---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 0 up to (excluding) 12.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Esri Portal for ArcGIS versions 12.1 and earlier contain a missing authentication vulnerability allowing remote, unauthenticated attackers to access an unprotected API.

Executive Summary:
A critical authentication bypass vulnerability in Esri Portal for ArcGIS allows remote, unauthenticated attackers to gain unauthorized access to sensitive system APIs.

Vulnerability Details

CVE-ID: CVE-2026-13019

Affected Software: Esri Portal for ArcGIS

Affected Versions: 0 up to (excluding) 12.1

Vulnerability: This is a missing authentication for critical function vulnerability. It allows a remote, unauthenticated attacker to interact with an unprotected API, potentially leading to full system compromise.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of exploitation. Successful exploitation could lead to unauthorized access to sensitive geographic data, system configuration changes, and potential full administrative control over the ArcGIS environment, resulting in significant data breaches and operational disruption.

Remediation Plan

Immediate Action: Upgrade all instances of Esri Portal for ArcGIS to version 12.1 or the latest available patched release provided by the vendor.

Proactive Monitoring: Review system and API access logs for anomalous requests or unauthorized attempts to access internal API endpoints.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the Portal for ArcGIS management interfaces to known, trusted management subnets.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the lack of authentication required for exploitation, this vulnerability poses an immediate risk to infrastructure security. Organizations should prioritize patching their ArcGIS environments immediately to eliminate the risk of unauthorized API access and potential system takeover.

---METADATA---
VENDOR: Red Hat
PRODUCT: Apicurio Registry
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists within the Red Hat build of Apicurio Registry 3 that may lead to unauthorized system impacts.

Executive Summary:
A high-severity security vulnerability in the Red Hat build of Apicurio Registry 3 poses a significant risk of unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12975

Affected Software: Red Hat Apicurio Registry

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified flaw within the Apicurio Registry component. While specific authentication requirements are not detailed, flaws of this nature typically allow for potential unauthorized access or service disruption if left unmitigated.

Business Impact

The identified vulnerability carries a CVSS score of 8.5, indicating a high risk of operational disruption or unauthorized data access. Successful exploitation could lead to a compromise of registry integrity, potentially impacting the development lifecycle or production services that rely on the registry for configuration management.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory and apply the necessary patches or security updates as soon as they become available.

Proactive Monitoring: Monitor system and application logs for unusual access patterns or unauthorized attempts to interact with the registry API.

Compensating Controls: Implement strict network segmentation and ensure the registry is not exposed to untrusted networks to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize the evaluation of this vulnerability within their infrastructure. It is critical to monitor vendor release channels for updates and apply them immediately upon release to mitigate the risk of potential exploitation.

---METADATA---
VENDOR: AWS
PRODUCT: Language Servers for AWS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A missing symlink validation vulnerability in Language Servers for AWS allows for arbitrary file writes outside of the intended workspace trust boundary.

Executive Summary:
Language Servers for AWS are susceptible to an arbitrary file write vulnerability that could allow an attacker to escape the workspace boundary and modify system files.

Vulnerability Details

CVE-ID: CVE-2026-12958

Affected Software: AWS Language Servers for AWS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from a failure to properly validate symbolic links. An attacker could exploit this to perform arbitrary file writes outside the designated workspace, potentially leading to unauthorized code execution or system configuration changes.

Business Impact

This vulnerability poses a severe risk to development environments. With a CVSS score of 7.8, the ability to write files outside of a trust boundary can be leveraged to gain elevated privileges or inject malicious code into the development pipeline, potentially resulting in downstream supply chain compromise.

Remediation Plan

Immediate Action: Apply the vendor-provided patch immediately to address the symlink validation logic.

Proactive Monitoring: Monitor for unusual file system activity, specifically writes occurring in directories outside of the defined project workspace.

Compensating Controls: Run the development environment with the principle of least privilege, ensuring the process has minimal write access to the underlying host operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Arbitrary file write vulnerabilities in developer tooling are dangerous as they can lead to full system compromise of build servers. We strongly advise updating the affected AWS Language Servers immediately to mitigate the risk of unauthorized workspace escape and subsequent system manipulation.

---METADATA---
VENDOR: Amazon (AWS)
PRODUCT: Language Servers for AWS
AFFECTED_VERSIONS: Versions prior to 1
---END_METADATA---

Description Summary:
Language Servers for AWS contain a vulnerability related to improper trust boundary enforcement, potentially allowing unauthorized access.

Executive Summary:
Improper trust boundary enforcement in Language Servers for AWS presents a high-severity risk that could lead to unauthorized access or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-12957

Affected Software: Amazon Language Servers for AWS

Affected Versions: Versions prior to 1

Vulnerability: This vulnerability involves a failure to properly enforce trust boundaries, allowing potential attackers to interact with the language server in ways that exceed defined authorization levels. This type of flaw typically occurs when input validation or context isolation between the user and the server is insufficient.

Business Impact

The CVSS score of 7.8 indicates a high potential for impact, including unauthorized access to sensitive development environments or codebases managed by AWS services. Compromise of these servers could lead to the theft of intellectual property, unauthorized code execution, or the deployment of malicious configurations across the development lifecycle.

Remediation Plan

Immediate Action: Upgrade to version 1 or higher of the Language Servers for AWS immediately to resolve the trust boundary enforcement flaw.

Proactive Monitoring: Audit access logs for the affected language server instances to identify any unauthorized requests or unexpected configuration changes.

Compensating Controls: Ensure that language servers are isolated within protected network segments and that access is restricted to known, authorized developers only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by improper trust boundary enforcement is severe, particularly in cloud-native development environments. Organizations must prioritize upgrading to the latest version to secure their development pipelines and prevent unauthorized access to sensitive infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: Youtube Showcase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Youtube Showcase plugin for WordPress is vulnerable to an Arbitrary Function Call, allowing attackers to execute unintended code via the plugin's interface.

Executive Summary:
The Youtube Showcase plugin for WordPress contains an Arbitrary Function Call vulnerability that could allow an attacker to execute unauthorized code.

Vulnerability Details

CVE-ID: CVE-2026-12923

Affected Software: WordPress Youtube Showcase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly validate inputs, leading to an Arbitrary Function Call vulnerability. This flaw can be leveraged by an attacker to execute functions within the application context, potentially leading to full site compromise.

Business Impact

An Arbitrary Function Call is a severe security flaw that can lead to remote code execution, unauthorized site administration, or complete data exfiltration. The CVSS score of 7.5 highlights the high risk this vulnerability poses to the availability and security of the affected WordPress instance.

Remediation Plan

Immediate Action: Update the Youtube Showcase plugin to the latest version released by the developer.

Proactive Monitoring: Monitor server logs for unexpected function execution patterns or unusual administrative actions initiated through the plugin.

Compensating Controls: Disable the plugin entirely until a secure version is deployed if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Arbitrary function vulnerabilities are critical as they often serve as a gateway to complete system takeover. IT administrators must treat this update with high priority to prevent unauthorized code execution and maintain the security posture of their web infrastructure.

---METADATA---
VENDOR: AzeoTech
PRODUCT: DAQFactory
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
AzeoTech DAQFactory version 21 contains a security vulnerability that may allow for unauthorized access or system impact.

Executive Summary:
AzeoTech DAQFactory version 21 is vulnerable to a high-severity security flaw that could lead to unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12921

Affected Software: AzeoTech DAQFactory

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects DAQFactory version 21, posing a significant risk to data acquisition and control systems if exploited by an attacker.

Business Impact

With a CVSS score of 8.4, this vulnerability presents a serious threat to the integrity and availability of DAQFactory-managed systems. Successful exploitation could lead to unauthorized data exfiltration or the disruption of critical data acquisition processes, causing significant operational and financial impact.

Remediation Plan

Immediate Action: Apply the latest security updates provided by AzeoTech to remediate the vulnerability in DAQFactory.

Proactive Monitoring: Review system logs and audit trails for unauthorized authentication attempts or unexpected changes in configuration settings.

Compensating Controls: Utilize host-based intrusion detection systems and limit user privileges to the minimum required levels to minimize the potential impact of an exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this high-severity vulnerability with urgency. It is recommended to apply the vendor-provided patches immediately and perform a thorough security audit of the affected DAQFactory environment to ensure no unauthorized persistence has been established.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux 10
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the libtiff library used within Red Hat Enterprise Linux 10 may allow for memory corruption or arbitrary code execution.

Executive Summary:
A critical flaw in the libtiff library on Red Hat Enterprise Linux 10 could allow attackers to compromise system security through malformed image processing.

Vulnerability Details

CVE-ID: CVE-2026-12912

Affected Software: Red Hat Red Hat Enterprise Linux 10

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the libtiff library, specifically concerning how it handles image data. An attacker could potentially trigger this flaw by providing a specially crafted TIFF file, leading to memory corruption or arbitrary code execution.

Business Impact

Successful exploitation poses a significant threat to data integrity and system availability, particularly on servers that process user-uploaded images. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent system-level compromise.

Remediation Plan

Immediate Action: Apply the latest package updates for libtiff and related system libraries via the Red Hat package management system.

Proactive Monitoring: Review system logs for segmentation faults or unusual process crashes associated with image processing services.

Compensating Controls: Restrict image processing services to run in sandboxed or containerized environments with limited privileges to minimize the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators must prioritize the deployment of security updates for libtiff on all Red Hat Enterprise Linux 10 instances. Immediate patching is the most effective way to secure the environment against potential exploitation of this library-level vulnerability.

---METADATA---
VENDOR: Horner Automation
PRODUCT: Cscape
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Horner Automation Cscape versions prior to 10 are vulnerable to a high-severity security flaw potentially allowing unauthorized access.

Executive Summary:
Horner Automation Cscape versions prior to 10 are susceptible to a high-severity vulnerability that poses a risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-12897

Affected Software: Horner Automation Cscape

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Cscape versions prior to 10; administrators should assume a high risk of exploitation until official patches are applied and verified.

Business Impact

The CVSS score of 8.4 indicates a high level of risk, particularly for industrial control environments relying on Cscape. Compromise of this software could allow attackers to manipulate automation processes or gain unauthorized access to the underlying host, leading to operational downtime or critical safety risks.

Remediation Plan

Immediate Action: Update all Cscape installations to version 10 or the latest version recommended by Horner Automation.

Proactive Monitoring: Monitor industrial network traffic for unexpected communication or command execution attempts directed at the Cscape host.

Compensating Controls: Implement strict network segmentation to isolate Cscape workstations from untrusted networks, significantly reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical nature of automation software, this vulnerability must be addressed urgently. Organizations should coordinate with their ICS/OT security teams to apply the necessary updates during the next scheduled maintenance window to mitigate the risk of unauthorized system manipulation.

---METADATA---
VENDOR: expr-eval
PRODUCT: expr-eval
AFFECTED_VERSIONS: All versions
---END_METADATA---

Description Summary:
The expr-eval package is vulnerable to arbitrary code execution via the toJSFunction() API due to insufficient sandboxing of user-supplied expressions.

Executive Summary:
The expr-eval library contains a critical code execution vulnerability that allows attackers to escape the application sandbox and execute arbitrary JavaScript code.

Vulnerability Details

CVE-ID: CVE-2026-12866

Affected Software: expr-eval

Affected Versions: All versions

Vulnerability: The vulnerability exists in the toJSFunction() API, which compiles user-controlled expressions into native code using new Function(). This allows an attacker to bypass intended sandbox restrictions and execute arbitrary JavaScript within the application's context.

Business Impact

The CVSS score of 9.8 highlights the severity of this remote code execution flaw. If an application utilizes this library to process untrusted input, an attacker could gain full control over the application's runtime environment, leading to data theft, unauthorized service modifications, or further system exploitation.

Remediation Plan

Immediate Action: Update to the latest version of expr-eval if a patch is available, or refactor the application to avoid passing untrusted input to the toJSFunction() API.

Proactive Monitoring: Monitor application logs for unexpected system calls or anomalous JavaScript execution patterns that deviate from normal application behavior.

Compensating Controls: Implement input validation and sanitization layers to ensure that expressions passed to the library are strictly controlled and do not contain malicious payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability affects all versions of the library, it requires immediate attention. Organizations using expr-eval must audit their code for usage of the toJSFunction() API and implement the necessary updates or architectural changes to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift Dev Spaces
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists in the vscode-java extension used within Red Hat OpenShift Dev Spaces, potentially impacting Java language support environments.

Executive Summary:
A high-severity vulnerability in the Red Hat OpenShift Dev Spaces vscode-java extension poses a significant risk to development environments and underlying container security.

Vulnerability Details

CVE-ID: CVE-2026-12856

Affected Software: Red Hat OpenShift Dev Spaces

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw resides within the vscode-java extension, which provides Java language support. While specific authentication requirements are not detailed, such extensions often execute code within the context of the developer's workspace, necessitating careful access control.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized code execution within development containers, potentially allowing attackers to pivot into the broader OpenShift cluster. Given the CVSS score of 8.8, the risk of lateral movement and compromise of proprietary source code is substantial, justifying a high-priority remediation stance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Red Hat for OpenShift Dev Spaces immediately.

Proactive Monitoring: Review container logs for unauthorized process execution or anomalous network activity originating from developer workspaces.

Compensating Controls: Implement strict NetworkPolicies to isolate development namespaces and limit the impact of a potential container breakout.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity of the development pipeline. Organizations should prioritize updating the vscode-java extension and verifying the security posture of all affected OpenShift Dev Spaces instances to mitigate the threat of unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E allows unauthenticated attackers to execute arbitrary system commands via the DNS configuration interface.

Vulnerability Details

CVE-ID: CVE-2026-12851

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The CNetSetObj::m_F_n_Set_DNS_Addr function fails to sanitize user-supplied DNS addresses before executing them as shell commands. This allows an unauthenticated attacker to inject arbitrary commands through the DVRSearch service or Network.cgi.

Business Impact

The CVSS score of 9.1 reflects the high severity of this vulnerability. Successful exploitation permits an attacker to execute commands with the privileges of the application, which could lead to full system takeover and persistent unauthorized access to the environment.

Remediation Plan

Immediate Action: Update the GeoVision GV-I/O Box 4E to the latest firmware version released by the vendor.

Proactive Monitoring: Review system configuration logs and monitor for unexpected changes to /etc/resolv.conf or other system files.

Compensating Controls: Restrict network access to the device so that only trusted management consoles can interact with the vulnerable network configuration endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for remote exploitation, immediate remediation is required. Security teams should ensure the latest firmware is deployed across all affected devices to prevent potential system compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E allows unauthenticated attackers to execute arbitrary system commands by manipulating gateway configuration parameters.

Vulnerability Details

CVE-ID: CVE-2026-12850

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The CNetSetObj::m_F_n_Set_Gate_way function contains a command injection flaw due to insufficient input validation. An unauthenticated attacker can exploit this by sending a crafted request to the DVRSearch service or Network.cgi to execute arbitrary commands.

Business Impact

With a CVSS score of 9.1, this vulnerability is classified as critical. Exploitation could result in a complete loss of confidentiality, integrity, and availability of the affected device, potentially facilitating further attacks on the internal network infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware update for the GeoVision GV-I/O Box 4E as specified by the vendor.

Proactive Monitoring: Monitor system logs for unusual execution patterns or unauthorized modification of network routing configurations.

Compensating Controls: Utilize a Web Application Firewall (WAF) or network ACLs to block unauthorized access to the device's management endpoints until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of triggering this command injection makes it an attractive target for attackers. It is imperative that security teams verify their firmware versions and deploy the necessary updates to secure the device against unauthorized remote command execution.

---METADATA---
VENDOR: Unknown
PRODUCT: Unknown (Version 6)
AFFECTED_VERSIONS: Version 6
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in a software product versioned "6". Specific technical details regarding the vulnerability type and vendor remain undisclosed in the primary summary.

Executive Summary:
A significant security flaw exists in a version 6 software product, which could lead to unauthorized system access and requires immediate investigation by IT security teams.

Vulnerability Details

CVE-ID: CVE-2026-1285

Affected Software: Unknown (Version 6)

Affected Versions: Version 6

Vulnerability: The vulnerability is described generically as an issue discovered in version 6 of the software. Based on the High CVSS score, the flaw likely permits significant unauthorized actions, possibly including remote code execution or privilege escalation by an unauthenticated or low-privileged attacker.

Business Impact

With a CVSS score of 7.5, the business impact is categorized as High. Successful exploitation could result in the loss of data confidentiality and integrity. The lack of specific product information increases the risk of the vulnerability going unpatched in diverse enterprise environments, leading to potential long-term exposure.

Remediation Plan

Immediate Action: Security administrators must cross-reference their software inventory against this CVE ID to identify the specific vendor and apply the relevant security patches immediately.

Proactive Monitoring: Review system and application logs for any version 6 software for signs of exploitation, such as unexpected administrative logins or outbound connections to malicious IPs.

Compensating Controls: Apply strict firewall rules to limit the exposure of any version 6 software to the public internet until a definitive patch can be confirmed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This vulnerability's lack of clear documentation is a significant hurdle for remediation and highlights the importance of maintaining an up-to-date Software Bill of Materials (SBOM).

Analyst Recommendation

The severity of this issue (CVSS 7.5) warrants an urgent review of internal software assets. Organizations must prioritize identifying the affected software and applying vendor-supplied updates to mitigate the risk of exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in the libNetSetObj.so library of GeoVision GV-I/O Box 4E allows remote code execution via a crafted network packet.

Executive Summary:
A critical OS command injection vulnerability in the GeoVision GV-I/O Box 4E enables unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-12849

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The vulnerability exists within the CNetSetObj::m_F_n_Set_Net_Mask function, which fails to sanitize input before passing it to a system call. This flaw is remotely reachable by unauthenticated attackers via the DVRSearch service or Network.cgi endpoint.

Business Impact

A successful exploit allows full remote command execution with system-level privileges. Given the CVSS score of 9.1, this vulnerability presents a critical risk, potentially leading to total device compromise, unauthorized network access, and the potential for lateral movement within the production environment.

Remediation Plan

Immediate Action: Update the GeoVision GV-I/O Box 4E firmware to the latest available version provided by the vendor.

Proactive Monitoring: Inspect network traffic for anomalous requests directed at the DVRSearch service or Network.cgi endpoint.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interfaces to authorized IP addresses only, reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security failure that could lead to complete device takeover. Administrators must prioritize applying the vendor-supplied security update immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The GeoVision GV-I/O Box 4E contains a stack-based buffer overflow vulnerability in the DVRSearch service, allowing remote code execution via crafted UDP packets.

Executive Summary:
A critical stack-based buffer overflow in the GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-12848

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the DVRSearch service, which listens on UDP port 10001. An unauthenticated attacker can trigger a stack overflow by sending a maliciously crafted UDP packet, leading to potential remote code execution.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation grants an attacker full control over the affected smart embedded device, enabling them to pivot into the internal network, disrupt physical security operations, or use the device as a persistent foothold for further malicious activity.

Remediation Plan

Immediate Action: Patch the device to the latest firmware version provided by GeoVision as soon as it becomes available.

Proactive Monitoring: Inspect network traffic directed to UDP port 10001 for anomalous packet sizes or malformed payloads.

Compensating Controls: Restrict network access to the GV-I/O Box 4E by placing it behind a firewall and allowing traffic only from trusted, authorized management IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this flaw and the potential for complete device compromise, immediate action is required. Organizations should isolate the affected hardware from public-facing networks and apply vendor-supplied updates immediately upon release to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the GeoVision GV-I/O Box 4E DVRSearch service allows unauthenticated remote attackers to execute arbitrary code via crafted UDP packets.

Executive Summary:
The GeoVision GV-I/O Box 4E is susceptible to a critical stack overflow vulnerability that allows unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12847

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a stack-based buffer overflow in the DVRSearch service, triggered when processing network configuration data. An unauthenticated attacker can send a malicious UDP packet to port 10001, causing memory corruption and potential code execution.

Business Impact

A successful exploit grants an attacker full control over the affected I/O device, which may be leveraged to manipulate physical relays or pivot into the internal network. Given the CVSS score of 10.0, this represents a maximum-severity risk that could lead to complete system compromise and severe operational disruption.

Remediation Plan

Immediate Action: Update the firmware of all affected GeoVision GV-I/O Box 4E units to the latest version provided by the vendor.

Proactive Monitoring: Inspect network traffic for anomalous UDP packets directed at port 10001 and monitor device logs for unexpected service restarts.

Compensating Controls: Restrict network access to the GV-I/O Box 4E using firewall rules, ensuring the device is not reachable from untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Organizations utilizing GeoVision GV-I/O Box 4E devices must prioritize firmware updates and network isolation to prevent unauthorized remote access and potential physical manipulation of connected systems.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the DVRSearch service allows unauthenticated remote attackers to execute arbitrary code via crafted UDP packets.

Executive Summary:
The GeoVision GV-I/O Box 4E is susceptible to a critical stack-based buffer overflow vulnerability that allows unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12846

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists within the DVRSearch service, which processes UDP messages on port 10001. An unauthenticated attacker can send a specially crafted packet that triggers a stack overflow via an insecure memcpy operation, leading to potential system compromise.

Business Impact

Given the CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation grants an attacker full control over the embedded device, potentially allowing them to pivot into the internal network, disrupt physical security controls connected to the I/O box, or facilitate further lateral movement.

Remediation Plan

Immediate Action: Update the firmware of the GeoVision GV-I/O Box 4E to the latest available version provided by the vendor.

Proactive Monitoring: Monitor network traffic for anomalous UDP activity directed at port 10001 and audit system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement strict network segmentation and utilize a firewall to restrict access to the device's management ports, ensuring only authorized management stations can communicate with the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of network access, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a critical threat to infrastructure integrity. Administrators must prioritize applying firmware patches immediately to eliminate the risk of remote exploitation. If patching is not immediately feasible, isolate the affected devices from external network exposure to prevent unauthorized access.

Executive Summary:
A high-severity vulnerability has been identified in SOLIDWORKS eDrawings, which could allow an attacker to take full control of a user's computer. This is achieved by tricking a user into opening a specially crafted design file (EPRT), which could lead to data theft, ransomware, or further attacks on the network. Immediate patching is required to mitigate this significant risk.

Vulnerability Details

CVE-ID: CVE-2026-1283

Affected Software: Release Multiple Products

Affected Versions: SOLIDWORKS eDrawings versions from Release SOLIDWORKS 2025 through Release SOLIDWORKS 2026

Vulnerability: This is a Heap-based Buffer Overflow vulnerability. It occurs within the software component responsible for parsing and reading EPRT files. An attacker can craft a malicious EPRT file with data that exceeds the allocated memory buffer. When a victim opens this file in a vulnerable version of SOLIDWORKS eDrawings, the excess data overwrites adjacent memory, which can be leveraged by the attacker to corrupt program execution flow and run arbitrary code on the victim's system with the same permissions as the logged-in user.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation could have a severe business impact, leading to a complete compromise of the affected user's workstation. Potential consequences include the theft of sensitive intellectual property such as proprietary design files, financial data, and personal information. Furthermore, a compromised system could be used as a foothold for an attacker to move laterally within the network, install ransomware, or deploy other malware, leading to significant operational disruption and financial loss.

Remediation Plan

Immediate Action:

• Identify all systems with the affected versions of SOLIDWORKS eDrawings installed.
• Apply the security updates provided by the vendor immediately to patch the vulnerability.
• Prioritize patching for systems used by engineers and designers who frequently handle files from external sources.

Proactive Monitoring:

• Monitor endpoint detection and response (EDR) logs for suspicious child processes spawning from the SOLIDWORKS eDrawings executable (e.g., eDrawings.exe launching powershell.exe, cmd.exe, or other unexpected processes).
• Review network logs for unusual outbound connections from workstations running the affected software, especially after a user opens an EPRT file.
• Analyze file access logs for patterns of unusual or repeated access to EPRT files that may indicate scanning or exploitation attempts.

Compensating Controls:

• If immediate patching is not feasible, implement strict email and web filtering rules to block or quarantine incoming EPRT files from untrusted or external sources.
• Conduct user awareness training to educate employees on the risks of opening attachments or files from unverified senders.
• Utilize application whitelisting to prevent unauthorized executables from running on workstations, which can limit the impact of a successful code execution exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 27, 2026, there is no known public proof-of-concept exploit code available, and no active exploitation has been observed in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, client-side vulnerabilities like this are often targeted in sophisticated phishing campaigns, and the status could change rapidly.

Analyst Recommendation

Given the high severity (CVSS 7.8) and the potential for arbitrary code execution, this vulnerability poses a significant risk to the organization, particularly concerning the protection of intellectual property. Although there is no current evidence of active exploitation, organizations must act proactively. We strongly recommend that the vendor-supplied security updates be applied to all affected systems as a matter of priority to prevent potential future exploitation.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DVP-12SE PLC
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Delta Electronics DVP-12SE Modbus TCP service lacks authentication, allowing unauthenticated attackers to interact with security-sensitive functions.

Executive Summary:
An unauthenticated access vulnerability in the Delta Electronics DVP-12SE PLC could allow unauthorized actors to manipulate critical industrial functions.

Vulnerability Details

CVE-ID: CVE-2026-12819

Affected Software: Delta Electronics DVP-12SE

Affected Versions: See vendor advisory

Vulnerability: The Modbus TCP service on the device operates without authentication or access control. This allows any unauthenticated entity with network access to the device to execute sensitive commands.

Business Impact

With a CVSS score of 9.3, this flaw represents a significant risk to the integrity and safety of industrial operations. Unauthorized access could allow an attacker to modify PLC logic or state, potentially resulting in physical damage to equipment or hazardous process conditions.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Delta Electronics to implement necessary authentication mechanisms.

Proactive Monitoring: Audit network traffic for unauthorized Modbus TCP connections and maintain rigorous logs of all interactions with the PLC.

Compensating Controls: Use a VPN or secure gateway to ensure that the PLC is not directly accessible over the public internet or untrusted segments of the internal network.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents an extreme risk due to the lack of access control on sensitive industrial equipment. It is imperative to restrict network access to the device immediately and apply vendor-supplied updates to enforce proper authentication.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DVP-12SE PLC
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A resource allocation vulnerability in the Delta Electronics DVP-12SE PLC Modbus TCP service allows for potential denial-of-service conditions.

Executive Summary:
The Delta Electronics DVP-12SE PLC contains a critical resource exhaustion flaw that could lead to complete device failure if exploited.

Vulnerability Details

CVE-ID: CVE-2026-12818

Affected Software: Delta Electronics DVP-12SE

Affected Versions: See vendor advisory

Vulnerability: This vulnerability (CWE-770) involves a lack of resource limits or throttling within the Modbus TCP service. An attacker can exploit this to exhaust system resources, leading to a crash or service unavailability.

Business Impact

The CVSS score of 9.3 highlights the high risk this vulnerability poses to industrial control environments. A successful exploit could cause unplanned production downtime, loss of control over industrial processes, and significant operational disruption.

Remediation Plan

Immediate Action: Update the DVP-12SE firmware to the latest version as specified in the official Delta Electronics security advisory.

Proactive Monitoring: Monitor Modbus TCP traffic for anomalous spikes in connection requests or unusual communication patterns directed at the PLC.

Compensating Controls: Isolate the PLC within a segmented network and use industrial firewalls to restrict access to the Modbus TCP service to authorized IP addresses only.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of PLC vulnerabilities, immediate patching is required. Network segmentation and strict access control should be implemented alongside firmware updates to minimize the attack surface of the affected device.

---METADATA---
VENDOR: Edimax
PRODUCT: BR-6478AC V2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the Edimax BR-6478AC V2 router, potentially allowing for unauthorized device control.

Executive Summary:
The Edimax BR-6478AC V2 router is impacted by a high-severity vulnerability that could allow attackers to gain unauthorized control over the network device.

Vulnerability Details

CVE-ID: CVE-2026-12806

Affected Software: Edimax BR-6478AC V2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the BR-6478AC V2 router model. Given the nature of network hardware, such flaws often involve authentication bypass or command injection, which can lead to complete device compromise.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to network perimeter security. Compromise of the router could allow an attacker to intercept traffic, redirect users, or gain a foothold within the internal network, leading to widespread data exposure.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by Edimax to address the vulnerability.

Proactive Monitoring: Monitor router management logs for unauthorized login attempts or configuration changes made outside of authorized maintenance windows.

Compensating Controls: Disable remote management interfaces on the router and ensure that administrative access is restricted to a dedicated, secure management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators must treat this router vulnerability with extreme urgency. Given that the device serves as a perimeter gateway, immediate firmware updates are required to prevent potential network-wide exploitation.

Executive Summary:
A high-severity vulnerability has been identified in the Frontend File Manager Plugin for WordPress, which could allow an unauthorized attacker to access and share sensitive files from the web server. Successful exploitation could lead to the exposure of confidential data, such as configuration files, user information, or proprietary business data. Organizations are urged to update the affected plugin immediately to prevent potential data breaches.

Vulnerability Details

CVE-ID: CVE-2026-1280

Affected Software: WordPress Frontend File Manager Plugin

Affected Versions: All versions up to, and including, 23

Vulnerability: The vulnerability exists due to a missing capability check on the wpfm_send_file_in_email AJAX function. This function is intended to allow authorized users to email files from the server. However, because the necessary security checks are absent, any unauthenticated user can craft a request to the server's AJAX endpoint, specify an arbitrary file path on the server, and provide an email address. The server will then execute this request and email the specified file to the attacker's chosen address, resulting in unauthorized information disclosure.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a significant negative impact on the business by enabling data exfiltration. An attacker could steal critical files such as wp-config.php (containing database credentials), customer data, intellectual property, or other sensitive documents stored on the web server. The consequences of such a data breach include reputational damage, financial loss, regulatory fines for non-compliance with data protection laws (e.g., GDPR, CCPA), and the potential for attackers to use leaked credentials to escalate their privileges and achieve further system compromise.

Remediation Plan

Immediate Action:

• Immediately update the Frontend File Manager Plugin to the latest version available (greater than version 23) where the vulnerability has been patched.
• If the plugin is not essential for business operations, consider deactivating and removing it entirely to eliminate the attack surface.
• Review WordPress security settings to ensure user roles and permissions are configured according to the principle of least privilege.

Proactive Monitoring:

• Monitor web server access logs for an unusual volume of POST requests to /wp-admin/admin-ajax.php with the parameter action=wpfm_send_file_in_email, especially from unauthenticated IP addresses.
• Review outbound mail server logs for unexpected emails originating from the web server, which could indicate that files are being exfiltrated.
• Utilize a Web Application Firewall (WAF) to detect and block malicious requests attempting to exploit this specific AJAX action.

Compensating Controls:

• If immediate patching is not feasible, implement a custom WAF rule to block any request containing the action=wpfm_send_file_in_email parameter.
• Temporarily disable the plugin until a patch can be applied.
• Enforce strict file system permissions to limit the web server user's read access to only necessary directories, reducing the scope of potential data exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 29, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the simplicity of exploiting missing capability checks in WordPress AJAX actions, it is highly probable that a functional proof-of-concept exploit will be developed and published in the near future.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the direct risk of sensitive data exfiltration, immediate action is strongly recommended. Organizations must prioritize updating the affected Frontend File Manager plugin to the latest patched version. Although this vulnerability is not currently listed on the CISA KEV list, its ease of exploitation makes it an attractive target for attackers. If patching cannot be performed immediately, compensating controls such as deploying a WAF rule or disabling the plugin should be implemented as a matter of urgency to mitigate the risk of a data breach.

---METADATA---
VENDOR: BerriAI
PRODUCT: litellm
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in BerriAI litellm that may expose the application to unauthorized actions or data access.

Executive Summary:
A critical security vulnerability in BerriAI litellm requires immediate attention to prevent potential unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12795

Affected Software: BerriAI litellm

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The exact nature of the vulnerability is currently underspecified; however, it is classified as a high-severity flaw within the litellm framework. The authentication requirements remain unconfirmed, necessitating a conservative security posture until the vendor provides granular technical details.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a significant risk to the integrity and availability of services relying on the litellm proxy. Exploitation could lead to unauthorized data access, service disruption, or the potential for downstream attacks against connected Large Language Model (LLM) backends.

Remediation Plan

Immediate Action: Review the official BerriAI security advisories and apply available patches or configuration changes immediately.

Proactive Monitoring: Audit application access logs for anomalous request patterns or unauthorized API calls directed toward the litellm instance.

Compensating Controls: Implement strict network ingress filtering and utilize a Web Application Firewall (WAF) to block suspicious traffic patterns commonly associated with application-level exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing BerriAI litellm should treat this vulnerability with high priority. Security teams must monitor vendor communication channels for patch releases and ensure that all instances are updated as soon as official guidance is published to minimize the window of exposure.

---METADATA---
VENDOR: Ezbsystems
PRODUCT: UltraISO Premium Edition
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability found in Ezbsystems UltraISO Premium Edition up to version 9 could allow for unauthorized system impact.

Executive Summary:
A high-severity vulnerability in Ezbsystems UltraISO Premium Edition poses a significant risk to system security and could lead to unauthorized exploitation.

Vulnerability Details

CVE-ID: CVE-2026-12786

Affected Software: Ezbsystems UltraISO Premium Edition

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in UltraISO Premium Edition that may allow an attacker to trigger unauthorized actions on the host system. The flaw likely impacts the software's ability to safely process data, potentially leading to security degradation.

Business Impact

With a CVSS score of 7.8, this vulnerability is classified as High severity. Exploitation could allow an attacker to bypass standard security restrictions, resulting in unauthorized access to sensitive disk image data or the host operating system, thereby impacting overall organizational security posture.

Remediation Plan

Immediate Action: Update all instances of UltraISO Premium Edition to the latest secure version provided by the vendor.

Proactive Monitoring: Review application logs for signs of suspicious file handling or unauthorized access attempts directed at disk image management tools.

Compensating Controls: Ensure the application is deployed within a hardened environment and utilize EDR solutions to detect and block malicious process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high-severity nature of this flaw, immediate action is required to secure affected systems. Organizations should audit their infrastructure for UltraISO installations and apply the necessary updates provided by Ezbsystems to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: IM-Magic
PRODUCT: Partition Resizer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in IM-Magic Partition Resizer up to version 7 that could facilitate unauthorized system impact.

Executive Summary:
A high-severity vulnerability in IM-Magic Partition Resizer could allow attackers to compromise system security and potentially gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-12784

Affected Software: IM-Magic Partition Resizer

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability represents a weakness in the IM-Magic Partition Resizer application, which could be leveraged to affect system stability or security. The exact nature of the flaw suggests potential for privilege escalation or unauthorized command execution depending on the attacker's level of access to the system.

Business Impact

The identified weakness carries a CVSS score of 7.8, categorizing it as a High-risk vulnerability. Successful exploitation could result in the compromise of partition-level data and unauthorized administrative control, leading to potential operational downtime and the loss of data confidentiality or integrity.

Remediation Plan

Immediate Action: Immediately apply the latest security patches or updates provided by IM-Magic to mitigate the identified vulnerability.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes or anomalous behavior within the partition management environment.

Compensating Controls: Implement strict access controls and ensure that the software is run with the principle of least privilege to limit potential blast radius.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should perform an immediate assessment of their environment to identify any installations of IM-Magic Partition Resizer. Given the high severity, ensure that all instances are updated to a secure version as soon as the vendor makes a patch available to prevent unauthorized system exploitation.

---METADATA---
VENDOR: EaseUS
PRODUCT: Partition Master
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists in EaseUS Partition Master up to version 14 that may expose the system to unauthorized access or exploitation.

Executive Summary:
A high-severity security vulnerability in EaseUS Partition Master poses a significant risk to system integrity and data security.

Vulnerability Details

CVE-ID: CVE-2026-12782

Affected Software: EaseUS Partition Master

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in EaseUS Partition Master that potentially allows an attacker to gain unauthorized control or escalate privileges on the host system. The specific authentication requirements for exploitation are currently unspecified, necessitating a cautious approach to system exposure.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized system access, potential data loss, or the compromise of sensitive partition configurations. With a CVSS score of 7.8, this flaw represents a High risk, as it may allow local or remote attackers to disrupt business-critical operations or gain persistent access to the underlying storage management environment.

Remediation Plan

Immediate Action: Identify and inventory all instances of EaseUS Partition Master and apply the latest security updates provided by the vendor.

Proactive Monitoring: Review system and application access logs for unusual administrative activity or unauthorized attempts to access partition management functions.

Compensating Controls: Restrict access to the software to authorized personnel only and ensure that the host system is protected by robust endpoint security solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High CVSS score, organizations should treat this vulnerability with urgency. Administrators must prioritize identifying vulnerable software versions and applying vendor patches to prevent potential system compromise. If patches are not immediately available, restrict usage of the software to isolated environments until remediation is confirmed.

---METADATA---
VENDOR: EaseUS
PRODUCT: Partition Master
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in EaseUS Partition Master up to version 14 that could allow for unauthorized system or disk manipulation.

Executive Summary:
A high-severity flaw in EaseUS Partition Master poses a significant threat to system stability and data security, necessitating immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-12781

Affected Software: EaseUS Partition Master

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability in EaseUS Partition Master potentially enables unauthorized interactions with disk partitions. Administrators should verify the vendor's documentation to identify the specific attack vector and determine if the exploit requires local or network-level access.

Business Impact

Unauthorized access to partition management tools allows an attacker to cause permanent data loss, disrupt system boot processes, or potentially escalate privileges on a compromised host. With a CVSS score of 7.8, the potential for operational disruption is significant, making it a priority for IT and security teams to address.

Remediation Plan

Immediate Action: Apply the latest security patches released by EaseUS to remediate the identified vulnerability.

Proactive Monitoring: Monitor system logs for unauthorized partition management commands or unexpected changes to disk configurations.

Compensating Controls: Limit access to the application to highly privileged users only and utilize host-based intrusion detection systems (HIDS) to alert on suspicious activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is imperative that all systems utilizing EaseUS Partition Master are audited and updated to the latest secure version. Given the high severity of this vulnerability, failure to patch could leave systems exposed to critical disk-level attacks that could result in total system failure or data loss.

---METADATA---
VENDOR: AOMEI
PRODUCT: Backupper
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been discovered in AOMEI Backupper up to version 8, which could potentially expose backup data or system configurations to unauthorized access.

Executive Summary:
A high-severity vulnerability in AOMEI Backupper threatens the integrity of backup operations and may lead to unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-12780

Affected Software: AOMEI Backupper

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in AOMEI Backupper that may allow an attacker to bypass intended security constraints. The exact mechanism requires investigation of the vendor's security documentation to determine if authentication is required for a successful exploit.

Business Impact

The compromise of backup software is particularly dangerous, as it can lead to the theft of sensitive data, the corruption of recovery points, or unauthorized access to the underlying operating system. The CVSS score of 7.8 confirms that this is a significant security concern that could severely impact business continuity and disaster recovery capabilities.

Remediation Plan

Immediate Action: Update AOMEI Backupper to the latest patched version immediately to ensure that security vulnerabilities are mitigated.

Proactive Monitoring: Monitor backup logs for unexpected errors, unauthorized configuration changes, or anomalous access attempts.

Compensating Controls: Ensure that backup repositories are protected by strict access control lists (ACLs) and that the application is running in an environment with hardened network security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority, as the software handles critical data assets. Ensure that the most recent security patches are installed across all deployments and monitor for any signs of unauthorized activity involving the backup infrastructure to maintain data integrity.

---METADATA---
VENDOR: AOMEI
PRODUCT: Dynamic Disk Manager
AFFECTED_VERSIONS: Up to version 10
---END_METADATA---

Description Summary:
A vulnerability in AOMEI Dynamic Disk Manager up to version 10 may allow attackers to perform unauthorized operations on disk management functions.

Executive Summary:
A high-severity vulnerability in AOMEI Dynamic Disk Manager up to version 10 could allow unauthorized disk management, threatening data availability and integrity.

Vulnerability Details

CVE-ID: CVE-2026-12779

Affected Software: AOMEI Dynamic Disk Manager

Affected Versions: Up to version 10

Vulnerability: This vulnerability affects the administrative functions of AOMEI Dynamic Disk Manager, potentially allowing an attacker to manipulate disk configurations or bypass access controls.

Business Impact

An exploit targeting AOMEI Dynamic Disk Manager could lead to unauthorized modification of disk structures, resulting in potential data loss or system instability. With a CVSS score of 7.8, this vulnerability poses a severe threat to business continuity, particularly for servers or workstations that rely on the software for critical storage management.

Remediation Plan

Immediate Action: Upgrade to the latest version of AOMEI Dynamic Disk Manager beyond version 10 immediately to resolve the identified security flaws.

Proactive Monitoring: Monitor disk configuration changes and audit access logs for the Dynamic Disk Manager application to identify any unauthorized modifications.

Compensating Controls: Restrict access to the disk management software to authorized administrative accounts only and apply strict file-system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for significant data disruption, administrators should prioritize updating AOMEI Dynamic Disk Manager. Failure to patch may expose storage infrastructure to unauthorized manipulation, making immediate remediation essential for maintaining system integrity.

---METADATA---
VENDOR: AOMEI
PRODUCT: Partition Assistant
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in AOMEI Partition Assistant up to version 10 that may permit unauthorized system access or manipulation.

Executive Summary:
A critical vulnerability in AOMEI Partition Assistant poses a high risk of system compromise, requiring immediate attention from security teams.

Vulnerability Details

CVE-ID: CVE-2026-12778

Affected Software: AOMEI Partition Assistant

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of AOMEI Partition Assistant, potentially allowing an attacker to execute unauthorized operations. As specific authentication requirements are not detailed, administrators should assume that local or network-based access could facilitate exploitation.

Business Impact

Successful exploitation of this flaw could result in complete unauthorized control over disk management functions, leading to data loss, system instability, or privilege escalation. With a CVSS score of 7.8, this vulnerability is classified as High severity, indicating a significant risk to operational integrity and data confidentiality.

Remediation Plan

Immediate Action: Verify the current version of AOMEI Partition Assistant in use and apply all available security updates provided by the vendor.

Proactive Monitoring: Review system and application logs for unusual execution patterns or unauthorized attempts to modify partition structures.

Compensating Controls: Restrict access to the software to authorized administrative users only and implement endpoint protection to detect suspicious process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, organizations should prioritize the identification of all instances of AOMEI Partition Assistant within their environment. Applying the vendor-provided patches is the only definitive way to mitigate this risk; if a patch is not yet available, restrict access to the application until a secure update is deployed.

---METADATA---
VENDOR: Montodel
PRODUCT: House-Rental-Management
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Montodel House-Rental-Management software that may allow for unauthorized system interaction.

Executive Summary:
A high-severity security vulnerability in Montodel House-Rental-Management poses a risk of unauthorized access to sensitive rental data.

Vulnerability Details

CVE-ID: CVE-2026-12775

Affected Software: Montodel House-Rental-Management

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the codebase of Montodel House-Rental-Management, potentially allowing an attacker to bypass intended security constraints. The specific entry point and authentication requirements are currently under investigation by the vendor.

Business Impact

The CVSS score of 7.3 indicates a high risk to the confidentiality and integrity of rental management operations. A successful exploit could lead to the unauthorized retrieval of tenant information or administrative manipulation of rental records, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Monitor the Montodel repository or vendor portal for security patches and apply them to all production environments upon release.

Proactive Monitoring: Review system and application logs for unusual administrative activity or unauthorized access attempts to the management dashboard.

Compensating Controls: Restrict access to the management interface to trusted IP ranges via VPN or secure gateway to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for sensitive data exposure, it is imperative that administrators prioritize the mitigation of this vulnerability. Ensure that all instances of the application are isolated from public exposure until the vendor provides a formal patch or security update.

---METADATA---
VENDOR: BerriAI
PRODUCT: litellm
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in BerriAI litellm that could potentially be leveraged by an attacker to compromise application integrity.

Executive Summary:
A high-severity weakness in BerriAI litellm requires proactive security measures to mitigate the risk of unauthorized exploitation.

Vulnerability Details

CVE-ID: CVE-2026-12773

Affected Software: BerriAI litellm

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability represents a weakness in the BerriAI litellm software, which may impact the security of the API proxy functionality. The authentication level required for exploitation is currently unspecified; therefore, default settings should be treated as potentially vulnerable.

Business Impact

The CVSS score of 7.3 highlights the necessity of addressing this flaw to prevent unauthorized access or system manipulation. Failure to remediate could allow an attacker to disrupt LLM workflows, leading to business process failure and potential unauthorized consumption of compute resources.

Remediation Plan

Immediate Action: Check the BerriAI official documentation for the latest security updates and apply all relevant patches to the litellm deployment.

Proactive Monitoring: Monitor for increased error rates or unexpected latency in LLM API requests, which may indicate attempted exploitation or system instability.

Compensating Controls: Ensure that the litellm service is running with the principle of least privilege, minimizing the permissions available to the service account.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators are advised to treat this vulnerability as a high-priority item. The immediate application of vendor-supplied security patches is the most effective way to secure the environment against potential exploitation of this identified weakness.

---METADATA---
VENDOR: cyberlord92
PRODUCT: miniOrange Social Login and Register
AFFECTED_VERSIONS: 0 through 7.7.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The miniOrange Social Login and Register plugin for WordPress is vulnerable to unauthenticated account takeover via flawed OAuth email validation and predictable OTP transaction hashing.

Executive Summary:
An unauthenticated account takeover vulnerability in the miniOrange Social Login and Register plugin allows attackers to gain full administrative access to WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-12761

Affected Software: cyberlord92 miniOrange Social Login and Register

Affected Versions: 0 through 7.7.0

Vulnerability: This vulnerability allows unauthenticated attackers to manipulate the Profile Completion flow by supplying an arbitrary email address and cracking a predictable OTP token hash to authenticate as any user, including administrators.

Business Impact

Successful exploitation results in full administrative compromise of the WordPress instance. Given the CVSS score of 9.8, this represents a critical risk, as an attacker can gain complete control over the site, modify content, inject malicious scripts, or exfiltrate sensitive user data, leading to severe reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Update the miniOrange Social Login and Register plugin to the latest available version immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected administrative account creations or unauthorized password resets.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block suspicious POST requests to the profile completion and OTP validation endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a critical threat to the integrity and security of the affected WordPress environment. Administrators must prioritize updating this plugin to the latest version to close the authentication bypass vector and prevent unauthorized administrative access.

---METADATA---
VENDOR: Adiss
PRODUCT: Biloop
AFFECTED_VERSIONS: 6.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authenticated cross-tenant authorization bypass in Adiss Biloop allows users to access or modify data belonging to other companies by manipulating the company ID parameter.

Executive Summary:
A critical authorization bypass vulnerability in Adiss Biloop allows authenticated users to access and manipulate sensitive data across different tenant environments.

Vulnerability Details

CVE-ID: CVE-2026-12686

Affected Software: Adiss Biloop

Affected Versions: 6.1.1

Vulnerability: The application fails to perform adequate server-side validation of the company ID parameter during POST requests. An authenticated user can exploit this to bypass cross-tenant boundaries, potentially accessing or altering sensitive billing and customer data of other organizations.

Business Impact

This vulnerability poses a severe risk to data confidentiality and integrity. With a CVSS score of 9.3, it represents a critical threat, as unauthorized access to multi-tenant environments can lead to significant data breaches, regulatory non-compliance, and loss of customer trust.

Remediation Plan

Immediate Action: Update the Adiss Biloop installation to the latest version provided by the vendor to implement proper authorization checks.

Proactive Monitoring: Review application access logs for anomalous POST requests involving unauthorized company ID parameters.

Compensating Controls: Ensure that Web Application Firewalls (WAF) are configured to monitor and block suspicious request patterns targeting company ID parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this authorization bypass, administrators must prioritize patching the affected Biloop instance immediately. Failure to address this flaw leaves sensitive cross-tenant data exposed to unauthorized manipulation.

---METADATA---
VENDOR: Google
PRODUCT: go-attestation
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Google go-attestation contains an improper validation vulnerability regarding index, position, or offset inputs, potentially leading to memory corruption or instability.

Executive Summary:
Google go-attestation is affected by an improper input validation vulnerability that could permit unauthorized memory access or system instability.

Vulnerability Details

CVE-ID: CVE-2026-12681

Affected Software: Google go-attestation

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software fails to properly validate index or offset values provided during input processing. This type of vulnerability typically requires an attacker to provide crafted input to an authenticated or unauthenticated interface, depending on the specific implementation, to trigger out-of-bounds access.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a high risk to systems relying on go-attestation for security-sensitive tasks. Exploitation may result in system crashes, denial of service, or potentially arbitrary code execution, which could lead to a compromise of the underlying platform's integrity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Google as soon as they become available for your environment.

Proactive Monitoring: Monitor application and system logs for unexpected crashes, segmentation faults, or unusual memory usage patterns.

Compensating Controls: Ensure that the application is running with the principle of least privilege to minimize the potential impact of a successful memory corruption exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should track the official Google security advisory for the release of a patch. Given the high severity of input validation flaws in security libraries, immediate testing and deployment of the update are required to maintain system integrity.

---METADATA---
VENDOR: IBM
PRODUCT: Sterling B2B Integrator / Sterling File Gateway
AFFECTED_VERSIONS: Version 6 (See vendor advisory for specific sub-versions)
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in IBM Sterling B2B Integrator and IBM Sterling File Gateway 6, potentially impacting system security.

Executive Summary:
A high-severity security vulnerability in IBM Sterling B2B Integrator and Sterling File Gateway 6 poses a risk to the secure processing of enterprise-level data transfers.

Vulnerability Details

CVE-ID: CVE-2026-1264

Affected Software: IBM Sterling B2B Integrator and IBM Sterling File Gateway

Affected Versions: Version 6

Vulnerability: This vulnerability resides in the IBM Sterling B2B suite. While the specific technical vector is not explicitly stated in the summary, the 7.1 CVSS score suggests a significant security weakness, possibly related to improper input validation or session management within the application's processing engine.

Business Impact

An attacker exploiting this flaw could potentially disrupt business-critical file transfers or gain unauthorized access to internal gateway configurations. The High severity rating (CVSS 7.1) reflects the potential for operational downtime and the compromise of confidential business communications between partners.

Remediation Plan

Immediate Action: Apply the recommended security patches provided by IBM for the Sterling B2B Integrator and File Gateway 6 platforms immediately.

Proactive Monitoring: Audit system logs for failed authentication attempts and review configuration change logs to detect any unauthorized modifications to gateway settings.

Compensating Controls: Implement strict network segmentation to isolate the B2B integration servers and utilize a Web Application Firewall (WAF) to inspect incoming traffic for malicious patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation of this vulnerability. This is the second high-severity flaw reported for this product line in this batch, suggesting a need for a comprehensive security review of the environment.

Analyst Recommendation

Organizations should treat this vulnerability with high priority due to its 7.1 CVSS score. Applying the latest vendor-supplied patches is the most effective way to mitigate the risk and ensure the continued security of the B2B integration environment.

---METADATA---
VENDOR: IBM
PRODUCT: Storage Protect Client
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
IBM Storage Protect Client 8 contains a security vulnerability that may allow for unauthorized access or system compromise.

Executive Summary:
A high-severity vulnerability in IBM Storage Protect Client 8 poses a significant risk of unauthorized system interaction if left unmitigated.

Vulnerability Details

CVE-ID: CVE-2026-12628

Affected Software: IBM Storage Protect Client

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects IBM Storage Protect Client 8, potentially allowing an attacker to compromise the integrity or availability of the backup client. The exact authentication requirements are currently unspecified; however, enterprise storage clients of this nature typically require authenticated access to exploit.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive backup data or the disruption of critical data protection services. Given the CVSS score of 8.1, the risk of data exfiltration or service interruption is substantial, threatening business continuity and regulatory compliance.

Remediation Plan

Immediate Action: Consult the official IBM security portal to identify and apply the necessary security updates or patches for your specific environment.

Proactive Monitoring: Review system access logs for unauthorized authentication attempts or anomalous activity originating from the backup client service.

Compensating Controls: Ensure the Storage Protect Client is restricted to trusted internal networks and utilize host-based firewalls to limit exposure to unauthorized entities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of backup infrastructure, the potential for exploitation remains high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from security administrators. Organizations should prioritize verifying their current version against IBM's security advisories and apply available patches immediately to mitigate the risk of unauthorized access to backup infrastructure.

---METADATA---
VENDOR: Aruba
PRODUCT: ArubaSign
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
ArubaSign contains a vulnerability involving incorrect default permissions that may allow unauthorized access to sensitive system resources.

Executive Summary:
A high-severity permission flaw in ArubaSign exposes the application to potential unauthorized access and compromise of system integrity.

Vulnerability Details

CVE-ID: CVE-2026-12602

Affected Software: Aruba ArubaSign

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application suffers from incorrect default permissions, which may allow local or remote attackers to gain unauthorized access to files or functions. As the specific authentication requirement is not explicitly defined, administrators should assume that the flaw could be exploited to bypass existing security controls.

Business Impact

The improper configuration of permissions presents a significant risk to data confidentiality and system integrity. With a CVSS score of 8.8, this vulnerability is classified as High, indicating that successful exploitation could lead to unauthorized data modification, administrative access, or full system compromise, resulting in operational downtime and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Aruba immediately to correct the default permission settings.

Proactive Monitoring: Review system access logs for unusual activity or attempts to access restricted directory paths or configuration files.

Compensating Controls: Implement strict file-system access controls (ACLs) and use an endpoint detection and response (EDR) solution to monitor for unauthorized process execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, immediate remediation is required to prevent unauthorized system access. Organizations should prioritize patching ArubaSign instances and conduct a thorough audit of account permissions to ensure no unauthorized access has already occurred.

---METADATA---
VENDOR: LoginPress
PRODUCT: LoginPress Pro
AFFECTED_VERSIONS: 0 through 6.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The LoginPress Pro plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access.

Executive Summary:
A critical authentication bypass vulnerability in the LoginPress Pro WordPress plugin exposes affected sites to unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-12598

Affected Software: LoginPress LoginPress Pro

Affected Versions: 0 through 6.2.3

Vulnerability: This vulnerability is an improper authentication flaw (CWE-287) that permits unauthenticated remote attackers to bypass security controls. By exploiting this weakness, an attacker can authenticate as a legitimate user, potentially gaining full control over the WordPress instance.

Business Impact

Successful exploitation of this flaw allows attackers to bypass login protections, leading to total compromise of the WordPress environment. This risk, justified by a CVSS score of 8.1, includes unauthorized data exfiltration, modification of site content, and potential malware injection, which could result in significant reputational damage and operational downtime.

Remediation Plan

Immediate Action: Update the LoginPress Pro plugin to the latest available version immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review authentication logs for unusual login patterns or successful logins from unrecognized IP addresses that bypass standard login workflows.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at authentication endpoints until the update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of an authentication bypass, administrators must prioritize this update above standard maintenance. Applying the latest version is the only effective way to remediate this vulnerability and secure the administrative gateway of your WordPress site.

---METADATA---
VENDOR: WordPress
PRODUCT: LoginPress Pro
AFFECTED_VERSIONS: 0 through 6.2.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The LoginPress Pro plugin for WordPress is vulnerable to an authentication bypass via the GitHub OAuth callback mechanism.

Executive Summary:
An authentication bypass vulnerability in the LoginPress Pro plugin for WordPress allows unauthenticated attackers to gain unauthorized access via the GitHub OAuth callback.

Vulnerability Details

CVE-ID: CVE-2026-12597

Affected Software: WordPress LoginPress Pro

Affected Versions: 0 through 6.2.3

Vulnerability: The plugin contains a flaw in the GitHub OAuth callback implementation that permits an unauthenticated attacker to bypass authentication protocols. By manipulating the callback response, an attacker can authenticate as an arbitrary user without legitimate credentials.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a significant risk of unauthorized access to the WordPress environment. Successful exploitation could lead to full administrative account takeover, modification of site content, and potential compromise of sensitive user information, directly impacting business continuity and data security.

Remediation Plan

Immediate Action: Update the LoginPress Pro plugin to the latest version immediately to mitigate the authentication flaw.

Proactive Monitoring: Review application logs for anomalous OAuth callback activity or unexpected successful logins from unauthorized GitHub accounts.

Compensating Controls: Use a WAF to monitor and filter traffic directed at OAuth callback endpoints to prevent the exploitation of insecure callback logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is critical that security teams apply the latest security patch for LoginPress Pro to remediate this authentication vulnerability. Given the ease of potential exploitation, immediate action is required to maintain the security and integrity of the WordPress site.

---METADATA---
VENDOR: WordPress
PRODUCT: LoginPress Pro
AFFECTED_VERSIONS: 0 through 6.2.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The LoginPress Pro plugin for WordPress is susceptible to an authentication bypass vulnerability due to unverified OAuth email handling.

Executive Summary:
An authentication bypass vulnerability in the LoginPress Pro plugin for WordPress allows unauthenticated attackers to potentially gain unauthorized access to user accounts.

Vulnerability Details

CVE-ID: CVE-2026-12595

Affected Software: WordPress LoginPress Pro

Affected Versions: 0 through 6.2.3

Vulnerability: The plugin fails to properly verify the email address returned during the OAuth authentication flow, allowing an unauthenticated attacker to manipulate the process and bypass standard login requirements. This flaw effectively grants unauthorized access to the application by spoofing legitimate user identities.

Business Impact

This vulnerability carries a CVSS score of 8.1, posing a high risk of unauthorized account access, data exfiltration, and administrative takeover of the WordPress instance. Such a compromise could lead to severe reputational damage, loss of data privacy, and significant operational disruption if administrative accounts are targeted.

Remediation Plan

Immediate Action: Update the LoginPress Pro plugin to the latest available version provided by the vendor.

Proactive Monitoring: Audit user authentication logs for suspicious login patterns or unauthorized access attempts using OAuth providers.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious or malformed OAuth callback requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must verify their current plugin version and apply available updates immediately. If an update is not yet available, consider disabling the OAuth functionality within LoginPress Pro until a patch is verified and installed.

---METADATA---
VENDOR: Qt
PRODUCT: Axivion
AFFECTED_VERSIONS: 7.8.5 through 7.8.12, 7.9.0-7.9.12, 7.10.0-7.10.10, 7.11.0-7.11.6, 7.12.0-7.12.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Axivion Dashboard API contains an authorization flaw that allows authenticated users to create API tokens for other users without the required permissions.

Executive Summary:
An authorization bypass vulnerability in the Axivion Dashboard API allows authenticated users to escalate privileges by generating tokens for other accounts.

Vulnerability Details

CVE-ID: CVE-2026-12593

Affected Software: Qt Axivion

Affected Versions: 7.8.5 through 7.8.12, 7.9.0 up to (excluding) 7.9.13, 7.10.0 up to (excluding) 7.10.11, 7.11.0 up to (excluding) 7.11.7, 7.12.0 up to (excluding) 7.12.2

Vulnerability: The vulnerability exists in an internal API endpoint (POST /api/users/~/{user}/tokens), which fails to perform proper authorization checks. An authenticated user can exploit this to create API tokens for other users, effectively bypassing access controls and gaining unauthorized access to other accounts.

Business Impact

This vulnerability represents a significant risk to organizational security by enabling privilege escalation and account takeover. With a CVSS score of 8.7, it poses a high risk of unauthorized data access and potential administrative compromise within the Axivion environment, which could lead to severe operational disruption.

Remediation Plan

Immediate Action: Update to one of the fixed releases: 7.9.13, 7.10.11, 7.11.7, or 7.12.2. Users on the 7.8.x branch must migrate to one of these supported, patched versions.

Proactive Monitoring: Audit API token generation logs for any suspicious activity where tokens are being created for users other than the authenticated requester.

Compensating Controls: Limit access to the Axivion Dashboard API to known, trusted IP addresses using a WAF or network-level access control list until patching is completed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to generate unauthorized API tokens constitutes a critical security failure. Organizations must prioritize the migration to a patched version, especially for users on legacy 7.8.x versions, to ensure robust protection against unauthorized access.

---METADATA---
VENDOR: Digiwin
PRODUCT: EasyFlow .NET
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Digiwin EasyFlow .NET contains an undisclosed security vulnerability that requires urgent attention and verification against vendor-provided documentation.

Executive Summary:
Digiwin EasyFlow .NET is affected by a high-severity security vulnerability that could potentially expose organizational data or internal processes.

Vulnerability Details

CVE-ID: CVE-2026-12581

Affected Software: Digiwin EasyFlow .NET

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Digiwin EasyFlow .NET platform. Detailed technical specifics regarding the vulnerability type and required authentication levels are currently pending, and administrators must consult the vendor for specific mitigation paths.

Business Impact

A CVSS score of 7.5 categorizes this as a high-severity issue. Given that EasyFlow is often used for business process management, successful exploitation could lead to unauthorized access to sensitive corporate workflows, data leakage, or the disruption of critical business operations.

Remediation Plan

Immediate Action: Contact the vendor or monitor their official portal for security patches and apply them to all EasyFlow .NET environments immediately.

Proactive Monitoring: Review access logs for unauthorized attempts to access workflow management interfaces or suspicious administrative activity.

Compensating Controls: If a patch is not immediately available, restrict network access to the application to trusted internal segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Digiwin EasyFlow .NET should treat this as a high-priority security item. Until the vendor provides full disclosure and a patch, focus on limiting the attack surface by restricting access to the software to the absolute minimum necessary personnel.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DTMSoft
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Delta Electronics DTMSoft is vulnerable to an insecure deserialization of untrusted data, which could allow a remote attacker to execute arbitrary code on the host system.

Executive Summary:
A critical deserialization vulnerability in Delta Electronics DTMSoft allows unauthenticated attackers to execute arbitrary code, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12578

Affected Software: Delta Electronics DTMSoft

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software fails to properly sanitize input during the deserialization process. An attacker can supply a crafted, malicious serialized object to the application, which, when processed, triggers arbitrary code execution with the privileges of the application.

Business Impact

Successful exploitation allows for complete remote code execution (RCE), which could lead to unauthorized data access, the installation of malware, or the lateral movement of an attacker within the corporate network. Given the CVSS score of 8.4, this vulnerability presents a severe risk to organizational confidentiality and integrity, particularly if the software is exposed to public networks.

Remediation Plan

Immediate Action: Update to the latest version of DTMSoft immediately to address the insecure deserialization flaw.

Proactive Monitoring: Review application logs for signs of anomalous data submission or unexpected system-level process spawning.

Compensating Controls: Utilize a Web Application Firewall or an Intrusion Prevention System (IPS) to detect and block malicious serialized objects being sent to the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, deserialization flaws are frequently targeted by attackers due to the high probability of achieving RCE.

Analyst Recommendation

Insecure deserialization is a high-impact vulnerability that requires immediate remediation. Organizations utilizing DTMSoft must prioritize testing and deploying the vendor's patch to prevent potential exploitation, as this vulnerability provides a direct pathway for attackers to gain a foothold within the infrastructure.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DVP80ES3
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Delta Electronics DVP80ES3 controller contains a vulnerability involving an improperly implemented security check, which may allow for unauthorized access or operational disruption.

Executive Summary:
An improperly implemented security check in the Delta Electronics DVP80ES3 poses a high-risk vulnerability that could lead to unauthorized control over industrial operations.

Vulnerability Details

CVE-ID: CVE-2026-12577

Affected Software: Delta Electronics DVP80ES3

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from an insecure implementation of security checks, likely allowing an attacker to bypass authentication or validation mechanisms. This defect potentially permits unauthorized users to modify device logic or settings, which is critical in an Industrial Control System (ICS) environment.

Business Impact

With a CVSS score of 8.7, this vulnerability is critical for environments utilizing the DVP80ES3 controller. Exploitation could lead to operational disruption, loss of process control, and potential safety risks within industrial facilities, necessitating immediate attention to prevent unauthorized tampering with physical processes.

Remediation Plan

Immediate Action: Consult the vendor’s security advisory to identify and apply the necessary firmware updates or configuration changes for the DVP80ES3.

Proactive Monitoring: Monitor industrial network traffic for unauthorized commands or communication patterns directed at the controller that deviate from standard operational baselines.

Compensating Controls: Isolate the DVP80ES3 from external networks and implement strict access controls at the network perimeter to prevent unauthorized remote interaction.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the industrial nature of the product, the risk of physical impact is significant. It is recommended that operators of DVP80ES3 controllers prioritize this patch in their next maintenance window and ensure that all industrial networks follow the "Defense-in-Depth" principle to minimize the attack surface.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DVP80ES3 PLC
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Delta Electronics DVP80ES3 PLC is affected by a vulnerability involving the improper enforcement of message integrity during transmission.

Executive Summary:
A vulnerability in the Delta Electronics DVP80ES3 PLC allows for potential manipulation of data due to improper message integrity enforcement.

Vulnerability Details

CVE-ID: CVE-2026-12576

Affected Software: Delta Electronics DVP80ES3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs within the communication channel of the DVP80ES3, where the integrity of transmitted messages is not properly verified, potentially allowing for data tampering or injection.

Business Impact

The lack of message integrity enforcement could allow a remote attacker to inject malicious commands or manipulate operational data, potentially leading to unauthorized control of the industrial process. With a CVSS score of 7.5, this vulnerability represents a severe threat to the safety and reliability of controlled operations.

Remediation Plan

Immediate Action: Apply the latest security firmware update provided by Delta Electronics to ensure proper message integrity checks are enforced.

Proactive Monitoring: Review communication logs for the PLC to identify any irregularities or unexpected traffic patterns that deviate from established baselines.

Compensating Controls: Implement secure communication protocols (e.g., VPNs or encrypted tunnels) to protect traffic between the controller and the management workstation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of command injection or data tampering in an industrial environment is unacceptable. Organizations should expedite the patching process and ensure that network-level defenses are in place to prevent unauthorized entities from interacting with the DVP80ES3 communication channels.