Search and filter 21637 vulnerabilities with AI analyst insights
In Dolibarr ERP & CRM <= 22
In Dolibarr ERP & CRM <= 22
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
An improper resource deallocation and closure vulnerability in the tools/zmqsend
An improper resource deallocation and closure vulnerability in the tools/zmqsend
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec
An out-of-bounds read in the read_global_param() function (libavcodec/av1dec
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
An issue in the file handling logic of the component download
An issue in the file handling logic of the component download
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Slah CMS v1
Slah CMS v1
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Incorrect access control in the config
Incorrect access control in the config
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
iccDEV provides a set of libraries and tools for working with ICC color management profiles
iccDEV provides a set of libraries and tools for working with ICC color management profiles
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Sonarr is a PVR for Usenet and BitTorrent users
Sonarr is a PVR for Usenet and BitTorrent users
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Sonarr is a PVR for Usenet and BitTorrent users
Sonarr is a PVR for Usenet and BitTorrent users
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Serve...
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any internal relationship table. Exploiting this allows the attacker to inject themselves into any Parse Role, gaining all permissions associated with that role, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Similarly, writing to any such table that backs a Relation field used in a pointerFields CLP bypasses that access control. This vulnerability is fixed in 9.5.2-alpha.7 and 8.6.20.
Update Parse Multiple Products to the latest version. Check vendor security advisory for specific patch details. Monitor for exploitation attempts and review access logs.
A server-side RCE vulnerability in OneUptime Synthetic Monitors allows low-privileged users to execute arbitrary commands by abusing exposed Playwrigh...
A server-side RCE vulnerability in OneUptime Synthetic Monitors allows low-privileged users to execute arbitrary commands by abusing exposed Playwright browser objects.
---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime Synthetic Monitors
AFFECTED_VERSIONS: Prior to 10.0.21
---END_METADATA---
Description Summary:
A server-side RCE vulnerability in OneUptime Synthetic Monitors allows low-privileged users to execute arbitrary commands by abusing exposed Playwright browser objects.
Executive Summary:
OneUptime is vulnerable to remote code execution because it exposes sensitive browser APIs to low-privileged users, allowing them to spawn malicious executables on the server.
Vulnerability Details
CVE-ID: CVE-2026-30957
Affected Software: OneUptime
Affected Versions: Prior to 10.0.21
Vulnerability: This vulnerability occurs because untrusted Synthetic Monitor code is executed while live host-realm Playwright browser and page objects remain exposed. A low-privileged authenticated project user can call Playwright APIs on these objects to cause the probe server to spawn an attacker-controlled executable, achieving server-side remote code execution without needing a sandbox escape.
Business Impact
With a CVSS score of 9.9, this vulnerability allows for the total compromise of the oneuptime-probe server. An attacker can execute arbitrary commands, potentially leading to data exfiltration, service disruption, and lateral movement within the hosting environment. This poses a severe risk to the integrity of the monitoring platform.
Remediation Plan
Immediate Action: Upgrade OneUptime to version 10.0.21 or later to properly isolate Playwright objects from the user execution environment.
Proactive Monitoring: Monitor for unexpected process creation (e.g., shells or unknown binaries) originating from the oneuptime-probe container.
Compensating Controls: Use container security tools to enforce strict syscall filtering and prevent the spawning of unauthorized sub-processes within the application environment.
Exploitation Status
Public Exploit Available: No
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. The direct access to Playwright APIs makes this RCE significantly easier to execute than typical sandbox escapes.
Analyst Recommendation
This vulnerability represents a critical failure in the isolation of user-provided code. It is imperative that administrators apply the update to version 10.0.21 immediately. Organizations should also review the permissions of users allowed to create synthetic monitors.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
A critical authorization bypass in OneUptime allows low-privileged users to forge headers, escape tenant isolation, and achieve full account takeover...
A critical authorization bypass in OneUptime allows low-privileged users to forge headers, escape tenant isolation, and achieve full account takeover of other users.
---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to 10.0.21
---END_METADATA---
Description Summary:
A critical authorization bypass in OneUptime allows low-privileged users to forge headers, escape tenant isolation, and achieve full account takeover of other users.
Executive Summary:
OneUptime is vulnerable to a multi-tenancy escape that allows low-privileged users to access other tenants' data and fully take over any user account via forged headers.
Vulnerability Details
CVE-ID: CVE-2026-30956
Affected Software: OneUptime
Affected Versions: Prior to 10.0.21
Vulnerability: This vulnerability stems from the server trusting client-supplied headers like is-multi-tenant-query and projectid. An authenticated low-privileged user can forge these headers to skip internal permission checks, disable tenant scoping, and access sensitive data belonging to other organizations, including plaintext password reset tokens, enabling full account takeover.
Business Impact
With a CVSS score of 9.9, this vulnerability represents a total breakdown of the platform's security model. Attackers can leak sensitive user fields, reset victim passwords, and compromise the data of every tenant on the platform. This leads to massive data exposure and a complete loss of customer trust.
Remediation Plan
Immediate Action: Update OneUptime to version 10.0.21 or later to ensure the server correctly validates and enforces tenant isolation independently of client-supplied headers.
Proactive Monitoring: Audit access logs for the presence of the is-multi-tenant-query header and investigate any cross-project data access patterns.
Compensating Controls: Implement a reverse proxy or API gateway that strips or validates sensitive internal headers before they reach the application server.
Exploitation Status
Public Exploit Available: No
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. However, the simplicity of forging headers makes this an extremely high-risk vulnerability for any multi-tenant deployment.
Analyst Recommendation
This is a catastrophic flaw for any SaaS or multi-tenant installation of OneUptime. Immediate remediation via upgrading to version 10.0.21 is mandatory. Organizations must also consider a full audit of their data to ensure no unauthorized access occurred prior to patching.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents
---METADATA---
VENDOR: AutoGPT
PRODUCT: Workflow Automation Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---
Description Summary:
A security vulnerability has been identified within the AutoGPT workflow automation platform, which facilitates the management of AI agents.
Executive Summary:
The AutoGPT platform contains a vulnerability that could potentially allow unauthorized parties to interfere with AI agent workflows.
Vulnerability Details
CVE-ID: CVE-2026-30950
Affected Software: AutoGPT Workflow Automation Platform
Affected Versions: See vendor advisory for specific affected versions
Vulnerability: This flaw impacts the AutoGPT platform, specifically concerning its workflow and agent management functions. Further investigation is required to determine the specific authentication requirements and entry points for this vulnerability.
Business Impact
The CVSS score of 7.1 underscores the need for proactive mitigation to prevent unauthorized access to automation systems. Failure to address this risk could result in operational disruptions or the compromise of sensitive data processed by the AI agents.
Remediation Plan
Immediate Action: Check for available updates from the vendor and apply them to all affected instances.
Proactive Monitoring: Review access control logs for suspicious administrative activity or unauthorized login attempts.
Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and protect the application against common exploit patterns.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.
Analyst Recommendation
Organizations should prioritize the deployment of patches provided by the vendor. Maintaining an updated software posture is the most effective way to mitigate the risks associated with this high-severity vulnerability.
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
StudioCMS is a server-side-rendered, Astro native, headless content management system
StudioCMS is a server-side-rendered, Astro native, headless content management system
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
baserCMS is a website development framework
baserCMS is a website development framework
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
FileBrowser Quantum is a free, self-hosted, web-based file manager
FileBrowser Quantum is a free, self-hosted, web-based file manager
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images
---METADATA---
VENDOR: ImageMagick Studio LLC
PRODUCT: ImageMagick
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---
Description Summary:
ImageMagick is susceptible to a vulnerability during image manipulation that could allow for unauthorized code execution or system instability when processing crafted files.
Executive Summary:
A high-severity vulnerability in ImageMagick poses a significant risk of remote exploitation through the processing of maliciously crafted image files by unauthenticated attackers.
Vulnerability Details
CVE-ID: CVE-2026-30929
Affected Software: ImageMagick Studio LLC ImageMagick
Affected Versions: See vendor advisory for specific affected versions
Vulnerability: The vulnerability involves improper handling of image data during editing and manipulation processes. An unauthenticated attacker could provide a specially crafted image file that triggers a memory corruption or logic flaw within the software.
Business Impact
Exploitation could lead to arbitrary code execution on the server or workstation processing the image, or a denial-of-service (DoS) condition that halts automated workflows. Given the CVSS score of 7.7, this is a High-severity issue, particularly for web applications that automatically process user-uploaded content, potentially leading to full server takeover.
Remediation Plan
Immediate Action: Update ImageMagick to the latest stable version provided by the vendor or the relevant Linux distribution maintainer.
Proactive Monitoring: Monitor application logs for crashes in image processing modules and inspect incoming file uploads for unusual header signatures.
Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect uploaded files and utilize sandboxing (e.g., Bubblewrap or Docker) to isolate the ImageMagick process from the rest of the system.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation of this vulnerability. ImageMagick vulnerabilities are frequently targeted by researchers and attackers due to the software's widespread use in automated web backends.
Analyst Recommendation
The severity of this vulnerability necessitates immediate patching, especially for any system that processes untrusted image content. Security teams should verify that all instances of ImageMagick, including those bundled within other software stacks, are updated to the latest secure version to prevent remote code execution.
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
SiYuan is a personal knowledge management system
SiYuan is a personal knowledge management system
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
pyasn1 is a generic ASN
pyasn1 is a generic ASN
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitr...
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitrary executables.
---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime Synthetic Monitors
AFFECTED_VERSIONS: Prior to 10.0.20
---END_METADATA---
Description Summary:
Low-privileged users in OneUptime can achieve server-side RCE by abusing injected Playwright browser objects within Synthetic Monitors to spawn arbitrary executables.
Executive Summary:
OneUptime’s Synthetic Monitors allow authenticated users to bypass normal execution limits and spawn arbitrary executables on the probe host via exposed Playwright objects.
Vulnerability Details
CVE-ID: CVE-2026-30921
Affected Software: OneUptime
Affected Versions: Prior to 10.0.20
Vulnerability: In OneUptime versions prior to 10.0.20, untrusted Playwright code is executed inside a Node.js vm but is provided with live host Playwright objects. This allows a low-privileged authenticated user to bypass sandbox restrictions by directly calling browser.browserType().launch() to spawn an arbitrary executable on the probe host or container.
Business Impact
This vulnerability carries a CVSS score of 9.9, indicating a near-total threat to the system. An attacker can achieve full remote code execution, allowing them to compromise the probe container, access sensitive environment variables, and potentially move laterally into the wider infrastructure.
Remediation Plan
Immediate Action: Update OneUptime to version 10.0.20 or later to ensure that Playwright objects are not exposed to the user-controlled execution environment.
Proactive Monitoring: Review synthetic monitor scripts for calls to launch() or other sensitive browser management functions and audit container processes for unauthorized binaries.
Compensating Controls: Restrict the privileges of the container running the oneuptime-probe and implement strict outbound network filtering to prevent command-and-control communication.
Exploitation Status
Public Exploit Available: No
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous because it provides a direct path to RCE without requiring complex sandbox escape techniques.
Analyst Recommendation
The ability for low-privileged users to execute arbitrary code on the server is a critical security failure. Administrators must upgrade to version 10.0.20 immediately to mitigate the risk of a full container and potentially cluster-wide compromise.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
OneUptime is a solution for monitoring and managing online services
OneUptime is a solution for monitoring and managing online services
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Apache Airflow versions 3
Apache Airflow versions 3
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
A path traversal vulnerability in the Mail feature of Zoom Workplace for Windows allows unauthenticated users to conduct an escalation of privilege vi...
A path traversal vulnerability in the Mail feature of Zoom Workplace for Windows allows unauthenticated users to conduct an escalation of privilege via network access.
---METADATA---
VENDOR: Zoom
PRODUCT: Zoom Workplace for Windows
AFFECTED_VERSIONS: Before 6.6.0
---END_METADATA---
Description Summary:
A path traversal vulnerability in the Mail feature of Zoom Workplace for Windows allows unauthenticated users to conduct an escalation of privilege via network access.
Executive Summary:
A critical privilege escalation vulnerability in Zoom Workplace for Windows allows unauthenticated attackers to gain elevated system permissions by exploiting a file path control flaw.
Vulnerability Details
CVE-ID: CVE-2026-30903
Affected Software: Zoom Workplace for Windows
Affected Versions: Before 6.6.0
Vulnerability: The vulnerability involves "External Control of File Name or Path" within the Zoom Mail feature. An unauthenticated attacker with network access can exploit this flaw to manipulate file paths, potentially leading to the execution of malicious files or the overwriting of sensitive system components to escalate privileges.
Business Impact
A successful exploit could allow an attacker to gain administrative rights on a user's workstation, leading to data theft, malware installation, and persistent access to the corporate network. The CVSS score of 9.6 reflects the high risk of unauthorized privilege elevation on end-user devices.
Remediation Plan
Immediate Action: Update Zoom Workplace for Windows to version 6.6.0 or later immediately.
Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for suspicious file system activity or unusual process spawning originating from the Zoom application.
Compensating Controls: Ensure that users do not have local administrative rights, which can limit the impact of privilege escalation vulnerabilities.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, Zoom's large install base makes it a primary target for sophisticated threat actors seeking to compromise corporate endpoints.
Analyst Recommendation
Privilege escalation in widely deployed communication software is a critical threat. IT administrators must ensure that all Windows endpoints are running the latest version of Zoom Workplace to mitigate this risk and protect the organization's fleet of devices.
Update Zoom Workplace for to the latest version. Check vendor security advisory for specific patch details. Monitor for exploitation attempts and review access logs.
Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local acce...
Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation...
Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable t...
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3
Update WordPress plugin/theme to the latest version. Review WordPress security settings and remove if no longer needed.
The installer for Qsee Client versions 1
The installer for Qsee Client versions 1
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
A path traversal vulnerability in Wazuh's cluster synchronization routine allows authenticated peers to write arbitrary files and potentially achieve...
A path traversal vulnerability in Wazuh's cluster synchronization routine allows authenticated peers to write arbitrary files and potentially achieve remote code execution.
---METADATA---
VENDOR: Wazuh
PRODUCT: Wazuh
AFFECTED_VERSIONS: 4.4.0 through 4.14.3
---END_METADATA---
Description Summary:
A path traversal vulnerability in Wazuh's cluster synchronization routine allows authenticated peers to write arbitrary files and potentially achieve remote code execution.
Executive Summary:
An authenticated path traversal vulnerability in Wazuh allows cluster peers to perform arbitrary file writes, potentially leading to full system-level compromise.
Vulnerability Details
CVE-ID: CVE-2026-30893
Affected Software: Wazuh
Affected Versions: 4.4.0 to 4.14.3
Vulnerability: Wazuh cluster nodes sync state by shipping compressed archives between peers. The extraction routine decompress_files() fails to confirm that each archive member stays inside the intended directory (CWE-22 path traversal, plus CWE-73 external control of a file path). An authenticated cluster peer crafts an archive with ../ entries so the receiving node writes attacker-controlled files outside the extraction directory, then escalates to code execution by overwriting a Python module that a Wazuh component imports. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) is notable for S:C, where the scope change reflects that the vulnerable component on one node executes code on other cluster nodes. Default cluster port is 1516/tcp.
Business Impact
Rated CVSS 9.0. The victim is the security-monitoring platform itself: an attacker who reaches the cluster plane (a compromised worker node, a leaked cluster key, or a rogue node) pivots to the manager tier and the rest of the fleet. That lets them disable rules and decoders, suppress or forge alerts, and delete audit trails, blinding detection across the entire monitored estate, not just the Wazuh hosts. Where wazuh-clusterd runs as root, it is full host compromise and a pivot point into the management network.
Remediation Plan
Immediate Action: Upgrade all Wazuh nodes to version 4.14.4 or later immediately.
Proactive Monitoring: Monitor cluster communication logs for unexpected file write operations or synchronization anomalies.
Compensating Controls: Isolate the cluster communication network and ensure that only authorized, trusted nodes can participate in the synchronization process.
Exploitation Status
Public Exploit Available: Yes
Analyst Notes: A proof-of-concept is referenced in the GHSA (GHSA-m8rw-v4f6-8787) as a separate attachment. This is a post-foothold, lateral-movement flaw (PR:H, since it requires an authenticated cluster peer), not an internet-facing pre-auth break, so the highest-value detections are host-side integrity monitoring of the Wazuh Python framework tree plus cluster-membership anomalies. The precondition to protect against is exposure of the cluster key and unrestricted access to the 1516/tcp cluster port.
Analyst Recommendation
The availability of a proof-of-concept makes this a high-priority remediation task. Organizations must apply the provided patch to all Wazuh components to prevent cluster-wide compromise.
Update Wazuh Multiple Products to the latest version. Check vendor security advisory for specific patch details. Monitor for exploitation attempts and review access logs.
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code executi...
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code execution and full cluster compromise.
---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime Synthetic Monitors
AFFECTED_VERSIONS: Prior to 10.0.18
---END_METADATA---
Description Summary:
OneUptime Synthetic Monitors are vulnerable to a sandbox escape via the Node.js vm module, allowing authenticated users to achieve remote code execution and full cluster compromise.
Executive Summary:
Authenticated users in OneUptime can escape the JavaScript sandbox to execute arbitrary system commands, leading to a complete compromise of the database and cluster credentials.
Vulnerability Details
CVE-ID: CVE-2026-30887
Affected Software: OneUptime
Affected Versions: Prior to 10.0.18
Vulnerability: The system executes custom Playwright/JavaScript code within an insecure Node.js vm module. An authenticated project member can leverage a standard prototype-chain escape to bypass this sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container.
Business Impact
The business impact is critical, as the affected container holds environment variables containing database and cluster credentials. Exploitation leads directly to a complete cluster compromise. With a CVSS score of 9.9, the risk involves total loss of data confidentiality, integrity, and availability across the entire monitoring infrastructure.
Remediation Plan
Immediate Action: Update OneUptime to version 10.0.18 or later to ensure untrusted code is executed in a secure, hardened environment.
Proactive Monitoring: Inspect synthetic monitor configurations for suspicious JavaScript or use of constructor escapes and review container logs for unauthorized shell activity.
Compensating Controls: Implement network segmentation to isolate the oneuptime-probe containers and restrict their access to sensitive internal databases and cluster APIs.
Exploitation Status
Public Exploit Available: No
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the use of well-known sandbox escape techniques makes the likelihood of exploitation by a knowledgeable insider very high.
Analyst Recommendation
Given the potential for complete cluster takeover, this vulnerability must be addressed with extreme urgency. Organizations should upgrade to version 10.0.18 immediately. Until the patch is applied, restrict the ability of users to create or modify synthetic monitors.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.
---METADATA---
VENDOR: Moodle (Plugin by mdjnelson)
PRODUCT: Custom Certificate (mod_customcert)
AFFECTED_VERSIONS: Prior to versions 4.4.9 and 5.0.3
---END_METADATA---
Description Summary:
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.
Executive Summary:
The Moodle Custom Certificate plugin contains a critical security flaw that allows authorized teachers to access and modify certificate data across different courses, leading to unauthorized data disclosure.
Vulnerability Details
CVE-ID: CVE-2026-30884
Affected Software: Custom Certificate Moodle Plugin (mod_customcert)
Affected Versions: Prior to versions 4.4.9 and 5.0.3
Vulnerability: The core_get_fragment and mod_customcert_save_element services fail to verify the context of a supplied elementid. This allows an authenticated teacher with management permissions in one course to manipulate certificates in any other course on the Moodle site.
Business Impact
This vulnerability enables cross-course data tampering and information disclosure, which can undermine the integrity of academic certifications. The CVSS score of 9.6 reflects the high impact on data integrity and confidentiality within the educational platform, potentially allowing for the unauthorized issuance of certificates.
Remediation Plan
Immediate Action: Update the Custom Certificate plugin to version 4.4.9 or 5.0.3 immediately through the Moodle plugin management interface.
Proactive Monitoring: Audit certificate modification logs for any changes made by users to courses they are not officially assigned to manage.
Compensating Controls: Review and restrict the mod/customcert:manage capability to only the most trusted administrative users until the patch is applied.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of context validation makes this vulnerability highly reliable for an authenticated attacker.
Analyst Recommendation
Moodle administrators must update the mod_customcert plugin to the fixed versions immediately. This action is necessary to prevent unauthorized users from compromising the validity of certificates across the entire installation.
Update Infor Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
Chamilo LMS is a learning management system
Chamilo LMS is a learning management system
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
baserCMS contains an OS command injection vulnerability within its update functionality. Authenticated administrators can exploit this flaw to execute...
baserCMS contains an OS command injection vulnerability within its update functionality. Authenticated administrators can exploit this flaw to execute arbitrary commands with server-level privileges.
---METADATA---
VENDOR: baserCMS
PRODUCT: baserCMS
AFFECTED_VERSIONS: Versions prior to 5.2.3
---END_METADATA---
Description Summary:
baserCMS contains an OS command injection vulnerability within its update functionality. Authenticated administrators can exploit this flaw to execute arbitrary commands with server-level privileges.
Executive Summary:
A critical OS command injection vulnerability in baserCMS allows authenticated administrators to achieve full remote code execution on the underlying server host.
Vulnerability Details
CVE-ID: CVE-2026-30877
Affected Software: baserCMS (Website Development Framework)
Affected Versions: Versions prior to 5.2.3
Vulnerability: This issue is classified as an OS Command Injection vulnerability residing in the update functionality of the framework. An attacker must be authenticated with administrator-level privileges to trigger the flaw, allowing them to bypass application logic and execute system-level commands under the context of the web server user.
Business Impact
A successful exploit poses a severe threat to the confidentiality, integrity, and availability of the server environment. By executing arbitrary OS commands, an attacker can gain persistent access, exfiltrate sensitive database content, or pivot into the internal network. The CVSS score of 9.1 reflects the critical nature of potential total system compromise, despite the requirement for administrative authentication.
Remediation Plan
Immediate Action: Administrators must immediately upgrade baserCMS installations to version 5.2.3 or later to patch the vulnerable update component.
Proactive Monitoring: Security teams should review system audit logs for unusual shell activity or unexpected outbound connections originating from the web server process.
Compensating Controls: Implement strict egress filtering to prevent reverse shell connections and ensure the web server is running with the least privilege necessary to minimize the impact of command execution.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of Mar 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the technical details regarding the update function flaw are now public, the risk of exploitation by malicious insiders or compromised admin accounts is significantly elevated.
Analyst Recommendation
The severity of this vulnerability necessitates an immediate update to version 5.2.3. Organizations should prioritize this patch to prevent administrative account compromise from escalating into a full server takeover. Ensure that all administrative credentials follow strong rotation policies to mitigate the risk of unauthorized access to the vulnerable update function.
Update the update Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
Chamilo LMS is a learning management system
Chamilo LMS is a learning management system
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read a...
SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.
---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to 3.5.10
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---
Description Summary:
A path traversal vulnerability in the SiYuan /export endpoint allows unauthenticated attackers to read arbitrary files from the server filesystem.
Executive Summary:
A critical path traversal vulnerability in SiYuan allows attackers to steal sensitive configuration files, potentially leading to full system compromise or remote code execution.
Vulnerability Details
CVE-ID: CVE-2026-30869
Affected Software: SiYuan SiYuan
Affected Versions: Prior to 3.5.10
Vulnerability: A path traversal flaw exists in the /export endpoint, where double-encoded sequences can be used to bypass security filters. This allows an unauthenticated attacker to retrieve sensitive files, including API tokens and authentication secrets.
Business Impact
The exposure of API tokens and session secrets poses an extreme risk, as it grants attackers administrative access to the SiYuan kernel API. With a CVSS score of 9.3, this vulnerability could be chained to achieve remote code execution, resulting in total server compromise and potential exfiltration of all stored knowledge management data.
Remediation Plan
Immediate Action: Upgrade SiYuan to version 3.5.10 or later immediately to patch the affected /export endpoint.
Proactive Monitoring: Inspect server logs for suspicious URL patterns containing directory traversal sequences (e.g., ../, %2e%2e%2f).
Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal attempts and double-encoded input strings.
Exploitation Status
Public Exploit Available: Not specified
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.
Analyst Recommendation
Given the severity of the data exposure and the potential for remote code execution, immediate remediation is required. Ensure that all instances are updated to the latest version and verify that no unauthorized access to sensitive configuration files has occurred.
Update the Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
A stored XSS vulnerability in Appsmith's Table Widget allows authenticated users to execute malicious scripts via unsanitized HTML attributes, leading...
A stored XSS vulnerability in Appsmith's Table Widget allows authenticated users to execute malicious scripts via unsanitized HTML attributes, leading to full administrative account takeover.
---METADATA---
VENDOR: Appsmith
PRODUCT: Appsmith Table Widget (TableWidgetV2)
AFFECTED_VERSIONS: Prior to 1.96
---END_METADATA---
Description Summary:
A stored XSS vulnerability in Appsmith's Table Widget allows authenticated users to execute malicious scripts via unsanitized HTML attributes, leading to full administrative account takeover.
Executive Summary:
Appsmith is vulnerable to a critical stored cross-site scripting flaw that allows a standard user to escalate privileges and achieve a full administrative account takeover.
Vulnerability Details
CVE-ID: CVE-2026-30862
Affected Software: Appsmith Table Widget (TableWidgetV2)
Affected Versions: Prior to 1.96
Vulnerability: This critical stored XSS vulnerability originates from a lack of HTML sanitization within the React rendering pipeline of the Table Widget. An authenticated attacker with a regular user account can inject malicious attributes that, when viewed by a System Administrator via the "Invite Users" feature, execute a high-privileged API call to capture environment variables and take over the administrative account.
Business Impact
A successful exploit results in the complete compromise of the Appsmith instance. By gaining access to the /api/v1/admin/env endpoint, an attacker can extract sensitive configuration data and credentials, leading to total administrative control. Given the CVSS score of 9.0, this represents a severe risk to organizational data integrity and the security of internal tools built on the platform.
Remediation Plan
Immediate Action: Update Appsmith to version 1.96 or later immediately to apply the necessary HTML sanitization patches.
Proactive Monitoring: Audit the "Invite Users" logs and review any suspicious activity originating from the Table Widget components or unexpected calls to administrative API endpoints.
Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the execution of inline scripts and unauthorized API requests.
Exploitation Status
Public Exploit Available: No
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows a standard user to compromise the entire system through a common administrative workflow, the potential for exploitation is high.
Analyst Recommendation
The severity of this privilege escalation vulnerability cannot be overstated. Organizations utilizing Appsmith for internal tooling must prioritize the update to version 1.96. Immediate remediation is required to prevent authenticated users from gaining unauthorized administrative access to the environment.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
An unauthenticated remote code execution vulnerability in WeKnora allows attackers to bypass command validation using the -p flag in npx node, leading...
An unauthenticated remote code execution vulnerability in WeKnora allows attackers to bypass command validation using the -p flag in npx node, leading to complete system compromise.
---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: 0.2.5 to before 0.2.10
---END_METADATA---
Description Summary:
An unauthenticated remote code execution vulnerability in WeKnora allows attackers to bypass command validation using the -p flag in npx node, leading to complete system compromise.
Executive Summary:
WeKnora is susceptible to a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands with full application privileges.
Vulnerability Details
CVE-ID: CVE-2026-30861
Affected Software: WeKnora LLM Framework
Affected Versions: 0.2.5 to before 0.2.10
Vulnerability: The vulnerability is located in the MCP stdio configuration validation. An unauthenticated remote attacker can bypass existing blacklists and whitelists by using the -p flag with npx node to execute arbitrary commands on the underlying server.
Business Impact
This flaw poses an extreme risk to data confidentiality, integrity, and availability. Successful exploitation grants the attacker the same privileges as the application, enabling them to steal sensitive documents, modify data, or move laterally within the network. The CVSS score of 9.9 underscores the critical risk associated with unauthenticated RCE.
Remediation Plan
Immediate Action: Upgrade WeKnora to version 0.2.10 or later to apply the necessary validation fixes.
Proactive Monitoring: Audit application logs for suspicious npx or uvx command executions and monitor for unauthorized user registrations.
Compensating Controls: Implement strict network egress filtering to prevent the application from communicating with malicious external servers during a potential exploit.
Exploitation Status
Public Exploit Available: true
Analyst Notes: As of Mar 7, 2026, this vulnerability is known to be exploitable due to the bypass of command validation logic. Because WeKnora allows unrestricted registration, any user can potentially trigger this flaw.
Analyst Recommendation
Given the unauthenticated nature of this RCE and the high CVSS score, this vulnerability must be treated as a top priority. Organizations using WeKnora should update to version 0.2.10 immediately to mitigate the risk of total system takeover.
Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.
A remote code execution vulnerability in WeKnora's database query functionality allows unauthenticated attackers to bypass SQL injection protections v...
A remote code execution vulnerability in WeKnora's database query functionality allows unauthenticated attackers to bypass SQL injection protections via PostgreSQL array expressions.
---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: Prior to version 0.2.12
---END_METADATA---
Description Summary:
A remote code execution vulnerability in WeKnora's database query functionality allows unauthenticated attackers to bypass SQL injection protections via PostgreSQL array expressions.
Executive Summary:
WeKnora faces a critical unauthenticated remote code execution vulnerability where attackers can bypass SQL injection filters to execute arbitrary code on the database server.
Vulnerability Details
CVE-ID: CVE-2026-30860
Affected Software: WeKnora LLM Framework
Affected Versions: Prior to version 0.2.12
Vulnerability: The application's validation system fails to recursively inspect child nodes within PostgreSQL array and row expressions. This allows an unauthenticated attacker to smuggle dangerous functions, such as large object operations, to achieve RCE with the privileges of the database user.
Business Impact
Exploitation of this vulnerability results in full compromise of the database server. Attackers can exfiltrate entire datasets, corrupt document stores, or gain a foothold for further network attacks. The CVSS score of 9.9 reflects the high impact of bypassing security controls to achieve unauthenticated code execution.
Remediation Plan
Immediate Action: Update the WeKnora framework to version 0.2.12 immediately to resolve the recursive validation flaw.
Proactive Monitoring: Review PostgreSQL logs for unusual function calls (e.g., lo_import, lo_export) and monitor for anomalous SQL syntax involving complex array expressions.
Compensating Controls: Apply the principle of least privilege to the database user account to limit the impact of a successful SQL injection or RCE.
Exploitation Status
Public Exploit Available: true
Analyst Notes: As of Mar 7, 2026, the technical details for bypassing the validation system are public. The ability to chain SQL injection into RCE makes this a highly attractive target for threat actors.
Analyst Recommendation
This is a critical vulnerability that bypasses standard SQL injection protections. Immediate patching to version 0.2.12 is the only effective way to ensure the security of the database and the WeKnora application environment.
Update PostgreSQL array expressions to the latest version. Monitor for exploitation attempts and review access logs.
GStreamer H
GStreamer H
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval
---METADATA---
VENDOR: WeKnora
PRODUCT: WeKnora LLM Framework
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---
Description Summary:
A high-severity vulnerability has been found in the WeKnora LLM framework, potentially impacting document understanding and semantic retrieval security.
Executive Summary:
WeKnora is affected by a high-severity vulnerability that could compromise the confidentiality and integrity of processed documents and semantic data.
Vulnerability Details
CVE-ID: CVE-2026-30855
Affected Software: WeKnora LLM Framework
Affected Versions: See vendor advisory for affected versions
Vulnerability: This vulnerability exists within the WeKnora framework's document processing or retrieval logic. With a CVSS score of 8.8, the flaw likely allows for unauthorized data access or manipulation of the document understanding pipeline.
Business Impact
An attacker could potentially access sensitive documents stored within the framework or manipulate the semantic retrieval results to provide false information. The CVSS score of 8.8 indicates a high risk to the core functionality of the platform.
Remediation Plan
Immediate Action: Update the WeKnora framework to the latest patched version as recommended by the vendor.
Proactive Monitoring: Monitor for anomalous document access patterns and review system logs for errors in the semantic retrieval engine.
Compensating Controls: Implement strict role-based access control (RBAC) to ensure that users can only access the documents and flows they are authorized to see.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. This is one of several vulnerabilities identified in the WeKnora framework recently, suggesting a need for a comprehensive security audit.
Analyst Recommendation
Apply the necessary updates immediately. Given the sensitive nature of document understanding frameworks, maintaining a fully patched environment is essential to prevent data breaches.
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
Caddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
---METADATA---
VENDOR: GStreamer
PRODUCT: GStreamer
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---
Description Summary:
GStreamer's rtpqdm2depay component contains a heap-based buffer overflow that could lead to unauthenticated remote code execution.
Executive Summary:
A critical heap-based buffer overflow in GStreamer allows unauthenticated attackers to execute arbitrary code remotely by exploiting the rtpqdm2depay media processing module.
Vulnerability Details
CVE-ID: CVE-2026-3085
Affected Software: GStreamer GStreamer
Affected Versions: See vendor advisory for specific affected versions
Vulnerability: This vulnerability is a heap-based buffer overflow within the rtpqdm2depay depayloader. An unauthenticated attacker can trigger the overflow by providing a malicious RTP stream, leading to memory corruption and subsequent remote code execution.
Business Impact
With a CVSS score of 8.8, this vulnerability poses a severe threat to system availability and data confidentiality. Exploitation could result in a complete system takeover, allowing attackers to bypass security boundaries and access sensitive internal resources.
Remediation Plan
Immediate Action: Update GStreamer to the latest available version to patch the heap-based buffer overflow in the rtpqdm2depay component.
Proactive Monitoring: Implement memory-integrity monitoring and review system logs for segmentation faults or application crashes related to GStreamer processes.
Compensating Controls: Deploy a Web Application Firewall (WAF) or specialized protocol filter to inspect and validate RTP traffic before it reaches the GStreamer processing engine.
Exploitation Status
Public Exploit Available: false
Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. The technical complexity of heap overflows is high, but the potential impact on media-heavy environments is catastrophic.
Analyst Recommendation
The 8.8 CVSS score indicates a critical priority. Organizations must ensure all systems utilizing GStreamer for RTP stream processing are updated immediately to prevent potential remote exploitation.
Apply security patches immediately for internet-facing systems. Monitor for exploitation attempts and review access logs.
Wallos is an open-source, self-hostable personal subscription tracker
Wallos is an open-source, self-hostable personal subscription tracker
Apply vendor security updates immediately. Monitor for exploitation attempts and review access logs.
---METADATA---
VENDOR: Parse
PRODUCT: Parse Server
AFFECTED_VERSIONS: Prior to 9.5.2-alpha.7 and 8.6.20
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---
Description Summary:
Parse Server is vulnerable to unauthorized access of internal relation tables via REST or GraphQL APIs, allowing privilege escalation via role manipulation.
Executive Summary:
A critical vulnerability in Parse Server allows unauthenticated attackers to manipulate internal relation tables, leading to full unauthorized access and privilege escalation.
Vulnerability Details
CVE-ID: CVE-2026-30966
Affected Software: Parse Parse Server
Affected Versions: Prior to 9.5.2-alpha.7 and 8.6.20
Vulnerability: The application fails to enforce master key requirements for internal table access, allowing any client with an application key to perform unauthorized CRUD operations on relation mappings. This vulnerability allows an unauthenticated attacker to inject themselves into privileged roles and bypass Class-Level Permissions (CLP).
Business Impact
Successful exploitation grants an attacker full administrative control over the backend data, including the ability to read, modify, or delete sensitive records. Given the CVSS score of 10.0, this represents a complete compromise of the application's integrity and confidentiality, potentially resulting in significant data breaches and total loss of system security.
Remediation Plan
Immediate Action: Upgrade Parse Server installations to version 9.5.2-alpha.7 or 8.6.20 immediately.
Proactive Monitoring: Review API access logs for anomalous requests targeting internal relation tables or unexpected changes to user role memberships.
Compensating Controls: Implement strict network-level access controls to limit access to API endpoints to known, trusted IP addresses while the update is being staged.
Exploitation Status
Public Exploit Available: Not specified
Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.
Analyst Recommendation
This vulnerability is highly critical due to the lack of necessary authentication checks for sensitive database operations. Administrators must prioritize patching Parse Server to the identified secure versions to prevent unauthorized privilege escalation and data manipulation.