---METADATA---
VENDOR: HKUDS
PRODUCT: nanobot
AFFECTED_VERSIONS: < 0.1.5
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/HKUDS/nanobot/security/advisories/GHSA-v5j3-4q66-58cf","name":"https://github.com/HKUDS/nanobot/security/advisories/GHSA-v5j3-4q66-58cf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/HKUDS/nanobot/releases/tag/v0.1.5","name":"https://github.com/HKUDS/nanobot/releases/tag/v0.1.5","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.719Z
---END_METADATA---

Description Summary:
HKUDS nanobot contains a Cross-Site WebSocket Hijacking vulnerability due to missing Origin header validation in the WebSocket server, allowing unauthorized cross-origin access.

Executive Summary:
A Cross-Site WebSocket Hijacking vulnerability in HKUDS nanobot allows remote attackers to gain full access to the bridge API and hijack user WhatsApp sessions.

Vulnerability Details

CVE-ID: CVE-2026-35589

Affected Software: HKUDS nanobot

Affected Versions: < 0.1.5

Vulnerability: The application fails to validate the Origin header during the WebSocket handshake, allowing any website visited by a user to establish a connection to the local WebSocket server. This vulnerability is unauthenticated, as the default configuration disables token-based authentication.

Business Impact

The exploitation of this vulnerability poses a severe risk to user privacy and account integrity. An attacker can hijack active WhatsApp sessions, read private messages, steal authentication credentials, or perform actions on behalf of the user. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to significant data compromise and unauthorized account control.

Remediation Plan

Immediate Action: Update the HKUDS nanobot software to version 0.1.5 or later, which implements the necessary origin validation.

Proactive Monitoring: Monitor local machine network traffic for unexpected WebSocket connections originating from browser-based processes to the bridge API on port 3001.

Compensating Controls: Ensure that browser extensions or security software are active to block malicious or suspicious cross-origin requests, although an update remains the only definitive fix.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw persists because the WebSocket server does not enforce the Same-Origin Policy, making it highly susceptible to exploitation via standard web browsing.

Analyst Recommendation

Due to the high severity and the potential for total compromise of the WhatsApp bridge, users must prioritize upgrading to version 0.1.5 immediately. The lack of default authentication combined with the failure to validate origins makes this an accessible target for remote attackers. Failure to patch leaves the underlying messaging session exposed to unauthorized monitoring and manipulation.

---METADATA---
VENDOR: National Security Agency
PRODUCT: Emissary
AFFECTED_VERSIONS: < 8.43.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3p24-9x7v-7789","name":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3p24-9x7v-7789","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/NationalSecurityAgency/emissary/commit/1faf33f2494c0128f250d7d2e8f2da99bbd32ae8","name":"https://github.com/NationalSecurityAgency/emissary/commit/1faf33f2494c0128f250d7d2e8f2da99bbd32ae8","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.679Z
---END_METADATA---

Description Summary:
The Emissary workflow engine is vulnerable to OS command injection via improper sanitization of configuration file paths in the Executrix component, allowing arbitrary code execution.

Executive Summary:
A high-severity OS command injection vulnerability in the National Security Agency Emissary engine allows local authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35582

Affected Software: National Security Agency Emissary

Affected Versions: < 8.43.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring within the Executrix.getCommand() function. An attacker with the ability to modify configuration files can inject arbitrary shell metacharacters into file ending parameters, which are then executed by the JVM process.

Business Impact

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary commands with the privileges of the underlying JVM process. Given the CVSS score of 8.8, this vulnerability poses a severe risk to data confidentiality, integrity, and system availability. Unauthorized access could lead to a complete system takeover, potentially exposing sensitive data processed by the workflow engine.

Remediation Plan

Immediate Action: Update the Emissary installation to version 8.43.0 or higher immediately to incorporate the necessary input validation patches.

Proactive Monitoring: Monitor system logs for unexpected shell process spawning or suspicious modifications to configuration files (e.g., .cfg files) within the application directory.

Compensating Controls: Ensure strict access control lists are enforced on the file system to prevent unauthorized users from modifying configuration files, as this is the primary attack vector.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it lacks any effective mitigation for downstream implementors other than upgrading the core framework.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, as it provides a direct path to code execution for any user capable of altering configuration inputs. Organizations should prioritize updating to Emissary 8.43.0 to neutralize the flaw at the source. If an immediate upgrade is not feasible, restrict access to configuration files to the absolute minimum number of authorized personnel to reduce the attack surface.

---METADATA---
VENDOR: Emissary
PRODUCT: Emissary
AFFECTED_VERSIONS: Prior to 8.39.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A shell injection vulnerability in Emissary workflow files allows attackers with repository write access to execute arbitrary commands, leading to supply chain compromise.

Executive Summary:
A critical shell injection vulnerability in the Emissary workflow engine allows attackers with repository write access to execute arbitrary commands and compromise downstream users.

Vulnerability Details

CVE-ID: CVE-2026-35580

Affected Software: Emissary Emissary

Affected Versions: Prior to 8.39.0

Vulnerability: The vulnerability exists due to the insecure interpolation of user-controlled workflow_dispatch inputs directly into shell commands via ${{ }} syntax within workflow files. This allows an authenticated attacker with repository write access to inject malicious shell commands.

Business Impact

This flaw facilitates supply chain attacks, potentially allowing an attacker to poison build artifacts and impact all users downstream of the affected workflow. The CVSS score of 9.1 reflects the high potential for widespread disruption and unauthorized code execution within the software development lifecycle.

Remediation Plan

Immediate Action: Upgrade the Emissary workflow engine to version 8.39.0 or later to ensure proper sanitization of inputs.

Proactive Monitoring: Inspect existing workflow files for suspicious ${{ }} expressions and review audit logs for unexpected shell commands executed by the workflow engine.

Compensating Controls: Restrict repository write access to trusted personnel only and implement strict peer review processes for all changes to workflow configuration files.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Supply chain security is paramount; failure to remediate this vulnerability could result in the compromise of downstream development pipelines. Organizations should prioritize updating to version 8.39.0 and reviewing repository access permissions to mitigate the risk of malicious command injection.

---METADATA---
VENDOR: Philips
PRODUCT: Hue Bridge
AFFECTED_VERSIONS: Philips Hue Bridge: 1.73.1973146020
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-156/","name":"ZDI-26-156","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.290Z
---END_METADATA---

Description Summary:
The Philips Hue Bridge HomeKit Accessory Protocol contains a missing authentication vulnerability that allows network-adjacent attackers to bypass security controls.

Executive Summary:
An unauthenticated, network-adjacent attacker can bypass authentication on Philips Hue Bridge devices, posing a high risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-3558

Affected Software: Philips Hue Bridge

Affected Versions: Philips Hue Bridge: 1.73.1973146020

Vulnerability: This flaw exists in the HomeKit Accessory Protocol service, which listens on TCP port 8080. It is a missing authentication vulnerability (CWE-306) that allows any unauthenticated attacker on the local network to gain access to bridge functionality.

Business Impact

The ability for an attacker to bypass authentication on the Hue Bridge can lead to unauthorized control over connected smart home devices and potential exposure of local network configurations. Given the CVSS score of 8.1, this represents a high-severity risk that could be leveraged to facilitate further lateral movement or unauthorized environmental control within a compromised facility.

Remediation Plan

Immediate Action: Monitor for official security updates from Philips and apply them as soon as they become available. In the interim, consider restricting access to the Hue Bridge management interfaces via network segmentation.

Proactive Monitoring: Review firewall logs and network traffic for unusual activity originating from or directed toward TCP port 8080.

Compensating Controls: Isolate the Hue Bridge on a dedicated VLAN to prevent unauthorized devices from reaching the HomeKit Accessory Protocol service.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is accessible to unauthenticated attackers, it requires network adjacency, which limits the attack surface to the local network segment.

Analyst Recommendation

This vulnerability presents a significant security gap due to the total lack of authentication for critical functions. Organizations and users should immediately isolate affected devices from untrusted network segments and prioritize the application of vendor patches once released to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: < 7.0.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ChurchCRM/CRM/pull/8016","name":"https://github.com/ChurchCRM/CRM/pull/8016","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in the Person Property Management subsystem of ChurchCRM allows authenticated users to inject arbitrary JavaScript code into person profiles.

Executive Summary:
A stored cross-site scripting vulnerability in ChurchCRM versions prior to 7.0.0 enables authenticated attackers to execute malicious scripts, potentially leading to full account compromise.

Vulnerability Details

CVE-ID: CVE-2026-35576

Affected Software: ChurchCRM

Affected Versions: < 7.0.0

Vulnerability: This is a stored cross-site scripting (CWE-79) vulnerability within the Person Property Management subsystem. An authenticated user can inject malicious JavaScript into person properties, which executes when other users view the profile or access the printable view.

Business Impact

Successful exploitation permits an attacker to perform actions on behalf of other users, including administrators, which may lead to session hijacking or the theft of sensitive church member data. Given the CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of the application environment.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 7.0.0 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web application logs for suspicious script tags or encoded payloads being submitted to the Person Property Management interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and prevent the loading of untrusted resources.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from improper neutralization of user-supplied data in the property management module, which persists even after previous security patches.

Analyst Recommendation

Organizations utilizing ChurchCRM must prioritize the update to version 7.0.0 immediately. Because this vulnerability allows for persistent malicious script execution, failing to patch leaves the system open to ongoing session hijacking and unauthorized administrative actions by any authenticated user on the platform.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in ChurchCRM prior to version 6.5.3 allows authenticated users to execute malicious scripts in an administrator session, potentially leading to account takeover.

Executive Summary:
A high-severity stored cross-site scripting vulnerability in ChurchCRM allows authenticated attackers to execute arbitrary JavaScript, posing a risk of full administrative account takeover.

Vulnerability Details

CVE-ID: CVE-2026-35575

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.3

Vulnerability: This vulnerability is a stored cross-site scripting (XSS) flaw located in the admin panel group-creation feature. It requires an authenticated user with group-creation privileges to inject malicious scripts, which execute when an administrator interacts with the compromised page.

Business Impact

The vulnerability carries a CVSS score of 8.0, reflecting its significant potential for impact. Successful exploitation permits attackers to hijack administrative sessions, granting them unauthorized access to sensitive church management data, member information, and system configuration, which could result in severe data breaches and loss of system integrity.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the security fix provided by the vendor.

Proactive Monitoring: Monitor server logs for suspicious activity originating from authenticated user accounts, specifically focusing on the group-creation module.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input patterns associated with XSS attacks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application fails to sanitize inputs in the group-creation feature and lacks the HttpOnly flag on session cookies, facilitating the theft of administrative credentials.

Analyst Recommendation

Given the potential for complete administrative account takeover, this vulnerability poses a critical risk to the confidentiality and integrity of your organization. IT administrators must prioritize updating ChurchCRM to version 6.5.3 immediately to eliminate the underlying injection flaw and prevent session hijacking attempts.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 6.5.3
---END_METADATA---

Description Summary:
ChurchCRM's backup restore functionality is vulnerable to path traversal, allowing authenticated administrators to overwrite configuration files and achieve remote code execution.

Executive Summary:
A path traversal flaw in ChurchCRM allows an authenticated administrator to achieve remote code execution by overwriting sensitive system configuration files.

Vulnerability Details

CVE-ID: CVE-2026-35573

Affected Software: ChurchCRM

Affected Versions: Prior to 6.5.3

Vulnerability: The vulnerability resides in the src/ChurchCRM/Backup/RestoreJob.php file, where improper handling of the $rawUploadedFile['name'] parameter allows for path traversal. An authenticated administrator can upload arbitrary files, such as a malicious .htaccess file, to the server's directory structure to gain code execution.

Business Impact

While this vulnerability requires administrative authentication, the impact is critical (CVSS 9.1). A compromised administrator account can lead to full server takeover, unauthorized access to sensitive donor and member data, and significant operational disruption of the church management system.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary path validation fixes.

Proactive Monitoring: Audit logs for administrative file upload activity and monitor for unexpected changes to .htaccess files or other sensitive configuration files.

Compensating Controls: Ensure that the web server process runs with the least privileges necessary and that the /tmp_attach/ directory is restricted from executing scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ChurchCRM must verify their current version and apply the 6.5.3 update immediately. Additionally, ensure that administrative access is restricted to authorized personnel only to mitigate the risk of account compromise.

---METADATA---
VENDOR: Gitlawb
PRODUCT: OpenClaude
AFFECTED_VERSIONS: < 0.5.1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m6rx-7pvw-2f73","name":"https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m6rx-7pvw-2f73","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Gitlawb/openclaude/commit/7002cb302b78ea2a19da3f26226de24e2903fa1d","name":"https://github.com/Gitlawb/openclaude/commit/7002cb302b78ea2a19da3f26226de24e2903fa1d","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.635Z
---END_METADATA---

Description Summary:
A logic flaw in the OpenClaude bashToolHasPermission function allows attackers to bypass path traversal restrictions when the sandbox auto-allow feature is enabled.

Executive Summary:
A path traversal vulnerability in Gitlawb OpenClaude versions prior to 0.5.1 permits unauthorized file system access, posing a significant risk to the integrity of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-35570

Affected Software: Gitlawb OpenClaude

Affected Versions: < 0.5.1

Vulnerability: The vulnerability resides in the bashToolHasPermission function within src/tools/BashTool/bashPermissions.ts, where an incorrect execution order allows commands to bypass path constraints. This flaw is reachable by a local user who can trigger the coding-agent command line interface with the sandbox auto-allow feature active.

Business Impact

The ability to bypass directory restrictions allows an attacker to read or write files outside of the intended sandbox environment, potentially leading to the compromise of sensitive system data. With a CVSS score of 8.4, this high-severity vulnerability represents a significant risk to confidential information and system integrity. Failure to remediate could allow an attacker to escalate their access within the host system.

Remediation Plan

Immediate Action: Update the OpenClaude package to version 0.5.1 or later via npm to ensure the logic flaw in permission checking is resolved.

Proactive Monitoring: Review system access logs for unusual command executions or attempts to access files outside of defined project directories.

Compensating Controls: Disable the sandbox auto-allow feature until the update can be applied to prevent the vulnerable logic path from being triggered.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it turns a restricted sandbox into an unrestricted execution environment for local users.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, organizations using OpenClaude must treat this as a priority update. Upgrading to version 0.5.1 is the only reliable method to patch the underlying logic flaw and restore sandbox security. Organizations should verify their current version and implement the update immediately to prevent unauthorized file access.

---METADATA---
VENDOR: Philips
PRODUCT: Hue Bridge
AFFECTED_VERSIONS: Philips Hue Bridge: 1.73.1973146020
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-155/","name":"ZDI-26-155","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.290Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the hap_pair_verify_handler function of the Philips Hue Bridge allows network-adjacent attackers to achieve remote code execution as root.

Executive Summary:
A heap-based buffer overflow vulnerability in the Philips Hue Bridge allows network-adjacent attackers to gain root-level remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3557

Affected Software: Philips Hue Bridge

Affected Versions: Philips Hue Bridge: 1.73.1973146020

Vulnerability: The flaw exists in the hap_pair_verify_handler function of the hk_hap service due to insufficient length validation of user-supplied data before copying it to a heap buffer. Although the vulnerability requires authentication, the mechanism can be bypassed, allowing a network-adjacent attacker to execute arbitrary code with root privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected Philips Hue Bridge device with root-level permissions. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to the compromise of the local network segment, potential lateral movement, and total loss of device confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Restrict access to the Hue Bridge management interface (TCP port 8080) to trusted network segments only, and monitor for any vendor-issued firmware updates.

Proactive Monitoring: Review network traffic logs for unusual activity targeting TCP port 8080 and inspect device logs for unexpected service restarts or unauthorized configuration changes.

Compensating Controls: Implement network segmentation to isolate the Hue Bridge from critical internal assets and ensure that the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to grant root-level execution via a bypass of the authentication process.

Analyst Recommendation

Due to the potential for root-level remote code execution, this vulnerability poses a significant risk to network security. Administrators should prioritize isolating the device from unauthorized network access and remain vigilant for official firmware updates from Philips to address the underlying heap overflow.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: Apostrophe
AFFECTED_VERSIONS: < 4.29.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292","name":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3","name":"https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3","tags":["x_refsource_MISC"]},{"url":"https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569","name":"https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.711Z
---END_METADATA---

Description Summary:
ApostropheCMS versions before 4.29.0 are vulnerable to stored cross-site scripting via SEO fields, allowing authenticated users to execute arbitrary JavaScript in the context of other users.

Executive Summary:
ApostropheCMS versions prior to 4.29.0 contain a stored cross-site scripting vulnerability that allows authenticated attackers to execute malicious scripts, potentially leading to unauthorized data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-35569

Affected Software: ApostropheCMS Apostrophe

Affected Versions: < 4.29.0

Vulnerability: The vulnerability is a stored cross-site scripting (XSS) flaw located in SEO-related fields, specifically the SEO Title and Meta Description. Due to improper output encoding, an authenticated attacker can inject malicious payloads that execute in the browser of any user viewing the affected page.

Business Impact

Successful exploitation permits an attacker to perform actions on behalf of other authenticated users, including administrators. This can lead to unauthorized API requests, the theft of sensitive user data, and potential account compromise. Given the CVSS score of 8.7, this vulnerability poses a high risk to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: Update the ApostropheCMS package to version 4.29.0 or later to ensure proper output encoding is applied to SEO fields.

Proactive Monitoring: Monitor internal access logs for anomalous API requests or suspicious script execution patterns originating from the content management system.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and prevent data exfiltration to external domains.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability advisory.

Analyst Notes: As of April 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable because the system fails to sanitize user-controlled input before rendering it in sensitive HTML contexts.

Analyst Recommendation

This vulnerability represents a significant security risk for environments utilizing ApostropheCMS. Security teams must prioritize updating to version 4.29.0 immediately to remediate the underlying lack of input sanitization. Failure to patch allows authenticated users to escalate privileges or exfiltrate sensitive information, necessitating prompt action to protect the integrity of the application environment.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.247Z
---END_METADATA---

Description Summary:
ChurchCRM, an open-source church management platform, contains an unspecified vulnerability that requires further technical clarification to determine the precise impact and exploitation vector.

Executive Summary:
An unspecified security vulnerability in ChurchCRM poses a significant risk to organizational data integrity and system security, warranting immediate investigation and remediation.

Vulnerability Details

CVE-ID: CVE-2026-35567

Affected Software: ChurchCRM ChurchCRM

Affected Versions: See vendor advisory

Vulnerability: The vulnerability details for this entry are currently insufficient to identify the specific flaw or the required authentication level for exploitation.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk that could lead to significant unauthorized access or system compromise. If left unaddressed, this vulnerability may allow attackers to manipulate sensitive member data, disrupt administrative operations, or gain unauthorized control over the management system, leading to potential reputational and operational damage.

Remediation Plan

Immediate Action: Organizations should monitor the official ChurchCRM repository and security advisories for the release of a patch or specific version guidance.

Proactive Monitoring: Security teams should review application and database access logs for unusual patterns, unauthorized login attempts, or anomalous administrative activity.

Compensating Controls: Deploy a Web Application Firewall with strict rule sets to inspect incoming traffic and block suspicious requests targeting the ChurchCRM web interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of detailed technical documentation necessitates a proactive approach to monitoring and system hardening until the vendor provides specific patch information.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be treated with urgency despite the current lack of specific technical details. Administrators must prioritize regular check-ins with official vendor channels and apply security updates as soon as they are made available to protect the integrity of the church management environment.

---METADATA---
VENDOR: Apache
PRODUCT: Directory LDAP API
AFFECTED_VERSIONS: Apache Directory LDAP API version 2.1.7 and earlier
---END_METADATA---

Description Summary:
The Apache Directory LDAP API client fails to verify the hostname during TLS certificate validation, enabling man-in-the-middle attacks.

Executive Summary:
Apache Directory LDAP API is vulnerable to man-in-the-middle attacks because it does not properly verify LDAP server hostnames during the handshake.

Vulnerability Details

CVE-ID: CVE-2026-35563

Affected Software: Apache Directory LDAP API

Affected Versions: Apache Directory LDAP API version 2.1.7 and earlier

Vulnerability: This is a high-severity vulnerability (CWE-297) where the client validates the certificate chain but fails to confirm that the certificate matches the specific LDAP hostname. This allows an attacker to present a valid certificate for a different server to impersonate the legitimate LDAP server.

Business Impact

With a CVSS score of 8.5, this flaw allows attackers to intercept or manipulate LDAP traffic. This can lead to the exposure of credentials, unauthorized access to directory services, or the compromise of authentication flows within the enterprise network.

Remediation Plan

Immediate Action: Upgrade to the latest available version of the Apache Directory LDAP API that enforces strict hostname verification.

Proactive Monitoring: Monitor for suspicious LDAP traffic patterns or certificate mismatch alerts if your monitoring tools are capable of inspecting encrypted traffic.

Compensating Controls: Ensure that all LDAP traffic is routed through encrypted tunnels or use mutual TLS (mTLS) with strict certificate pinning where supported.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The failure to verify hostnames in security-critical libraries is a significant oversight. Organizations relying on Apache Directory LDAP API should update their dependencies immediately to ensure proper hostname validation is in place and to secure their authentication infrastructure.

---METADATA---
VENDOR: Amazon
PRODUCT: Athena ODBC Driver
AFFECTED_VERSIONS: Versions prior to 2.0
---END_METADATA---

Description Summary:
The Amazon Athena ODBC driver is vulnerable to resource exhaustion due to unlimited resource allocation within its parsing components during data processing.

Executive Summary:
Amazon Athena ODBC driver versions prior to 2.0 are susceptible to a denial-of-service condition caused by unrestricted resource allocation during the parsing of incoming data.

Vulnerability Details

CVE-ID: CVE-2026-35562

Affected Software: Amazon Athena ODBC Driver

Affected Versions: Versions prior to 2.0

Vulnerability: This vulnerability involves the allocation of resources without limits within the driver's parsing components. An attacker can exploit this flaw by providing specially crafted input that causes the driver to consume excessive system memory or CPU, typically occurring during the initial data parsing phase.

Business Impact

A successful exploit of this vulnerability can lead to a complete Denial of Service (DoS) for applications relying on the Athena ODBC driver. This results in system instability, application crashes, and the inability to process data queries, potentially halting business operations that depend on real-time data analytics. The CVSS score of 7.5 reflects a High severity, primarily due to the impact on system availability.

Remediation Plan

Immediate Action: Administrators should immediately upgrade to Amazon Athena ODBC driver version 2.0 or later to resolve the unrestricted resource allocation issue.

Proactive Monitoring: Monitor system resource usage (CPU and Memory) on hosts utilizing the ODBC driver for unexplained spikes that may indicate exploitation attempts.

Compensating Controls: Implement network-level access controls to ensure only trusted applications and IP addresses can establish connections via the ODBC driver.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high as it targets fundamental parsing logic.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent operational downtime. Organizations should prioritize the deployment of version 2.0 of the Amazon Athena ODBC driver across all affected environments to mitigate the risk of denial-of-service attacks.

---METADATA---
VENDOR: Amazon
PRODUCT: Athena ODBC Driver
AFFECTED_VERSIONS: Versions prior to 2.0
---END_METADATA---

Description Summary:
The Amazon Athena ODBC driver contains insufficient security controls in its browser-based authentication components, potentially allowing for unauthorized session access.

Executive Summary:
Weak authentication security controls in the Amazon Athena ODBC driver's browser-based login flow could allow unauthorized users to gain access to the data environment.

Vulnerability Details

CVE-ID: CVE-2026-35561

Affected Software: Amazon Athena ODBC Driver

Affected Versions: Versions prior to 2.0

Vulnerability: This vulnerability stems from insufficient authentication security controls within the driver's browser-based authentication components. This flaw could be exploited to bypass or weaken the authentication process, allowing an attacker to gain unauthorized access to the driver’s connection session.

Business Impact

Weaknesses in authentication controls directly threaten the security of the data stored in Amazon Athena. Unauthorized access could lead to large-scale data exfiltration, unauthorized data modification, or regulatory non-compliance. The CVSS score of 7.4 reflects the high risk of unauthorized access to sensitive business intelligence data.

Remediation Plan

Immediate Action: Organizations must update to Amazon Athena ODBC driver version 2.0 or later, which implements strengthened authentication controls for browser-based flows.

Proactive Monitoring: Audit Amazon Athena access logs for unusual login patterns, such as logins from unexpected locations or at unusual times.

Compensating Controls: Implement Multi-Factor Authentication (MFA) at the Identity Provider level to provide an additional layer of security that remains effective even if driver-level controls are weak.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Authentication bypasses are highly sought after by threat actors, making timely patching essential.

Analyst Recommendation

Securing the authentication gateway is critical for maintaining data sovereignty. Administrators should treat this as a high-priority update and deploy version 2.0 across all workstations and servers utilizing the Athena ODBC driver.

---METADATA---
VENDOR: Amazon
PRODUCT: Athena ODBC Driver
AFFECTED_VERSIONS: Versions prior to 2.0
---END_METADATA---

Description Summary:
The Amazon Athena ODBC driver fails to properly validate certificates within its identity provider (IdP) connection components, enabling potential interception.

Executive Summary:
Improper certificate validation in the Amazon Athena ODBC driver prior to version 2.0 allows attackers to perform Man-in-the-Middle (MitM) attacks during identity provider authentication.

Vulnerability Details

CVE-ID: CVE-2026-35560

Affected Software: Amazon Athena ODBC Driver

Affected Versions: Versions prior to 2.0

Vulnerability: The driver's identity provider connection components do not correctly validate the digital certificates presented by the IdP. This unauthenticated flaw allows a network-positioned attacker to present a fraudulent certificate, which the driver will incorrectly trust.

Business Impact

Failure to validate certificates exposes sensitive authentication traffic to Man-in-the-Middle attacks. Attackers can intercept, decrypt, and modify communication between the driver and the identity provider, leading to the theft of credentials and unauthorized access to Amazon Athena data. The CVSS score of 7.4 indicates a High severity risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade the Amazon Athena ODBC driver to version 2.0 or later to ensure proper certificate validation logic is enforced.

Proactive Monitoring: Inspect network traffic for unusual certificate authorities or self-signed certificates appearing in connections to identity providers.

Compensating Controls: Ensure the use of encrypted tunnels (VPNs) and secure network segments for all administrative and data-access traffic to reduce the risk of interception.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, MitM attacks are a common method for credential harvesting in enterprise environments.

Analyst Recommendation

Organizations using Amazon Athena must prioritize this update to protect their authentication chain. Applying the version 2.0 update is the only effective way to ensure that identity provider connections are properly authenticated and secured against interception.

---METADATA---
VENDOR: Philips
PRODUCT: Hue Bridge
AFFECTED_VERSIONS: Philips Hue Bridge: 1.73.1973146020
CONFIDENCE: high
MISSING: patch, exploit_status
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-154/","name":"ZDI-26-154","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.290Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Philips Hue Bridge HomeKit component allows unauthenticated network-adjacent attackers to execute arbitrary code.

Executive Summary:
A heap-based buffer overflow vulnerability in the Philips Hue Bridge allows unauthenticated, network-adjacent attackers to achieve remote code execution, posing a significant risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-3556

Affected Software: Philips Hue Bridge

Affected Versions: Philips Hue Bridge: 1.73.1973146020

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) occurring in the hk_hap_pair_storage_put function, which fails to validate the length of user-supplied data before copying it to a fixed-length buffer. The vulnerability is exploitable by unauthenticated, network-adjacent attackers.

Business Impact

Successful exploitation of this flaw allows for remote code execution in the context of the HomeKit service. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to the complete compromise of the Hue Bridge, potentially serving as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Monitor official Philips security advisories for the release of a firmware update and apply it immediately upon availability.

Proactive Monitoring: Review network access logs for anomalous traffic directed at the HomeKit service ports, specifically looking for unexpected large payloads during the pairing process.

Compensating Controls: Restrict access to the Hue Bridge to trusted network segments and ensure the device is not directly exposed to the public internet to mitigate the network-adjacent attack vector.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to facilitate unauthenticated code execution via memory corruption.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability, users should prioritize the security of their Philips Hue Bridge hardware. While a patch is currently pending, administrators must restrict network exposure and prepare to deploy the vendor-supplied firmware update as soon as it is released to prevent potential exploitation.

---METADATA---
VENDOR: Amazon
PRODUCT: Athena ODBC driver
AFFECTED_VERSIONS: Before version 2
---END_METADATA---

Description Summary:
The Amazon Athena ODBC driver contains a high-severity vulnerability due to improper neutralization of special elements in its authentication components.

Executive Summary:
A vulnerability in the Amazon Athena ODBC driver's authentication process could allow attackers to bypass security controls or gain unauthorized access to cloud data.

Vulnerability Details

CVE-ID: CVE-2026-35558

Affected Software: Amazon Athena ODBC driver

Affected Versions: Before version 2

Vulnerability: This vulnerability involves the improper neutralization of special elements within the driver's authentication components. This suggests a potential for injection-style attacks that could manipulate the authentication flow, potentially allowing an attacker to bypass credential checks or escalate privileges.

Business Impact

A successful exploit could lead to unauthorized access to sensitive data stored in Amazon Athena, resulting in data breaches and regulatory non-compliance. With a CVSS score of 7.8, the risk to data confidentiality and integrity is high, especially for organizations that use ODBC drivers to connect legacy applications to cloud data lakes.

Remediation Plan

Immediate Action: Upgrade the Amazon Athena ODBC driver to version 2 or later on all client machines and servers immediately.

Proactive Monitoring: Audit Amazon Athena query logs in AWS CloudTrail for any unusual or unauthorized data access patterns originating from ODBC connections.

Compensating Controls: Use AWS Identity and Access Management (IAM) policies to enforce the principle of least privilege, ensuring that even if a driver is compromised, the attacker's access to data is limited.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. Authentication flaws in database drivers are critical because they reside at the junction between applications and sensitive data stores.

Analyst Recommendation

Immediate application of the updated driver is the most effective mitigation strategy. Administrators should ensure that all instances of the driver, including those on developer workstations and automated reporting servers, are identified and patched without delay.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Kafka Java
AFFECTED_VERSIONS: Apache Kafka Clients: 2.8.0 through 3.9.1, 4.0.0 through 4.0.1, 4.1.0 through 4.1.1
CONFIDENCE: high
MISSING: none
CREDITS: Bharath Vissapragada bharathv@apache.org (reporter); Donny Nadolny donny.nadolny@hotmail.com (finder); Donny Nadolny donny.nadolny@hotmail.com (remediation developer)
SOURCES_JSON: [{"url":"https://issues.apache.org/jira/browse/KAFKA-19012","name":null,"tags":["issue-tracking"]},{"url":"https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6","name":null,"tags":["mailing-list","vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
A race condition in the Apache Kafka Java producer client's buffer pool management can cause messages to be silently delivered to incorrect topics, leading to data exposure and corruption.

Executive Summary:
A critical race condition vulnerability in the Apache Kafka Java producer client allows for the silent misrouting of messages, posing a severe risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-35554

Affected Software: Apache Software Foundation Kafka Java

Affected Versions: Apache Kafka Clients: 2.8.0 through 3.9.1, 4.0.0 through 4.0.1, 4.1.0 through 4.1.1

Vulnerability: This vulnerability involves a race condition (CWE-362) and use-after-free (CWE-416) within the buffer pool management logic, which is triggered when a produce batch expires while a network request is still in flight. Because the flaw occurs during internal producer processing, it does not require user authentication to trigger if an attacker can influence the producer environment.

Business Impact

The potential for silent message misrouting carries significant business consequences, including the unauthorized disclosure of sensitive information to unintended consumers and the corruption of downstream data pipelines. Given the CVSS score of 8.7, this flaw is categorized as High severity, as it directly undermines the fundamental trust and integrity of data streaming architectures.

Remediation Plan

Immediate Action: Upgrade the Kafka client libraries to versions 3.9.2, 4.0.2, or 4.1.2 to incorporate the necessary synchronization fixes.

Proactive Monitoring: Monitor consumer applications for unexpected deserialization errors or anomalous message content that may indicate data was delivered to an incorrect topic.

Compensating Controls: While network-level controls may not prevent this internal race condition, ensure that strict access control lists (ACLs) are applied to all Kafka topics to limit the impact if data is delivered to an unintended destination.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires specific timing conditions related to network latency and batch expiration, making it complex to weaponize, though the impact of successful exploitation remains severe.

Analyst Recommendation

Organizations utilizing the Apache Kafka Java producer client must prioritize upgrading to the patched versions immediately. Given the silent nature of this data corruption, administrators should also perform a thorough review of message integrity logs to determine if any unusual delivery patterns occurred prior to the patch application.

---METADATA---
VENDOR: CAXperts
PRODUCT: UPVWebServices and UDiTH Portal
AFFECTED_VERSIONS: CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0
CONFIDENCE: high
MISSING: patch, technical_details
SOURCES_JSON: [{"url":"https://caxperts.com","name":null,"tags":[]},{"url":"https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:20:30.648Z
---END_METADATA---

Description Summary:
An authorization bypass flaw in CAXperts UPVWebServices and UDiTH Portal allows low privileged users to invoke administrative APIs and deactivate application licenses.

Executive Summary:
An authorization bypass vulnerability in CAXperts UPVWebServices and UDiTH Portal allows authenticated users to execute administrative functions, resulting in potential license deactivation and severe service disruption.

Vulnerability Details

CVE-ID: CVE-2026-35552

Affected Software: CAXperts UPVWebServices and UDiTH Portal

Affected Versions: UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0

Vulnerability: This is an improper authorization vulnerability where missing access control checks on administrative API endpoints permit low privileged, authenticated remote users to perform restricted actions.

Business Impact

A successful exploit allows malicious actors with standard user credentials to deactivate the application license, causing complete operational downtime for affected web services. This disruption can halt critical business workflows, lead to productivity losses, and require emergency administrative intervention. The high CVSS score of 8.1 reflects the severe impact on system integrity and availability despite requiring initial low level authentication.

Remediation Plan

Immediate Action: Review the vendor security advisory from CAXperts and apply available software updates or patches as soon as they are released.

Proactive Monitoring: Monitor API access logs for unusual requests directed toward administrative endpoints originating from low privileged user accounts.

Compensating Controls: Implement strict network segmentation and restrict user role permissions to limit the exposure of sensitive API interfaces to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of missing authorization checks makes the administrative endpoint inherently vulnerable to abuse by any valid low privileged user.

Analyst Recommendation

Security teams must treat this high severity vulnerability with urgency due to its potential to disrupt core business operations. Organizations should audit current user accounts, restrict access privileges where possible, and apply vendor supplied patches immediately upon release.

---METADATA---
VENDOR: Philips
PRODUCT: Hue Bridge
AFFECTED_VERSIONS: Philips Hue Bridge: 1.73.1973146020
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-153/","name":"ZDI-26-153","tags":["x_research-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:39.290Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability in the Philips Hue Bridge Zigbee stack allows network-adjacent attackers to execute arbitrary code via malformed Zigbee ZCL frames.

Executive Summary:
A heap-based buffer overflow in the Philips Hue Bridge Zigbee stack creates a critical risk of remote code execution for devices during the pairing process.

Vulnerability Details

CVE-ID: CVE-2026-3555

Affected Software: Philips Hue Bridge

Affected Versions: Philips Hue Bridge: 1.73.1973146020

Vulnerability: This vulnerability occurs due to insufficient size validation of custom Zigbee ZCL frames within the Model Info download functionality, leading to a heap-based buffer overflow when data is copied to a fixed-size buffer. Exploitation requires an unauthenticated, network-adjacent attacker and user interaction in the form of initiating the device pairing process.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Hue Bridge firmware. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to full device compromise, potential lateral movement within the local network, and the loss of confidentiality, integrity, and availability for the affected hardware.

Remediation Plan

Immediate Action: Monitor official vendor communications and apply security patches for the Philips Hue Bridge as soon as they are made available by the manufacturer.

Proactive Monitoring: Inspect network traffic for anomalous Zigbee frame patterns and review device logs for signs of unexpected crashes or unauthorized configuration changes during pairing windows.

Compensating Controls: Restrict access to the local network where the Hue Bridge is deployed and ensure the device is segmented from sensitive corporate assets to minimize the potential for lateral movement.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for arbitrary code execution, though the requirement for user interaction during the pairing process provides a significant operational barrier for attackers.

Analyst Recommendation

This vulnerability presents a significant risk to the security of smart home and IoT environments. Administrators should prioritize the installation of firmware updates as soon as they are released by Philips and strictly control the device pairing window to prevent unauthorized network-adjacent actors from triggering the vulnerable code path.

---METADATA---
VENDOR: Guardsix
PRODUCT: ODBC Enrichment Plugins
AFFECTED_VERSIONS: Before 5.2.1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974","name":null,"tags":[]},{"url":"https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.567Z
---END_METADATA---

Description Summary:
A logic flaw in Guardsix ODBC Enrichment Plugins allows authenticated operators to perform SSRF and misuse stored credentials by retaining them when modifying connection endpoints.

Executive Summary:
An authenticated logic flaw in Guardsix ODBC Enrichment Plugins allows attackers to redirect database connections and misuse stored credentials, posing a significant risk of internal system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35548

Affected Software: Guardsix ODBC Enrichment Plugins

Affected Versions: Before 5.2.1

Vulnerability: The vulnerability is a logic flaw where stored database credentials are not cleared when an administrator updates the target Host, IP address, or Port of an Enrichment Source. An authenticated operator user can exploit this to redirect connection traffic to unintended internal systems, facilitating Server Side Request Forgery (SSRF) and the unauthorized use of cached credentials.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high severity risk. Successful exploitation allows an attacker to pivot from the application to internal network resources, potentially leading to unauthorized data access or further lateral movement within the environment. The impact is elevated by the potential for credential misuse, which could compromise the integrity and confidentiality of sensitive database information.

Remediation Plan

Immediate Action: Update the Guardsix ODBC Enrichment Plugins to version 5.2.1 or later to ensure the credential cache is correctly invalidated upon endpoint modification.

Proactive Monitoring: Review access logs for the Enrichment Source configuration module and monitor for unusual database connection requests originating from the plugin service.

Compensating Controls: Restrict administrative access to the Enrichment Source configuration interface to only essential personnel and implement strict egress filtering on the server hosting the plugins to limit potential SSRF impact.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a failure in state management within the plugin, which is inherently exploitable by any user with the operator role.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized access to internal systems, immediate remediation is required. Organizations should prioritize updating to version 5.2.1 to eliminate the credential reuse flaw. Until the update is applied, ensure that access to the configuration console is strictly audited and limited to trusted administrators.

---METADATA---
VENDOR: libnv
PRODUCT: libnv
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A heap-based buffer overflow in libnv, caused by improper message size validation, allows for system crashes or potential privilege escalation.

Executive Summary:
A critical heap-based buffer overflow in libnv allows unprivileged users to crash the system or potentially escalate their privileges.

Vulnerability Details

CVE-ID: CVE-2026-35547

Affected Software: libnv

Affected Versions: See vendor advisory

Vulnerability: The library fails to validate message sizes during header processing. This leads to an out-of-bounds write on the heap, which an attacker can leverage to cause a system panic or execute arbitrary code with elevated privileges.

Business Impact

The CVSS score of 9.1 highlights a critical threat. Privilege escalation and system-level instability can lead to unauthorized data access and significant denial-of-service, impacting business continuity for systems relying on this library.

Remediation Plan

Immediate Action: Update all software packages that include the affected version of libnv to the latest patched version.

Proactive Monitoring: Monitor system logs for unexpected crashes or service restarts that may indicate an exploitation attempt.

Compensating Controls: Implement memory protection features (e.g., ASLR, DEP) and restrict access to the specific services that utilize the vulnerable library.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, no active exploitation has been reported. However, the potential for privilege escalation makes this a high-priority update.

Analyst Recommendation

Security teams should identify all applications utilizing the affected version of libnv and coordinate an immediate update cycle. Verify system integrity following any unexpected service restarts.

---METADATA---
VENDOR: Anviz
PRODUCT: CX2 Lite and CX7 Firmware
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated firmware uploads, allowing remote attackers to execute arbitrary code and obtain a reverse shell.

Executive Summary:
This critical vulnerability in Anviz CX2 Lite and CX7 firmware allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35546

Affected Software: Anviz CX2 Lite and CX7

Affected Versions: All versions

Vulnerability: This is an unauthenticated arbitrary code execution vulnerability (CWE-306) resulting from a lack of proper validation during the firmware upload process. An attacker can submit crafted archives to the device, which are then executed, granting the attacker a reverse shell on the underlying system.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk to organizational infrastructure. Successful exploitation allows an attacker to gain complete control over the affected hardware, potentially leading to unauthorized network access, data exfiltration, or the use of these devices as pivots for lateral movement within the production environment.

Remediation Plan

Immediate Action: Contact Anviz support or consult the vendor advisory (ICSA-26-106-03) to obtain the latest firmware updates. If no patch is available, isolate affected devices from public-facing networks immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections, specifically those indicating reverse shell activity (e.g., unexpected SSH or netcat traffic).

Compensating Controls: Implement strict network segmentation to ensure these devices cannot be accessed by untrusted users and utilize a WAF or firewall rules to restrict access to the device management interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of authentication requirements for critical firmware management functions.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, organizations should prioritize the identification of all Anviz CX2 Lite and CX7 devices within their environment. Apply the necessary firmware updates immediately upon release by the vendor to close this critical security gap.

---METADATA---
VENDOR: Sudo
PRODUCT: Sudo
AFFECTED_VERSIONS: Through version 1.x (See vendor advisory)
---END_METADATA---

Description Summary:
A security vulnerability exists in Sudo through version 1.x that could allow for unauthorized actions or privilege escalation.

Executive Summary:
A critical security flaw in Sudo versions through 1.x may allow users to bypass security restrictions or elevate privileges on affected Unix-like systems.

Vulnerability Details

CVE-ID: CVE-2026-35535

Affected Software: Sudo

Affected Versions: Through version 1.x

Vulnerability: While specific technical details are limited, the flaw resides within the Sudo utility's core logic. This vulnerability likely allows a local user to execute commands with elevated privileges or bypass configured security policies defined in the sudoers file.

Business Impact

The compromise of the Sudo utility is a significant security event, as it is a primary mechanism for administrative control on Linux and Unix systems. An attacker could gain root-level access, leading to full system compromise, data theft, and persistent unauthorized access. The CVSS score of 7.4 justifies the High severity rating and underscores the risk to system integrity.

Remediation Plan

Immediate Action: Update Sudo to the latest patched version provided by your operating system vendor immediately.

Proactive Monitoring: Review Sudo logs (/var/log/auth.log or /var/log/secure) for unusual command executions or failed attempts to use Sudo by unauthorized users.

Compensating Controls: Restrict Sudo usage to the absolute minimum number of users required and implement strict "sudoers" configurations using the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Given that Sudo is a high-value target for attackers, a patch should be applied before exploit code is developed.

Analyst Recommendation

Due to the critical role Sudo plays in system security, this vulnerability represents a high risk to any environment. It is strongly recommended to apply the latest security updates from your distribution maintainer to all production servers immediately.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 7.1.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqp6-54p2-m66f","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqp6-54p2-m66f","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in ChurchCRM before 7.1.0 allows authenticated users with the EditRecords role to inject arbitrary JavaScript via the Facebook field in PersonView.php.

Executive Summary:
A stored cross-site scripting vulnerability in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to perform session hijacking and full account takeover.

Vulnerability Details

CVE-ID: CVE-2026-35534

Affected Software: ChurchCRM CRM

Affected Versions: < 7.1.0

Vulnerability: The application fails to properly escape quote characters within the PersonView.php file, allowing an authenticated user with the EditRecords role to inject malicious JavaScript into HTML attributes. This stored XSS payload executes when an administrator or other user views the compromised profile, leading to potential session hijacking.

Business Impact

Successful exploitation poses a significant risk to organizational integrity, as an attacker can gain unauthorized administrative access to the church management system. With a CVSS score of 7.6, this vulnerability represents a high-risk threat that could lead to the exposure of sensitive member data, unauthorized modification of records, and full compromise of the CRM environment.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to apply the necessary output sanitization fixes.

Proactive Monitoring: Review audit logs for suspicious activity involving profile modifications, particularly within the Facebook or social media fields of member records.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common XSS patterns and malicious script injection attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of proper character escaping in the affected function.

Analyst Recommendation

Given the potential for complete account takeover, organizations using ChurchCRM must prioritize the update to version 7.1.0 immediately. Administrators should also audit existing user roles and permissions to ensure that only authorized personnel have access to edit sensitive profile fields, thereby reducing the attack surface for similar injection flaws.

---METADATA---
VENDOR: jdx
PRODUCT: mise
AFFECTED_VERSIONS: 2026.2.18 through 2026.4.5
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8","name":"https://github.com/jdx/mise/security/advisories/GHSA-436v-8fw5-4mj8","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
The mise development tool manager insecurely loads trust-control settings from local .mise.toml files before performing trust checks, allowing for potential command execution.

Executive Summary:
A vulnerability in the mise tool manager allows unauthenticated local attackers to execute arbitrary commands by placing a malicious .mise.toml file in a project repository.

Vulnerability Details

CVE-ID: CVE-2026-35533

Affected Software: jdx mise

Affected Versions: 2026.2.18 through 2026.4.5

Vulnerability: This is an improper access control vulnerability (CWE-284) where the software processes configuration directives before verifying trust. An unauthenticated attacker can exploit this by crafting a malicious .mise.toml file to trigger dangerous directives, including environment sourcing, templates, hooks, or tasks.

Business Impact

Successful exploitation of this flaw allows an attacker to achieve full control over the development environment, potentially leading to unauthorized access to sensitive credentials, source code, or internal systems. Given the CVSS score of 7.7, this represents a high risk for organizations relying on mise for infrastructure or application development, as it could facilitate lateral movement within the development pipeline.

Remediation Plan

Immediate Action: Update the mise package to version 2026.6.4 or later as specified in the OSV advisory to resolve the insecure configuration loading logic.

Proactive Monitoring: Monitor developer workstations and CI/CD pipelines for unexpected execution of hooks, tasks, or environment source commands originating from mise.

Compensating Controls: Implement strict repository access controls and verify the integrity of project configuration files before cloning or running tools in untrusted environments.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it relies on the implicit trust often granted to local project-level configuration files.

Analyst Recommendation

This vulnerability presents a significant risk to development environments by bypassing intended trust boundaries. Organizations should prioritize patching all instances of the mise tool to version 2026.6.4 immediately to prevent potential command injection and system compromise.

---METADATA---
VENDOR: Strawberry
PRODUCT: Strawberry GraphQL
AFFECTED_VERSIONS: < 0.312.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77","name":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
Strawberry GraphQL is vulnerable to resource exhaustion via WebSocket subscriptions, allowing unauthenticated attackers to trigger memory growth and server crashes through excessive message flooding.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in Strawberry GraphQL allows remote attackers to cause server instability or crashes via uncontrolled WebSocket subscription requests.

Vulnerability Details

CVE-ID: CVE-2026-35526

Affected Software: Strawberry Strawberry GraphQL

Affected Versions: < 0.312.3

Vulnerability: The vulnerability exists in the WebSocket subscription handlers for graphql-transport-ws and graphql-ws protocols, where the library fails to enforce limits on the number of active subscriptions per connection. An unauthenticated attacker can flood the server with subscribe messages, causing linear memory growth and event loop saturation.

Business Impact

The exploitation of this vulnerability leads to a denial of service (DoS) condition, potentially resulting in complete system downtime for applications relying on the affected GraphQL API. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and operational continuity, as it allows an unauthenticated actor to crash the service with minimal effort.

Remediation Plan

Immediate Action: Update the Strawberry GraphQL library to version 0.312.3 or later to implement necessary resource constraints on WebSocket subscriptions.

Proactive Monitoring: Monitor server memory utilization and WebSocket connection logs for patterns of rapid, repetitive subscription initiation that deviate from normal traffic profiles.

Compensating Controls: Implement WebSocket rate limiting at the load balancer or application gateway level to restrict the number of incoming messages and concurrent connections from a single IP address.

Exploitation Status

Public Exploit Available: No (No confirmed public exploit exists in the available data).

Analyst Notes: As of April 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ease of exploitation and the lack of authentication required to trigger the resource exhaustion.

Analyst Recommendation

Given the ease with which an unauthenticated attacker can trigger a denial-of-service state, it is critical that organizations using Strawberry GraphQL prioritize this update. Administrators should verify their current library version and apply the patch immediately to prevent potential service disruptions.

---METADATA---
VENDOR: Strawberry
PRODUCT: GraphQL
AFFECTED_VERSIONS: < 0.312.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-vpwc-v33q-mq89","name":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-vpwc-v33q-mq89","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.203Z
---END_METADATA---

Description Summary:
Strawberry GraphQL versions before 0.312.3 are vulnerable to an authentication bypass on WebSocket subscription endpoints due to improper handling of the graphql-ws subprotocol.

Executive Summary:
An authentication bypass vulnerability in Strawberry GraphQL allows unauthenticated remote attackers to circumvent connection hooks and access sensitive subscription data.

Vulnerability Details

CVE-ID: CVE-2026-35523

Affected Software: Strawberry GraphQL

Affected Versions: < 0.312.3

Vulnerability: This flaw exists because the legacy graphql-ws subprotocol handler fails to verify that the required connection_init handshake is completed before processing subscription messages. An unauthenticated attacker can bypass the on_ws_connect authentication hook by sending a start message directly to the WebSocket endpoint.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to GraphQL subscription data, potentially leading to the exposure of sensitive information or unauthorized real-time updates. Given the CVSS score of 7.5, this high-severity issue poses a significant risk to data confidentiality, as it allows attackers to bypass security controls without requiring prior authentication or user interaction.

Remediation Plan

Immediate Action: Update the strawberry-graphql package to version 0.312.3 or later immediately to enforce proper handshake validation.

Proactive Monitoring: Review application logs for WebSocket connection patterns that lack the expected connection_init handshake sequence, which may indicate attempted exploitation.

Compensating Controls: Implement network-level restrictions or a Web Application Firewall configured to inspect and validate WebSocket subprotocols if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable because it allows an attacker to bypass authentication logic by manipulating the subprotocol handshake sequence.

Analyst Recommendation

This vulnerability represents a critical failure in the authentication workflow of the affected API library. Organizations utilizing Strawberry GraphQL should prioritize upgrading to version 0.312.3 to ensure that the connection_init handshake is correctly enforced. Failure to patch may expose backend data streams to unauthorized access by any remote actor.

---METADATA---
VENDOR: Pi-hole
PRODUCT: FTL
AFFECTED_VERSIONS: pi-hole FTL: >= 6.0, < 6.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c","name":"https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
Pi-hole FTL contains an OS Command Injection vulnerability via the DHCP hosts configuration parameter, allowing authenticated attackers to execute arbitrary system commands.

Executive Summary:
An authenticated remote code execution vulnerability in the Pi-hole FTL engine poses a critical risk to system integrity and security.

Vulnerability Details

CVE-ID: CVE-2026-35521

Affected Software: Pi-hole FTL

Affected Versions: pi-hole FTL: >= 6.0, < 6.6

Vulnerability: The FTL engine fails to properly sanitize input in the dhcp.hosts configuration parameter, allowing an authenticated attacker to inject CRLF sequences and arbitrary dnsmasq directives to achieve OS command execution.

Business Impact

The ability for an authenticated attacker to execute arbitrary commands on the underlying system represents a total compromise of the host. Given the CVSS score of 8.8, this vulnerability presents a high risk of unauthorized data access, lateral movement within the network, and potential full system takeover.

Remediation Plan

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system logs for suspicious dnsmasq configuration changes or unexpected command execution patterns originating from the FTL service.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted users only, and employ network segmentation to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable because it allows an attacker to manipulate configuration files directly via the API.

Analyst Recommendation

This vulnerability is severe because it allows for full system control by an authenticated user. Organizations utilizing Pi-hole FTL versions 6.0 through 6.5 must prioritize upgrading to version 6.6 immediately to eliminate the risk of command injection.

---METADATA---
VENDOR: Pi-hole
PRODUCT: FTLDNS
AFFECTED_VERSIONS: pi-hole FTL: >= 6.0, < 6.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj","name":"https://github.com/pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
Pi-hole FTLDNS versions 6.0 through 6.5 are vulnerable to remote code execution via CRLF injection in the DHCP lease time configuration parameter, allowing attackers to inject arbitrary directives.

Executive Summary:
An authenticated remote code execution vulnerability in Pi-hole FTLDNS allows attackers to achieve full system compromise through malicious DHCP configuration injection.

Vulnerability Details

CVE-ID: CVE-2026-35520

Affected Software: Pi-hole FTLDNS

Affected Versions: pi-hole FTL: >= 6.0, < 6.6

Vulnerability: This is an OS command injection vulnerability (CWE-78) facilitated by CRLF injection (CWE-93). An authenticated attacker can inject arbitrary dnsmasq configuration directives into the dhcp.leaseTime parameter, leading to remote command execution on the host system.

Business Impact

The ability for an attacker to execute arbitrary commands on the system hosting Pi-hole poses a severe risk to network infrastructure integrity. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could lead to unauthorized access to internal network traffic, persistent backdoors, or complete compromise of the DNS service.

Remediation Plan

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later immediately to neutralize the injection vector.

Proactive Monitoring: Review system logs for unusual dnsmasq configuration changes or unexpected process execution patterns initiated by the FTL user account.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted management IP addresses only, and ensure the service runs with the least privilege necessary to limit potential damage.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker has gained authenticated access to the management interface.

Analyst Recommendation

This vulnerability presents a significant risk to the security of your network infrastructure. Administrators should prioritize updating the Pi-hole FTL engine to version 6.6 to eliminate the underlying injection flaw. Failure to patch may allow an attacker with standard administrative credentials to escalate their privileges to full system control.

---METADATA---
VENDOR: Pi-hole
PRODUCT: FTL
AFFECTED_VERSIONS: pi-hole FTL: >= 6.0, < 6.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp","name":"https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
The Pi-hole FTL engine is vulnerable to OS command injection via CRLF sequences in the dns.hostRecord parameter, allowing authenticated attackers to execute arbitrary commands on the underlying system.

Executive Summary:
An authenticated remote code execution vulnerability in Pi-hole FTL versions 6.0 through 6.5 poses a critical risk to system integrity and host security.

Vulnerability Details

CVE-ID: CVE-2026-35519

Affected Software: Pi-hole FTL

Affected Versions: pi-hole FTL: >= 6.0, < 6.6

Vulnerability: This vulnerability involves improper neutralization of CRLF sequences and OS command injection within the dns.hostRecord configuration parameter. An authenticated attacker can inject malicious dnsmasq directives to gain full command execution on the host system.

Business Impact

The ability for an authenticated user to execute arbitrary commands leads to a complete compromise of the host server. Given the CVSS score of 8.8, this vulnerability represents a high risk of unauthorized data access, lateral movement within the network, and potential full system takeover, which could result in significant operational disruption and data loss.

Remediation Plan

Immediate Action: Update the Pi-hole FTL engine to version 6.6 or later to incorporate the necessary security patches.

Proactive Monitoring: Review web interface access logs for unusual activity, particularly focusing on interactions with DNS record configuration endpoints.

Compensating Controls: Implement strict access control lists for the Pi-hole management interface and ensure that the service runs with the least privilege necessary to mitigate the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for direct OS command injection through standard configuration parameters.

Analyst Recommendation

Given the potential for complete system compromise via remote code execution, organizations running Pi-hole FTL versions 6.0 through 6.5 must prioritize the update to version 6.6. While the vulnerability requires authentication, the severity of the impact necessitates immediate action to prevent unauthorized command execution and maintain the security of the DNS infrastructure.

---METADATA---
VENDOR: Pi-hole
PRODUCT: FTL
AFFECTED_VERSIONS: pi-hole FTL: >= 6.0, < 6.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m","name":"https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
The Pi-hole FTL engine is vulnerable to remote code execution via CRLF injection in the DNS CNAME records configuration parameter, allowing authenticated attackers to execute arbitrary system commands.

Executive Summary:
An authenticated remote code execution vulnerability in Pi-hole FTL versions 6.0 through 6.5 poses a critical risk to system integrity and host security.

Vulnerability Details

CVE-ID: CVE-2026-35518

Affected Software: Pi-hole FTL

Affected Versions: pi-hole FTL: >= 6.0, < 6.6

Vulnerability: This vulnerability involves OS Command Injection and CRLF Injection within the dns.cnameRecords parameter. An authenticated attacker can inject newline characters to manipulate dnsmasq configuration directives, leading to arbitrary code execution on the underlying host.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to gain full control over the host system. This could lead to unauthorized data access, complete system compromise, or the use of the affected device as a pivot point for further network attacks. With a CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate prioritization.

Remediation Plan

Immediate Action: Update Pi-hole FTL to version 6.6 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for unusual dnsmasq configuration changes or unexpected process execution patterns originating from the FTL service.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to trusted users only and implement network segmentation to limit the potential reach of an attacker who gains command execution.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for the manipulation of configuration files that directly interface with the operating system command line.

Analyst Recommendation

Given the potential for complete system takeover, administrators should move quickly to patch the FTL engine. Verify your current version of Pi-hole FTL and perform the update to 6.6 immediately to eliminate the command injection vector. Failure to address this vulnerability increases the likelihood of unauthorized administrative access and persistent system compromise.

---METADATA---
VENDOR: Pi-hole
PRODUCT: FTLDNS (pihole-FTL)
AFFECTED_VERSIONS: pi-hole FTL: >= 6.0, < 6.6
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj","name":"https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
Pi-hole FTL versions 6.0 through 6.5 contain an OS command injection vulnerability in the upstream DNS configuration parameter, allowing authenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical remote code execution vulnerability in Pi-hole FTL allows authenticated attackers to gain full control over the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-35517

Affected Software: Pi-hole FTL

Affected Versions: pi-hole FTL: >= 6.0, < 6.6

Vulnerability: This flaw involves improper neutralization of CRLF sequences and OS command injection within the dns.upstreams configuration parameter. An attacker with authenticated access can inject arbitrary dnsmasq directives to trigger command execution on the host server.

Business Impact

The ability to execute arbitrary commands on the underlying host poses a severe risk to the entire network infrastructure, as Pi-hole often acts as a critical DNS resolver. Successful exploitation could lead to full system compromise, data theft, or the use of the server as a pivot point for lateral movement within the environment. With a CVSS score of 8.8, this high-severity vulnerability warrants immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Update the pihole-FTL component to version 6.6 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Review system logs and the Pi-hole web interface configuration history for anomalous entries in the upstream DNS server settings.

Compensating Controls: Restrict administrative access to the Pi-hole web interface to known, trusted IP addresses using a firewall or reverse proxy to limit the exposure of the management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub repository.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's reliance on CRLF injection makes it a straightforward target for attackers who have successfully authenticated to the administrative interface.

Analyst Recommendation

Given the potential for remote code execution and the availability of public proof-of-concept material, this vulnerability presents a significant risk to internal network integrity. IT administrators must prioritize patching the pihole-FTL engine to version 6.6 immediately. Restricting access to the management interface is a vital secondary measure to reduce the attack surface until the update can be fully deployed.

---METADATA---
VENDOR: SenseLive
PRODUCT: X3050 Management Interface
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SenseLive X3050 web management interface is vulnerable to an authentication bypass due to client-side logic that relies on hardcoded values instead of secure server-side verification.

Executive Summary:
A critical authentication vulnerability in the SenseLive X3050 management interface allows attackers to bypass security controls by exploiting insecure client-side verification logic.

Vulnerability Details

CVE-ID: CVE-2026-35503

Affected Software: SenseLive X3050

Affected Versions: See vendor advisory

Vulnerability: The web management interface performs authentication checks exclusively on the client side using hardcoded parameters. An attacker can retrieve these values to bypass authentication and gain unauthorized administrative access to the device.

Business Impact

A CVSS score of 9.8 indicates a critical risk to the availability and integrity of the affected hardware. Successful exploitation allows an attacker to gain full administrative control, enabling the modification of device configurations, interception of traffic, or complete disabling of security features, which could lead to widespread operational downtime.

Remediation Plan

Immediate Action: Apply the latest firmware or software update provided by SenseLive to migrate authentication logic to the server side.

Proactive Monitoring: Monitor for unusual administrative logins or configuration changes occurring from unauthorized or unexpected source IP addresses.

Compensating Controls: Restrict access to the web management interface via network-level controls such as VLAN segmentation or Access Control Lists (ACLs) to ensure only trusted administrative endpoints can reach the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a fundamental design flaw in the product's security architecture. Immediate patching is required, and organizations should treat the affected devices as untrusted until the update is applied and administrative credentials are rotated.

---METADATA---
VENDOR: changedetection.io
PRODUCT: changedetection.io
AFFECTED_VERSIONS: Prior to 0.54.8
---END_METADATA---

Description Summary:
An improper decorator ordering in changedetection.io causes authentication wrappers to be bypassed, exposing sensitive routes to unauthenticated access.

Executive Summary:
A critical authentication bypass in changedetection.io allows unauthenticated attackers to access restricted application routes.

Vulnerability Details

CVE-ID: CVE-2026-35490

Affected Software: changedetection.io

Affected Versions: Prior to 0.54.8

Vulnerability: The application incorrectly orders Flask decorators, resulting in the auth wrapper being omitted from the call chain. This vulnerability effectively disables authentication for affected routes, allowing unauthenticated remote access.

Business Impact

The bypass of authentication controls poses a severe risk to data confidentiality and integrity. Given the CVSS score of 9.8, this flaw could allow unauthorized actors to manipulate or view sensitive web monitoring data, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Upgrade changedetection.io to version 0.54.8 or later immediately.

Proactive Monitoring: Review web server access logs for anomalous traffic patterns targeting administrative or restricted URI endpoints.

Compensating Controls: Implement IP-based access restrictions or place the application behind an authentication-enabled reverse proxy until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must update the changedetection.io instance to version 0.54.8 to restore proper authentication enforcement and mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Tandoor
PRODUCT: Recipes
AFFECTED_VERSIONS: < 2.6.4
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f","name":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4","name":"https://github.com/TandoorRecipes/recipes/releases/tag/2.6.4","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
Tandoor Recipes prior to 2.6.4 contains an authorization bypass where users with read-only shared access can modify or delete RecipeBook data due to an improper permission check.

Executive Summary:
A high-severity authorization flaw in Tandoor Recipes allows authenticated users with shared read-only access to perform unauthorized modifications or deletions of sensitive recipe data.

Vulnerability Details

CVE-ID: CVE-2026-35488

Affected Software: Tandoor Recipes

Affected Versions: < 2.6.4

Vulnerability: The vulnerability exists in the RecipeBookViewSet and RecipeBookEntryViewSet classes, which fail to validate HTTP methods against the CustomIsShared permission class. Consequently, any authenticated user with shared access can execute write operations, such as PUT, PATCH, or DELETE, on objects intended to be read-only.

Business Impact

The exploitation of this vulnerability leads to a significant loss of data integrity and availability within the application, as unauthorized users can delete or overwrite entire recipe collections. With a CVSS score of 8.1, the risk is substantial, potentially resulting in operational disruption and the loss of proprietary culinary data for organizations relying on the platform.

Remediation Plan

Immediate Action: Upgrade Tandoor Recipes to version 2.6.4 or later to apply the necessary permission checks that restrict write operations to authorized users only.

Proactive Monitoring: Review application access logs for unexpected DELETE, PUT, or PATCH requests originating from accounts that should only possess read-only permissions.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall to monitor and filter unauthorized API calls to the affected ViewSet endpoints until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally an implementation error in the Django permission framework, making it highly susceptible to exploitation by any authenticated user who has been granted shared access to a resource.

Analyst Recommendation

Given the ease of exploitation and the potential for total data loss within affected recipe books, administrators must prioritize this update. Applying the 2.6.4 patch is the only definitive method to ensure that shared access remains restricted to read-only as intended by the application logic.

---METADATA---
VENDOR: oobabooga
PRODUCT: text-generation-webui
AFFECTED_VERSIONS: < 4.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2","name":"https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jvrj-w5hq-6cp2","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the superbooga and superboogav2 extensions of text-generation-webui allows unauthenticated attackers to exfiltrate data and probe internal services.

Executive Summary:
The oobabooga text-generation-webui is vulnerable to unauthenticated Server-Side Request Forgery, enabling attackers to access sensitive cloud metadata and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-35486

Affected Software: oobabooga text-generation-webui

Affected Versions: < 4.3

Vulnerability: This is a Server-Side Request Forgery (CWE-918) flaw where the superbooga and superboogav2 RAG extensions fail to validate user-supplied URLs. An unauthenticated attacker can supply arbitrary URLs to be fetched by the server, leading to the exposure of cloud IAM credentials and internal network resources.

Business Impact

Successful exploitation poses a significant risk to organizational infrastructure by allowing attackers to move laterally from the web interface into the internal network. The ability to retrieve cloud metadata can lead to full compromise of cloud environments and theft of sensitive credentials. Given the CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Update the oobabooga text-generation-webui software to version 4.3 or later to incorporate the necessary URL validation logic.

Proactive Monitoring: Review web server and application logs for unusual outbound requests to internal IP addresses or cloud metadata service endpoints (e.g., 169.254.169.254).

Compensating Controls: If immediate patching is not possible, restrict the server's network access to prevent it from reaching internal segments or sensitive cloud metadata endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of input validation makes this vulnerability trivial to exploit for any attacker with network access to the web interface.

Analyst Recommendation

The risk posed by this SSRF vulnerability is severe due to its unauthenticated nature and the potential for cloud credential theft. Administrators must prioritize updating to version 4.3 immediately to close the attack vector. Failure to remediate this flaw exposes the underlying host and cloud infrastructure to unauthorized reconnaissance and lateral movement.

---METADATA---
VENDOR: Oobabooga
PRODUCT: text-generation-webui
AFFECTED_VERSIONS: < 4.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-hqg5-487v-5mc6","name":"https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-hqg5-487v-5mc6","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
An unauthenticated path traversal vulnerability exists in the load_grammar function of the text-generation-webui interface, allowing attackers to read arbitrary files on the server filesystem.

Executive Summary:
An unauthenticated path traversal vulnerability in Oobabooga text-generation-webui versions prior to 4.3 allows remote attackers to read sensitive files from the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-35485

Affected Software: Oobabooga text-generation-webui

Affected Versions: < 4.3

Vulnerability: This is a path traversal vulnerability (CWE-22) triggered by the lack of server-side validation for dropdown values in the load_grammar function. An unauthenticated remote attacker can submit crafted POST requests containing directory traversal sequences to access any file on the host system.

Business Impact

The ability to read arbitrary files on the server poses a significant risk to confidentiality. An attacker could potentially retrieve configuration files, credentials, or sensitive system data, leading to full system compromise or lateral movement within the network. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Update the Oobabooga text-generation-webui software to version 4.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review web server access logs for suspicious POST requests containing directory traversal characters, such as double dots and forward slashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and restrict access to the API endpoints used by the interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the ease of exploitation for this path traversal vulnerability and the associated risk of sensitive data exposure, users must prioritize upgrading to version 4.3 immediately. Organizations should assess their current deployment of text-generation-webui and verify that the latest patches have been applied across all instances to eliminate this critical security gap.

---METADATA---
VENDOR: InvenTree
PRODUCT: InvenTree
AFFECTED_VERSIONS: >= 0.16.0, < 1.2.7
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg","name":"https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.959Z
---END_METADATA---

Description Summary:
InvenTree contains an authorization bypass vulnerability where any authenticated user can generate valid API tokens for other users, including administrators, by manipulating the user ID in a POST request.

Executive Summary:
A critical authorization bypass vulnerability in InvenTree allows authenticated users to escalate privileges by hijacking the API tokens of any other user in the system.

Vulnerability Details

CVE-ID: CVE-2026-35478

Affected Software: InvenTree

Affected Versions: >= 0.16.0, < 1.2.7

Vulnerability: This vulnerability, categorized as CWE-639, involves an improper authorization check within the API token generation logic. By submitting a crafted POST request to the /api/user/tokens/ endpoint, an authenticated user can impersonate any other account, including superusers, by specifying their user ID.

Business Impact

The vulnerability poses a severe risk to organizational data integrity and system security. Because an attacker can generate a valid token for an administrator, they can gain full unauthorized access to the inventory management system, potentially leading to unauthorized data modification, exfiltration, or complete system compromise. With a CVSS score of 8.3, this flaw represents a high risk to business continuity and operational security.

Remediation Plan

Immediate Action: Upgrade InvenTree to version 1.2.7 or 1.3.0 immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for anomalous requests directed at the /api/user/tokens/ endpoint, particularly those involving unexpected user ID associations.

Compensating Controls: If immediate patching is not feasible, restrict network access to the API endpoints to trusted IP ranges and monitor user account activity for suspicious configuration changes or unauthorized administrative actions.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of exploitation, requiring only a single valid authenticated session to perform the attack.

Analyst Recommendation

Given the ability for standard users to escalate privileges to administrative status, this vulnerability must be treated with high priority. Organizations using InvenTree should verify their current version and initiate the update process to version 1.2.7 or higher immediately. Failure to address this flaw leaves the entire inventory system susceptible to total compromise by any internal user.

---METADATA---
VENDOR: goshs
PRODUCT: goshs
AFFECTED_VERSIONS: Prior to 2.0.0-beta.3
---END_METADATA---

Description Summary:
The goshs SimpleHTTPServer exhibits a path traversal flaw in the file deletion function due to improper handling of return values.

Executive Summary:
A path traversal vulnerability in goshs allows remote attackers to delete arbitrary files on the host system, threatening system availability.

Vulnerability Details

CVE-ID: CVE-2026-35471

Affected Software: goshs

Affected Versions: Prior to 2.0.0-beta.3

Vulnerability: The deleteFile() function fails to return after a path traversal check, causing the application to proceed with the deletion operation despite the check failing.

Business Impact

An attacker can delete sensitive system files, leading to a denial-of-service or the destruction of critical data. With a CVSS score of 9.8, this flaw represents a significant risk to system stability and integrity.

Remediation Plan

Immediate Action: Update goshs to version 2.0.0-beta.3 or later.

Proactive Monitoring: Monitor logs for unauthorized file deletion attempts and unexpected service outages.

Compensating Controls: Ensure the service account has minimal filesystem permissions, restricted only to the directories required for operation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The failure to properly handle validation returns is a critical logic error. Administrators must update to the latest version immediately to ensure that path validation is enforced correctly.

---METADATA---
VENDOR: devcode-it
PRODUCT: OpenSTAManager
AFFECTED_VERSIONS: < 2.10.2
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/devcode-it/openstamanager/security/advisories/GHSA-mmm5-3g4x-qw39","name":"https://github.com/devcode-it/openstamanager/security/advisories/GHSA-mmm5-3g4x-qw39","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2","name":"https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.247Z
---END_METADATA---

Description Summary:
OpenSTAManager versions prior to 2.10.2 contain an SQL injection vulnerability in the confronta_righe.php script, allowing authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in OpenSTAManager allows authenticated attackers to extract sensitive database information, requiring an immediate update to version 2.10.2.

Vulnerability Details

CVE-ID: CVE-2026-35470

Affected Software: devcode-it OpenSTAManager

Affected Versions: < 2.10.2

Vulnerability: The application fails to properly sanitize the righe parameter in the confronta_righe.php file before including it in a database query. This vulnerability requires an authenticated attacker to trigger the malicious SQL injection.

Business Impact

Successful exploitation of this SQL injection vulnerability grants an attacker the ability to bypass application logic and exfiltrate sensitive data, such as customer records, invoicing details, and administrative credentials. Given the CVSS score of 8.8, this represents a high risk to data confidentiality and integrity, potentially leading to severe regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Update the OpenSTAManager installation to version 2.10.2 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review application access logs for unusual GET requests containing SQL syntax patterns or unexpected characters in the righe parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack signatures targeting the application backend.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable because the vulnerable parameter is directly concatenated into an SQL query without any validation.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of a known proof-of-concept, necessitates an urgent response. Security teams must prioritize upgrading to version 2.10.2 to close the injection vector. If an immediate patch is not feasible, restrict access to the affected module and implement strict WAF filtering to mitigate the risk of unauthorized database access.

---METADATA---
VENDOR: wolfSSL
PRODUCT: wolfSSL
AFFECTED_VERSIONS: 0 up to (excluding) 5.9.0
CONFIDENCE: high
MISSING: none
CREDITS: Oleh Konko (finder)
SOURCES_JSON: [{"url":"https://github.com/wolfSSL/wolfssl/pull/9859","name":null,"tags":["patch"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.183Z
---END_METADATA---

Description Summary:
A vulnerability in wolfSSL allows an unauthenticated attacker to trigger an out-of-bounds read during ALPN parsing, potentially causing a process crash and denial of service.

Executive Summary:
A critical out-of-bounds read vulnerability in the wolfSSL library allows unauthenticated remote attackers to cause a denial of service via a crafted ALPN protocol list.

Vulnerability Details

CVE-ID: CVE-2026-3547

Affected Software: wolfSSL wolfSSL

Affected Versions: 0 up to (excluding) 5.9.0

Vulnerability: The flaw is an out-of-bounds read (CWE-125) occurring during ALPN parsing when the library is compiled with ALPN enabled. This issue affects unauthenticated users and can be triggered if the software is built with compatibility features such as enable-apachehttpd, enable-nginx, or enable-curl.

Business Impact

Successful exploitation of this vulnerability results in a process crash, leading to a denial of service for any application relying on the affected wolfSSL library. Given the CVSS score of 7.5, this poses a significant risk to service availability, particularly for critical infrastructure or web-facing services that utilize the library for TLS/SSL termination.

Remediation Plan

Immediate Action: Upgrade the wolfSSL library to version 5.9.0 or later, or apply the patch provided in the upstream repository at commit 922d04b3568c6428a9fb905ddee3ef5a68db3108.

Proactive Monitoring: Monitor application logs for unexpected process crashes or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If upgrading is not immediately feasible, disable the ALPN feature in the wolfSSL build configuration if it is not required for application functionality.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if the library is compiled with specific compatibility flags that enable ALPN, which is otherwise disabled by default.

Analyst Recommendation

Organizations should prioritize updating the wolfSSL library to the latest version to eliminate the risk of service disruption. While the vulnerability requires specific build configurations to be active, the potential for remote denial of service makes patching a high-priority task for all security and IT operations teams.

---METADATA---
VENDOR: Unknown
PRODUCT: Temporary Browser Client
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Stored API keys in a temporary browser client are not marked as protected, allowing for credential extraction via JavaScript console errors or other system faults.

Executive Summary:
Insecure storage of API keys in a browser-based client allows for the unauthorized extraction of encryption credentials, leading to potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-35467

Affected Software: Temporary Browser Client

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the improper protection of stored API keys within a browser client. Because these keys are not marked as protected, they can be exposed through JavaScript console logs or during error handling, allowing an attacker with local or session access to extract sensitive encryption credentials.

Business Impact

The extraction of API keys can lead to unauthorized access to cloud services, databases, or other integrated third-party platforms. With a CVSS score of 7.5, the risk is High, as it could lead to large-scale data exfiltration and the compromise of the entire service ecosystem associated with those keys.

Remediation Plan

Immediate Action: Apply vendor security updates that implement proper protection (such as encryption or secure storage flags) for API keys in the browser client.

Proactive Monitoring: Audit application logs for abnormal API usage patterns that might indicate compromised credentials are being used by unauthorized parties.

Compensating Controls: Implement short-lived API tokens and strict IP-based access controls for API endpoints to minimize the impact of a leaked key.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is primarily exploitable if an attacker can induce or view application errors or gain access to the user's browser environment.

Analyst Recommendation

Developers and administrators must ensure that sensitive credentials are never stored in a way that is accessible to client-side scripts or error-reporting mechanisms. Apply the recommended patches immediately to ensure that API keys are properly protected within the browser environment.

---METADATA---
VENDOR: Freedom of the Press Foundation
PRODUCT: SecureDrop Client
AFFECTED_VERSIONS: < 0.17.5
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc","name":"https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655","name":"https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655","tags":["x_refsource_MISC"]},{"url":"https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8","name":"https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.679Z
---END_METADATA---

Description Summary:
SecureDrop Client versions 0.17.4 and below are vulnerable to arbitrary file overwriting via improper filename validation during gzip archive extraction, potentially leading to remote code execution.

Executive Summary:
A vulnerability in the SecureDrop Client allows an attacker who has compromised the associated SecureDrop Server to achieve remote code execution on the Client virtual machine.

Vulnerability Details

CVE-ID: CVE-2026-35465

Affected Software: Freedom of the Press Foundation SecureDrop Client

Affected Versions: < 0.17.5

Vulnerability: This flaw involves improper validation of filenames during the extraction of gzip archives, which allows for absolute path traversal. An unauthenticated attacker who successfully compromises the upstream SecureDrop Server can leverage this to overwrite critical system files, including the SQLite database, to execute arbitrary code on the client machine.

Business Impact

The potential for remote code execution represents a critical risk to the confidentiality and integrity of highly sensitive journalistic communications. Given the CVSS score of 7.5, this vulnerability could allow an adversary to decrypt or intercept source submissions, leading to severe reputational damage and the potential exposure of protected sources. The impact is elevated because the SecureDrop system is specifically designed to handle high-stakes, anonymous whistleblowing data.

Remediation Plan

Immediate Action: Update the SecureDrop Client software to version 0.17.5 or later immediately to incorporate the necessary filename validation logic.

Proactive Monitoring: Monitor virtual machine logs and system integrity metrics for unauthorized file modifications or unexpected process execution within the sd-app environment.

Compensating Controls: Ensure that the SecureDrop Server remains strictly isolated and hardened, as the exploit chain relies on the prior compromise of the server component.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit chain is complex, requiring a prior breach of the server, the ability to achieve code execution makes this a high-priority update for all deployments.

Analyst Recommendation

Organizations utilizing SecureDrop must prioritize the upgrade to version 0.17.5 to remediate the path traversal flaw. Because this vulnerability provides a mechanism for persistence and data exfiltration after a server compromise, failure to patch leaves the entire submission workflow exposed to advanced adversaries. Apply the update as part of the next scheduled maintenance window or sooner if the environment is considered high-risk.

---METADATA---
VENDOR: pyLoad
PRODUCT: pyLoad
AFFECTED_VERSIONS: <= 0.5.0b3.dev96
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j","name":"https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx","name":"https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx","tags":["x_refsource_MISC"]},{"url":"https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1","name":"https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1","tags":["x_refsource_MISC"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33509","name":"https://www.cve.org/CVERecord?id=CVE-2026-33509","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.207Z
---END_METADATA---

Description Summary:
A vulnerability in pyLoad allows authenticated users with specific permissions to achieve remote code execution by manipulating configuration settings to plant malicious payloads in the session directory.

Executive Summary:
An authenticated remote code execution vulnerability in pyLoad allows attackers to compromise the host system by exploiting insecure deserialization through manipulated session files.

Vulnerability Details

CVE-ID: CVE-2026-35464

Affected Software: pyLoad pyLoad

Affected Versions: <= 0.5.0b3.dev96

Vulnerability: This issue involves incorrect authorization (CWE-863) and deserialization of untrusted data (CWE-502). An authenticated user with SETTINGS and ADD permissions can redirect download paths to the Flask session directory, planting a malicious pickle payload that triggers arbitrary code execution upon processing a crafted session cookie.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying server. This poses a severe risk to data confidentiality, integrity, and availability, potentially leading to full system compromise. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: As no official release version containing the fix is specified, users must apply the fix from the upstream commit c4cf995a2803bdbe388addfc2b0f323277efc0e1 directly to their source code or restrict access to the application to trusted personnel only.

Proactive Monitoring: Security teams should monitor server access logs for unusual session activity or attempts to modify download storage paths by non-administrative users.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall to monitor and block requests containing serialized object patterns or suspicious session manipulation attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on the application's native handling of pickle data, which is dangerous when influenced by user-controlled configurations.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant security risk to any environment hosting pyLoad. Organizations should prioritize applying the provided code-level fix or limiting application access until a stable, patched version is released by the vendor. Failure to address this flaw could lead to complete server compromise.

---METADATA---
VENDOR: pyLoad
PRODUCT: pyLoad
AFFECTED_VERSIONS: <= 0.5.0b3.dev96
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr","name":"https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1","name":"https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.211Z
---END_METADATA---

Description Summary:
A vulnerability in pyLoad allows authenticated users with settings permissions to execute arbitrary OS commands via the AntiVirus plugin configuration.

Executive Summary:
A critical OS command injection vulnerability in pyLoad allows authenticated users to achieve remote code execution by manipulating the AntiVirus plugin configuration.

Vulnerability Details

CVE-ID: CVE-2026-35463

Affected Software: pyLoad pyLoad

Affected Versions: <= 0.5.0b3.dev96

Vulnerability: The application fails to properly restrict configuration options within the AntiVirus plugin. An attacker with standard user privileges and SETTINGS permissions can modify the executable path parameter, which is then passed directly to a system command execution function, resulting in OS command injection.

Business Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying host system with the privileges of the pyLoad process. This can lead to full system compromise, unauthorized access to sensitive download data, or lateral movement within the network. Given the CVSS score of 8.8, this vulnerability poses a high risk to the confidentiality, integrity, and availability of the affected environment.

Remediation Plan

Immediate Action: As no formal patch version is currently available, restrict access to the SETTINGS functionality to only the most trusted administrative accounts. Review the GitHub advisory for available commit-level patches and apply them if possible.

Proactive Monitoring: Monitor system logs for suspicious subprocess execution patterns, specifically processes spawned by the pyLoad user that deviate from standard AntiVirus utility paths.

Compensating Controls: Implement strict network segmentation for the server hosting pyLoad and ensure the application process runs with the least privilege necessary to limit the impact of a potential command injection.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it leverages a legitimate plugin configuration parameter to bypass security controls and trigger command execution.

Analyst Recommendation

Organizations currently running pyLoad versions 0.5.0b3.dev96 and earlier must prioritize this vulnerability. Since a public proof-of-concept exists and the vulnerability leads to remote code execution, it is imperative to limit access to settings immediately and monitor for unauthorized configuration changes while awaiting an official software update.

---METADATA---
VENDOR: libp2p
PRODUCT: rust-libp2p
AFFECTED_VERSIONS: < 0.17.1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7","name":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-v5hw-cv9c-rpg7","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.211Z
---END_METADATA---

Description Summary:
An unauthenticated resource exhaustion vulnerability exists in rust-libp2p due to unbounded memory growth when processing rendezvous DISCOVER requests.

Executive Summary:
The rust-libp2p networking stack is vulnerable to denial of service attacks through unbounded memory allocation, which can be triggered by unauthenticated remote peers.

Vulnerability Details

CVE-ID: CVE-2026-35457

Affected Software: libp2p rust-libp2p

Affected Versions: < 0.17.1

Vulnerability: This vulnerability, categorized as CWE-770, occurs because the rendezvous server improperly handles pagination cookies by storing them without memory bounds. An unauthenticated remote attacker can exploit this by repeatedly sending DISCOVER requests, forcing the service to consume excessive memory and leading to a denial of service.

Business Impact

The ability for an unauthenticated attacker to remotely exhaust memory resources presents a significant threat to service availability. With a CVSS score of 8.2, this vulnerability is classified as High severity, as it allows for simple disruption of network services without requiring any prior authentication or user interaction.

Remediation Plan

Immediate Action: Update the rust-libp2p library to version 0.17.1 or later to implement the necessary bounds checking for pagination cookies.

Proactive Monitoring: Monitor server memory utilization and network traffic logs for an unusual spike in incoming DISCOVER requests from individual or multiple peers.

Compensating Controls: Implement rate limiting at the network or application layer to restrict the volume of requests a single peer can submit to the rendezvous service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its automatable nature and lack of authentication requirements.

Analyst Recommendation

Given the ease of exploitation and the potential for complete service disruption, organizations utilizing rust-libp2p should prioritize updating to version 0.17.1 immediately. The lack of authentication requirements makes this an attractive target for automated denial of service attacks, necessitating swift remediation to maintain operational stability.

---METADATA---
VENDOR: ACES
PRODUCT: LORIS
AFFECTED_VERSIONS: 24.0.0 to 27.0.2, 28.0.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/aces/Loris/security/advisories/GHSA-47jj-7xfg-8759","name":"https://github.com/aces/Loris/security/advisories/GHSA-47jj-7xfg-8759","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.963Z
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the LORIS FilesDownloadHandler allows authenticated users to access files outside of the intended download directories.

Executive Summary:
An authenticated directory traversal vulnerability in the ACES LORIS platform allows unauthorized file access, posing a high risk to sensitive research data.

Vulnerability Details

CVE-ID: CVE-2026-35446

Affected Software: ACES LORIS

Affected Versions: 24.0.0 to 27.0.2, 28.0.0

Vulnerability: This vulnerability is caused by an incorrect order of operations in the FilesDownloadHandler, which permits authenticated users to escape designated download directories and access arbitrary files on the server.

Business Impact

The ability for an authenticated user to traverse the file system could lead to the unauthorized disclosure of sensitive neuroimaging research data, configuration files, or system credentials. With a CVSS score of 7.7, this high-severity vulnerability represents a significant risk to data confidentiality and regulatory compliance within research environments.

Remediation Plan

Immediate Action: Update the LORIS application to version 27.0.3 or 28.0.1 immediately to incorporate the provided fix.

Proactive Monitoring: Monitor server access logs for requests containing suspicious directory traversal patterns, such as sequences of dot-dot-slash (../).

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the service account's file system permissions to only those directories strictly required for operation.

Exploitation Status

Public Exploit Available: No (exploit_available unknown)

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user, making account security and prompt patching essential.

Analyst Recommendation

Given the potential for unauthorized data access and the high CVSS severity rating, organizations utilizing the LORIS platform must prioritize applying the identified patches. Ensure that internal access controls remain robust to prevent unauthorized users from leveraging this vulnerability to compromise the integrity of the research environment.

---METADATA---
VENDOR: Directus
PRODUCT: Directus
AFFECTED_VERSIONS: < 11.17.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc","name":"https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.251Z
---END_METADATA---

Description Summary:
Directus versions prior to 11.17.0 suffer from an information disclosure flaw where aggregate functions allow authenticated users to bypass masking for concealed fields.

Executive Summary:
A critical information disclosure vulnerability in Directus allows authenticated users to extract sensitive data, including API tokens and two-factor authentication secrets.

Vulnerability Details

CVE-ID: CVE-2026-35442

Affected Software: Directus Directus

Affected Versions: < 11.17.0

Vulnerability: This vulnerability arises from improper authorization and sensitive data exposure, where aggregate functions (min, max) combined with groupBy queries return raw database values instead of masked placeholders for concealed fields. The vulnerability is exploitable by any authenticated user with read access to the target collection.

Business Impact

Successful exploitation of this flaw poses a severe risk to organizational security, as it allows attackers to retrieve highly sensitive credentials such as static API tokens and 2FA secrets. Given the CVSS score of 8.1, this vulnerability is classified as High severity, as it facilitates unauthorized access to administrative or user accounts, potentially leading to a full compromise of the database management system.

Remediation Plan

Immediate Action: Update the Directus installation to version 11.17.0 or later to apply the necessary authorization checks on aggregate functions.

Proactive Monitoring: Review database access logs for unusual aggregate queries, specifically those targeting the directus_users collection or fields marked with the conceal special type.

Compensating Controls: Implement strict role-based access control (RBAC) to limit user access to sensitive collections and monitor for unauthorized attempts to perform aggregate operations on concealed data.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally exploitable due to a logic error in how the application processes masked fields during aggregation.

Analyst Recommendation

The ability for authenticated users to extract administrative credentials and security tokens makes this a high-priority remediation item. IT administrators should audit current user permissions to minimize the blast radius while scheduling the deployment of version 11.17.0 immediately to resolve the underlying authorization flaw.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome prior to 145.0.7632.159
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop.html","name":null,"tags":[]},{"url":"https://issues.chromium.org/issues/485683110","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.858Z
---END_METADATA---

Description Summary:
A heap buffer overflow in the Google Chrome WebCodecs component allows a remote attacker to trigger an out of bounds memory write via a crafted HTML page.

Executive Summary:
A heap buffer overflow vulnerability in Google Chrome allows remote attackers to execute arbitrary code via crafted HTML content, posing a high risk to user systems.

Vulnerability Details

CVE-ID: CVE-2026-3544

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 145.0.7632.159

Vulnerability: This is a heap buffer overflow (CWE-122) in the WebCodecs component, which can be triggered by an unauthenticated remote attacker through a maliciously crafted HTML page. The vulnerability involves an out of bounds memory write, which typically leads to application crashes or remote code execution.

Business Impact

The potential for remote code execution presents a significant threat to organizational security, as it could allow attackers to gain control over user workstations, exfiltrate sensitive data, or install persistent malware. With a CVSS score of 8.8, this vulnerability is categorized as High severity, reflecting the impact on confidentiality, integrity, and availability. Failure to remediate this flaw could result in widespread system compromise and potential data breaches.

Remediation Plan

Immediate Action: Update Google Chrome to version 145.0.7632.159 or later immediately to incorporate the vendor security patch.

Proactive Monitoring: Monitor endpoint security logs for unusual process execution patterns or unexpected browser crashes that may indicate exploitation attempts.

Compensating Controls: Use browser isolation technologies or endpoint protection platforms capable of detecting and blocking malicious memory operations within web browsers.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. While the vulnerability is critical due to the potential for remote code execution, it requires user interaction, such as navigating to a malicious web page, to trigger the flaw.

Analyst Recommendation

Given the high severity of this heap buffer overflow and the potential for remote exploitation, all organizations should prioritize the deployment of the latest Google Chrome updates. Administrators must ensure that all endpoints are patched to version 145.0.7632.159 or newer to eliminate this attack vector. Continuous monitoring of browser activity remains a recommended best practice for maintaining a resilient security posture.