---METADATA---
VENDOR: Unity Catalog
PRODUCT: Unity Catalog
AFFECTED_VERSIONS: 0.4.0 and earlier
---END_METADATA---

Description Summary:
Unity Catalog 0.4.0 and earlier contains a critical authentication bypass in the token exchange endpoint due to improper validation of the issuer claim in incoming JSON Web Tokens (JWTs).

Executive Summary:
Unity Catalog versions 0.4.0 and earlier are subject to a critical authentication bypass that allows attackers to spoof identities by providing untrusted JWT issuer claims.

Vulnerability Details

CVE-ID: CVE-2026-27478

Affected Software: Unity Catalog

Affected Versions: 0.4.0 and earlier

Vulnerability: The vulnerability resides in the /api/1.0/unity-control/auth/tokens endpoint, which extracts the "iss" (issuer) claim from JWTs without verification. An attacker can provide a malicious issuer URL, forcing the system to fetch a JWKS from an attacker-controlled server to "validate" the token's signature.

Business Impact

This flaw facilitates a complete authentication bypass, allowing unauthorized users to access data and AI assets managed within the Unity Catalog. Given the CVSS score of 9.1, the impact is severe, potentially leading to the exposure of proprietary machine learning models and sensitive organizational datasets.

Remediation Plan

Immediate Action: Update Unity Catalog to the latest available version (post-0.4.0) that enforces a whitelist of trusted identity providers.

Proactive Monitoring: Audit authentication logs for unusual token exchange requests and monitor outbound network traffic for requests to unknown or suspicious domains originating from the Unity Catalog server.

Compensating Controls: Implement network-level egress filtering to prevent the Unity Catalog server from connecting to untrusted external JWKS endpoints or use a dedicated identity proxy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, JWT implementation flaws are frequently targeted once discovered due to the high value of the bypassed security layer.

Analyst Recommendation

The reliance on untrusted issuer claims for signature verification fundamentally breaks the security model of the Unity Catalog. Organizations using this software for data governance must apply the vendor-provided patches immediately to prevent unauthorized access to critical AI infrastructure.

---METADATA---
VENDOR: Bixat
PRODUCT: RustFly
AFFECTED_VERSIONS: 2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the RustFly remote UI control mechanism allows unauthenticated attackers to execute arbitrary system commands via UDP port 5005.

Executive Summary:
Bixat RustFly 2.0.0 is susceptible to unauthenticated remote command injection, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-27476

Affected Software: Bixat RustFly

Affected Versions: 2.0.0

Vulnerability: The vulnerability (CWE-78) stems from improper sanitization of hex-encoded instructions sent over UDP port 5005. This allows an unauthenticated, remote attacker to inject and execute OS-level commands on the underlying system.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete system compromise. An attacker could establish reverse shells, exfiltrate sensitive data, or disrupt business operations entirely. The exposure of UDP port 5005 to untrusted networks significantly increases the probability of successful exploitation.

Remediation Plan

Immediate Action: Update the software to the latest available version provided by the vendor. If an update is unavailable, restrict network access to UDP port 5005 to trusted management IP addresses only.

Proactive Monitoring: Monitor network traffic for unexpected UDP activity on port 5005 and investigate any anomalies in system process execution patterns.

Compensating Controls: Utilize a network firewall to block inbound traffic to the affected UDP port from untrusted external sources.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept is available via VulnCheck and PacketStorm.

Analyst Notes: As of Feb 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the injection vector makes this an attractive target for automated scanning.

Analyst Recommendation

Due to the availability of proof-of-concept material and the critical severity of command injection, immediate remediation is required. Organizations should verify their exposure and apply vendor patches or network-level access controls without delay.

---METADATA---
VENDOR: BigBlueButton
PRODUCT: BigBlueButton
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the BigBlueButton open-source virtual classroom software could allow an attacker to compromise session integrity or access unauthorized data.

Executive Summary:
A high-severity security flaw in BigBlueButton threatens the confidentiality and integrity of virtual classroom sessions and user data.

Vulnerability Details

CVE-ID: CVE-2026-27466

Affected Software: BigBlueButton

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the BigBlueButton platform, an open-source solution for online learning. Based on the CVSS score of 7.2, the flaw likely involves improper access controls or input validation within the web-based conferencing interface.

Business Impact

A successful exploit could lead to unauthorized access to private meetings, exposure of student/teacher information, or disruption of educational services. The CVSS score of 7.2 reflects a high risk to organizational reputation and data privacy, particularly for institutions handling sensitive educational records.

Remediation Plan

Immediate Action: Administrators should update their BigBlueButton instances to the latest stable release provided by the developers.

Proactive Monitoring: Review meeting access logs for anomalous join patterns or unauthorized administrative actions within the classroom dashboard.

Compensating Controls: Ensure that all sessions are protected by strong passwords and that the "waiting room" feature is enabled to vet participants manually.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. Organizations using this platform for sensitive communications should remain vigilant and patch promptly.

Analyst Recommendation

Virtual classroom environments are frequent targets for disruption. We recommend that security teams apply the available vendor updates immediately to prevent potential session hijacking or data exposure that could impact institutional operations.

---METADATA---
VENDOR: Umbraco
PRODUCT: Umbraco Engage
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Umbraco Engage, a business intelligence platform, is affected by a high-severity vulnerability that could lead to unauthorized platform access.

Executive Summary:
Umbraco Engage contains a high-severity vulnerability that poses a significant risk to business intelligence data and platform security.

Vulnerability Details

CVE-ID: CVE-2026-27449

Affected Software: Umbraco Engage

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited, the vulnerability affects the Umbraco Engage platform and carries a CVSS score of 7.5. This typically indicates a flaw that could allow for unauthorized data access or privilege escalation.

Business Impact

A compromise of a business intelligence platform like Umbraco Engage could lead to the exposure of sensitive corporate data, analytics, and strategic insights. The High severity rating (7.5) suggests that successful exploitation could result in significant data confidentiality breaches or unauthorized modifications to business reports.

Remediation Plan

Immediate Action: Organizations should immediately consult the Umbraco security advisory and apply the recommended security updates to all Engage instances.

Proactive Monitoring: Review access logs for the Umbraco Engage dashboard for any unauthorized login attempts or unusual data export activities.

Compensating Controls: Ensure the platform is behind a VPN or protected by multi-factor authentication (MFA) to reduce the attack surface while waiting for patch deployment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 28, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public exploit code provides a brief window for administrators to secure their environments.

Analyst Recommendation

Given the high severity of this vulnerability and the sensitive nature of business intelligence data, immediate patching is required. Administrators must verify their current version against the vendor's advisory and update to a secure release to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Rustaurius
PRODUCT: Five Star Business Profile and Schema
AFFECTED_VERSIONS: <= 2.3.19
---END_METADATA---

Description Summary:
An arbitrary code execution vulnerability exists in Rustaurius Five Star Business Profile and Schema versions 2.3.19 and earlier, exploitable by authenticated users with Editor capabilities.

Executive Summary:
A critical arbitrary code execution vulnerability in Rustaurius Five Star Business Profile and Schema allows authenticated Editors to gain unauthorized control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-27436

Affected Software: Rustaurius Five Star Business Profile and Schema

Affected Versions: <= 2.3.19

Vulnerability: This vulnerability enables authenticated attackers with 'Editor' privileges to execute arbitrary code on the underlying server. The flaw stems from insufficient input validation, allowing malicious files or commands to be processed by the server-side application.

Business Impact

The ability for an authenticated user to execute arbitrary code leads to a total compromise of the application and potentially the underlying web server. With a CVSS score of 9.1, this represents a severe risk of lateral movement, privilege escalation, and persistent backend access that could lead to complete system takeover.

Remediation Plan

Immediate Action: Update the Rustaurius Five Star Business Profile and Schema plugin to the latest version immediately to patch the code execution vector.

Proactive Monitoring: Audit user activity logs to identify any unauthorized or suspicious actions performed by accounts with Editor-level privileges.

Compensating Controls: Restrict or audit the permissions of all accounts with 'Editor' roles and ensure that file upload restrictions are strictly enforced at the server level.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation by malicious insiders or compromised accounts is high.

Analyst Recommendation

Given the critical nature of this arbitrary code execution flaw, organizations must treat this as a high-priority update. Promptly applying the vendor-provided patch is the only effective way to mitigate the risk of full system compromise via elevated user accounts.

---METADATA---
VENDOR: Zozothemes
PRODUCT: Zegen
AFFECTED_VERSIONS: <= 1.1.9
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in Zozothemes Zegen allows authenticated attackers to execute malicious code.

Executive Summary:
An arbitrary file upload vulnerability in the Zozothemes Zegen theme poses a critical risk of remote code execution for affected WordPress environments.

Vulnerability Details

CVE-ID: CVE-2026-27419

Affected Software: Zozothemes Zegen

Affected Versions: <= 1.1.9

Vulnerability: This vulnerability stems from improper validation of file uploads, allowing an authenticated user with subscriber-level access to upload arbitrary files to the server. By bypassing file type restrictions, an attacker can upload malicious scripts to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized control over the web server, leading to full site compromise, data exfiltration, or the deployment of malware. Given the CVSS score of 9.9, this flaw represents an extreme risk to the confidentiality, integrity, and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update the Zozothemes Zegen theme to the latest available version provided by the vendor to patch the upload validation flaw.

Proactive Monitoring: Review web server access logs for requests targeting directory paths where uploaded files are stored, specifically looking for suspicious file extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict file uploads to verified, safe file types and block direct access to known upload directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent total system compromise. Administrators must prioritize updating the Zegen theme to the latest version and perform a thorough audit of the server for any web shells or unauthorized files uploaded prior to the patch.

---METADATA---
VENDOR: Fuelthemes
PRODUCT: Werkstatt
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A PHP Object Injection vulnerability in the Werkstatt theme allows authenticated contributors to execute arbitrary code.

Executive Summary:
A high-severity PHP Object Injection flaw in the Fuelthemes Werkstatt theme enables authenticated contributors to compromise the hosting environment.

Vulnerability Details

CVE-ID: CVE-2026-27414

Affected Software: Fuelthemes Werkstatt

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from improper handling of serialized data by the theme, which can be exploited by an authenticated contributor. This allows the attacker to inject malicious objects into the application flow, resulting in remote code execution.

Business Impact

Successful exploitation allows an attacker to gain control over the WordPress instance, potentially resulting in data theft, malware distribution, or site defacement. With a CVSS score of 8.8, this flaw necessitates urgent attention to maintain the security and availability of the web infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Werkstatt theme provided by Fuelthemes to mitigate the injection risk.

Proactive Monitoring: Review application access logs for suspicious user behavior and monitor the integrity of critical application configuration files.

Compensating Controls: Deploy WAF rules designed to filter and block suspicious POST requests containing serialized PHP objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with high priority, as it permits unauthorized code execution within the application context. Updating the theme is the primary defense; failure to do so leaves the environment exposed to potential remote compromise.

---METADATA---
VENDOR: Cozmoslabs
PRODUCT: Profile Builder Pro
AFFECTED_VERSIONS: n/a through 3.13.9
---END_METADATA---

Description Summary:
Cozmoslabs Profile Builder Pro is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive information from the database by sending crafted queries.

Executive Summary:
A critical Blind SQL Injection vulnerability in Profile Builder Pro allows attackers to silently exfiltrate sensitive database information, including user credentials and configuration data.

Vulnerability Details

CVE-ID: CVE-2026-27413

Affected Software: Cozmoslabs Profile Builder Pro

Affected Versions: n/a through 3.13.9

Vulnerability: The plugin fails to properly neutralize special elements used in SQL commands. This allows an attacker to perform "Blind" SQL injection, where they can infer database content based on the server's response time or HTTP status codes, even if direct error messages are suppressed.

Business Impact

With a CVSS score of 9.3, this vulnerability represents a major threat to data confidentiality. Attackers can extract user hashes, personal information, and site metadata, which can be used for further attacks or sold on the dark web. This could lead to significant regulatory fines and a loss of customer trust.

Remediation Plan

Immediate Action: Update Cozmoslabs Profile Builder Pro to the latest version (above 3.13.9) immediately to resolve the improper query handling.

Proactive Monitoring: Monitor database logs for unusual query patterns and look for time-delay based attacks in web server access logs (e.g., requests that take exactly 5 or 10 seconds to respond).

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection enabled to filter out malicious payloads targeting database parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. However, SQL injection remains one of the most common and damaging attack vectors for web applications.

Analyst Recommendation

Organizations must prioritize the application of the patch. The ability to extract the entire database through blind injection is a critical risk that must be mitigated immediately to protect sensitive user and corporate data.

---METADATA---
VENDOR: StylemixThemes
PRODUCT: Pearl - Corporate Business
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Local File Inclusion (LFI) vulnerability exists in the Pearl - Corporate Business theme, allowing unauthenticated attackers to read sensitive files on the server.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in the StylemixThemes Pearl - Corporate Business theme poses a severe risk of unauthorized file access and potential server compromise.

Vulnerability Details

CVE-ID: CVE-2026-27412

Affected Software: StylemixThemes Pearl - Corporate Business

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw that allows an unauthenticated attacker to manipulate file paths and access arbitrary files on the underlying server. Because no authentication is required, any remote actor can exploit this to read sensitive configuration files or credentials.

Business Impact

Successful exploitation of this flaw can lead to the exposure of sensitive system files, configuration data, and potentially database credentials, facilitating further attacks. With a CVSS score of 8.1, this is a high-severity issue that could result in a complete compromise of the web application and unauthorized access to hosted data.

Remediation Plan

Immediate Action: Update the Pearl - Corporate Business theme to the latest version provided by the vendor immediately.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences (e.g., ../) or attempts to access system files like /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for unauthenticated attackers to access sensitive files, this vulnerability must be treated with extreme urgency. Administrators should verify their current version and apply security patches as soon as they are released to prevent potential data exfiltration or system compromise.

---METADATA---
VENDOR: BookPro
PRODUCT: BookPro
AFFECTED_VERSIONS: <= 1
---END_METADATA---

Description Summary:
BookPro versions 1 and earlier contain an unauthenticated arbitrary file deletion vulnerability.

Executive Summary:
An unauthenticated arbitrary file deletion vulnerability in BookPro allows remote attackers to delete critical system files, threatening service availability.

Vulnerability Details

CVE-ID: CVE-2026-27400

Affected Software: BookPro BookPro

Affected Versions: <= 1

Vulnerability: The application fails to implement adequate access controls, enabling an unauthenticated attacker to delete arbitrary files on the server. This vulnerability stems from improper input validation regarding file operations.

Business Impact

With a CVSS score of 8.6, the vulnerability represents a high risk to business operations. The ability for an unauthenticated user to delete files can lead to permanent data loss and total system compromise, necessitating an urgent response to prevent exploitation.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor for BookPro immediately.

Proactive Monitoring: Inspect system logs for suspicious file system activity and monitor for unauthorized access patterns.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block potentially malicious file deletion commands.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using BookPro should treat this as a high-priority update. The lack of authentication requirements makes this vulnerability highly accessible to attackers, and remediation should be performed without delay.

---METADATA---
VENDOR: Zohocorp ManageEngine
PRODUCT: ADSelfService Plus, DataSecurity Plus, RecoveryManager Plus
AFFECTED_VERSIONS: ADSelfService Plus < 6525, DataSecurity Plus < 6264, RecoveryManager Plus < 6313
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zohocorp ManageEngine products contain a command injection vulnerability in agent machines due to a third-party dependency, allowing authenticated remote code execution.

Executive Summary:
A critical command injection vulnerability in Zohocorp ManageEngine products permits authenticated remote code execution, posing a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-2740

Affected Software: Zohocorp ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus

Affected Versions: ADSelfService Plus < 6525; DataSecurity Plus < 6264; RecoveryManager Plus < 6313

Vulnerability: This is a command injection vulnerability (CWE-77) triggered by a flaw in a third-party dependency. While the CVSS score is 8.4, the vulnerability requires low privileges (authenticated) to execute arbitrary commands on agent machines.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on agent machines, potentially leading to full system compromise, lateral movement within the network, and the theft of sensitive data. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Update ADSelfService Plus to 6525 or later, DataSecurity Plus to 6264 or later, and RecoveryManager Plus to 6313 or later as specified by the vendor advisory.

Proactive Monitoring: Monitor agent machine logs for unexpected process execution or abnormal command-line activity indicative of injection attempts.

Compensating Controls: Restrict network access to management agents to trusted administrative segments to limit the potential pool of authenticated attackers.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is restricted by the requirement for authenticated access to the system.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators should prioritize patching all affected ManageEngine instances to prevent potential unauthorized code execution and secure their environment against exploitation.

---METADATA---
VENDOR: Unknown
PRODUCT: Paid Videochat Turnkey Site
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated insecure deserialization vulnerability in Paid Videochat Turnkey Site allows attackers to execute arbitrary code.

Executive Summary:
The Paid Videochat Turnkey Site is susceptible to an unauthenticated remote code execution vulnerability via insecure deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2026-27333

Affected Software: Unknown Paid Videochat Turnkey Site

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an insecure deserialization vulnerability affecting the application's data handling processes. Because it does not require authentication, any remote attacker can submit maliciously crafted data to trigger code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a critical threat to the entire hosting environment. Successful exploitation grants an attacker the ability to execute arbitrary commands, potentially leading to full server takeover, data theft, and significant service disruption.

Remediation Plan

Immediate Action: Apply security updates immediately. If no patch is available, disable the affected functionality until a fix is released.

Proactive Monitoring: Inspect server logs for unexpected code execution patterns or anomalous outbound network connections from the web server.

Compensating Controls: Utilize a WAF to inspect incoming traffic for serialized object signatures that are commonly associated with deserialization exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability, it poses an extreme risk to all deployed instances. Immediate mitigation is required; if patching is not possible, isolating the affected system from public access is strongly advised.

---METADATA---
VENDOR: Adobe
PRODUCT: ColdFusion
AFFECTED_VERSIONS: Adobe ColdFusion: 0 through 2025.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Adobe ColdFusion is vulnerable to improper input validation, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
Adobe ColdFusion is impacted by a critical input validation vulnerability that allows unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-27304

Affected Software: Adobe ColdFusion

Affected Versions: Adobe ColdFusion: 0 through 2025.6

Vulnerability: The application fails to properly validate input, leading to arbitrary code execution. This vulnerability is reachable by an unauthenticated attacker over the network (AV:A).

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the ColdFusion service. This level of access typically results in a complete compromise of the application, potential lateral movement within the network, and the loss of confidentiality and integrity for sensitive business data. Given the CVSS score of 9.3, this constitutes a critical security risk requiring immediate remediation.

Remediation Plan

Immediate Action: Update Adobe ColdFusion to the version specified in the vendor security advisory (APSB26-38).

Proactive Monitoring: Monitor server access logs for unusual request patterns or attempts to execute system-level commands via the ColdFusion service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious input payloads targeting ColdFusion interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as an improper input validation issue makes it a high-value target for automated exploitation tools.

Analyst Recommendation

The high CVSS score of 9.3 reflects the severity of an arbitrary code execution flaw that does not require user interaction or authentication. Administrators should prioritize patching all instances of Adobe ColdFusion across the environment to the latest secure version immediately to eliminate this critical exposure.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: Adobe Adobe Connect: 0 through 12.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Adobe Connect contains a deserialization vulnerability that allows remote attackers to execute arbitrary code.

Executive Summary:
A critical deserialization vulnerability in Adobe Connect permits unauthenticated remote code execution, posing a severe risk to organizational infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27303

Affected Software: Adobe Connect

Affected Versions: Adobe Adobe Connect: 0 through 12.10

Vulnerability: The application improperly deserializes untrusted data, which can be leveraged to execute arbitrary code. The vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

Arbitrary code execution via deserialization provides an attacker with full control over the host running Adobe Connect. The potential for a complete system compromise, including the exfiltration of sensitive meeting data and integration credentials, makes this a critical risk. The CVSS score of 9.6 underscores the urgency of addressing this vulnerability to prevent unauthorized access and potential data breaches.

Remediation Plan

Immediate Action: Update Adobe Connect to the latest version as mandated by the vendor security advisory (APSB26-37).

Proactive Monitoring: Audit system logs for unexpected process execution or abnormal resource consumption originating from the Adobe Connect service.

Compensating Controls: Utilize network segmentation to restrict access to the Adobe Connect management interface, limiting the exposure to untrusted network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Deserialization vulnerabilities are notoriously dangerous and often result in high-impact exploitation if a public exploit is developed.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required to protect the environment. Organizations should verify that all Adobe Connect instances are updated to the secure version provided by Adobe to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Connect allows attackers to execute malicious JavaScript in a victim's browser via DOM manipulation.

Executive Summary:
Adobe Connect contains a critical DOM-based XSS vulnerability that could allow attackers to execute arbitrary JavaScript within a user's browser session, potentially leading to full account compromise.

Vulnerability Details

CVE-ID: CVE-2026-27246

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a DOM-based Cross-Site Scripting (XSS) vulnerability where the application improperly handles user-supplied input within the Document Object Model. Exploitation requires user interaction, specifically tricking a victim into visiting a crafted webpage to trigger the malicious script execution.

Business Impact

Successful exploitation poses a severe risk to organizational security, as an attacker could hijack user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of the victim. Given the CVSS score of 9.3, this vulnerability represents a critical threat to data integrity and confidentiality within the Adobe Connect environment.

Remediation Plan

Immediate Action: Update Adobe Connect to the latest available version provided by Adobe to remediate this flaw.

Proactive Monitoring: Review web server and application access logs for suspicious URL patterns or unexpected JavaScript execution requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block malicious script injection attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the potential for session hijacking, the risk remains significant.

Analyst Recommendation

The critical nature of this vulnerability necessitates immediate attention. IT administrators should prioritize patching Adobe Connect installations to the latest version to prevent potential cross-site scripting attacks that could compromise user accounts and sensitive data.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected Cross-Site Scripting (XSS) vulnerability in Adobe Connect enables attackers to execute malicious JavaScript in a victim's browser by enticing them to click a crafted link.

Executive Summary:
Adobe Connect is susceptible to a critical reflected XSS vulnerability that enables attackers to execute arbitrary code in a victim's browser session through malicious URL manipulation.

Vulnerability Details

CVE-ID: CVE-2026-27245

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a reflected Cross-Site Scripting (XSS) vulnerability where the application fails to properly sanitize input before reflecting it back to the user. An attacker can exploit this by crafting a URL that, when visited by a target, executes unauthorized JavaScript in the context of their session.

Business Impact

Reflected XSS can be leveraged to perform phishing, session hijacking, or unauthorized administrative actions. With a CVSS score of 9.3, the impact is critical, as it allows attackers to bypass security boundaries and potentially gain control over authenticated user sessions.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Adobe to ensure all vulnerable endpoints are patched.

Proactive Monitoring: Monitor for anomalous traffic or URLs containing suspicious script-like parameters directed at the Adobe Connect instance.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious payloads commonly used in XSS attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease with which reflected XSS can be weaponized in social engineering campaigns necessitates prompt action.

Analyst Recommendation

Given the critical severity rating, organizations must treat this vulnerability as a high priority. Ensure all systems are updated to the vendor-recommended versions to mitigate the risk of malicious script injection and unauthorized access.

---METADATA---
VENDOR: Adobe
PRODUCT: Connect
AFFECTED_VERSIONS: 2025.3, 12.10 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected Cross-Site Scripting (XSS) vulnerability exists in Adobe Connect, allowing attackers to execute malicious JavaScript via crafted URLs.

Executive Summary:
Adobe Connect contains a critical reflected XSS vulnerability that allows an attacker to execute malicious scripts in the victim's browser, potentially leading to complete session compromise.

Vulnerability Details

CVE-ID: CVE-2026-27243

Affected Software: Adobe Connect

Affected Versions: 2025.3, 12.10 and earlier

Vulnerability: This is a reflected Cross-Site Scripting (XSS) vulnerability resulting from insufficient input validation. By enticing a user to visit a malicious URL, an attacker can force the victim's browser to execute arbitrary JavaScript, which runs within the context of the vulnerable application.

Business Impact

The impact of this vulnerability is critical, as evidenced by the CVSS score of 9.3. Successful exploitation allows for the theft of session cookies and sensitive data, potentially leading to unauthorized access to the Adobe Connect platform and broader impacts on organizational data privacy.

Remediation Plan

Immediate Action: Update all Adobe Connect installations to the most recent version released by the vendor.

Proactive Monitoring: Audit application logs for patterns indicating attempts to inject scripts via URL parameters or malicious redirects.

Compensating Controls: Implement robust WAF configurations to detect and block reflected XSS payloads before they reach the application server.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high due to the potential for attackers to easily distribute malicious links to unsuspecting users.

Analyst Recommendation

Security teams should prioritize the application of vendor-provided patches immediately. Failure to address this vulnerability increases the risk of session hijacking and unauthorized access, which could have severe consequences for organizational security.

---METADATA---
VENDOR: bleon-ethical
PRODUCT: api-gateway-deploy
AFFECTED_VERSIONS: Version 1.0.0
---END_METADATA---

Description Summary:
A critical attack chain involving OS command injection and privilege escalation in api-gateway-deploy allows for root-level execution and container escape.

Executive Summary:
Attackers can exploit command injection flaws in the api-gateway-deploy container to gain root privileges and potentially escape to the host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27208

Affected Software: bleon-ethical api-gateway-deploy

Affected Versions: Version 1.0.0

Vulnerability: The vulnerability stems from insecure input handling in entrypoint.sh and the use of the root user within the Dockerfile. An attacker can use OS command injection to execute arbitrary code, which, combined with the default root configuration, facilitates a container escape.

Business Impact

This vulnerability poses a severe threat to infrastructure integrity, as a successful container escape can lead to unauthorized access to the underlying host and adjacent network resources. With a CVSS score of 9.2, the risk of significant infrastructure modification and data theft is critical.

Remediation Plan

Immediate Action: Upgrade to version 1.0.1, which implements strict input sanitization and enforces a non-root "appuser" for container execution.

Proactive Monitoring: Monitor container logs for suspicious shell commands and audit host systems for unauthorized processes originating from the container runtime.

Compensating Controls: Utilize runtime security tools (e.g., Falco or AppArmor) to restrict container capabilities and prevent unauthorized system calls or file access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 24, 2026, no active exploitation has been reported. However, the combination of command injection and root execution makes this a highly attractive target for attackers seeking to compromise cloud environments.

Analyst Recommendation

The transition from root to a non-privileged user is a fundamental security best practice that was missing in the initial release. Organizations must update to version 1.0.1 immediately to mitigate the risk of host-level compromise and ensure secure deployment of their API gateways.

---METADATA---
VENDOR: Formwork
PRODUCT: Formwork CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Formwork, a flat file-based CMS, is susceptible to a high-severity vulnerability that could allow for unauthorized file access or system compromise.

Executive Summary:
A critical security flaw in the Formwork CMS could allow attackers to bypass security controls, potentially leading to unauthorized data access or site takeover.

Vulnerability Details

CVE-ID: CVE-2026-27198

Affected Software: Formwork

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: As a flat file-based CMS, Formwork relies on the file system for data storage. This vulnerability likely involves improper sanitization of file paths or administrative inputs, which could be exploited by an attacker to manipulate the CMS's internal files.

Business Impact

A compromise of the CMS can lead to the defacement of websites, theft of sensitive content, and the distribution of malware to site visitors. The CVSS score of 8.8 indicates a high level of risk to the integrity and confidentiality of any web presence powered by Formwork.

Remediation Plan

Immediate Action: Update the Formwork CMS installation to the latest version immediately to apply necessary security patches.

Proactive Monitoring: Review web server logs for unusual POST requests or attempts to access sensitive file paths (e.g., configuration files).

Compensating Controls: Apply strict file system permissions to the Formwork directory, ensuring the web server only has the minimum necessary write access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. CMS vulnerabilities are frequently targeted by automated scanners for large-scale exploitation.

Analyst Recommendation

Maintaining the security of web-facing content management systems is vital. We recommend an immediate audit of all Formwork installations and the application of the latest security updates to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry (SAML SSO)
AFFECTED_VERSIONS: 21.12.0 through 26.1.0
---END_METADATA---

Description Summary:
A critical flaw in Sentry's SAML SSO implementation allows account takeover via malicious Identity Providers in multi-organization or specifically configured self-hosted instances.

Executive Summary:
A critical vulnerability in Sentry's SAML implementation enables attackers to take over any user account by exploiting weaknesses in multi-organization SSO configurations.

Vulnerability Details

CVE-ID: CVE-2026-27197

Affected Software: Sentry

Affected Versions: 21.12.0 through 26.1.0

Vulnerability: The SAML SSO implementation fails to properly isolate organizations, allowing an attacker with a malicious SAML Identity Provider to impersonate users from another organization on the same instance. This requires the instance to have multiple organizations or specific SSO modification permissions enabled.

Business Impact

A successful account takeover gives attackers access to sensitive error logs, source code snippets, and performance data. Given the CVSS score of 9.1, this represents a high-impact risk to corporate intellectual property and security monitoring integrity.

Remediation Plan

Immediate Action: Update Sentry to version 26.2.0 immediately to resolve the SAML isolation flaw.

Proactive Monitoring: Audit SAML configuration changes and review login logs for unexpected authentication events originating from unfamiliar Identity Providers.

Compensating Controls: As a workaround, mandate individual user-based two-factor authentication (2FA), which prevents attackers from completing the login process even if the SAML bypass is successful.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation. The vulnerability is most dangerous in multi-tenant environments or large self-hosted installations.

Analyst Recommendation

Updating to version 26.2.0 is the most effective way to mitigate this risk. Additionally, administrators should strongly encourage or enforce 2FA for all users, as it provides a critical second layer of defense against account takeover vulnerabilities like this one.

---METADATA---
VENDOR: Deno
PRODUCT: Deno Runtime
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Deno JavaScript and TypeScript runtime that could potentially allow for unauthorized code execution or system interference.

Executive Summary:
A high-severity vulnerability in the Deno runtime poses a significant risk to the security and stability of applications executing JavaScript or TypeScript code.

Vulnerability Details

CVE-ID: CVE-2026-27190

Affected Software: Deno

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the current disclosure, the flaw involves the core Deno runtime environment. The vulnerability likely impacts the boundary between the runtime and the host system, potentially requiring specific user-driven execution.

Business Impact

Compromise of a runtime environment like Deno can lead to arbitrary code execution, allowing attackers to bypass security sandboxes. With a CVSS score of 8.1, this vulnerability could result in significant data exfiltration or unauthorized access to the host server's resources and sensitive files.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Deno Land team immediately to ensure the runtime environment is secured.

Proactive Monitoring: Monitor application logs for unusual crashes or unexpected system calls originating from the Deno process.

Compensating Controls: Implement strict file system and network permission flags (e.g., --allow-net, --allow-read) to limit the potential impact of a runtime compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. Given the high CVSS score, security teams should treat this as a priority update for all Deno-based infrastructure.

Analyst Recommendation

The Deno runtime is often used in security-sensitive backend environments. It is critical that administrators identify all instances of Deno within their stack and apply the necessary updates immediately to mitigate the risk of remote or local exploitation.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via update URL poisoning, allowing an attacker to force the system to download and extract a malicious update package.

Executive Summary:
A critical supply chain vulnerability in MajorDoMo allows unauthenticated attackers to hijack the system update process and deploy webshells by poisoning the update URL.

Vulnerability Details

CVE-ID: CVE-2026-27180

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This unauthenticated RCE vulnerability exists in the saverestore module. An attacker can use a crafted request to change the system's update URL to a malicious server, then trigger a "force update" that downloads and extracts an unverified tarball containing arbitrary PHP files into the webroot.

Business Impact

This vulnerability is assigned a CVSS score of 9.8 due to the ease with which an attacker can achieve full system compromise. By poisoning the update mechanism, an attacker can gain persistent access through webshells, bypass all traditional security controls, and effectively own the entire MajorDoMo environment and its data.

Remediation Plan

Immediate Action: Update to the latest version of MajorDoMo, which includes improved authentication checks and secure update verification.

Proactive Monitoring: Monitor network traffic for outbound connections to unknown or suspicious update servers and check the webroot for newly created or modified PHP files.

Compensating Controls: Use egress filtering to restrict the server's ability to communicate with unauthorized external IP addresses and implement file integrity monitoring (FIM).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the multi-step nature of this exploit (poisoning then triggering) can be easily scripted, making it a high-risk flaw for any internet-facing instance.

Analyst Recommendation

The ability to redirect system updates to a malicious source is a severe architectural flaw. Organizations must apply the latest security updates immediately. Furthermore, ensure that the system is not exposed to the public internet without additional layers of authentication, such as a reverse proxy or VPN.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via a race condition and unsanitized user input in the rc/index.php and cycle_execs.php components.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on MajorDoMo systems by exploiting a race condition in the command queuing mechanism, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27175

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves unauthenticated OS command injection where user input is interpolated into shell commands without sanitization. By exploiting a race condition between the web-accessible rc endpoint and the cycle_execs.php polling loop, an attacker can inject shell metacharacters that are executed with the permissions of the web server.

Business Impact

The impact of this vulnerability is critical, as reflected in its CVSS score of 9.8. Successful exploitation grants the attacker full remote code execution (RCE) without requiring any credentials. This can lead to the complete takeover of the host system, lateral movement within the network, and the deployment of ransomware or data exfiltration tools.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the MajorDoMo project immediately or disable web access to the rc/ directory and cycle_execs.php.

Proactive Monitoring: Inspect system logs for unusual shell command executions or suspicious activity originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block shell metacharacters (e.g., semicolons, backticks, pipes) in HTTP GET and POST requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit requires no authentication and targets a common home automation platform, the risk of rapid exploit development is extremely high.

Analyst Recommendation

This vulnerability represents a "worst-case" scenario for networked software: unauthenticated RCE. IT administrators must treat this as a top priority and apply updates immediately. Given the complexity of the race condition, manual sanitization is not recommended; a full vendor-supplied patch is the only reliable solution.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo allows unauthenticated remote code execution via the admin panel's PHP console due to a logic error that bypasses authentication and passes input to the eval() function.

Executive Summary:
MajorDoMo systems are at risk of complete takeover due to a flaw that allows unauthenticated attackers to execute arbitrary PHP code through the administrative console feature.

Vulnerability Details

CVE-ID: CVE-2026-27174

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A logic error in modules/panel.class.php fails to terminate execution after a redirect, allowing unauthenticated requests to reach an AJAX handler. This handler passes user-supplied GET parameters directly to the eval() function, facilitating unauthenticated remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a catastrophic risk to the confidentiality, integrity, and availability of the affected system. An attacker can execute arbitrary PHP code, which allows for database manipulation, file system access, and the ability to use the compromised host as a staging point for further internal network attacks.

Remediation Plan

Immediate Action: Update MajorDoMo to the latest version immediately to resolve the authentication bypass and remove the insecure use of the eval() function.

Proactive Monitoring: Review web server access logs for requests to /admin.php containing ajax_panel, op, and command parameters from unauthorized IP addresses.

Compensating Controls: Restrict access to the /admin.php endpoint using IP whitelisting or a VPN to prevent external exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of exploiting an eval()-based vulnerability makes it a highly attractive target for automated scanning and exploitation scripts.

Analyst Recommendation

The presence of an unauthenticated eval() sink is a critical security failure. Administrators should not wait for evidence of exploitation before acting. The primary remediation—applying the vendor patch—must be performed immediately to prevent unauthorized remote command execution.