---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.13
---END_METADATA---

Description Summary:
OpenClaw contains a remote command injection vulnerability in the iMessage attachment staging flow. Unsanitized SCP paths allow attackers to execute commands on remote hosts.

Executive Summary:
Attackers can execute arbitrary commands on remote servers configured with OpenClaw by sending a malicious iMessage attachment, leading to full remote system compromise.

Vulnerability Details

CVE-ID: CVE-2026-32917

Affected Software: OpenClaw

Affected Versions: Before 2026.3.13

Vulnerability: A remote command injection vulnerability exists in the iMessage attachment staging flow. Unsanitized attachment paths containing shell metacharacters are passed directly to an SCP command. An unauthenticated attacker can craft a path that executes arbitrary commands on the remote host when attachment staging is enabled.

Business Impact

This vulnerability allows for the complete takeover of servers used for iMessage staging. Attackers can gain persistent access, exfiltrate private messages, and move laterally to other systems in the network. The CVSS score of 9.8 reflects the high severity of unauthenticated remote command execution on critical communication infrastructure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.13 or later immediately. If patching is not possible, disable the remote attachment staging feature.

Proactive Monitoring: Monitor remote hosts for suspicious scp or ssh processes and inspect system logs for unusual file paths containing shell characters like ;, &, or |.

Compensating Controls: Implement strict SSH key management and limit the commands that the OpenClaw user can execute on remote hosts using rssh or similar restricted shell environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. The vulnerability is highly critical because it can be triggered remotely through the standard iMessage flow.

Analyst Recommendation

Command injection via SCP operands is a well-understood but devastating flaw. Organizations relying on OpenClaw for message staging must prioritize the update to version 2026.3.13. Until the patch is applied, the remote staging feature should be considered unsafe and disabled.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.7 before 2026.3.11
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.3.11 contain an unauthenticated authorization bypass allowing remote attackers to execute privileged gateway actions via synthetic operator clients.

Executive Summary:
A critical authorization bypass in OpenClaw allows unauthenticated remote attackers to perform administrative actions, including session deletion and agent execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32916

Affected Software: OpenClaw

Affected Versions: 2026.3.7 before 2026.3.11

Vulnerability: This flaw involves an authorization bypass within plugin subagent routes that utilize a synthetic operator client with excessive administrative scopes. Remote unauthenticated attackers can target these routes to invoke runtime methods and perform privileged actions without valid credentials.

Business Impact

A successful exploit allows an external actor to gain administrative control over gateway functions, leading to unauthorized session termination or malicious agent execution. Given the CVSS score of 9.4, this vulnerability represents a critical threat that could result in total system compromise, data loss, and significant operational downtime. The ability for unauthenticated users to bypass security controls necessitates immediate remediation.

Remediation Plan

Immediate Action: Administrators must upgrade OpenClaw to version 2026.3.11 or later immediately to patch the vulnerable subagent routing logic.

Proactive Monitoring: Security teams should review gateway access logs for unusual requests to plugin-owned routes and monitor for unauthorized agent execution or unexpected session terminations.

Compensating Controls: Implementing strict IP whitelisting for gateway access and deploying a Web Application Firewall (WAF) to filter suspicious runtime method calls can provide temporary protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the unauthenticated access vector, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this authorization bypass cannot be overstated, as it grants administrative-level access to unauthenticated remote users. Organizations using affected versions of OpenClaw must prioritize the application of the official vendor patch immediately. Failure to update leaves the infrastructure vulnerable to complete takeover and persistent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.7
---END_METADATA---

Description Summary:
OpenClaw fails to properly validate headers during cross-origin redirects, leading to the leakage of sensitive authorization headers like API keys to untrusted destinations.

Executive Summary:
A critical header validation vulnerability in OpenClaw allows attackers to intercept sensitive API keys and authorization tokens by triggering cross-origin redirects.

Vulnerability Details

CVE-ID: CVE-2026-32913

Affected Software: OpenClaw

Affected Versions: Before 2026.3.7

Vulnerability: The fetchWithSsrFGuard function contains an improper header validation flaw. When a request is redirected to a different origin, the system fails to strip sensitive custom headers (e.g., X-Api-Key, Private-Token), forwarding them to the new, potentially malicious destination.

Business Impact

The leakage of administrative API keys and private tokens can lead to full account takeover and unauthorized access to the OpenClaw environment. Attackers can intercept these credentials by inducing a redirect to a server they control. With a CVSS score of 9.3, this vulnerability represents a critical risk to the confidentiality of system credentials and integrated third-party services.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.7 or later to ensure that sensitive headers are properly stripped during cross-origin redirects.

Proactive Monitoring: Review logs for unusual outbound requests or redirects to unknown domains, especially those initiated by automated processes or internal fetch functions.

Compensating Controls: Rotate all API keys and private tokens that may have been exposed through cross-origin requests prior to the patch application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. This type of vulnerability is often exploited in complex attack chains involving user-generated content or open redirects.

Analyst Recommendation

The exposure of authentication secrets is a critical security failure. It is imperative to update OpenClaw to the patched version immediately. Furthermore, security teams should treat any existing API keys as potentially compromised and perform a full credential rotation after the update is complete.

---METADATA---
VENDOR: Chamilo
PRODUCT: Chamilo LMS
AFFECTED_VERSIONS: Prior to 1.11.38 and 2.0.0-RC.3
---END_METADATA---

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in its file move function, allowing authenticated users to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code with web server privileges, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32892

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is an OS Command Injection vulnerability within the move() function in fileManage.lib.php. The application fails to properly sanitize user-supplied input before passing it to shell commands, enabling any authenticated user with teacher-level access to achieve remote code execution.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands as the www-data user, leading to potential full system compromise, data exfiltration, and unauthorized modification of learning materials. With a CVSS score of 9.1, this vulnerability represents a critical threat to the confidentiality and availability of the LMS platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later to incorporate the necessary input sanitization.

Proactive Monitoring: Review web server access logs for anomalous mv or shell-related command patterns and monitor for unexpected process creation by the www-data service account.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block requests containing shell metacharacters in file path parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which allows direct OS command execution—the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their Chamilo LMS instances and restrict course creation permissions to trusted users until the update is applied to mitigate the risk of unauthorized system-level access.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector, allowing for full administrative session takeover and service-wide credential theft.

Executive Summary:
A critical stored XSS vulnerability in Anchorr’s Jellyseerr integration allows attackers to forge administrative session tokens and gain full control over the bot and all linked media services.

Vulnerability Details

CVE-ID: CVE-2026-32891

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: Malicious JavaScript can be injected via the Jellyseerr user selector. When an administrator views the dashboard, the script executes, calls the authenticated /api/config endpoint, and exfiltrates session tokens and API keys. This allows an attacker with a Jellyseerr account to escalate to full administrator status.

Business Impact

This vulnerability results in a total compromise of the Anchorr ecosystem. By hijacking an admin session, attackers gain access to the dashboard and all integrated services, including Jellyfin, Jellyseerr, and Discord. The exposure of API keys allows for simultaneous account takeovers across multiple platforms, leading to extensive data exposure and unauthorized infrastructure control. The CVSS score of 9.0 underscores the high severity.

Remediation Plan

Immediate Action: Update Anchorr to version 1.4.2 immediately to remediate the XSS flaw and secure the administrative configuration data.

Proactive Monitoring: Audit Jellyseerr user accounts for suspicious names or profiles and monitor Anchorr admin logs for session activity originating from unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block XSS payloads and restrict access to the Anchorr dashboard to a management VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the potential for chained attacks leading to a full service-wide takeover makes this a high-risk vulnerability.

Analyst Recommendation

Applying the 1.4.2 update is the only effective way to mitigate this risk. Given that this vulnerability allows for administrative session forgery, administrators should also invalidate all current sessions and rotate all API keys for integrated services (Discord, Jellyfin, Jellyseerr) immediately after patching.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below suffer from a stored XSS vulnerability in the User Mapping dropdown, enabling unauthenticated attackers to exfiltrate critical secrets and API keys.

Executive Summary:
A critical stored Cross-Site Scripting (XSS) vulnerability in Anchorr allows attackers to exfiltrate sensitive credentials, including Discord tokens and API keys, by targeting an administrator's browser.

Vulnerability Details

CVE-ID: CVE-2026-32890

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: The web dashboard's User Mapping dropdown fails to sanitize input, allowing any Discord user in a configured guild to inject malicious JavaScript. This script executes in the admin's session to exfiltrate plaintext secrets from the /api/config endpoint without requiring direct authentication to the bot.

Business Impact

The impact is severe, as the vulnerability facilitates the theft of critical secrets like DISCORD_TOKEN, JELLYFIN_API_KEY, and JWT_SECRET. This leads to a total compromise of the bot and all integrated media services, potentially exposing user data and allowing unauthorized access to the underlying media server infrastructure. The CVSS score of 9.6 highlights the extreme risk of credential exfiltration.

Remediation Plan

Immediate Action: Update the Anchorr bot to version 1.4.2 immediately to patch the XSS vulnerability and secure the configuration endpoint.

Proactive Monitoring: Monitor Discord guild activity for suspicious user mapping requests and review web server logs for unauthorized access to the /api/config endpoint.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict where scripts can be executed and where data can be exfiltrated, reducing the effectiveness of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit can be triggered by any member of a Discord guild and results in full credential theft, it is a high-priority target for attackers.

Analyst Recommendation

Organizations utilizing Anchorr must treat this as a critical priority due to the plaintext exposure of API keys and tokens. Immediate application of version 1.4.2 is required. Following the update, it is strongly recommended to rotate all potentially exposed secrets, including Discord tokens and media server API keys.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the libheif decoder allows for an out-of-bounds read when processing malformed HEIF or AVIF files.

Executive Summary:
An out-of-bounds read vulnerability in libheif could allow an attacker to cause a denial-of-service or potentially leak sensitive memory content.

Vulnerability Details

CVE-ID: CVE-2026-32882

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This is an Out-of-bounds Read (CWE-125) vulnerability. The flaw occurs during the parsing of HEIF/AVIF image formats, where the decoder fails to properly validate input length, leading to memory access outside of intended bounds.

Business Impact

With a CVSS score of 7.1, this vulnerability poses a significant risk to applications that process image uploads from untrusted users. Exploitation could result in application crashes (Denial of Service) or the exposure of sensitive memory contents, which may be leveraged as part of a larger exploit chain.

Remediation Plan

Immediate Action: Update the libheif library to version 1.22.0 or later across all dependent systems.

Proactive Monitoring: Check application logs for frequent crashes or errors occurring during image processing tasks.

Compensating Controls: Implement strict input validation or sandboxing for any services that process user-uploaded HEIF/AVIF images to prevent malicious files from reaching the decoder.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Out-of-bounds read vulnerabilities are common vectors in image processing libraries and are frequently used to gain information about system memory layout.

Analyst Recommendation

Organizations using libraries that rely on libheif for image processing must prioritize updating to version 1.22.0. Given the ubiquity of image processing in modern web applications, ensuring the latest security patches are applied is essential to maintaining system stability and data integrity.

---METADATA---
VENDOR: OPEXUS
PRODUCT: eComplaint and eCASE
AFFECTED_VERSIONS: Versions before 10.1.0.0
---END_METADATA---

Description Summary:
OPEXUS eComplaint and eCASE expose secret verification codes in HTTP responses during password resets. Attackers can use this to hijack accounts and reset security questions without authorization.

Executive Summary:
A critical information disclosure vulnerability in OPEXUS eComplaint and eCASE allows unauthenticated attackers to hijack user accounts by intercepting password reset verification codes.

Vulnerability Details

CVE-ID: CVE-2026-32865

Affected Software: OPEXUS eComplaint and eCASE

Affected Versions: Versions before 10.1.0.0

Vulnerability: The application incorrectly includes the secret password reset verification code within the HTTP response when the ForcePasswordReset.aspx page is requested. An unauthenticated attacker who knows a target's email address can trigger a reset and retrieve the code from the response to gain full account access.

Business Impact

The CVSS score of 9.8 indicates a critical risk to organizational data and user privacy. Successful exploitation allows for complete account takeover, enabling attackers to access sensitive complaint data or case files. Furthermore, because the attacker can reset security questions, the original user may be permanently locked out of their account, leading to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Upgrade OPEXUS eComplaint and eCASE to version 10.1.0.0 or later to ensure verification codes are no longer exposed in responses.

Proactive Monitoring: Audit application logs for an unusual volume of password reset requests originating from a single IP address or targeting multiple users.

Compensating Controls: Implement rate limiting on the password reset endpoint and ensure that all web traffic is inspected for sensitive tokens being leaked in outbound HTTP bodies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. The logic flaw is straightforward to exploit, making it a highly attractive target for malicious actors once the vulnerability details are known.

Analyst Recommendation

Organizations using OPEXUS eComplaint or eCASE must apply the version 10.1.0.0 update immediately. Because this flaw allows for unauthenticated account takeover, it poses a direct threat to the confidentiality of sensitive case management data.

---METADATA---
VENDOR: Cudy
PRODUCT: LT300
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the Cudy LT300 router, potentially allowing unauthorized system access.

Executive Summary:
The Cudy LT300 router contains a high-severity security flaw that poses a significant risk of unauthorized system compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-32833

Affected Software: Cudy LT300

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Cudy LT300 router, potentially allowing an attacker to bypass security controls. Given the nature of router-based flaws, this typically impacts the device's management interface, likely requiring network-level access to exploit.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the network gateway, enabling attackers to intercept traffic, modify network configurations, or pivot into internal segments. With a CVSS score of 8.8, this represents a high risk to organizational data integrity and network confidentiality.

Remediation Plan

Immediate Action: Check the official Cudy support portal immediately for firmware updates and apply the latest security patches to all deployed units.

Proactive Monitoring: Monitor network traffic for unusual administrative login attempts or unauthorized modifications to router configuration settings.

Compensating Controls: Restrict access to the router’s administrative management interface to trusted internal IP addresses or a dedicated management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the LT300 as a network gateway, immediate remediation is required. Administrators should verify the current firmware version against the vendor's security advisory and prioritize patching to prevent unauthorized access to the network infrastructure.

---METADATA---
VENDOR: datacycle-engine
PRODUCT: dataCycle-CORE
AFFECTED_VERSIONS: <= 25.07.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The dataCycle-CORE management system contains an improper authorization vulnerability that allows authenticated users to perform unauthorized data management operations.

Executive Summary:
An improper authorization vulnerability in dataCycle-CORE allows authenticated users to access or manipulate data they are not authorized to interact with.

Vulnerability Details

CVE-ID: CVE-2026-32821

Affected Software: dataCycle-CORE

Affected Versions: <= 25.07.3

Vulnerability: This is an improper authorization vulnerability (CWE-285). While the attacker must be authenticated, the system fails to verify if the user possesses the necessary permissions to execute specific data management tasks.

Business Impact

The CVSS score of 8.1 indicates a high risk to data confidentiality and integrity. An attacker with standard user access could escalate their impact by accessing or modifying sensitive data managed by the system, leading to potential data breaches and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Update dataCycle-CORE to the latest version provided by the vendor to ensure proper authorization checks are enforced.

Proactive Monitoring: Audit user access logs to identify suspicious patterns of data modification or unauthorized attempts to access restricted project folders.

Compensating Controls: Apply the principle of least privilege by restricting user access to only the specific data stores required for their role until the patch is implemented.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed exploitation in the wild.

Analyst Recommendation

Because this vulnerability allows authenticated users to bypass authorization controls, it should be treated with urgency. Administrators must update the application immediately to ensure that data access policies are correctly enforced across all user levels.

---METADATA---
VENDOR: Admidio
PRODUCT: Admidio User Management
AFFECTED_VERSIONS: 5.0.0 through 5.0.6
---END_METADATA---

Description Summary:
Admidio versions 5.0.0 through 5.0.6 fail to validate delete permissions and CSRF tokens in the documents module, allowing unauthenticated or low-privileged users to delete files.

Executive Summary:
A critical vulnerability in Admidio's document management module allows unauthenticated or unauthorized users to permanently delete the entire document library through manipulated HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-32817

Affected Software: Admidio User Management

Affected Versions: 5.0.0 through 5.0.6

Vulnerability: The application fails to perform proper authorization checks for file and folder deletion, only verifying view-level access. Furthermore, the lack of CSRF protection allows an unauthenticated attacker to trigger deletions via simple GET requests if the module is in public mode.

Business Impact

This vulnerability poses a significant risk to data availability and business continuity. An attacker can achieve a total denial of service for the document library by wiping all files. For organizations relying on Admidio for user management and document storage, this could lead to the permanent loss of sensitive records and significant reputational damage. The CVSS score of 9.1 reflects this high impact on availability.

Remediation Plan

Immediate Action: Upgrade Admidio to version 5.0.7 immediately to introduce proper permission validation and CSRF protection for the documents module.

Proactive Monitoring: Review web server logs for suspicious GET requests targeting modules/documents-files.php with folder_delete or file_delete actions.

Compensating Controls: If immediate updates are not possible, disable the "Documents and Files" module or set documents_files_module_enabled to 0 in the application configuration.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the exploit—requiring only a basic HTTP GET request—makes it highly likely to be targeted.

Analyst Recommendation

The ability for unauthenticated users to destroy a document library is a critical security failure. Administrators must apply the version 5.0.7 patch immediately. Ensure that backups of the document library are verified and stored securely to mitigate the impact of potential data loss incidents.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.

Executive Summary:
A critical authorization bypass vulnerability in SiYuan allows any authenticated user, including those with restricted permissions, to execute arbitrary SQL commands and potentially compromise the entire application database.

Vulnerability Details

CVE-ID: CVE-2026-32767

Affected Software: SiYuan Knowledge Management System

Affected Versions: 3.6.0 and below

Vulnerability: This flaw exists in the /api/search/fullTextSearchBlock endpoint when the method parameter is set to 2. An authenticated attacker with "Reader" role privileges can bypass security middleware to inject raw SQL statements directly into the SQLite database.

Business Impact

A successful exploit grants an attacker full control over the application's data layer. This results in total loss of data confidentiality, integrity, and availability, as an attacker can exfiltrate, modify, or delete all stored knowledge and system tables. The CVSS score of 9.8 reflects the critical nature of this flaw, where a low-privileged user can cause catastrophic system-wide impact.

Remediation Plan

Immediate Action: Administrators must upgrade SiYuan to version 3.6.1 or later immediately to apply the necessary authorization and read-only checks to the affected endpoint.

Proactive Monitoring: Review application logs for unusual activity involving the /api/search/fullTextSearchBlock endpoint, specifically looking for SQL syntax or the use of method=2 by non-admin users.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses and consider implementing a Web Application Firewall (WAF) to filter for common SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation by any authenticated user and the critical impact on data integrity, the potential for internal or external exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it completely bypasses the application's security model. Organizations using SiYuan should prioritize the update to version 3.6.1. Failure to remediate this flaw leaves the entire knowledge base vulnerable to unauthorized manipulation or permanent deletion by any user with basic access.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: 1.8.208 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeScout versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) via unsanitized email notification templates, allowing unauthenticated attackers to execute arbitrary scripts.

Executive Summary:
A critical Stored XSS vulnerability in FreeScout allows unauthenticated attackers to conduct session hijacking and account takeover by injecting malicious payloads into email notifications.

Vulnerability Details

CVE-ID: CVE-2026-32754

Affected Software: FreeScout

Affected Versions: 1.8.208 and below

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability originating from the improper sanitization of incoming email bodies within the Laravel framework. An unauthenticated attacker can inject malicious HTML or JavaScript that executes when viewed by an agent or administrator, leading to credential theft or account takeover.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows attackers to compromise administrative accounts and gain unauthorized access to sensitive help desk communications. Given the CVSS score of 9.3, this flaw represents a critical threat to data confidentiality and integrity, potentially leading to widespread account compromise and reputational damage.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.209 or later immediately to apply the necessary output sanitization.

Proactive Monitoring: Monitor help desk email traffic for unusual patterns and review system logs for suspicious activity originating from external email addresses.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a WAF to filter common XSS payloads in incoming emails.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of exploitation, the potential for malicious activity is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the FreeScout application to version 1.8.209 to mitigate the risk of remote code execution and unauthorized account access.

---METADATA---
VENDOR: GNU
PRODUCT: inetutils (telnetd)
AFFECTED_VERSIONS: Through 2.7
---END_METADATA---

Description Summary:
GNU inetutils telnetd through version 2.7 contains an out-of-bounds write vulnerability in the LINEMODE SLC suboption handler due to missing buffer checks.

Executive Summary:
A critical out-of-bounds write in the GNU telnet daemon allows remote attackers to potentially execute arbitrary code or cause a denial of service on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-32746

Affected Software: GNU inetutils (telnetd)

Affected Versions: Through 2.7

Vulnerability: The add_slc function in the telnet daemon does not verify if the internal buffer is full before writing data during the Set Local Characters (SLC) negotiation. This allows a remote, unauthenticated attacker to overflow the buffer and overwrite adjacent memory locations.

Business Impact

Because telnetd often runs with elevated privileges, an out-of-bounds write can lead to full system compromise. The CVSS score of 9.8 indicates a high degree of exploitability and impact. Successful exploitation could result in unauthorized access to legacy systems, data theft, or persistent presence within the network environment.

Remediation Plan

Immediate Action: Disable the telnet service immediately and migrate to secure alternatives like SSH. If telnet must be used, apply the latest security patches from the GNU project.

Proactive Monitoring: Audit system logs for crashes in the telnetd process and monitor network traffic for unusual telnet negotiation sequences.

Compensating Controls: Use network isolation or VPNs to restrict telnet access to trusted administrative hosts only, and employ an Intrusion Detection System (IDS) to flag malformed telnet packets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in core networking utilities like inetutils are frequently targeted once disclosed.

Analyst Recommendation

The use of telnet is generally discouraged due to its lack of encryption. This vulnerability provides a critical reason to finally decommission any remaining telnet infrastructure. If decommissioning is not possible, the GNU inetutils package must be updated to a patched version immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in libheif due to improper memory handling, potentially allowing arbitrary code execution via a specially crafted HEIF or AVIF file.

Executive Summary:
A heap-based buffer overflow in the libheif library exposes systems to potential remote code execution through malicious image file processing.

Vulnerability Details

CVE-ID: CVE-2026-32741

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the decoding of HEIF/AVIF image formats. The flaw can be triggered by an unauthenticated user providing a maliciously crafted image file to an application utilizing the affected library.

Business Impact

The exploitation of this vulnerability could lead to arbitrary code execution, resulting in full system compromise, loss of data confidentiality, and potential service disruption. With a CVSS score of 7.1, this represents a significant risk to any environment that relies on libheif for image processing, as attackers may leverage this to gain unauthorized access to underlying host systems.

Remediation Plan

Immediate Action: Update the libheif library to version 1.22.0 or later immediately to incorporate the necessary memory safety patches.

Proactive Monitoring: Monitor system logs for unexpected crashes or errors in applications that handle HEIF or AVIF image files, which may indicate exploitation attempts.

Compensating Controls: Implement file-type validation and sandboxing for image processing services to isolate potential memory corruption events from the broader system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability in the wild. However, given the nature of memory corruption flaws, the potential for exploitation is high, and immediate patching is strongly recommended.

Analyst Recommendation

Given the severity of heap-based buffer overflows, organizations should prioritize updating all instances of libheif. Failure to patch allows a vector for remote code execution, which could be catastrophic if the library is integrated into public-facing web services or media processing pipelines.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in libheif allows attackers to perform memory corruption, potentially leading to system instability or arbitrary code execution via malicious image files.

Executive Summary:
An out-of-bounds write vulnerability in libheif poses a severe risk of memory corruption and potential system compromise when processing malformed HEIF/AVIF files.

Vulnerability Details

CVE-ID: CVE-2026-32740

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability involves an out-of-bounds write (CWE-787) within the libheif decoder. An unauthenticated attacker can exploit this by submitting a specially crafted image file, causing the application to write data outside of intended memory boundaries.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of total system impact. Successful exploitation could allow an attacker to overwrite critical memory, leading to privilege escalation or unauthorized code execution, which may result in severe operational downtime and data breaches.

Remediation Plan

Immediate Action: Upgrade to libheif version 1.22.0 or later to remediate the out-of-bounds write defect.

Proactive Monitoring: Review application performance metrics and error logs for signs of memory exhaustion or segmentation faults that could indicate an attempt to trigger this write-related flaw.

Compensating Controls: Utilize memory-safe execution environments or restrict file processing to low-privilege service accounts to limit the blast radius of a potential exploitation event.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical impact is rated as total, necessitating urgent attention from security teams.

Analyst Recommendation

The high CVSS score reflects the dangerous nature of out-of-bounds write vulnerabilities. Security teams must ensure all software dependencies using libheif are identified and patched to version 1.22.0 immediately to prevent unauthorized memory manipulation and potential system takeover.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: @apostrophecms/import-export
AFFECTED_VERSIONS: Prior to version 3.5.3
---END_METADATA---

Description Summary:
A "Zip Slip" path traversal vulnerability in the ApostropheCMS import-export module allows authenticated users with content modification permissions to write arbitrary files to the host filesystem.

Executive Summary:
A critical Zip Slip vulnerability in ApostropheCMS allows authenticated editors to overwrite system files and achieve remote code execution by uploading malicious archives.

Vulnerability Details

CVE-ID: CVE-2026-32731

Affected Software: ApostropheCMS @apostrophecms/import-export

Affected Versions: Prior to version 3.5.3

Vulnerability: The extract() function in gzip.js uses path.join() without sanitizing ../ segments in tar entry names. This allows an authenticated user with "Global Content Modify" permissions to upload a .tar.gz file that writes content to any path accessible by the Node.js process.

Business Impact

This vulnerability is assigned a CVSS score of 9.9. While it requires authentication, the "Global Content Modify" role is commonly held by many staff members. A successful exploit allows for host-level code execution, permanent data loss via file overwriting, and full server compromise, leading to total operational disruption.

Remediation Plan

Immediate Action: Update the @apostrophecms/import-export package to version 3.5.3 or higher immediately.

Proactive Monitoring: Review CMS upload logs for .tar.gz files and audit the filesystem for any unexpected files created in system directories or application source folders.

Compensating Controls: Ensure the Node.js process runs with the least possible filesystem privileges and implement a WAF to inspect archive contents if possible, though patching is the only reliable fix.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. Zip Slip is a well-documented vulnerability class, making this an easy target for malicious insiders or compromised editor accounts.

Analyst Recommendation

Given the CVSS score of 9.9, this is the most critical vulnerability in this batch. Organizations must update their ApostropheCMS dependencies immediately to prevent a catastrophic compromise of the host environment.