Remediation Plan

Immediate Action: Update camera firmware to the latest available version provided by Milesight that addresses the default key issue.

Proactive Monitoring: Review network traffic logs for anomalous SSL/TLS handshake patterns or unauthorized connection attempts to the camera management interfaces.

Compensating Controls: Isolate camera networks using VLANs and restrict access to management interfaces via a VPN or firewalled proxy.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must prioritize firmware updates for all deployed Milesight cameras. If immediate patching is not possible, segmenting these devices from the primary network is essential to mitigate the risk of interception.

---METADATA---
VENDOR: F5
PRODUCT: BIG-IP and BIG-IQ
AFFECTED_VERSIONS: BIG-IP: 21.0.0 up to 21.0.0.2, 17.5.0 up to 17.5.1.6, 17.1.0 up to 17.1.3.2, 16.1.0 and later; BIG-IQ: 8.4.0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in F5 BIG-IP and BIG-IQ systems allows authenticated users with Certificate Manager roles to modify configuration objects to execute arbitrary system commands.

Executive Summary:
A high-severity privilege escalation vulnerability in F5 BIG-IP and BIG-IQ allows authenticated attackers to execute arbitrary commands via modified configuration objects.

Vulnerability Details

CVE-ID: CVE-2026-32643

Affected Software: F5 BIG-IP and BIG-IQ

Affected Versions: BIG-IP: 21.0.0 up to 21.0.0.2, 17.5.0 up to 17.5.1.6, 17.1.0 up to 17.1.3.2, 16.1.0 and later; BIG-IQ: 8.4.0 and later

Vulnerability: This vulnerability (CWE-250) permits an authenticated attacker with at least the Certificate Manager role to manipulate configuration objects. This manipulation results in the execution of arbitrary commands with elevated system privileges.

Business Impact

The ability to execute arbitrary commands on critical network infrastructure appliances like BIG-IP and BIG-IQ poses a severe risk to organizational security. With a CVSS score of 8.7, this flaw could allow an attacker to bypass security controls, disrupt network traffic, or maintain persistent access to the internal network.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by F5 for both BIG-IP and BIG-IQ platforms.

Proactive Monitoring: Monitor configuration change logs for any suspicious modifications to certificate-related objects or unexpected command execution.

Compensating Controls: Implement strict role-based access control (RBAC) to ensure that only essential personnel possess the Certificate Manager role and audit existing permissions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is limited to those who have already achieved a specific level of authenticated administrative access.

Analyst Recommendation

Security teams must treat this vulnerability as a high priority. Ensure that all affected BIG-IP and BIG-IQ systems are updated to the vendor-specified versions to prevent the misuse of administrative roles for arbitrary command execution.

---METADATA---
VENDOR: Glances
PRODUCT: Glances
AFFECTED_VERSIONS: Prior to version 4.5.2
---END_METADATA---

Description Summary:
The Glances monitoring tool exposes sensitive HTTP Basic credentials for downstream servers via an unauthenticated API endpoint when the central browser is run without a password.

Executive Summary:
An unauthenticated information disclosure vulnerability in Glances allows remote attackers to harvest reusable authentication secrets for protected downstream monitoring servers.

Vulnerability Details

CVE-ID: CVE-2026-32633

Affected Software: Glances Glances

Affected Versions: Prior to version 4.5.2

Vulnerability: The /api/4/serverslist endpoint returns raw server objects that include embedded HTTP Basic credentials in the uri field. In common internal deployments where the Glances Browser is started without the --password flag, this endpoint is completely unauthenticated.

Business Impact

The exposure of reusable credentials allows an attacker to gain unauthorized access to all downstream Glances servers within the infrastructure. With a CVSS score of 9.1, this vulnerability poses a critical risk to organizational security, as it facilitates lateral movement and provides attackers with deep visibility into system performance and configurations across the entire network.

Remediation Plan

Immediate Action: Update Glances to version 4.5.2 or higher immediately and ensure that all Glances Browser instances are configured with the --password requirement.

Proactive Monitoring: Review API access logs for unauthorized requests to the /api/4/serverslist endpoint and monitor for anomalous login activity on downstream monitoring nodes.

Compensating Controls: Implement network segmentation to ensure the Glances API is only accessible from trusted administrative subnets and use a Web Application Firewall (WAF) to block unauthenticated access to the /api/ path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the unauthenticated nature of the disclosure makes this a highly attractive target for internal or external attackers seeking to escalate privileges.

Analyst Recommendation

This vulnerability represents a significant failure in credential handling. It is imperative that organizations update to version 4.5.2 and enforce password authentication on all monitoring interfaces to prevent the mass exposure of infrastructure credentials.

---METADATA---
VENDOR: Mintplex Labs
PRODUCT: AnythingLLM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
AnythingLLM contains a high-severity vulnerability related to how it processes content into context for Large Language Models, potentially leading to unauthorized access.

Executive Summary:
A critical vulnerability in AnythingLLM allows for the potential compromise of LLM context and system integrity, posing a severe risk to AI-integrated data workflows.

Vulnerability Details

CVE-ID: CVE-2026-32628

Affected Software: Mintplex Labs AnythingLLM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the application's core logic for transforming content into LLM context. While specific technical details are limited, it likely involves improper sanitization of inputs, which could allow an unauthenticated or low-privileged attacker to influence the LLM's behavior or access sensitive data.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as High-to-Critical. A successful exploit could lead to the exposure of private documents used as context, the injection of malicious instructions into the LLM, or broader system compromise, severely impacting the reliability and security of AI-driven business operations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Mintplex Labs for the AnythingLLM application immediately.

Proactive Monitoring: Monitor application logs for anomalous content ingestion requests or unusual patterns in LLM interaction history.

Compensating Controls: Isolate the AnythingLLM instance within a restricted network segment and implement strict API authentication to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score reflects the significant access an attacker could gain to sensitive organizational data used in AI training and chatting.

Analyst Recommendation

The urgency for this remediation is high due to the 8.8 CVSS score. Security teams should prioritize the update of AnythingLLM instances to prevent attackers from compromising the integrity of the organization's LLM context and associated data repositories.

---METADATA---
VENDOR: AnythingLLM
PRODUCT: AnythingLLM Desktop
AFFECTED_VERSIONS: 1.11.1 and earlier
---END_METADATA---

Description Summary:
A Streaming Phase XSS in AnythingLLM Desktop's chat pipeline escalates to Remote Code Execution (RCE) on the host OS due to insecure Electron configurations and lack of sanitization.

Executive Summary:
AnythingLLM Desktop is subject to a critical vulnerability where a simple chat interaction can trigger remote code execution on the user's computer without any interaction.

Vulnerability Details

CVE-ID: CVE-2026-32626

Affected Software: AnythingLLM Desktop

Affected Versions: 1.11.1 and earlier

Vulnerability: The vulnerability stems from a failure to escape HTML entities in the custom markdown-it image renderer and the use of dangerouslySetInnerHTML without DOMPurify sanitization. This unauthenticated XSS flaw escalates to RCE because the underlying Electron framework is insecurely configured.

Business Impact

This vulnerability poses a catastrophic risk to individual workstations and corporate data. An attacker can execute arbitrary commands on the host operating system simply by sending a malicious payload through the chat interface. The CVSS score of 9.6 reflects the ease of exploitation and the total compromise of the host machine.

Remediation Plan

Immediate Action: Update AnythingLLM Desktop to the latest version (post-1.11.1) immediately to apply the necessary sanitization and Electron security hardening.

Proactive Monitoring: Review endpoint security logs for suspicious process spawning from the AnythingLLM application and inspect chat history for unusual markdown or HTML tags.

Compensating Controls: Use application control software to restrict the execution of unauthorized scripts and ensure the application is run with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation. However, the combination of XSS and RCE in a popular desktop application makes this a highly attractive target for attackers.

Analyst Recommendation

Immediate remediation is mandatory for all users of AnythingLLM Desktop. The transition from XSS to RCE is a critical failure point; therefore, updating to a version that implements proper DOMPurify sanitization and hardened Electron settings is the only effective way to mitigate this risk.

---METADATA---
VENDOR: Apollo
PRODUCT: Federation
AFFECTED_VERSIONS: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in Apollo Federation's query plan execution allows attackers to pollute Object.prototype, potentially leading to remote code execution or denial of service.

Executive Summary:
Apollo Federation is vulnerable to a critical prototype pollution flaw that allows malicious clients or compromised subgraphs to compromise the integrity of the entire gateway.

Vulnerability Details

CVE-ID: CVE-2026-32621

Affected Software: Apollo Federation

Affected Versions: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2

Vulnerability: A vulnerability in the gateway's query plan execution allows for the pollution of Object.prototype. This can be triggered by a malicious client using field aliases/variables or by a compromised subgraph sending malicious JSON response payloads.

Business Impact

Prototype pollution in a central gateway like Apollo Federation is a Critical risk (CVSS 9.9). It can lead to Remote Code Execution (RCE), bypass of security logic, or persistent Denial of Service (DoS) across the entire application graph. This affects the core architecture of the organization's API ecosystem.

Remediation Plan

Immediate Action: Update Apollo Federation to version 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2, or later to address the pollution flaw.

Proactive Monitoring: Audit GraphQL queries for unusual field aliasing patterns and monitor subgraph responses for unexpected JSON structures targeting prototype-inheritable properties.

Compensating Controls: Implement strict schema validation and use security libraries that freeze the Object.prototype to prevent modification at runtime.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 16, 2026, there is no public information indicating active exploitation. However, prototype pollution is a highly effective attack vector against Node.js-based environments.

Analyst Recommendation

Given the CVSS score of 9.9 and the central role Apollo Federation plays in modern API architectures, this update must be applied immediately. Security teams should coordinate with development teams to ensure all gateways and subgraphs are running the patched versions to maintain the integrity of the unified graph.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SPeL injection vulnerability in the Spinnaker Echo service allows remote attackers to execute arbitrary Java code and access system files with full JVM privileges.

Executive Summary:
Spinnaker is subject to a critical remote code execution vulnerability that allows attackers to gain full system access via insecure SPeL expression processing.

Vulnerability Details

CVE-ID: CVE-2026-32613

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The Echo service fails to restrict SPeL (Spring Expression Language) to a trusted context, allowing an authenticated or unauthenticated attacker (depending on deployment) to invoke arbitrary Java classes and execute commands on the underlying host.

Business Impact

The severity of this vulnerability is underscored by its CVSS score of 9.9, reflecting the potential for full system compromise. Successful exploitation grants attackers the ability to execute arbitrary commands, access sensitive credentials, and pivot within the infrastructure, leading to catastrophic data breaches and loss of control over the CI/CD pipeline.

Remediation Plan

Immediate Action: Upgrade Spinnaker to version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. If patching cannot be performed immediately, disable the Echo service as a temporary workaround.

Proactive Monitoring: Review system logs for unusual process execution or unauthorized file access originating from the Echo service component.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Runtime Application Self-Protection (RASP) tool to detect and block malicious expression language payloads directed at the Spinnaker services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total compromise vector. Security teams must treat this as a high-priority incident, ensuring that all Spinnaker instances are updated to the secure versions or that the vulnerable service is disabled to prevent exploitation.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in Spinnaker's clouddriver pods allows attackers to execute arbitrary commands, potentially compromising credentials and resources.

Executive Summary:
Spinnaker clouddriver pods are vulnerable to arbitrary command execution, posing a critical risk of complete environment compromise.

Vulnerability Details

CVE-ID: CVE-2026-32604

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The application fails to properly sanitize inputs, allowing an attacker to execute arbitrary commands directly on the clouddriver pods. This vulnerability facilitates the exfiltration of credentials and the modification of cloud resources managed by the platform.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely severe. Successful exploitation allows an attacker to achieve full control over the clouddriver component, leading to the compromise of cloud credentials, unauthorized manipulation of infrastructure resources, and potential lateral movement into the target cloud environment.

Remediation Plan

Immediate Action: Upgrade to Spinnaker version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. As a temporary mitigation, disable the gitrepo artifact types.

Proactive Monitoring: Monitor for unexpected command execution within container environments and watch for unusual spikes in resource usage or unexpected network connections originating from clouddriver pods.

Compensating Controls: Apply strict network policies to restrict outbound traffic from clouddriver pods and ensure that the service account permissions associated with the pods follow the principle of least privilege.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease with which arbitrary commands can be executed, this vulnerability requires immediate attention. Organizations should prioritize updating their Spinnaker environment to the patched versions to prevent unauthorized access and potential takeover of their cloud infrastructure.

---METADATA---
VENDOR: PyJWT
PRODUCT: PyJWT
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
PyJWT, a Python implementation of JSON Web Token, contains a vulnerability that could compromise token integrity or verification processes.

Executive Summary:
A high-severity vulnerability in the PyJWT library threatens the integrity of JSON Web Token (JWT) authentication, potentially allowing attackers to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-32597

Affected Software: PyJWT

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the PyJWT library's handling of token processing or verification. While specific function names are not provided, the flaw likely impacts the core authentication logic used by applications relying on this Python implementation.

Business Impact

A successful exploit could lead to unauthorized access to sensitive application features or administrative interfaces. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data breaches and identity spoofing, as JWTs are frequently used for session management and identity propagation in modern web architectures.

Remediation Plan

Immediate Action: Update the PyJWT library to the latest patched version via pip or your preferred package manager immediately.

Proactive Monitoring: Review application logs for unusual authentication patterns or failed token validation attempts that might indicate exploitation testing.

Compensating Controls: Implement strict input validation for all JWT headers and ensure that the library is configured to explicitly require secure signing algorithms (e.g., RS256).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role PyJWT plays in authentication, the potential for exploitation is high once technical details become public.

Analyst Recommendation

The high CVSS score of 7.5 underscores the urgency of this advisory. Organizations using PyJWT must prioritize updating their dependencies across all environments to mitigate the risk of authentication bypass. Failure to patch could leave applications vulnerable to sophisticated session hijacking attacks.

---METADATA---
VENDOR: Nelio Software
PRODUCT: Nelio AB Testing
AFFECTED_VERSIONS: versions up to and including 8.2.7
---END_METADATA---

Description Summary:
Nelio AB Testing plugin for WordPress contains a code injection vulnerability. This allows remote attackers to execute arbitrary code by exploiting improper control of code generation.

Executive Summary:
Nelio AB Testing versions up to 8.2.7 are susceptible to a critical code injection vulnerability that could lead to full site takeover and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-32573

Affected Software: Nelio Software Nelio AB Testing

Affected Versions: n/a through 8.2.7

Vulnerability: This flaw involves the Improper Control of Generation of Code ('Code Injection') within the Nelio AB Testing plugin. The vulnerability allows an attacker to inject and execute malicious code, potentially gaining unauthorized control over the WordPress environment.

Business Impact

A successful exploit could result in the complete compromise of the affected web server, leading to unauthorized data access, website defacement, or the installation of persistent backdoors. The CVSS score of 9.1 reflects a Critical severity level, indicating that the vulnerability poses an extreme risk to organizational data integrity and service availability.

Remediation Plan

Immediate Action: Update the Nelio AB Testing plugin to the latest available version (greater than 8.2.7) immediately to patch the injection point.

Proactive Monitoring: Review web server access logs for unusual PHP execution patterns or suspicious requests targeting plugin directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rulesets specifically designed to block common remote code execution (RCE) and code injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical CVSS score of 9.1, the potential for rapid exploit development is high.

Analyst Recommendation

The critical nature of this code injection vulnerability necessitates immediate remediation. IT administrators should prioritize updating the Nelio AB Testing plugin across all WordPress instances to prevent unauthorized system access and ensure the security of the underlying hosting infrastructure.

---METADATA---
VENDOR: TOKUHIROM
PRODUCT: UnQLite for Perl
AFFECTED_VERSIONS: 0 through 0.06
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The UnQLite for Perl module embeds an outdated, vulnerable version of the UnQLite library, which is susceptible to heap-based buffer overflows.

Executive Summary:
The UnQLite for Perl module contains a legacy, vulnerable third-party component that poses a critical risk of heap-based memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-3257

Affected Software: TOKUHIROM UnQLite for Perl

Affected Versions: 0 through 0.06

Vulnerability: The module suffers from a dependency on a vulnerable third-party component (CWE-1395), specifically an outdated 2014-era version of the UnQLite library, which lacks modern protections against heap-based buffer overflows.

Business Impact

Successful exploitation of a heap overflow can lead to arbitrary code execution, system crashes, or significant data compromise. Given the CVSS score of 9.8, this vulnerability is critical and could allow an attacker to gain full control over the affected application environment.

Remediation Plan

Immediate Action: The vendor has deprecated this module as of version 0.06; users must migrate to an alternative database solution immediately.

Proactive Monitoring: Monitor system memory usage and application logs for signs of segmentation faults or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: If migration is delayed, isolate the application within a restricted-privilege container or sandbox to limit the impact of a potential code execution event.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a consequence of using deprecated and unmaintained third-party code.

Analyst Recommendation

Because the software is deprecated and contains a critical vulnerability, patching is not an option. Organizations must treat this as a high-priority migration task and move to a supported database component to eliminate this risk entirely.

---METADATA---
VENDOR: PublishPress
PRODUCT: PublishPress Revisions
AFFECTED_VERSIONS: From n/a through 3.7.23
---END_METADATA---

Description Summary:
PublishPress Revisions is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands. This affects versions up to 3.7.23.

Executive Summary:
PublishPress Revisions for WordPress is vulnerable to a critical Blind SQL Injection attack, which could allow attackers to extract sensitive data from the site's database.

Vulnerability Details

CVE-ID: CVE-2026-32539

Affected Software: PublishPress Revisions (WordPress Plugin)

Affected Versions: From n/a through 3.7.23

Vulnerability: The vulnerability is a Blind SQL Injection resulting from improper neutralization of user-supplied input used in SQL queries. An attacker can use specially crafted payloads to query the database indirectly, potentially identifying as an unauthenticated or low-privileged user depending on the revisionary access configuration.

Business Impact

Successful exploitation can lead to the unauthorized disclosure of sensitive information, including user credentials, site configurations, and proprietary content. SQL injection is a high-impact flaw that can lead to complete database compromise. The CVSS score of 9.3 highlights the severe risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Update the PublishPress Revisions plugin to the latest available version (greater than 3.7.23) to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing SQL keywords such as UNION, SELECT, SLEEP(), or AND/OR logic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with generic SQL injection protection rules to block malicious payloads before they reach the WordPress application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Blind SQLi is more difficult to exploit than standard SQLi but remains a highly effective method for data exfiltration by patient attackers.

Analyst Recommendation

SQL injection remains one of the most dangerous web vulnerabilities. We recommend an immediate update to the latest version of PublishPress Revisions. Additionally, ensure that the database user for WordPress follows the principle of least privilege to limit the scope of any potential injection.

---METADATA---
VENDOR: Halfdata
PRODUCT: Green Downloads
AFFECTED_VERSIONS: From n/a through 2.08
---END_METADATA---

Description Summary:
Green Downloads allows unrestricted upload of files with dangerous types, enabling the use of malicious files. This affects versions up to 2.08.

Executive Summary:
The Green Downloads WordPress plugin is vulnerable to an unrestricted file upload flaw, allowing unauthenticated attackers to upload and execute malicious scripts on the server.

Vulnerability Details

CVE-ID: CVE-2026-32536

Affected Software: Green Downloads (WordPress Plugin)

Affected Versions: From n/a through 2.08

Vulnerability: This is an Unrestricted Upload of File with Dangerous Type vulnerability in the halfdata-paypal-green-downloads component. The plugin does not properly validate file extensions or content types, allowing an unauthenticated user to upload executable files (e.g., .php files) to the server.

Business Impact

This vulnerability directly leads to Remote Code Execution (RCE). An attacker can upload a web shell and gain full control over the website and the underlying server environment. The CVSS score of 9.9 reflects the critical nature of unauthenticated file upload vulnerabilities.

Remediation Plan

Immediate Action: Update Green Downloads to the latest version immediately. If no update is available, disable the file upload functionality or the plugin entirely.

Proactive Monitoring: Scan the plugin's download and upload directories for unexpected PHP or executable files that do not match the expected document types.

Compensating Controls: Configure the web server to disable the execution of scripts in the directory where the plugin stores uploaded files (e.g., using .htaccess or Nginx configuration).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Unrestricted file upload is a highly reliable exploitation method once a vulnerable endpoint is identified.

Analyst Recommendation

The ability to upload and execute files provides an attacker with a permanent foothold on the system. This vulnerability must be remediated immediately. Ensure that all file upload components in your environment enforce strict allow-lists for file extensions and perform server-side content validation.

---METADATA---
VENDOR: JetMonsters
PRODUCT: JetFormBuilder
AFFECTED_VERSIONS: From n/a through 3.5.6.1
---END_METADATA---

Description Summary:
JetFormBuilder is vulnerable to Code Injection due to improper control of code generation. This affects versions up to and including 3.5.6.1.

Executive Summary:
A critical code injection vulnerability in the JetFormBuilder WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server, leading to a complete site takeover.

Vulnerability Details

CVE-ID: CVE-2026-32525

Affected Software: JetFormBuilder (WordPress Plugin)

Affected Versions: From n/a through 3.5.6.1

Vulnerability: The vulnerability is a Code Injection flaw within the jetformbuilder component. The plugin fails to properly sanitize inputs that are later used in the generation of executable code, allowing an unauthenticated attacker to inject and run malicious PHP scripts.

Business Impact

Successful exploitation allows for Remote Code Execution (RCE), giving the attacker the same permissions as the web server. This can lead to the theft of sensitive customer data, deployment of malware, and total loss of site availability. The CVSS score of 9.9 indicates an extreme risk level.

Remediation Plan

Immediate Action: Update JetFormBuilder to version 3.5.7 or higher immediately to patch the code injection entry points.

Proactive Monitoring: Review web logs for unusual POST requests to form-processing endpoints that contain PHP code fragments or obfuscated strings.

Compensating Controls: Implement strict file integrity monitoring (FIM) to detect any unauthorized changes to the WordPress core or plugin files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Code injection in form builders is a common target for automated exploit kits.

Analyst Recommendation

Given the CVSS score of 9.9, this vulnerability is critical. We recommend an immediate update of the JetFormBuilder plugin. Administrators should also review their WordPress security posture to ensure that unauthenticated code execution is mitigated by layered defenses.

---METADATA---
VENDOR: wpWax
PRODUCT: Templatiq
AFFECTED_VERSIONS: n/a through 0.2.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Templatiq WordPress plugin is vulnerable to an arbitrary file upload flaw, allowing authenticated contributors to execute malicious code on the server.

Executive Summary:
The Templatiq plugin for WordPress contains a critical file upload vulnerability that allows authenticated users to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-32474

Affected Software: wpWax Templatiq

Affected Versions: n/a through 0.2.5

Vulnerability: This vulnerability is an unrestricted file upload flaw (CWE-434) that permits an authenticated user with contributor-level access to upload malicious files, potentially leading to full system compromise.

Business Impact

Successful exploitation allows an attacker to bypass security restrictions and execute arbitrary code on the underlying server. Given the CVSS score of 9.9, this vulnerability poses a critical risk to data confidentiality, integrity, and availability, potentially resulting in complete site takeover.

Remediation Plan

Immediate Action: Review the wpWax vendor advisory for the latest security update and apply it immediately to address the file upload restriction.

Proactive Monitoring: Monitor server logs for suspicious file uploads or access to non-standard executable file types within the WordPress uploads directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to the upload functionality based on user roles.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the low privilege requirement for contributors.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for remote code execution, organizations must prioritize patching. If an update is not immediately available, restrict plugin access or disable the functionality until a secure version is deployed.

---METADATA---
VENDOR: Kamlesh Parmar
PRODUCT: Sync Post With Other Site
AFFECTED_VERSIONS: n/a through 1.9.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Sync Post With Other Site WordPress plugin is vulnerable to an arbitrary file upload flaw, allowing authenticated contributors to execute malicious code on the server.

Executive Summary:
The Sync Post With Other Site plugin for WordPress contains a critical file upload vulnerability that allows authenticated users to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-32463

Affected Software: Kamlesh Parmar Sync Post With Other Site

Affected Versions: n/a through 1.9.3

Vulnerability: This vulnerability is an unrestricted file upload flaw (CWE-434) that permits an authenticated user with contributor-level access to upload malicious files, potentially leading to full system compromise.

Business Impact

Successful exploitation allows an attacker to bypass security restrictions and execute arbitrary code on the underlying server. Given the CVSS score of 9.9, this vulnerability represents a critical threat to the integrity and availability of the affected WordPress environment.

Remediation Plan

Immediate Action: Check the developer website for the latest version of the Sync Post With Other Site plugin and apply the necessary updates to resolve the flaw.

Proactive Monitoring: Audit WordPress file system logs for anomalous activity or the creation of unexpected files within the upload directories.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and prevent the upload of prohibited file types.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high for any user holding the contributor role.

Analyst Recommendation

Administrators must verify the plugin version and apply updates immediately. Given the high risk of code execution, failing to patch this vulnerability leaves the application open to complete compromise by authenticated attackers.