---METADATA---
VENDOR: Anviz
PRODUCT: CX2 Lite and CX7
AFFECTED_VERSIONS: Anviz Anviz CX7 Firmware: All versions, Anviz Anviz CX2 Lite Firmware: All versions
CONFIDENCE: high
MISSING: patch
CREDITS: An anonymous researcher reported this vulnerability to CISA. (finder)
SOURCES_JSON: [{"url":"https://www.anviz.com/contact-us.html","name":null,"tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03","name":null,"tags":[]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.679Z
---END_METADATA---

Description Summary:
Anviz CX2 Lite and CX7 devices are vulnerable to unverified firmware update packages, which allow an attacker to achieve unauthenticated remote code execution.

Executive Summary:
A critical vulnerability in Anviz CX2 Lite and CX7 firmware allows unauthenticated remote code execution through the upload of malicious update packages.

Vulnerability Details

CVE-ID: CVE-2026-40066

Affected Software: Anviz CX2 Lite and CX7

Affected Versions: Anviz Anviz CX7 Firmware: All versions, Anviz Anviz CX2 Lite Firmware: All versions

Vulnerability: This flaw stems from a lack of verification for firmware update packages (CWE-494), enabling an attacker to trigger the execution of arbitrary scripts on the device. Despite the CVSS vector suggesting low privileges, the authoritative description confirms this is an unauthenticated remote code execution vulnerability.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on these devices represents a severe security risk, potentially leading to full device compromise and loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this vulnerability carries a high risk of lateral movement into the wider network environment.

Remediation Plan

Immediate Action: Contact the vendor immediately via their official support channels to inquire about firmware updates, as a formal patch version is currently unknown.

Proactive Monitoring: Monitor network traffic for unusual outbound connections originating from the biometric devices and review device logs for unauthorized firmware upload attempts.

Compensating Controls: Isolate affected devices on a restricted management VLAN and use firewall rules to prevent unauthorized hosts from accessing the management interface of the devices.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of April 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on unverified firmware updates makes it a high-value target for attackers seeking persistent access to operational technology environments.

Analyst Recommendation

Given the potential for complete device compromise, organizations using Anviz CX2 Lite and CX7 hardware should prioritize the isolation of these devices from public-facing network segments. Administrators must actively engage with the vendor for remediation guidance and remain vigilant for any anomalous behavior until an official firmware update is available and applied.

---METADATA---
VENDOR: Ziosoft, Inc.
PRODUCT: Ziostation2
AFFECTED_VERSIONS: v2.9.8.7 and earlier
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://jvn.jp/en/jp/JVN00575116/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.567Z
---END_METADATA---

Description Summary:
A path traversal vulnerability in Ziosoft Ziostation2 allows remote, unauthenticated attackers to access sensitive information on the underlying operating system.

Executive Summary:
A critical path traversal vulnerability in Ziosoft Ziostation2 allows unauthenticated remote attackers to access sensitive system files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-40062

Affected Software: Ziosoft, Inc. Ziostation2

Affected Versions: v2.9.8.7 and earlier

Vulnerability: This is a path traversal vulnerability (CWE-22) residing in the Ziostation2 application. The flaw allows an unauthenticated remote attacker to bypass directory restrictions and access unauthorized files on the host operating system.

Business Impact

The ability for an unauthenticated attacker to read arbitrary files from the system constitutes a severe risk to data integrity and confidentiality. Given the CVSS score of 7.5, this vulnerability is classified as High severity. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or protected health information, potentially resulting in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately restrict network access to the Ziostation2 interface to only trusted IP addresses.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing directory traversal sequences, such as double dots (..) or forward slashes, directed at the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts to mitigate the risk until an official vendor update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for automated scanning.

Analyst Recommendation

The severity of this vulnerability is elevated by the lack of authentication required for exploitation. Organizations utilizing Ziostation2 should prioritize network segmentation and WAF deployment immediately. Monitor vendor communications closely for the release of a security patch and apply it as soon as it becomes available to remediate the underlying flaw.

---METADATA---
VENDOR: F5
PRODUCT: BIG-IP
AFFECTED_VERSIONS: 21.0.0 up to (excluding) 21.0.0.1, 17.5.0 up to (excluding) 17.5.1.4, 17.1.0 up to (excluding) 17.1.3.1, 16.1.0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in F5 BIG-IP allows authenticated administrators to execute arbitrary system commands via iControl REST or the TMOS Shell.

Executive Summary:
A critical command injection vulnerability exists in F5 BIG-IP that allows an authenticated administrator to execute arbitrary system commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40061

Affected Software: F5 BIG-IP

Affected Versions: 21.0.0 up to (excluding) 21.0.0.1, 17.5.0 up to (excluding) 17.5.1.4, 17.1.0 up to (excluding) 17.1.3.1, 16.1.0 and later

Vulnerability: This vulnerability involves improper neutralization of special elements used in a command (CWE-77). It requires an authenticated attacker with Resource Administrator or Administrator privileges to trigger the flaw via iControl REST or the TMOS Shell.

Business Impact

Successful exploitation allows an attacker with elevated administrative access to execute arbitrary commands at the system level. Given the CVSS score of 8.7, this represents a high risk to the confidentiality and integrity of the BIG-IP appliance, which often serves as a critical gateway for network traffic and security services.

Remediation Plan

Immediate Action: Upgrade to version 21.1.0 or later, or apply the specific version updates provided by F5 in security advisory K000160788.

Proactive Monitoring: Review TMOS Shell and iControl REST logs for unauthorized or suspicious command sequences executed by administrative accounts.

Compensating Controls: Restrict access to management interfaces to trusted IP addresses and enforce strict role-based access control (RBAC) to minimize the number of users with administrative privileges.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires existing administrative privileges, the ability to escalate to system-level command execution makes it a high-risk vector for malicious insiders or compromised admin accounts.

Analyst Recommendation

Organizations should prioritize patching F5 BIG-IP appliances immediately. Given the high severity of command injection, ensuring that all affected systems are updated to the vendor-recommended versions is essential to preventing potential unauthorized system-level control.

---METADATA---
VENDOR: CrowdStrike
PRODUCT: LogScale
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical unauthenticated path traversal vulnerability in CrowdStrike LogScale allows remote attackers to read arbitrary files from the server filesystem.

Executive Summary:
A critical unauthenticated path traversal vulnerability in CrowdStrike LogScale allows remote attackers to access arbitrary files, necessitating immediate updates for self-hosted instances.

Vulnerability Details

CVE-ID: CVE-2026-40050

Affected Software: CrowdStrike LogScale

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A specific cluster API endpoint fails to sanitize user input, allowing an unauthenticated remote attacker to perform directory traversal and read sensitive files from the server's filesystem.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Unauthorized access to files could expose system configurations, credentials, or sensitive log data, leading to severe security breaches. Next-Gen SIEM customers are not affected.

Remediation Plan

Immediate Action: Self-hosted customers must upgrade to the latest patched version of LogScale immediately.

Proactive Monitoring: Review server access logs for path traversal patterns (e.g., ../ sequences) directed at cluster API endpoints.

Compensating Controls: Ensure that LogScale cluster API endpoints are not exposed to the public internet and are restricted to internal network access only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CrowdStrike has confirmed this vulnerability and already mitigated it for SaaS customers. Self-hosted customers must prioritize updating their infrastructure to the latest version to ensure protection against unauthorized file access.

---METADATA---
VENDOR: Apache
PRODUCT: Camel PQC
AFFECTED_VERSIONS: 4.19.0 up to 4.20.0, 4.18.0 up to 4.18.2
CONFIDENCE: high
MISSING: none
CREDITS: Andrea Cosentino from ASF (finder); Venkatraman Kumar from Securin (finder)
SOURCES_JSON: [{"url":"https://camel.apache.org/security/CVE-2026-40048.html","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.711Z
---END_METADATA---

Description Summary:
The Camel-PQC FileBasedKeyLifecycleManager class is vulnerable to insecure deserialization of untrusted data, allowing local attackers to achieve arbitrary code execution.

Executive Summary:
A critical deserialization vulnerability in Apache Camel PQC allows an attacker with local file system access to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-40048

Affected Software: Apache Camel PQC

Affected Versions: 4.19.0 up to 4.20.0, 4.18.0 up to 4.18.2

Vulnerability: This flaw involves the use of java.io.ObjectInputStream to deserialize key files without adequate filtering or class-loading restrictions. An attacker who can write to the key directory can execute arbitrary code during the deserialization process, requiring low privileges on the local system.

Business Impact

The ability to execute arbitrary code on a system hosting Apache Camel services poses a severe risk to data integrity, confidentiality, and system availability. With a CVSS score of 7.8, this high-severity vulnerability could allow an attacker to gain full control over the application environment, potentially leading to unauthorized access to sensitive cryptographic keys and internal application data.

Remediation Plan

Immediate Action: Upgrade to Apache Camel PQC version 4.20.0 or 4.18.2 to ensure the replacement of vulnerable deserialization methods with secure PKCS#8 and X.509 JSON encoding.

Proactive Monitoring: Review filesystem access logs for the configured key directory to identify unauthorized modifications or attempts to write files with the .key extension.

Compensating Controls: Ensure strict filesystem permissions are enforced on directories containing keys to prevent unauthorized users from placing malicious serialized objects in the application path.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (oscerd/CVE-2026-40048).

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation in the wild. The vulnerability is inherently dangerous because it leverages standard Java deserialization mechanisms, making it a high-value target for attackers who have gained initial low-privileged access to a server.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for full code execution, this vulnerability should be prioritized for immediate remediation. Organizations utilizing Apache Camel PQC must audit their deployment environments for the affected versions and apply the provided patches to eliminate the deserialization risk.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.15.0 up to (excluding) 4.18.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An argument injection vulnerability in the Apache Camel Docling component allows attackers to inject malicious CLI flags and perform directory traversal via improperly sanitized exchange headers.

Executive Summary:
An argument injection vulnerability in Apache Camel’s Docling component enables attackers to manipulate system command execution, potentially leading to unauthorized file access.

Vulnerability Details

CVE-ID: CVE-2026-40047

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.15.0 up to (excluding) 4.18.3

Vulnerability: The component uses insufficient validation when constructing command-line arguments for the docling tool. An attacker can supply malicious flags or traversal sequences through the CamelDoclingCustomArguments header, which are then passed to the subprocess.

Business Impact

A successful exploit could allow an attacker to read files outside of the intended directory or influence the behavior of the external docling tool. Given the CVSS score of 9.1, this is a critical issue that could lead to significant data exposure if the application handles untrusted input within these specific headers.

Remediation Plan

Immediate Action: Upgrade to Apache Camel 4.19.0 or 4.18.3 to apply the strict allowlist and path normalization fixes.

Proactive Monitoring: Review Camel routes for any mapping of untrusted message content into the CamelDoclingCustomArguments header.

Compensating Controls: Implement strict input validation at the edge and strip internal Camel headers from messages originating from untrusted sources before they reach the Docling producer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk of argument injection. Organizations should prioritize patching to the recommended versions and ensure that header sanitization is enforced across all Camel routes to prevent untrusted data from reaching the Docling component.

---METADATA---
VENDOR: Apache
PRODUCT: ActiveMQ
AFFECTED_VERSIONS: 6.0.0 up to (excluding) 6.2.4
CONFIDENCE: high
MISSING: none
CREDITS: Adrien Bernard (finder)
SOURCES_JSON: [{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66168","name":null,"tags":["related"]},{"url":"https://activemq.apache.org/security-advisories.data/CVE-2026-40046-announcement.txt","name":null,"tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread/zdntj5rcgjjzrpow84o339lzldy68zrg","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.919Z
---END_METADATA---

Description Summary:
A vulnerability in Apache ActiveMQ allows for an integer overflow or wraparound due to improper validation of the MQTT control packet remaining length field.

Executive Summary:
An integer overflow vulnerability in Apache ActiveMQ, specifically affecting versions 6.0.0 through 6.2.3, poses a significant denial of service risk to messaging infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-40046

Affected Software: Apache ActiveMQ, ActiveMQ All, and ActiveMQ MQTT

Affected Versions: 6.0.0 up to (excluding) 6.2.4

Vulnerability: This vulnerability is an integer overflow (CWE-190) occurring within the MQTT control packet handling. The vulnerability is exploitable by an unauthenticated attacker who can send a maliciously crafted MQTT packet to trigger a service crash.

Business Impact

The primary risk associated with this vulnerability is a denial of service, which can disrupt critical messaging queues and downstream application processing. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent operational downtime. Organizations relying on ActiveMQ for real-time data exchange may experience significant service degradation if this vulnerability is exploited against their messaging brokers.

Remediation Plan

Immediate Action: Upgrade to Apache ActiveMQ version 6.2.4 or transition to a 5.19.x release (version 5.19.2 or later) to resolve the underlying validation flaw.

Proactive Monitoring: Review application and system logs for repeated connection drops or abrupt service restarts associated with MQTT traffic.

Compensating Controls: Implement network-level filtering to restrict access to the MQTT management ports to trusted IP addresses only, which reduces the attack surface while awaiting patch deployment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of proper length validation in the MQTT control packet parsing logic.

Analyst Recommendation

The vulnerability represents a clear risk to the availability of message-oriented middleware. Administrators should prioritize the upgrade to the specified patched versions across all production environments to eliminate the risk of service interruption. Failure to patch leaves the broker susceptible to remote denial of service attacks.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files.

Executive Summary:
An unauthenticated deserialization vulnerability in Pachno 1.0.6 allows attackers to execute arbitrary code by injecting malicious objects into world-writable cache files.

Vulnerability Details

CVE-ID: CVE-2026-40044

Affected Software: Pachno

Affected Versions: 1.0.6

Vulnerability: The application unserializes data from world-writable cache files during the framework bootstrap process before any authentication checks occur. An unauthenticated attacker can exploit this by writing malicious serialized PHP objects to these predictable file paths, leading to remote code execution.

Business Impact

The CVSS score of 9.8 indicates a critical risk, as this vulnerability provides a direct vector for full server compromise. Successful exploitation grants the attacker the ability to execute commands with the privileges of the web server, leading to data exfiltration, system destruction, or further network penetration.

Remediation Plan

Immediate Action: Restrict write permissions on the directory containing the Pachno cache files to prevent unauthorized object injection.

Proactive Monitoring: Monitor the web server’s cache directory for the creation of unexpected files or modifications to existing files that do not correspond to legitimate application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to the ease of exploitation and the level of access granted. Administrators must immediately restrict file system permissions as an interim measure while awaiting an official vendor patch to address the underlying deserialization flaw.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pachno 1.0.6 is vulnerable to XML external entity (XXE) injection, allowing unauthenticated attackers to read arbitrary files via the TextParser helper.

Executive Summary:
Pachno version 1.0.6 contains a critical XML external entity injection vulnerability that allows unauthenticated remote attackers to read sensitive files from the host system.

Vulnerability Details

CVE-ID: CVE-2026-40042

Affected Software: Pachno

Affected Versions: 1.0.6

Vulnerability: The application utilizes unsafe XML parsing via simplexml_load_string() without proper LIBXML_NONET restrictions. This allows an unauthenticated attacker to inject malicious XML entities into wiki articles or comments, forcing the server to resolve external files.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk of data exfiltration. Attackers can bypass access controls to read configuration files, credentials, or sensitive business data, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Update Pachno to the latest available version provided by the vendor to remediate the unsafe XML parsing implementation.

Proactive Monitoring: Review application logs for unusual XML entity references or repeated failed access attempts to system-level files.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious XML payloads or non-standard external entity resolution requests.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security gap that could lead to complete information disclosure. Administrators should prioritize patching the Pachno instance immediately to prevent unauthenticated access to sensitive system data.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: patch
CREDITS: LiquidWorm as Gjoko Krstic of Zero Science Lab (finder)
SOURCES_JSON: [{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5982.php","name":"Zero Science Lab Disclosure","tags":["third-party-advisory"]},{"url":"https://www.vulncheck.com/advisories/pachno-unrestricted-file-upload-remote-code-execution","name":"VulnCheck Advisory: Pachno 1.0.6 Unrestricted File Upload Remote Code Execution","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to achieve remote code execution on the server via the /uploadfile endpoint.

Executive Summary:
An unrestricted file upload vulnerability in Pachno 1.0.6 allows authenticated attackers to execute arbitrary code on the host server, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-40040

Affected Software: Pachno Pachno

Affected Versions: 1.0.6

Vulnerability: This is an unrestricted file upload flaw (CWE-434) located at the /uploadfile endpoint. Authenticated users can bypass extension filtering to upload executable scripts, such as .php5 files, to web-accessible directories.

Business Impact

The ability to execute arbitrary code on the server represents a critical security compromise, as it grants an attacker full control over the application environment. With a CVSS score of 8.8, this vulnerability carries a high risk of data exfiltration, service disruption, and unauthorized lateral movement within the network.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict access to the /uploadfile endpoint and implement strict server-side validation of all uploaded file types.

Proactive Monitoring: Review web server access logs for suspicious requests to the upload directory and monitor for the creation of unauthorized executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing non-permitted file extensions or unexpected content types directed at the upload interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ZSL-2026-5982 research writeup.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild, but the existence of a published proof-of-concept makes this vulnerability highly exploitable by malicious actors with valid credentials.

Analyst Recommendation

Given the potential for remote code execution, organizations should treat this vulnerability with high priority. Users must audit their environment for the presence of Pachno 1.0.6 and apply restrictive access controls to the vulnerable endpoint until a formal security update is provided by the vendor.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: patch
CREDITS: LiquidWorm as Gjoko Krstic of Zero Science Lab (finder)
SOURCES_JSON: [{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5980.php","name":"Zero Science Lab Disclosure","tags":["third-party-advisory"]},{"url":"https://www.vulncheck.com/advisories/pachno-stored-cross-site-scripting-via-multiple-parameters","name":"VulnCheck Advisory: Pachno 1.0.6 Stored Cross-Site Scripting via Multiple Parameters","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.867Z
---END_METADATA---

Description Summary:
Pachno version 1.0.6 is vulnerable to stored cross-site scripting (XSS) via multiple POST parameters, allowing attackers to execute arbitrary scripts in the browser sessions of other users.

Executive Summary:
A stored cross-site scripting vulnerability in Pachno 1.0.6 allows authenticated attackers to execute malicious scripts in user browser sessions, posing a risk of session hijacking or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-40038

Affected Software: Pachno Pachno

Affected Versions: 1.0.6

Vulnerability: This is a stored cross-site scripting (CWE-79) flaw caused by improper sanitization of input in the value, comment_body, article_content, description, and message parameters. The vulnerability requires the attacker to be an authenticated user who can submit POST requests to the application.

Business Impact

Successful exploitation allows an attacker to execute arbitrary HTML or JavaScript code within the context of a victim's browser session. This could lead to the theft of session cookies, account takeover, or the performance of unauthorized actions on behalf of the user, potentially impacting the integrity of the application. Given the CVSS score of 7.2, this vulnerability represents a high risk for organizations relying on Pachno for content management or user collaboration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the affected input parameters and review application logs for suspicious POST request patterns.

Proactive Monitoring: Monitor web server logs for high volumes of unusual POST requests containing script tags or encoded characters directed at the identified parameters.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS and deploy a Web Application Firewall (WAF) to detect and block malicious script injection attempts in real time.

Exploitation Status

Public Exploit Available: Yes, a technical write-up detailing the vulnerability exists via the provided research references.

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation in the wild. The vulnerability is inherently exploitable because the application fails to properly sanitize user-supplied input before storing it in the database and rendering it in other users' browsers.

Analyst Recommendation

Organizations should treat this vulnerability with high priority due to the potential for administrative account compromise via XSS. Until a vendor-supplied patch is available, ensure that all user inputs are strictly validated at the application level and utilize WAF rules to filter out common XSS payloads. Contact the vendor for an official update release schedule to remediate this flaw permanently.

---METADATA---
VENDOR: Obsidian Forensics
PRODUCT: Unfurl
AFFECTED_VERSIONS: 0 up to (excluding) 2026.04
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (reporter)
SOURCES_JSON: [{"url":"https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m","name":"GHSA Advisory GHSA-h5qv-qjv4-pc5m","tags":["vendor-advisory"]},{"url":"https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04","name":"VulnCheck Advisory: dfir-unfurl - Denial of Service via Unbounded zlib Decompression","tags":["release-notes","patch"]},{"url":"https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.947Z
---END_METADATA---

Description Summary:
Unfurl contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows unauthenticated remote attackers to trigger a denial of service via memory exhaustion.

Executive Summary:
Obsidian Forensics Unfurl is vulnerable to a denial of service attack via maliciously crafted URL parameters that cause uncontrolled memory consumption.

Vulnerability Details

CVE-ID: CVE-2026-40036

Affected Software: Obsidian Forensics Unfurl

Affected Versions: 0 up to (excluding) 2026.04

Vulnerability: This vulnerability involves improper handling of highly compressed data within the parse_compressed.py file, which lacks resource limits for zlib decompression. An unauthenticated attacker can submit specially crafted payloads to the /json/visjs endpoint to trigger excessive memory allocation and crash the service.

Business Impact

Successful exploitation of this vulnerability results in an immediate denial of service, rendering the Unfurl application unavailable to all users. Given the critical nature of forensic tools in incident response workflows, this disruption could impede security operations and delay essential investigations. With a CVSS score of 7.5, the risk is classified as High due to the ease of remote, unauthenticated exploitation.

Remediation Plan

Immediate Action: Update the Unfurl package to version 20260405 or later to implement the necessary decompression limits.

Proactive Monitoring: Monitor server memory utilization and review web server access logs for anomalous, high-frequency requests directed at the /json/visjs endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) or an API gateway to inspect and filter incoming requests, specifically blocking payloads that exhibit signs of extreme compression ratios or suspicious URL parameter lengths.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to trigger, as it requires no authentication and utilizes standard HTTP parameters to force excessive resource consumption.

Analyst Recommendation

The severity of this vulnerability is elevated by its potential to completely halt service availability through a simple, unauthenticated request. Administrators should prioritize updating to the patched version 20260405 immediately to remove the underlying resource allocation flaw and prevent service disruption.

---METADATA---
VENDOR: Unfurl
PRODUCT: Unfurl
AFFECTED_VERSIONS: Through 2025.08
---END_METADATA---

Description Summary:
Unfurl contains an improper input validation vulnerability in configuration parsing that enables Flask debug mode by default, potentially leading to remote code execution.

Executive Summary:
An improper input validation vulnerability in Unfurl allows unauthenticated attackers to enable Flask debug mode, leading to potential remote code execution and sensitive information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-40035

Affected Software: Unfurl Unfurl

Affected Versions: Through 2025.08

Vulnerability: This is an improper input validation flaw within the application's configuration parsing logic. Because the debug configuration value is improperly evaluated as a boolean, an unauthenticated attacker can trigger the Werkzeug debugger to execute arbitrary code.

Business Impact

The vulnerability carries a CVSS score of 9.1, indicating a critical risk to organizational security. Successful exploitation allows for complete system compromise, enabling attackers to extract sensitive data or gain persistent unauthorized access, which could lead to significant reputational damage and operational disruption.

Remediation Plan

Immediate Action: Upgrade Unfurl to the latest version immediately to patch the insecure configuration parsing logic.

Proactive Monitoring: Monitor application logs for unauthorized access to the Werkzeug debugger interface or unusual Flask initialization patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests attempting to reach the Werkzeug debug endpoint or suspicious debug-related headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, organizations should prioritize patching as the primary mitigation strategy. Failure to address this could result in full remote control of the affected infrastructure, necessitating immediate attention from IT security teams.

---METADATA---
VENDOR: FreeRDP
PRODUCT: FreeRDP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in FreeRDP versions prior to 3.0, potentially exposing systems to unauthorized exploitation.

Executive Summary:
Legacy versions of FreeRDP (prior to 3.0) contain a critical security vulnerability that requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-40033

Affected Software: FreeRDP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a high-severity vulnerability affecting versions prior to the 3.0 release. While specific technical details are limited, it involves core protocol handling that could lead to unauthorized system access.

Business Impact

As FreeRDP is a critical component for remote desktop connectivity, this vulnerability could allow an attacker to intercept sessions or compromise the underlying host system. The CVSS score of 8.8 justifies immediate action to prevent unauthorized access or remote code execution.

Remediation Plan

Immediate Action: Upgrade all instances of FreeRDP to version 3.0 or the latest available stable release.

Proactive Monitoring: Monitor network traffic for anomalous RDP-related connections or unexpected session behavior.

Compensating Controls: Restrict RDP access to VPN-only tunnels and implement Multi-Factor Authentication (MFA) for all remote access points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on FreeRDP for remote infrastructure management must prioritize the upgrade path to version 3.0. Failure to update leaves remote access infrastructure highly susceptible to exploitation.

---METADATA---
VENDOR: tclahr
PRODUCT: UAC (Unix-like Artifacts Collector)
AFFECTED_VERSIONS: 0 up to 3.3.0-rc1
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (finder)
SOURCES_JSON: [{"url":"https://github.com/tclahr/uac/pull/443","name":"Pull Request","tags":["issue-tracking"]},{"url":"https://github.com/tclahr/uac/commit/cb95d7166cd47908e1189d9669e43f9a6d3d707f","name":"Patch Commit #1","tags":["patch"]},{"url":"https://github.com/tclahr/uac/commit/50ace60e172e38feb78347bdf579311c23eff078","name":"Patch Commit #2","tags":["patch"]},{"url":"https://github.com/tclahr/uac/commit/d0fca5e36d8d6a33a4404f0f6fe92b0424544589","name":"Patch Commit #3","tags":["patch"]},{"url":"https://github.com/tclahr/uac/issues/429","name":"Related Issue","tags":["issue-tracking"]},{"url":"https://mobasi.ai/sentinel","name":"Mobasi Sentinel Vulnerability Index","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/uac-rc1-command-injection-via-placeholder-substitution","name":"VulnCheck Advisory: UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.947Z
---END_METADATA---

Description Summary:
UAC contains a command injection vulnerability in its command execution pipeline, allowing attackers to achieve arbitrary command execution via unsanitized inputs in the _run_command() function.

Executive Summary:
A critical command injection vulnerability in UAC allows attackers to execute arbitrary commands with the privileges of the UAC process, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40032

Affected Software: tclahr UAC (Unix-like Artifacts Collector)

Affected Versions: 0 up to 3.3.0-rc1

Vulnerability: This is a command injection flaw (CWE-78) occurring within the _run_command() function, where attacker-controlled inputs are passed to an eval statement without sanitization. An attacker can supply malicious payloads through system files or iterator values to execute arbitrary code under the security context of the UAC process.

Business Impact

The vulnerability carries a CVSS score of 7.8, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to run arbitrary code, which could lead to unauthorized data exfiltration, permanent system persistence, or the modification of critical forensic logs, severely undermining the integrity of security operations.

Remediation Plan

Immediate Action: Update the UAC software to version 3.3.0-rc1 or newer to implement the necessary input sanitization fixes in the command execution pipeline.

Proactive Monitoring: Review system logs for unexpected shell metacharacters or command substitutions, particularly within processes invoking UAC, and monitor for unauthorized execution of child processes.

Compensating Controls: Restrict execution permissions for the UAC utility to only necessary service accounts and ensure that input files processed by UAC are sourced from trusted, non-writable locations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires user interaction, the ability to inject commands via system files makes this a significant risk for environments where UAC processes untrusted or externally sourced artifact data.

Analyst Recommendation

Given the severity of potential command execution, organizations should prioritize upgrading their UAC deployments to version 3.3.0-rc1 immediately. Failure to patch leaves forensic collection infrastructure vulnerable to subversion, which could be leveraged to hide attacker activity during an incident response lifecycle.

---METADATA---
VENDOR: ufrisk
PRODUCT: MemProcFS
AFFECTED_VERSIONS: 0 through 5.16.12
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (finder)
SOURCES_JSON: [{"url":"https://github.com/ufrisk/MemProcFS/releases/tag/v5.17","name":"Release Notes","tags":["product"]},{"url":"https://github.com/ufrisk/MemProcFS/commit/df80e6e83641f5004025ce661e6dd8139028d7b5","name":"Patch Commit","tags":["patch"]},{"url":"https://mobasi.ai/sentinel","name":"Mobasi Sentinel Vulnerability Index","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/memprocfs-dll-shared-library-hijacking","name":"VulnCheck Advisory: MemProcFS < 5.17 DLL/Shared Library Hijacking","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.951Z
---END_METADATA---

Description Summary:
MemProcFS versions before 5.17 are susceptible to DLL and shared-library hijacking due to unsafe library-loading patterns, potentially leading to arbitrary code execution.

Executive Summary:
MemProcFS versions prior to 5.17 contain multiple unsafe library-loading vulnerabilities that allow an attacker to achieve arbitrary code execution via DLL hijacking.

Vulnerability Details

CVE-ID: CVE-2026-40031

Affected Software: ufrisk MemProcFS

Affected Versions: 0 through 5.16.12

Vulnerability: This vulnerability involves uncontrolled search path elements (CWE-427) where the application uses insecure library-loading calls, such as bare-name LoadLibraryU and dlopen, without path qualification. An attacker can exploit this by placing a malicious library in the working directory or manipulating environment variables to execute arbitrary code when the application initiates a load.

Business Impact

The ability to execute arbitrary code on a system running MemProcFS presents a severe security risk, as it allows for full system compromise, data exfiltration, or the installation of persistent malware. While the CVSS score of 7.8 indicates a high severity, the local attack vector and user interaction requirement slightly temper the immediate risk compared to a remote exploit. Nevertheless, the potential for total impact on system confidentiality, integrity, and availability necessitates prompt remediation.

Remediation Plan

Immediate Action: Update MemProcFS to version 5.17.0 or later, which includes the necessary security fixes and path qualification changes.

Proactive Monitoring: Monitor system logs for unauthorized DLL loading events or unexpected processes spawning from the MemProcFS directory.

Compensating Controls: Ensure that the application is executed from a secure, read-only directory to prevent attackers from placing malicious libraries in the working path.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if an attacker can influence the file system environment where the application is executed.

Analyst Recommendation

Given the potential for arbitrary code execution, this vulnerability poses a significant risk to affected environments. Administrators should prioritize updating to version 5.17.0 immediately to eliminate the underlying library-loading flaws. Failure to patch leaves systems vulnerable to local privilege escalation and full system compromise if an attacker gains control over the local execution environment.

---METADATA---
VENDOR: khyrenz
PRODUCT: parseusbs
AFFECTED_VERSIONS: 0 up to 1.9.0
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (finder)
SOURCES_JSON: [{"url":"https://github.com/khyrenz/parseusbs/pull/10","name":"Pull Request","tags":["issue-tracking"]},{"url":"https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b","name":"Patch Commit","tags":["patch"]},{"url":"https://mobasi.ai/sentinel","name":"Mobasi Sentinel Vulnerability Index","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/parseusbs-command-injection-via-volume-path-argument","name":"VulnCheck Advisory: parseusbs < 1.9 Command Injection via Volume Path Argument","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.951Z
---END_METADATA---

Description Summary:
The parseusbs library contains an OS command injection vulnerability in the volume listing path argument, allowing attackers to execute arbitrary commands via crafted shell metacharacters.

Executive Summary:
A critical OS command injection vulnerability in the khyrenz parseusbs library allows for arbitrary command execution when processing crafted volume paths.

Vulnerability Details

CVE-ID: CVE-2026-40030

Affected Software: khyrenz parseusbs

Affected Versions: 0 up to 1.9.0

Vulnerability: This vulnerability is a classic OS command injection (CWE-78) triggered when the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command. An unauthenticated attacker can exploit this by providing a malicious volume path containing shell metacharacters during the enumeration process.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the underlying host system with the privileges of the parseusbs process. This represents a significant risk to system integrity and confidentiality, as it could lead to full system compromise or unauthorized data exfiltration. The CVSS score of 7.8 confirms the high severity of this flaw, reflecting the potential for total technical impact on the affected host.

Remediation Plan

Immediate Action: Update the parseusbs library to version 1.9.0 or later, which includes the necessary sanitization of the volume path argument.

Proactive Monitoring: Monitor system process logs for suspicious commands originating from the parseusbs service, particularly those involving shell execution or unexpected file system access.

Compensating Controls: If an immediate update is not possible, restrict the input provided to the -v flag to ensure it contains only expected alphanumeric characters and does not include shell metacharacters.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit exists, the nature of the vulnerability is straightforward to weaponize if the library is used in an application that accepts user-supplied input for the volume path argument.

Analyst Recommendation

The presence of a command injection flaw in a library that processes external input poses a high risk to any application relying on parseusbs. Organizations should prioritize updating to version 1.9.0 immediately to eliminate this vector for remote command execution. Failure to patch may expose the host environment to arbitrary code execution if an attacker can influence the volume path parameter.

---METADATA---
VENDOR: Users manager – PN
PRODUCT: Users manager – PN
AFFECTED_VERSIONS: Up to and including 1.1.15
---END_METADATA---

Description Summary:
The Users manager – PN WordPress plugin contains a privilege escalation flaw allowing unauthenticated attackers to modify arbitrary user metadata.

Executive Summary:
An unauthenticated privilege escalation vulnerability in Users manager – PN allows attackers to modify arbitrary user account metadata.

Vulnerability Details

CVE-ID: CVE-2026-4003

Affected Software: Users manager – PN (WordPress Plugin)

Affected Versions: Up to and including 1.1.15

Vulnerability: The plugin fails to perform proper authorization checks on an AJAX endpoint, and the required nonce is publicly exposed. This allows unauthenticated attackers to update arbitrary user metadata, including security tokens used for authentication.

Business Impact

This vulnerability is rated at 9.8 CVSS, as it allows an unauthenticated attacker to manipulate user accounts, potentially escalating their own privileges to administrative status. This leads to total site compromise and unauthorized access to administrative functions.

Remediation Plan

Immediate Action: Update the Users manager – PN plugin to the latest available version provided by the vendor.

Proactive Monitoring: Audit user account metadata for unauthorized changes, specifically looking for modifications to security-related fields.

Compensating Controls: Temporarily disable the plugin until a secure update is applied, or use a WAF to block access to the affected AJAX endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of an ineffective nonce and missing authorization checks makes this a critical risk. Administrators must update the plugin immediately and inspect user account records for any signs of tampering.

---METADATA---
VENDOR: khyrenz
PRODUCT: parseusbs
AFFECTED_VERSIONS: 0 up to 1.9.0
CONFIDENCE: high
MISSING: none
CREDITS: Mobasi Security Team (finder)
SOURCES_JSON: [{"url":"https://github.com/khyrenz/parseusbs/pull/10","name":"Pull Request","tags":["issue-tracking"]},{"url":"https://github.com/khyrenz/parseusbs/commit/99f05996494e7e41ea0c7e13145ba20eb793e46b","name":"Patch Commit","tags":["patch"]},{"url":"https://mobasi.ai/sentinel","name":"Mobasi Sentinel Vulnerability Index","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/parseusbs-command-injection-via-crafted-lnk-filename","name":"VulnCheck Advisory: parseusbs < 1.9 Command Injection via Crafted LNK Filename","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.951Z
---END_METADATA---

Description Summary:
A command injection vulnerability in parseusbs allows arbitrary code execution on the forensic examiner's machine via maliciously crafted LNK filenames.

Executive Summary:
A critical OS command injection vulnerability exists in the parseusbs tool, potentially allowing an attacker to execute arbitrary code on a forensic examiner's workstation.

Vulnerability Details

CVE-ID: CVE-2026-40029

Affected Software: khyrenz parseusbs

Affected Versions: 0 up to 1.9.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring in the parseUSBs.py script, where LNK file paths are passed into an os.popen() call without sanitization. An unauthenticated attacker can exploit this by providing a crafted LNK filename containing shell metacharacters that trigger command execution when the forensic tool parses the file.

Business Impact

The successful exploitation of this vulnerability results in full system compromise for the affected forensic examiner, as the malicious commands execute with the privileges of the user running the script. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to data exfiltration, lateral movement within a forensic network, or the compromise of sensitive digital evidence.

Remediation Plan

Immediate Action: Upgrade the parseusbs software to version 1.9.0 or later, which includes the fix for sanitizing LNK file paths.

Proactive Monitoring: Monitor forensic workstations for unexpected child processes spawned by python scripts or unusual shell activity during the ingestion of USB artifacts.

Compensating Controls: Ensure that forensic tools are executed in isolated, non-persistent virtual environments or sandboxes to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the provided data.

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires user interaction, specifically the act of parsing a malicious LNK file, which makes the attack vector dependent on the workflow of the forensic examiner.

Analyst Recommendation

Given the high impact of arbitrary command execution, users of the parseusbs tool should prioritize updating to version 1.9.0 immediately. Forensic teams should also review their ingestion workflows to ensure that untrusted media is handled in secure, restricted environments until the patch is fully deployed.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel Platform HTTP Main
AFFECTED_VERSIONS: 4.14.1 up to 4.14.6, 4.18.0 up to 4.18.2
CONFIDENCE: high
MISSING: none
CREDITS: Jihang Yu (finder)
SOURCES_JSON: [{"url":"https://camel.apache.org/security/CVE-2026-40022.html","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.711Z
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Apache Camel allows unauthenticated access to protected routes and management endpoints when non-root context paths are configured.

Executive Summary:
A critical authentication bypass flaw in the Apache Camel platform permits unauthenticated users to access sensitive management endpoints and business routes, posing a high risk of unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-40022

Affected Software: Apache Software Foundation Apache Camel Platform HTTP Main

Affected Versions: 4.14.1 up to 4.14.6, 4.18.0 up to 4.18.2

Vulnerability: This is an authentication bypass (CWE-288) where the authentication handler only matches the exact configured context path rather than its subpaths. Consequently, unauthenticated requests to subpaths of protected routes are processed without credential challenges, exposing sensitive metadata.

Business Impact

The vulnerability allows attackers to bypass security controls and access sensitive management endpoints, such as the /observe/info route. This can result in the exposure of critical runtime metadata including internal process IDs, system paths, and environment details. Given the CVSS score of 8.2, this represents a significant security breach potential that could facilitate further reconnaissance and exploitation of the backend infrastructure.

Remediation Plan

Immediate Action: Update the Apache Camel component to version 4.14.6, 4.18.2, or 4.20.0 as provided in the Maven repository.

Proactive Monitoring: Review web server and application access logs for unusual patterns of unauthenticated requests targeting /api or /admin subpaths.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized attempts to access management endpoints if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation in the wild. However, the availability of a public proof-of-concept makes this vulnerability highly accessible to unauthorized parties. The flaw is inherently dangerous due to the ease of bypassing authentication for management routes.

Analyst Recommendation

This vulnerability presents a severe risk to the confidentiality of system metadata and internal application logic. Administrators must prioritize the update to the patched versions of Apache Camel, as this is the only definitive way to resolve the path-matching logic error. Failure to patch may leave your environment vulnerable to unauthorized reconnaissance and potential follow-on attacks.

---METADATA---
VENDOR: Apache
PRODUCT: Wicket
AFFECTED_VERSIONS: 8.0.0 through 8.17.0, 9.0.0, 10.0.0 through 10.8.0
---END_METADATA---

Description Summary:
Apache Wicket fails to invoke the changeSessionId method after session binding, exposing the application to session fixation attacks.

Executive Summary:
A session fixation vulnerability in Apache Wicket allows unauthorized attackers to hijack user sessions due to improper session management.

Vulnerability Details

CVE-ID: CVE-2026-40010

Affected Software: Apache Wicket

Affected Versions: 8.0.0–8.17.0, 9.0.0, 10.0.0–10.8.0

Vulnerability: The application does not properly update the session identifier upon authentication or session binding. This allows an attacker to potentially fix a session ID and hijack a victim's authenticated session.

Business Impact

Session fixation can lead to total unauthorized access to user accounts, including administrative accounts, resulting in data theft and unauthorized transactions. The 9.1 CVSS score reflects the high risk of account takeover and the potential for broad impact on user security.

Remediation Plan

Immediate Action: Upgrade to Apache Wicket version 10.9.0 or the latest recommended release for your specific branch.

Proactive Monitoring: Audit application logs for suspicious session activity or frequent session ID reuse patterns.

Compensating Controls: Implement strict session timeout policies and ensure that all sensitive traffic is protected by HTTPS with the Secure cookie flag enabled.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Addressing this vulnerability is essential for maintaining user trust and security. Administrators should update their dependencies as soon as possible to ensure that session identifiers are correctly rotated upon authentication.

---METADATA---
VENDOR: Woocommerce Custom Product Addons Pro
PRODUCT: Woocommerce Custom Product Addons Pro (WordPress Plugin)
AFFECTED_VERSIONS: Up to and including 5.4.1
---END_METADATA---

Description Summary:
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to unauthenticated Remote Code Execution (RCE) via the PHP eval() function in custom pricing formulas.

Executive Summary:
Unauthenticated attackers can execute arbitrary PHP code on WordPress sites using the Woocommerce Custom Product Addons Pro plugin, resulting in total server takeover.

Vulnerability Details

CVE-ID: CVE-2026-4001

Affected Software: Woocommerce Custom Product Addons Pro

Affected Versions: Up to and including 5.4.1

Vulnerability: The plugin uses the eval() function within process_custom_formula() to handle pricing. Because it fails to properly sanitize user-submitted field values (specifically failing to escape single quotes), an unauthenticated attacker can inject and execute arbitrary PHP code.

Business Impact

A successful exploit grants the attacker full control over the WordPress environment and the underlying web server. This can lead to the theft of customer data, injection of credit card skimmers (Magecart-style), and complete site defacement. The CVSS score of 9.8 indicates a critical risk to the confidentiality and integrity of the e-commerce platform.

Remediation Plan

Immediate Action: Update the Woocommerce Custom Product Addons Pro plugin to the latest patched version immediately.

Proactive Monitoring: Scan the WordPress filesystem for unauthorized PHP files or modifications to core files. Monitor for unusual outbound network connections from the web server.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing PHP execution patterns or suspicious characters in product addon fields.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public evidence of active exploitation. However, RCE vulnerabilities in popular WordPress plugins are frequently targeted by automated botnets shortly after disclosure.

Analyst Recommendation

Due to the critical nature of unauthenticated RCE, administrators must update this plugin immediately. If an update is not available, the plugin should be deactivated until a patch is applied to prevent site compromise.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: IoTDB
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache IoTDB versions 1.0.0 through 2.0.9 are vulnerable to unsafe reflection via the pipe processor, which fails to validate externally controlled Java class names.

Executive Summary:
A critical unsafe reflection vulnerability in Apache IoTDB allows unauthenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-40008

Affected Software: Apache Software Foundation IoTDB

Affected Versions: 1.0.0 up to (excluding) 2.0.10

Vulnerability: The vulnerability exists in the pipe processor, which uses Class.forName().newInstance() on user-supplied input without validation. This allows an unauthenticated attacker to instantiate arbitrary Java classes, potentially leading to remote code execution.

Business Impact

This vulnerability is rated at 9.8 (Critical) because it allows for full system compromise without authentication. Exploitation would likely result in total loss of confidentiality, integrity, and availability of the IoTDB instance and potentially the underlying host server, posing a severe risk to data processing environments.

Remediation Plan

Immediate Action: Upgrade Apache IoTDB to version 2.0.10 or later immediately to resolve the unsafe reflection flaw.

Proactive Monitoring: Inspect application logs for unusual class loading patterns or attempts to execute unexpected Java methods within the pipe processor.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests containing class-instantiation payloads and restrict network access to the IoTDB management ports.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this remote code execution vulnerability requires an immediate upgrade to version 2.0.10. Security teams should treat this as a high-priority task to ensure that the environment is protected against potential exploitation of the insecure reflection mechanism.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache IoTDB
AFFECTED_VERSIONS: 1.0.0 up to 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack exhaustion vulnerability in Apache IoTDB's AirGap receiver allows unauthenticated attackers to cause a denial-of-service via uncontrolled recursion.

Executive Summary:
An unauthenticated denial-of-service vulnerability in Apache IoTDB allows remote attackers to crash the service via uncontrolled recursion.

Vulnerability Details

CVE-ID: CVE-2026-40007

Affected Software: Apache IoTDB

Affected Versions: 1.0.0 up to 2.0.10 (Fixed in 2.0.10)

Vulnerability: The readLength method in the AirGap receiver lacks recursion depth limits when processing socket data containing specific prefixes. An unauthenticated attacker can exploit this to exhaust the JVM stack, resulting in a StackOverflowError and service denial.

Business Impact

The CVSS score of 7.5 reflects the critical nature of this denial-of-service, particularly for IoT infrastructure. Because the attack is unauthenticated and network-accessible, it can be triggered remotely to disrupt critical data collection services and impact the availability of industrial IoT environments.

Remediation Plan

Immediate Action: Update Apache IoTDB to version 2.0.10 or later to ensure the recursion limit is correctly implemented.

Proactive Monitoring: Monitor JVM stack usage and error logs for recurring StackOverflowError exceptions or unexpected thread crashes associated with the AirGap receiver.

Compensating Controls: Use network segmentation or firewalls to restrict access to the IoTDB AirGap receiver port to only known, trusted IP addresses if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered remotely without authentication.

Analyst Recommendation

Apache IoTDB users should prioritize upgrading to version 2.0.10 immediately. This update is essential to prevent potential service instability and denial-of-service attacks that could paralyze IoT data processing pipelines.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache IoTDB
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache IoTDB contains multiple vulnerabilities including missing authentication and improper resource management, allowing unauthenticated remote attackers to trigger denial-of-service conditions.

Executive Summary:
A high-severity vulnerability in Apache IoTDB allows unauthenticated attackers to cause a denial-of-service (DoS) condition via remote memory exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-40006

Affected Software: Apache Software Foundation Apache IoTDB

Affected Versions: 1.0.0 up to (excluding) 2.0.10

Vulnerability: The vulnerability stems from improper memory allocation and a lack of authentication for the AirGap pipe receiver (port 9780). An unauthenticated attacker can send crafted TCP requests that bypass security checks, triggering excessive heap memory allocation and resource exhaustion.

Business Impact

Successful exploitation of this vulnerability results in a denial-of-service, rendering the IoTDB service unavailable. With a CVSS score of 7.5, the impact is significant for organizations relying on IoTDB for real-time data ingestion and processing. Because the attack vector is network-based and requires no authentication, the potential for service disruption is high, which could lead to operational downtime and data processing delays.

Remediation Plan

Immediate Action: Upgrade Apache IoTDB to version 2.0.10 or later to apply the necessary authentication controls and resource throttling.

Proactive Monitoring: Monitor network traffic to port 9780 for unusual connection spikes and review server logs for signs of unexpected memory pressure or service crashes.

Compensating Controls: If an immediate upgrade is not feasible, restrict network access to port 9780 via firewall rules to trusted IP addresses only, or disable the pipe_air_gap_receiver_enabled configuration if it is not required for your operations.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit available).

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its "automatable" nature, meaning an attacker could easily script attacks against exposed instances.

Analyst Recommendation

Given the ease of exploitation over the network and the critical impact on service availability, administrators should prioritize patching to version 2.0.10. Organizations that cannot update immediately must implement strict network-level access controls to the affected port to prevent unauthorized access and potential service degradation.

---METADATA---
VENDOR: Apache
PRODUCT: IoTDB
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 2.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in Apache IoTDB allows unauthenticated attackers to write arbitrary files to the filesystem by leveraging an unsafe API.

Executive Summary:
A critical path traversal vulnerability in Apache IoTDB allows unauthenticated attackers to write arbitrary files, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40005

Affected Software: Apache IoTDB

Affected Versions: 1.0.0 up to (excluding) 2.0.10

Vulnerability: This is a path traversal vulnerability (CWE-22) residing in an unsafe API within Apache IoTDB. An unauthenticated remote attacker can exploit this flaw to overwrite or create arbitrary files on the underlying host, limited only by the permissions of the IoTDB process.

Business Impact

The ability to write arbitrary files provides an attacker with a direct path to remote code execution or persistent system modification. Given the CVSS score of 9.1, this vulnerability poses a severe threat to data integrity and system availability. Successful exploitation could lead to unauthorized configuration changes, deployment of malicious backdoors, or the destruction of critical operational data.

Remediation Plan

Immediate Action: Upgrade Apache IoTDB to version 2.0.10 or later immediately to resolve the unsafe API handling.

Proactive Monitoring: Monitor server logs for unusual file write operations, particularly those targeting system configuration directories or application binaries.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Network Intrusion Detection System (NIDS) to identify and block traffic patterns indicative of path traversal attempts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score and the ability for unauthenticated exploitation make this a high-priority remediation item. Organizations running vulnerable versions of Apache IoTDB must prioritize the upgrade to version 2.0.10 to eliminate the risk of arbitrary file writes and potential system takeover.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A broken access control vulnerability in an unspecified product allows authenticated users to perform horizontal privilege escalation.

Executive Summary:
A critical broken access control vulnerability enables authenticated users to escalate privileges horizontally, potentially leading to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3999

Affected Software: Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is defined as a broken access control flaw that allows an authenticated user to access or manipulate data belonging to other users. This is a horizontal privilege escalation issue, meaning a user can access resources at the same privilege level but belonging to a different account.

Business Impact

This vulnerability poses a significant threat to data privacy and multi-tenant environment security. With a CVSS score of 8.8, it represents a high risk of unauthorized data exposure, which could lead to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Apply the vendor-provided security patch immediately upon availability for all affected software instances.

Proactive Monitoring: Review access logs and audit trails to identify any suspicious user activity that suggests horizontal movement or unauthorized data access.

Compensating Controls: Implement strict role-based access control (RBAC) and, where possible, enforce additional authentication layers for sensitive data access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the importance of robust access control mechanisms. Administrators should audit user permissions and ensure that security patches are applied as soon as they are released by the respective vendors to prevent privilege escalation.

---METADATA---
VENDOR: Marimo
PRODUCT: Marimo
AFFECTED_VERSIONS: marimo-team marimo: < 0.23.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","name":"https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/marimo-team/marimo/pull/9098","name":"https://github.com/marimo-team/marimo/pull/9098","tags":["x_refsource_MISC"]},{"url":"https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a","name":"https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a","tags":["x_refsource_MISC"]}]
---END_METADATA---

Description Summary:
Marimo reactive Python notebook versions prior to 0.23.0 contain a pre-authentication remote code execution vulnerability in the terminal WebSocket endpoint.

Executive Summary:
A critical pre-authentication remote code execution vulnerability in Marimo allows unauthenticated attackers to execute arbitrary system commands, and it is currently being exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-39987

Affected Software: Marimo

Affected Versions: marimo-team marimo: < 0.23.0

Vulnerability: The /terminal/ws WebSocket endpoint fails to perform authentication validation. This allows an unauthenticated attacker to establish a connection, obtain a full PTY shell, and execute arbitrary system commands on the underlying host.

Business Impact

The CVSS score of 9.5 reflects the extreme risk posed by this vulnerability. Since the flaw is reachable without authentication, it allows for trivial remote code execution, which can lead to complete server takeover, lateral movement within the network, and the deployment of malicious payloads like the NKAbuse malware. The high exploitability and rapid weaponization by attackers make this a top-tier security priority.

Remediation Plan

Immediate Action: Update the Marimo package to version 0.23.0 or later immediately.

Proactive Monitoring: Audit logs for suspicious connections to the /terminal/ws endpoint and monitor for anomalous child processes spawned by the Marimo service.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized WebSocket traffic to the /terminal/ws endpoint until the patch can be applied.

Exploitation Status

Public Exploit Available: Yes (multiple public GitHub PoCs exist)

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of April 23, 2026. Exploitation was observed within hours of public disclosure, demonstrating a high level of interest from malicious actors.

Analyst Recommendation

Due to the ease of exploitation and the confirmed active use in the wild, this vulnerability presents an immediate and critical risk. All systems running vulnerable versions of Marimo must be updated to version 0.23.0 or taken offline until the update can be verified.

---METADATA---
VENDOR: patrickjuchli
PRODUCT: basic-ftp
AFFECTED_VERSIONS: < 5.2.1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q","name":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b","name":"https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b","tags":["x_refsource_MISC"]},{"url":"https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1","name":"https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.919Z
---END_METADATA---

Description Summary:
The basic-ftp library for Node.js is vulnerable to FTP command injection via CRLF sequences in file path parameters, allowing attackers to execute arbitrary FTP commands.

Executive Summary:
An unauthenticated attacker can perform FTP command injection in the basic-ftp library, potentially leading to unauthorized data manipulation or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-39983

Affected Software: patrickjuchli basic-ftp

Affected Versions: < 5.2.1

Vulnerability: This vulnerability involves improper neutralization of CRLF sequences, which allows an unauthenticated attacker to inject malicious commands into FTP API calls such as cd(), remove(), or uploadFrom(). By including newline characters in path parameters, the library splits intended commands, effectively bypassing security controls on the FTP control socket.

Business Impact

The ability to inject arbitrary FTP commands poses a significant risk to data integrity and system availability. An attacker could potentially delete files, upload unauthorized content, or manipulate directory structures, which may lead to severe operational disruption or loss of sensitive information. With a CVSS score of 8.6, this flaw is classified as High severity, necessitating immediate attention to prevent unauthorized system interaction.

Remediation Plan

Immediate Action: Update the basic-ftp dependency to version 5.2.1 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review application logs for unusual file path inputs containing newline characters or suspicious FTP command sequences that deviate from standard operational patterns.

Compensating Controls: While no direct WAF rule can replace a patch, ensure that all application inputs are strictly validated for illegal characters before being passed to library functions.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the library fails to properly sanitize user-supplied path strings before passing them to the socket.

Analyst Recommendation

Given the High severity of this command injection vulnerability and the availability of a public proof-of-concept, organizations using the basic-ftp library must prioritize updating to version 5.2.1. Failure to address this flaw could allow attackers to gain unauthorized control over FTP operations, leading to critical data integrity issues. Ensure all development and production environments are patched to eliminate this attack vector.

---METADATA---
VENDOR: Josh-XT
PRODUCT: AGiXT
AFFECTED_VERSIONS: < 1.9.2
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw","name":"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f","name":"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f","tags":["x_refsource_MISC"]},{"url":"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2","name":"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.919Z
---END_METADATA---

Description Summary:
The safe_join function in AGiXT versions prior to 1.9.2 fails to validate file paths, allowing authenticated attackers to perform directory traversal to read, write, or delete arbitrary server files.

Executive Summary:
A directory traversal vulnerability in AGiXT allows authenticated attackers to perform arbitrary file operations, posing a significant risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-39981

Affected Software: Josh-XT AGiXT

Affected Versions: < 1.9.2

Vulnerability: This is a path traversal vulnerability (CWE-22) located in the safe_join function of the essential_abilities extension. An authenticated attacker can exploit this flaw to bypass workspace restrictions and manipulate files on the host server.

Business Impact

The ability to read, write, or delete arbitrary files on the host server provides an attacker with broad control over the application environment. This could lead to the theft of sensitive configuration data, the injection of malicious code, or a total loss of system availability. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could be leveraged to escalate privileges or move laterally within the network.

Remediation Plan

Immediate Action: Update the AGiXT platform to version 1.9.2 or later to apply the necessary path validation logic.

Proactive Monitoring: Review system and application logs for unusual file access patterns, especially those containing directory traversal sequences such as dot-dot-slash notation.

Compensating Controls: Deploy a Web Application Firewall or host-based intrusion detection system to monitor and block requests attempting to access restricted file paths outside the designated agent workspace.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation or a published weaponized exploit for this vulnerability. However, per CISA's SSVC assessment, a proof-of-concept exists, so the exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains authenticated access to the platform.

Analyst Recommendation

Organizations utilizing AGiXT must prioritize upgrading to version 1.9.2 immediately. Because the vulnerability allows for arbitrary file write and delete operations, the potential for persistent compromise is high. Administrators should treat this as a critical maintenance item to prevent unauthorized access to the underlying server infrastructure.

---METADATA---
VENDOR: OpenCTI
PRODUCT: OpenCTI
AFFECTED_VERSIONS: Prior to 6.9.5
---END_METADATA---

Description Summary:
OpenCTI prior to 6.9.5 contains an EJS template injection vulnerability allowing authenticated users with Manage customization capabilities to execute arbitrary JavaScript on the platform.

Executive Summary:
An authenticated remote code execution vulnerability in OpenCTI allows users with specific administrative privileges to execute arbitrary JavaScript, potentially compromising the platform.

Vulnerability Details

CVE-ID: CVE-2026-39980

Affected Software: OpenCTI

Affected Versions: Prior to 6.9.5

Vulnerability: The vulnerability exists in the safeEjs.ts file, which fails to properly sanitize EJS templates. An attacker with the "Manage customization" capability can exploit this flaw during notifier template execution to run arbitrary JavaScript within the context of the OpenCTI process.

Business Impact

Successful exploitation allows an attacker to gain code execution within the OpenCTI environment. Given the CVSS score of 9.1, this represents a critical risk, as it could lead to the theft of sensitive threat intelligence data, platform takeover, or lateral movement into connected security infrastructure.

Remediation Plan

Immediate Action: Upgrade all OpenCTI instances to version 6.9.5 or later immediately.

Proactive Monitoring: Review audit logs for unusual notifier template modifications or unauthorized access to the customization management interface.

Compensating Controls: Restrict "Manage customization" capabilities to the absolute minimum number of trusted administrators until patching is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of threat intelligence operations. Organizations should prioritize patching to version 6.9.5 to eliminate the risk of arbitrary code execution by malicious or compromised internal accounts.

---METADATA---
VENDOR: Combodo
PRODUCT: iTop
AFFECTED_VERSIONS: < 3.2.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh","name":"https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh","tags":["x_refsource_CONFIRM"]}]
---END_METADATA---

Description Summary:
Combodo iTop versions prior to 3.2.3 are vulnerable to a code injection flaw that allows authenticated users to delete a critical configuration file, resulting in remote code execution.

Executive Summary:
An unauthenticated vulnerability in Combodo iTop allows for the deletion of a critical configuration file, which can be leveraged by an attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-39975

Affected Software: Combodo iTop

Affected Versions: < 3.2.3

Vulnerability: The application is susceptible to a code injection vulnerability (CWE-94) caused by the ability to delete the .readonly configuration file. Deleting this file, which is intended to prevent write actions, allows an attacker to bypass security restrictions and execute arbitrary code.

Business Impact

The ability to execute arbitrary code on the server provides an attacker with complete control over the iTop instance. This leads to total compromise of the IT service management data, potential exfiltration of sensitive organizational information, and the ability to pivot to other internal systems. The CVSS score of 9.4 reflects the extreme severity of this vulnerability.

Remediation Plan

Immediate Action: Update Combodo iTop to version 3.2.3 or later immediately.

Proactive Monitoring: Monitor for unexpected file deletion events or unauthorized modifications to the application directory and configuration files.

Compensating Controls: Ensure the web server process runs with the least privilege necessary, preventing it from having write permissions to sensitive configuration files whenever possible.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 24, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is inherently dangerous due to the ease with which the security-critical .readonly file can be removed.

Analyst Recommendation

This is a critical vulnerability that carries a high risk of total system compromise. Organizations utilizing iTop must verify their current version and apply the update to 3.2.3 or higher without delay to mitigate the risk of remote code execution.

---METADATA---
VENDOR: n8n
PRODUCT: n8n-MCP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The n8n-MCP server contains an unspecified vulnerability that may expose sensitive documentation, properties, and operations to unauthorized AI assistants.

Executive Summary:
A high-severity vulnerability in the n8n-MCP server poses a significant risk of unauthorized information disclosure regarding sensitive node documentation and operations.

Vulnerability Details

CVE-ID: CVE-2026-39974

Affected Software: n8n n8n-MCP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Model Context Protocol (MCP) server implementation within n8n. It involves improper handling of access controls or data exposure, potentially allowing unauthorized AI entities to interact with or extract sensitive operational configuration data.

Business Impact

Successful exploitation could lead to the exposure of internal workflow documentation and operational properties, facilitating reconnaissance for further attacks against the n8n environment. Given the CVSS score of 8.5, the risk to intellectual property and internal configuration security is substantial.

Remediation Plan

Immediate Action: Review the official n8n security advisory and apply the latest security patches for the n8n-MCP component immediately.

Proactive Monitoring: Audit logs for unusual access requests to the MCP interface and monitor for unexpected AI-driven queries against sensitive endpoints.

Compensating Controls: Restrict network access to the MCP server endpoint to trusted IP ranges and implement robust authentication mechanisms for all AI-assistant integrations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Organizations utilizing n8n-MCP must treat this issue with high urgency. Ensure all components are updated to the latest supported versions and audit existing integrations to ensure that AI access is limited to the minimum required functionality.

---METADATA---
VENDOR: iBotPeaches
PRODUCT: Apktool
AFFECTED_VERSIONS: >= 3.0.0, < 3.0.2
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m","name":"https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/iBotPeaches/Apktool/pull/4041","name":"https://github.com/iBotPeaches/Apktool/pull/4041","tags":["x_refsource_MISC"]},{"url":"https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3","name":"https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585c","tags":["x_refsource_MISC"]},{"url":"https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2","name":"https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.647Z
---END_METADATA---

Description Summary:
A path traversal vulnerability in iBotPeaches Apktool versions 3.0.0 and 3.0.1 allows attackers to write arbitrary files to the filesystem during APK decoding, potentially leading to remote code execution.

Executive Summary:
A path traversal vulnerability in iBotPeaches Apktool versions 3.0.0 and 3.0.1 poses a critical risk by allowing arbitrary file writes, which can lead to remote code execution on the host machine.

Vulnerability Details

CVE-ID: CVE-2026-39973

Affected Software: iBotPeaches Apktool

Affected Versions: >= 3.0.0, < 3.0.2

Vulnerability: The software fails to sanitize file paths within the resource output directory, allowing unauthenticated users to use malicious APK files to traverse directories. This flaw occurs during the standard decoding process when the tool writes decoded resources to the local filesystem.

Business Impact

The ability to write files to arbitrary locations on a host system is severe, as it permits attackers to overwrite sensitive configuration files or startup scripts. Given the CVSS score of 7.1, this high-severity vulnerability could lead to total system compromise, unauthorized data access, or the execution of malicious code under the context of the user running the tool.

Remediation Plan

Immediate Action: Update iBotPeaches Apktool to version 3.0.2 or later, which re-introduces the necessary path sanitization logic to prevent directory traversal.

Proactive Monitoring: Review file system changes and audit logs for unauthorized file creation or modification occurring in sensitive directories, such as SSH or startup folders, after executing Apktool.

Compensating Controls: If an immediate update is not feasible, restrict the use of Apktool to isolated, sandboxed environments or virtual machines that do not contain sensitive user data or system configurations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository frawlaboy/CVE-2026-39973-PoC.

Analyst Notes: As of April 21, 2026, there is no public information indicating active exploitation in the wild, though a public proof-of-concept is available. The vulnerability is highly exploitable as it relies on the standard functionality of the tool to trigger the malicious write operation.

Analyst Recommendation

The presence of a functional proof-of-concept combined with the potential for remote code execution necessitates immediate action. Security teams must ensure that all instances of Apktool are upgraded to version 3.0.2 to close this security regression and prevent potential host system compromise.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
The Cacti performance management framework is vulnerable to a pre-authentication SQL injection via an improperly validated input parameter in graph_view.php.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in Cacti allows remote attackers to execute arbitrary database queries, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39955

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The application fails to properly sanitize input via the FILTER_VALIDATE_REGEXP in graph_view.php. This allows an unauthenticated attacker to inject malicious SQL commands directly into the database query structure.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the high potential for data exfiltration, database modification, or complete administrative takeover of the Cacti framework. The impact includes significant risk to organizational data integrity and potential unauthorized access to sensitive performance monitoring metrics.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to implement the necessary input validation fixes.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the graph_view.php endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability is unauthenticated and allows for full database control, immediate patching is required. Organizations should treat this as a high-priority remediation task to protect their monitoring infrastructure from unauthorized access.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
An SQL injection vulnerability in Cacti allows unauthenticated attackers to execute arbitrary database commands via the rfilter parameter in graph_view.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in Cacti 1.2.30 and prior permits remote attackers to compromise the confidentiality, integrity, and availability of the database.

Vulnerability Details

CVE-ID: CVE-2026-39948

Affected Software: Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability stems from improper validation of the 'rfilter' request parameter, which is directly concatenated into SQL queries. An unauthenticated attacker can supply a malicious payload to bypass regex validation, enabling arbitrary SQL injection on installations where guest graph viewing is enabled.

Business Impact

With a CVSS score of 9.3, this flaw is highly critical. A successful exploit grants an attacker the ability to dump sensitive database contents, modify records, or potentially disrupt service, leading to significant data loss or unauthorized access to internal management frameworks.

Remediation Plan

Immediate Action: Upgrade the Cacti installation to version 1.2.31 or later immediately.

Proactive Monitoring: Review database and web server access logs for anomalous SQL queries, particularly those involving 'RLIKE' syntax or unexpected character patterns.

Compensating Controls: Disable guest graph viewing functionality and deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the 'rfilter' parameter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the severity of impact, the potential for exploitation is high.

Analyst Recommendation

The severity of this SQL injection vulnerability necessitates an immediate upgrade to version 1.2.31. Organizations must treat this as a high-priority remediation to prevent unauthorized database access and ensure the continued integrity of the Cacti management framework.

---METADATA---
VENDOR: Ceph
PRODUCT: Ceph
AFFECTED_VERSIONS: >= 19.0.0, < 19.2.6; >= 20.0.0, < 20.2.4
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2","name":"https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ceph/ceph/releases/tag/v19.2.6","name":"https://github.com/ceph/ceph/releases/tag/v19.2.6","tags":["x_refsource_MISC"]},{"url":"https://github.com/ceph/ceph/releases/tag/v20.2.4","name":"https://github.com/ceph/ceph/releases/tag/v20.2.4","tags":["x_refsource_MISC"]}]
---END_METADATA---

Description Summary:
A cryptographic flaw in the Ceph RADOS Gateway allows authenticated users to tamper with STS session tokens via CBC bit-flipping, resulting in a full administrative privilege escalation.

Executive Summary:
A critical cryptographic vulnerability in the Ceph RADOS Gateway allows low-privileged users to escalate to full administrative access, posing a severe risk to storage infrastructure integrity.

Vulnerability Details

CVE-ID: CVE-2026-39944

Affected Software: Ceph Ceph

Affected Versions: >= 19.0.0, < 19.2.6; >= 20.0.0, < 20.2.4

Vulnerability: This vulnerability involves the use of an unauthenticated AES-128-CBC cryptographic handler for STS session tokens, which allows an attacker with a standard user token to perform bit-flipping attacks to modify administrative flags. This enables a low-privileged authenticated user to bypass all capability checks and achieve global administrative access.

Business Impact

The exploitation of this vulnerability permits unauthorized actors to gain full administrative control over the Ceph storage platform. This leads to a total compromise of data confidentiality, integrity, and availability, as an attacker can manipulate, delete, or exfiltrate sensitive stored objects and blocks. With a CVSS score of 8.8, this high-severity flaw requires immediate remediation to prevent the potential for widespread data breaches and system sabotage.

Remediation Plan

Immediate Action: Upgrade to Ceph version 20.2.4 or 19.2.6 immediately to implement the required message authentication for STS tokens.

Proactive Monitoring: Review RGW access logs for unusual administrative activity or rapid, repeated token modification attempts that deviate from standard user behavior.

Compensating Controls: While a WAF may not inspect the internal contents of encrypted STS tokens, restricting access to the RGW S3 endpoint via network-level controls can limit the attack surface for untrusted entities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it requires only a single valid low-privileged token and no complex network manipulation, making it highly attractive for attackers who have already established a foothold in the environment.

Analyst Recommendation

Given the severity of potential administrative escalation, organizations should treat this update as a high-priority task. Security teams must verify their current Ceph version and apply the recommended patches to both the 19.x and 20.x branches immediately to neutralize the risk of unauthorized privilege elevation.

---METADATA---
VENDOR: Directus
PRODUCT: Directus
AFFECTED_VERSIONS: < 11.17.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95","name":"https://github.com/directus/directus/security/advisories/GHSA-393c-p46r-7c95","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/directus/directus/releases/tag/v11.17.0","name":"https://github.com/directus/directus/releases/tag/v11.17.0","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.919Z
---END_METADATA---

Description Summary:
Directus versions prior to 11.17.0 contain an improper access control vulnerability in the PATCH /files/{id} endpoint, allowing authenticated users to overwrite arbitrary file contents.

Executive Summary:
A critical authorization bypass in Directus allows authenticated users to overwrite system files and manipulate metadata, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-39942

Affected Software: Directus

Affected Versions: < 11.17.0

Vulnerability: This vulnerability involves improper access control and authorization bypass via a user-controlled filename_disk parameter in the PATCH /files/{id} endpoint. An authenticated attacker can overwrite existing files within the system and manipulate metadata fields to hide their activity.

Business Impact

The ability to overwrite files and tamper with metadata directly undermines the integrity of the database content managed by Directus. With a CVSS score of 8.5, this high-severity flaw could lead to unauthorized data modification, loss of critical business information, and potential regulatory compliance failures regarding data accuracy.

Remediation Plan

Immediate Action: Update the Directus instance to version 11.17.0 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Monitor server logs for unusual patterns of PATCH requests to the /files/ endpoint, particularly those involving modifications to file metadata or unexpected file path references.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter API requests to the /files/ endpoint, specifically looking for attempts to modify the filename_disk parameter.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is moderate as it requires an authenticated user session, but the impact of unauthorized file overwriting is severe.

Analyst Recommendation

Given the potential for unauthorized data manipulation and loss of integrity, administrators must prioritize upgrading to version 11.17.0. Verify that all Directus instances are patched to this version, as the vulnerability resides in a core API function that is likely exposed in standard deployments.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
Cacti versions 1.2.30 and prior contain an unauthenticated Local File Inclusion (LFI) vulnerability via the graph_theme parameter, potentially allowing unauthorized file access.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in Cacti enables remote attackers to read arbitrary files from the host system, creating a critical risk of sensitive data exposure.

Vulnerability Details

CVE-ID: CVE-2026-39938

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability stems from improper input validation within the graph_theme parameter and rrdtool IPC serialization. This allows an unauthenticated attacker to traverse the file system and include arbitrary local files.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical as it allows for the disclosure of sensitive configuration files, credentials, or system data. Such access facilitates further exploitation and compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to implement the necessary hardening and input sanitization.

Proactive Monitoring: Inspect web server logs for suspicious requests containing directory traversal sequences (e.g., ../) targeting the graph_theme parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block directory traversal patterns and unauthorized file access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of LFI vulnerabilities, immediate patching is required to protect the host environment. Administrators should verify the integrity of the system after applying the update to ensure no unauthorized access occurred previously.

---METADATA---
VENDOR: openemr
PRODUCT: openemr
AFFECTED_VERSIONS: 0 through 8.2.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
OpenEMR contains a remote code execution vulnerability via eval injection in the CategoryTree component, allowing authenticated administrators to execute arbitrary OS commands.

Executive Summary:
A critical remote code execution vulnerability in OpenEMR allows authenticated administrators to execute arbitrary operating system commands via an unsafe eval() call.

Vulnerability Details

CVE-ID: CVE-2026-39932

Affected Software: openemr openemr

Affected Versions: 0 through 8.2.0

Vulnerability: The vulnerability exists in the CategoryTree component, where unsanitized user input is processed through an eval() call. While the vector requires high privileges, the resulting command execution allows an attacker to gain full control over the underlying web server.

Business Impact

The vulnerability allows for full system compromise, enabling attackers to move laterally within the network or access sensitive medical records. Given the sensitivity of data handled by OpenEMR, the 9.1 CVSS score reflects the severe impact of unauthorized code execution.

Remediation Plan

Immediate Action: Update OpenEMR to the latest available version as provided by the vendor.

Proactive Monitoring: Monitor server logs for unexpected execution of system commands or unauthorized modifications to the database structure.

Compensating Controls: Restrict administrative access to the application to trusted internal networks only and utilize host-based intrusion detection systems to monitor for anomalous process spawns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for administrative privileges slightly mitigates the initial attack surface.

Analyst Recommendation

While this vulnerability requires authenticated access, the ability to execute arbitrary OS commands makes it a high-priority risk. Administrators should apply available vendor patches immediately and restrict administrative interface access to known, secure management networks.

---METADATA---
VENDOR: Flarum
PRODUCT: Flarum Framework
AFFECTED_VERSIONS: 0 up to (excluding) 1.8.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Flarum Framework contains a vulnerability involving the use of expired keys, which allows attackers to bypass password reset token expiration mechanisms.

Executive Summary:
A critical vulnerability in the Flarum Framework allows attackers to bypass password reset token expiration, potentially enabling unauthorized account takeovers.

Vulnerability Details

CVE-ID: CVE-2026-39923

Affected Software: Flarum Flarum Framework

Affected Versions: 0 up to (excluding) 1.8.16

Vulnerability: The software suffers from the use of a key past its expiration date (CWE-324). This flaw allows an attacker to reuse or extend password reset tokens that should have been invalidated, effectively bypassing the intended security window for account recovery.

Business Impact

Successful exploitation of this flaw could lead to full account takeover, granting attackers unauthorized access to user accounts and their associated privileges. With a CVSS score of 8.1, the potential for widespread account compromise presents a major risk to user data integrity and overall platform security.

Remediation Plan

Immediate Action: Upgrade Flarum Framework to version 1.8.16 or higher immediately to resolve the token expiration defect.

Proactive Monitoring: Monitor authentication logs for unusual patterns in password reset requests or multiple successful resets for the same account occurring outside of expected timeframes.

Compensating Controls: While no direct WAF rule can fully mitigate this logic flaw, enforcing multi-factor authentication on all user accounts will prevent an attacker from gaining full control even if they bypass the password reset mechanism.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it directly undermines the integrity of the password recovery process.

Analyst Recommendation

Given the high impact of potential account takeovers, administrators must treat this update with high priority. Patching to version 1.8.16 is the only reliable way to ensure that password reset tokens are correctly invalidated after their intended expiration.

---METADATA---
VENDOR: BridgeHead
PRODUCT: FileStore
AFFECTED_VERSIONS: Prior to 24A
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BridgeHead FileStore exposes the Apache Axis2 admin module with default credentials, allowing unauthenticated remote code execution.

Executive Summary:
A critical vulnerability in BridgeHead FileStore allows unauthenticated attackers to execute arbitrary OS commands via the exposed Apache Axis2 administration interface.

Vulnerability Details

CVE-ID: CVE-2026-39920

Affected Software: BridgeHead FileStore

Affected Versions: Prior to 24A

Vulnerability: The application incorrectly exposes the Apache Axis2 administration module on network-accessible ports with default credentials. An unauthenticated remote attacker can leverage these credentials to deploy a malicious Java archive and execute arbitrary OS commands on the underlying host.

Business Impact

This vulnerability provides an attacker with full control over the host system, leading to complete system compromise and potential lateral movement within the network. The CVSS score of 9.8 reflects the extreme severity, as the ease of exploitation through default credentials makes this an attractive target for automated threats.

Remediation Plan

Immediate Action: Upgrade to BridgeHead FileStore version 24A or later, which addresses the exposure of the administration module.

Proactive Monitoring: Monitor for unauthorized access to the Apache Axis2 administration portal and inspect the server for any unusual Java archive deployments or unexpected process executions.

Compensating Controls: Immediately restrict network access to the administration module using firewall rules and ensure that all default credentials have been changed across the entire infrastructure.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely critical vulnerability that facilitates full system compromise. Organizations running BridgeHead FileStore must prioritize patching to version 24A and verify that no management interfaces are exposed to untrusted networks.

---METADATA---
VENDOR: Vvveb
PRODUCT: Vvveb
AFFECTED_VERSIONS: Prior to 1.0.8.1
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
Vvveb is vulnerable to unauthenticated remote code execution via code injection in the installation endpoint's subdir parameter.

Executive Summary:
An unauthenticated code injection vulnerability in Vvveb allows attackers to achieve remote code execution by manipulating configuration files.

Vulnerability Details

CVE-ID: CVE-2026-3918

Affected Software: Vvveb Vvveb

Affected Versions: Prior to 1.0.8.1

Vulnerability: The installation endpoint fails to sanitize the subdir POST parameter before writing it to the env.php configuration file. An unauthenticated attacker can break out of the string context to inject arbitrary PHP code.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to the integrity and availability of the web application. Successful exploitation allows an attacker to execute code as the web server user, leading to full system compromise and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade Vvveb installations to version 1.0.8.1 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests to installation endpoints and verify the integrity of the env.php configuration file for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious injection patterns targeting the installation directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute arbitrary code makes this an urgent security priority. Organizations using Vvveb must verify their versioning and apply the necessary updates without delay.

---METADATA---
VENDOR: Flow
PRODUCT: TIM Flow
AFFECTED_VERSIONS: 0 up to (excluding) 26.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TIM Flow is susceptible to HTTP Request/Response Splitting via the rt parameter, potentially allowing for cross-site scripting or cache poisoning attacks.

Executive Summary:
An HTTP header injection vulnerability in TIM Flow allows attackers to manipulate HTTP responses, creating risks of cross-site scripting and cache poisoning.

Vulnerability Details

CVE-ID: CVE-2026-39915

Affected Software: Flow TIM Flow

Affected Versions: 0 up to (excluding) 26.0.6

Vulnerability: The software is vulnerable to CRLF injection (CWE-113) within the rt parameter. By injecting carriage return and line feed characters, an unauthenticated attacker can manipulate HTTP headers, which may result in response splitting or similar injection-based attacks.

Business Impact

This vulnerability can be leveraged to conduct cross-site scripting (XSS) or cache poisoning, leading to potential account hijacking, session theft, or the distribution of malicious content to users. Given the high CVSS score of 8.1, this represents a significant threat to user security and the overall reputation of the affected web service.

Remediation Plan

Immediate Action: Update TIM Flow to version 26.0.6 or later to include the necessary sanitization for HTTP headers.

Proactive Monitoring: Monitor web traffic for requests containing encoded CRLF characters or unusual header patterns that may indicate injection attempts.

Compensating Controls: Implement strict input validation on all URL parameters and deploy a WAF with rules configured to block CRLF sequences in HTTP traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires user interaction, the potential for total impact on the affected session makes this a high-priority item.

Analyst Recommendation

The update to version 26.0.6 is mandatory to secure the application against header injection. Security teams should prioritize patching this vulnerability to prevent potential session-based attacks against their user base.

---METADATA---
VENDOR: V2Board
PRODUCT: V2Board and Xboard
AFFECTED_VERSIONS: V2Board 1.6.1 through 1.7.4; Xboard 0 through 0.1.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
V2Board and Xboard expose authentication tokens in HTTP response bodies during the loginWithMailLink process, allowing unauthenticated attackers to hijack accounts, including those with admin privileges.

Executive Summary:
An authentication token exposure vulnerability in V2Board and Xboard enables unauthenticated attackers to perform full account takeovers by intercepting sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-39912

Affected Software: V2Board and Xboard

Affected Versions: V2Board 1.6.1-1.7.4; Xboard 0-0.1.9

Vulnerability: The application improperly leaks authentication tokens in HTTP response bodies via the loginWithMailLink endpoint. An unauthenticated attacker can supply a known email address to trigger the workflow and obtain a valid bearer token, granting them full access to the target account.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to user and administrative accounts. Exploitation leads to unauthorized access to sensitive user data, configuration changes, and potential full administrative control over the board instance, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update V2Board and Xboard to the latest patched versions provided by the respective maintainers.

Proactive Monitoring: Inspect application logs for anomalous POST requests to the loginWithMailLink endpoint and monitor for unexpected administrative account activity.

Compensating Controls: Disable the login_with_mail_link_enable feature immediately if patching cannot be performed, and implement WAF rules to block suspicious traffic patterns targeting authentication endpoints.

Exploitation Status

Public Exploit Available: Yes (PoC)

Analyst Notes: As of Apr 9, 2026, there is evidence of a Proof-of-Concept (PoC) exploit. Immediate remediation is required to prevent unauthorized account access.

Analyst Recommendation

This vulnerability is highly critical due to the ease of exploitation and the potential for full account takeover. Administrators should apply the vendor-provided patches immediately and review recent access logs for signs of unauthorized token exchange.

---METADATA---
VENDOR: Hashgraph
PRODUCT: Guardian
AFFECTED_VERSIONS: 0 through 3.5.1
CONFIDENCE: high
MISSING: none
CREDITS: Christ Bouchuen (finder)
SOURCES_JSON: [{"url":"https://github.com/hashgraph/guardian/pull/5929","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/hashgraph/guardian/commit/45fbe2f7e0e8feee30105d42d66ed63fb6177ebe","name":null,"tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/hashgraph-guardian-unsandboxed-javascript-execution-rce","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.919Z
---END_METADATA---

Description Summary:
Hashgraph Guardian versions 3.5.1 and earlier contain a vulnerability allowing authenticated users to execute arbitrary code via unsandboxed JavaScript expressions in the Custom Logic policy block.

Executive Summary:
Hashgraph Guardian contains a critical remote code execution vulnerability that allows authenticated users to compromise sensitive credentials and forge administrative tokens.

Vulnerability Details

CVE-ID: CVE-2026-39911

Affected Software: Hashgraph Guardian

Affected Versions: 0 through 3.5.1

Vulnerability: The software fails to isolate user-supplied JavaScript expressions passed to the Node.js Function constructor within the Custom Logic policy block. This allows an authenticated Standard Registry user to escape the intended execution environment to access native Node.js modules and sensitive filesystem resources.

Business Impact

The ability to execute arbitrary code with the privileges of the application process poses a severe risk to the entire Hashgraph Guardian deployment. An attacker can exfiltrate sensitive environment variables, including RSA private keys and JWT signing keys, enabling the forgery of administrative authentication tokens. Given the CVSS score of 8.8, this vulnerability represents a high risk of total system compromise and unauthorized data access.

Remediation Plan

Immediate Action: Update Hashgraph Guardian to a version containing the fix implemented in commit 45fbe2f7e0e8feee30105d42d66ed63fb6177ebe.

Proactive Monitoring: Review application logs for suspicious activity within the Custom Logic policy block and monitor for unauthorized access to sensitive environment variables or unusual process behavior.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact if a container is compromised, and ensure that the application process runs with the least privileges necessary.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the direct use of unsafe JavaScript constructors, which bypasses intended logical boundaries.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the Hashgraph Guardian platform. Security teams must prioritize updating the software to the patched version immediately to prevent unauthorized code execution and potential administrative account takeovers. If an immediate update is not feasible, restrict access to the Custom Logic policy block to only the most trusted users until the patch can be applied.

---METADATA---
VENDOR: STACKIT
PRODUCT: IaaS API
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A missing authorization check in the STACKIT IaaS API allows low-privileged users to escalate privileges to full organization compromise.

Executive Summary:
A critical authorization bypass in the STACKIT IaaS API allows low-privileged attackers to escalate privileges and gain full control over the organization’s cloud environment.

Vulnerability Details

CVE-ID: CVE-2026-39910

Affected Software: STACKIT IaaS API

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves a missing authorization check on the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach high-privileged service accounts to virtual machines and retrieve OAuth2 tokens from the metadata service.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an existential risk to the organization's cloud infrastructure. An attacker exploiting this can move laterally, access high-privilege credentials, and effectively gain full administrative control over the entire organization's cloud environment, leading to massive data theft and infrastructure destruction.

Remediation Plan

Immediate Action: Update the STACKIT IaaS API to the latest version that enforces proper authorization checks on service account management.

Proactive Monitoring: Audit API logs for unauthorized modifications to virtual machine service accounts and suspicious metadata service queries.

Compensating Controls: Apply the principle of least privilege by restricting user ability to manage service accounts and monitoring for unusual OAuth2 token requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it enables complete cloud environment takeover. Immediate patching of the IaaS API is required, alongside an audit of current service account configurations to identify any prior unauthorized escalations.

---METADATA---
VENDOR: Symantec
PRODUCT: Data Loss Prevention Windows Endpoint
AFFECTED_VERSIONS: Prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15
CONFIDENCE: high
MISSING: none
CREDITS: Manuel Feifel (finder)
SOURCES_JSON: [{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37306","name":null,"tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.175Z
---END_METADATA---

Description Summary:
An elevation of privilege vulnerability in Symantec Data Loss Prevention Windows Endpoint allows local attackers to gain unauthorized access to protected system resources.

Executive Summary:
A local elevation of privilege vulnerability in Symantec Data Loss Prevention Windows Endpoint poses a significant risk of unauthorized resource access for affected systems.

Vulnerability Details

CVE-ID: CVE-2026-3991

Affected Software: Symantec Data Loss Prevention Windows Endpoint

Affected Versions: Prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15

Vulnerability: This vulnerability involves the inclusion of functionality from an untrusted control sphere (CWE-829), which can be exploited by an authenticated local user with low privileges to escalate their access level.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass standard security restrictions and gain elevated privileges on the host machine. Given the CVSS score of 7.8, this flaw represents a High severity risk, potentially facilitating full system compromise, unauthorized data access, or the deployment of additional malicious payloads within the enterprise environment.

Remediation Plan

Immediate Action: Update the Symantec Data Loss Prevention Windows Endpoint software to version 25.1.00100.60229, 16.1.00200.60431, 16.0.20009.60689, 16.0.10112.60928, or later, as specified in the Broadcom security advisory.

Proactive Monitoring: Review system access logs for anomalous behavior or unexpected process execution patterns originating from low-privileged user accounts.

Compensating Controls: Ensure robust endpoint security policies are in place to restrict local user execution permissions and employ principle of least privilege to minimize the potential impact of an escalation attempt.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which inherently limits the attack surface to users already present on the system.

Analyst Recommendation

Organizations utilizing Symantec Data Loss Prevention on Windows endpoints must treat this vulnerability with high priority. Administrators should plan for an immediate deployment of the provided vendor patches to prevent local privilege escalation and subsequent system compromise. Failure to update may allow malicious actors to exploit the software to gain unauthorized administrative-level control over protected endpoint resources.

---METADATA---
VENDOR: ggml-org
PRODUCT: llama.cpp
AFFECTED_VERSIONS: 0 up to (excluding) b8585
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the llama.cpp RPC graph recompute handler, which could lead to memory corruption or arbitrary code execution.

Executive Summary:
A use-after-free vulnerability in the llama.cpp RPC handler presents a critical risk of memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39909

Affected Software: ggml-org llama.cpp

Affected Versions: 0 up to (excluding) b8585

Vulnerability: The vulnerability is a use-after-free (CWE-416) condition within the RPC graph recompute handler. It is exploitable by an unauthenticated attacker over the network, though it requires specific conditions to trigger successfully.

Business Impact

The use-after-free flaw allows for memory corruption, which can be leveraged to crash the service or potentially execute arbitrary code. With a CVSS score of 8.1, this vulnerability poses a high risk to systems running llama.cpp in networked environments, potentially leading to total loss of system integrity.

Remediation Plan

Immediate Action: Update llama.cpp to build b8585 or later to resolve the memory management defect.

Proactive Monitoring: Monitor system logs for unexpected service crashes or segmentation faults, which may indicate attempted exploitation of memory management flaws.

Compensating Controls: Isolate llama.cpp instances within restricted network segments and employ memory protection features, such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), to mitigate the impact of memory corruption.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is technically complex and requires careful exploitation of the RPC handler, but it remains a significant concern for high availability systems.

Analyst Recommendation

Organizations utilizing llama.cpp must update to build b8585 immediately to address the use-after-free vulnerability. Due to the potential for remote code execution, this update should be treated as a high priority task to prevent unauthorized system access or service disruption.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in Cacti versions 1.2.30 and prior, where the rfilter parameter is unsafely concatenated into an RLIKE clause, reachable by unauthenticated users.

Executive Summary:
An unauthenticated SQL injection vulnerability in Cacti allows remote attackers to execute arbitrary database commands, posing a critical risk of complete database compromise.

Vulnerability Details

CVE-ID: CVE-2026-39893

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability occurs because the rfilter request variable is passed directly into a SQL RLIKE clause without proper sanitization. In environments where guest viewing is enabled, an unauthenticated attacker can manipulate database queries to extract or modify data.

Business Impact

The CVSS score of 9.8 reflects the high potential for total database compromise, including the theft of user credentials, system configuration, or monitoring data. This represents a significant risk to the confidentiality and integrity of the entire management framework.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to ensure all SQL inputs are properly sanitized and parameterized.

Proactive Monitoring: Review database query logs for unusual patterns or SQL syntax errors that may indicate automated injection attempts.

Compensating Controls: Disable guest access to the Cacti interface if it is not strictly required for business operations to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a critical vulnerability that must be addressed immediately to prevent data exfiltration. Organizations should apply the vendor-provided patch and audit database activity for any signs of post-compromise manipulation.