---METADATA---
VENDOR: WGCLOUD
PRODUCT: WGCLOUD
AFFECTED_VERSIONS: v2.3.7 and before
---END_METADATA---

Description Summary:
A remote code execution (RCE) vulnerability in WGCLOUD v2.3.7 and earlier allows attackers to execute arbitrary code via the test connection function.

Executive Summary:
WGCLOUD monitoring software is affected by a critical remote code execution vulnerability that permits full system compromise through its connection testing feature.

Vulnerability Details

CVE-ID: CVE-2026-30402

Affected Software: WGCLOUD

Affected Versions: v2.3.7 and before

Vulnerability: The "test connection" function in WGCLOUD fails to properly sanitize inputs, allowing a remote attacker to inject and execute arbitrary code on the server. This vulnerability can be triggered by interacting with the connection diagnostic tools within the application.

Business Impact

WGCLOUD is often used for infrastructure monitoring, meaning a compromise of this system could provide an attacker with a vantage point to observe the entire IT environment. A successful RCE exploit allows for full server control, leading to potential data breaches, service disruption, and the loss of monitoring capabilities. The CVSS score of 9.8 reflects the extreme risk to the host system.

Remediation Plan

Immediate Action: Update WGCLOUD to the latest version immediately to patch the vulnerable test connection function.

Proactive Monitoring: Review system logs for suspicious processes or network connections originating from the WGCLOUD server, especially those related to shell execution.

Compensating Controls: Restrict access to the WGCLOUD web console to authorized administrative IP addresses and use a WAF to inspect traffic for injection-style attacks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation. Monitoring tools are high-value targets for attackers, making this RCE a significant concern for IT operations teams.

Analyst Recommendation

The ability to execute code remotely on a monitoring server is a critical security failure. Administrators must prioritize the update of WGCLOUD to a secure version. Ensure that the management console is not exposed to the public internet until the patch has been successfully applied.

---METADATA---
VENDOR: ISC
PRODUCT: BIND
AFFECTED_VERSIONS: 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BIND servers using GSS-API TKEY authentication are vulnerable to excessive memory consumption when processing malicious packets, potentially leading to a denial-of-service condition.

Executive Summary:
A memory exhaustion vulnerability in ISC BIND servers could allow remote attackers to cause a denial-of-service condition by sending maliciously-constructed TKEY packets.

Vulnerability Details

CVE-ID: CVE-2026-3039

Affected Software: ISC BIND

Affected Versions: 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This is a resource management vulnerability (CWE-771) where BIND fails to properly handle memory allocation during GSS-API TKEY authentication. It is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation results in a denial-of-service (DoS) state, rendering DNS services unavailable. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to organizational infrastructure, as DNS downtime interrupts critical network communication and business operations.

Remediation Plan

Immediate Action: Upgrade BIND installations to the vendor-recommended versions: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1.

Proactive Monitoring: Monitor server memory utilization and DNS traffic logs for spikes in TKEY-related packets or unexpected service restarts.

Compensating Controls: If immediate patching is not feasible, consider disabling GSS-API TKEY authentication if it is not strictly required for current operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to DNS availability. Administrators should prioritize upgrading to the patched releases immediately to prevent potential service disruptions.

---METADATA---
VENDOR: Flipper Devices
PRODUCT: flipperzero-firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack overflow vulnerability has been discovered in the "Main" function of the Flipper Zero firmware, commit ad2a80.

Executive Summary:
A stack overflow vulnerability in the Flipper Zero firmware could allow an attacker to cause system crashes or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-30363

Affected Software: Flipper Devices flipperzero-firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a stack overflow located within the "Main" function of the firmware. This type of memory corruption flaw can be triggered by providing specially crafted input, potentially leading to arbitrary code execution or a denial-of-service state.

Business Impact

With a CVSS score of 8.4, this vulnerability represents a significant risk to the integrity of the Flipper Zero device. Successful exploitation could allow an attacker to gain control over the device's operations, compromising any sensitive data stored or processed by the unit.

Remediation Plan

Immediate Action: Update the Flipper Zero firmware to the latest available release that includes the patch for commit ad2a80.

Proactive Monitoring: Observe the device for unexpected reboots or unstable behavior that could indicate memory corruption attempts.

Compensating Controls: Avoid connecting the device to untrusted or malicious wireless environments that could deliver the payload required to trigger the overflow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of the Flipper Zero should verify their firmware version and update immediately to resolve this stack overflow. Given the risk of memory corruption, proactive patching is essential to maintain the security and operational reliability of the hardware.

---METADATA---
VENDOR: LeonVanzyl
PRODUCT: Autocoder
AFFECTED_VERSIONS: commit 79d02a
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A remote code execution vulnerability exists in the Autocoder /devserver/start endpoint, allowing arbitrary code execution via a crafted command parameter.

Executive Summary:
An unauthenticated remote code execution vulnerability in the LeonVanzyl Autocoder development server allows attackers to execute arbitrary commands on the host machine.

Vulnerability Details

CVE-ID: CVE-2026-30352

Affected Software: LeonVanzyl Autocoder

Affected Versions: Commit 79d02a

Vulnerability: The vulnerability is a command injection flaw located in the /devserver/start endpoint. An attacker can provide a maliciously crafted command parameter that is processed by the underlying system without sufficient validation, leading to unauthorized code execution.

Business Impact

Rated at 9.8, this RCE vulnerability poses a critical threat to the confidentiality, integrity, and availability of any system running the affected Autocoder commit. Attackers can gain full control over the host environment, leading to data theft, lateral movement within the network, or permanent system disruption.

Remediation Plan

Immediate Action: Discontinue use of the vulnerable commit immediately and restrict network access to the /devserver/start endpoint until a secure update is provided.

Proactive Monitoring: Review web server and application access logs for unusual requests targeting the /devserver/start path and monitor for suspicious child processes spawned by the application.

Compensating Controls: Implement strict network-level segmentation or a reverse proxy with path-based filtering to block all access to the /devserver/ directory from external or untrusted internal networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the simplicity of the attack vector, this vulnerability should be treated as an emergency. Users should verify their current deployment against the affected commit and isolate the service until a verified fix is released by the maintainer.

---METADATA---
VENDOR: Balena
PRODUCT: Etcher
AFFECTED_VERSIONS: Balena Etcher for Windows prior to v2
---END_METADATA---

Description Summary:
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in Balena Etcher for Windows prior to version 2, potentially allowing for unauthorized file operations.

Executive Summary:
Balena Etcher for Windows is vulnerable to a race condition that could be exploited to perform unauthorized file modifications or escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-30332

Affected Software: Balena Etcher

Affected Versions: Balena Etcher for Windows prior to v2

Vulnerability: This vulnerability is a TOCTOU race condition. An attacker with local access could potentially manipulate files between the time the application checks their status and the time it performs an operation, leading to unauthorized actions.

Business Impact

While this vulnerability typically requires local access, it can be used as part of a multi-stage attack to escalate privileges or modify system files during the image flashing process. The CVSS score of 7.5 reflects a high severity, as it compromises the integrity of the software's core function: writing disk images safely.

Remediation Plan

Immediate Action: Upgrade Balena Etcher for Windows to version 2 or later to resolve the race condition vulnerability.

Proactive Monitoring: Monitor for suspicious file system activity during the execution of disk imaging tools, particularly in temporary directories.

Compensating Controls: Implement strict application control policies to ensure only authorized users can run imaging software with administrative privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Race conditions are often difficult to exploit reliably but remain a significant security concern for applications requiring elevated privileges.

Analyst Recommendation

To maintain system integrity, users should update Balena Etcher to version 2 immediately. This update is critical for preventing potential local attackers from exploiting the race condition to perform unauthorized system modifications.

---METADATA---
VENDOR: TOKUHIROM
PRODUCT: Image::EPEG
AFFECTED_VERSIONS: 0 through 0.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Image::EPEG for Perl versions 0 through 0.15 embeds a legacy, unmaintained Epeg library from 2004, exposing applications to critical security vulnerabilities.

Executive Summary:
The Perl module Image::EPEG contains an outdated and unsupported third party library, which introduces significant security risks to any application utilizing this component.

Vulnerability Details

CVE-ID: CVE-2026-3031

Affected Software: TOKUHIROM Image::EPEG

Affected Versions: 0 through 0.15

Vulnerability: This vulnerability involves the use of unmaintained third party components (CWE-1104). The Image::EPEG module embeds Epeg version 0.9.0, a JPEG thumbnail library that has not received security updates since 2004, leaving it susceptible to known and unknown unpatched flaws.

Business Impact

The CVSS score of 9.8 reflects the critical severity of this issue. Because the component is unmaintained, any vulnerability within the embedded library cannot be patched by the original developers, potentially allowing unauthenticated remote attackers to achieve full system compromise, data theft, or denial of service.

Remediation Plan

Immediate Action: Organizations should evaluate their reliance on Image::EPEG and migrate to a modern, actively maintained library for JPEG processing.

Proactive Monitoring: Review application dependency trees to identify where Image::EPEG is utilized and monitor server logs for unusual crashes or abnormal memory usage patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests that might target image processing pipelines, although this is a temporary measure and not a substitute for removing the vulnerable component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk stems primarily from the architectural inclusion of a long-obsolete library that lacks modern security protections.

Analyst Recommendation

Given the critical CVSS severity and the impossibility of receiving security patches for the embedded legacy code, immediate action is required. Organizations must prioritize the replacement of the Image::EPEG module to eliminate the exposure to unpatched vulnerabilities inherent in the legacy Epeg 0.9.0 library.

---METADATA---
VENDOR: AI Code
PRODUCT: AI Code
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
AI Code's "Execute safe commands" feature is vulnerable to prompt injection, allowing attackers to bypass user approval and execute arbitrary terminal commands.

Executive Summary:
AI Code is vulnerable to unauthenticated arbitrary command execution because its AI-driven safety filter can be bypassed through simple prompt injection attacks.

Vulnerability Details

CVE-ID: CVE-2026-30304

Affected Software: AI Code AI Code

Affected Versions: See vendor advisory

Vulnerability: The application uses an AI model to distinguish between "safe" and "destructive" terminal commands. An attacker can use prompt injection templates to mislead the model into misclassifying malicious commands as safe, resulting in automatic execution without the required user approval.

Business Impact

This vulnerability allows for arbitrary command execution on the host machine where AI Code is running. This could result in the loss of intellectual property, data theft, or the installation of malware. The CVSS score of 9.6 reflects the high impact of bypassing the primary security control of the "safe execution" feature.

Remediation Plan

Immediate Action: Update AI Code to the latest version. Disable the "Execute safe commands" feature and require manual approval for all command executions until the patch is verified.

Proactive Monitoring: Review command execution logs for any instances of obfuscated or unusual shell commands that were automatically approved by the AI model.

Compensating Controls: Run the AI Code environment within a restricted sandbox or container with minimal privileges to limit the impact of any successful command injection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. Prompt injection is a known and evolving threat vector against AI-integrated tools.

Analyst Recommendation

The reliance on AI models for security enforcement without robust, non-AI secondary checks is a significant design flaw. Administrators should immediately disable automatic command execution features and update the software. Moving toward a "zero-trust" model for AI-generated commands is highly recommended.

---METADATA---
VENDOR: Axon Code
PRODUCT: Axon Code
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Axon Code is vulnerable to OS command injection on Windows systems because its auto-approval module incorrectly uses a Unix parser, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
Axon Code installations on Windows are subject to unauthenticated Remote Code Execution due to a failure to properly sanitize Windows-specific command line escape sequences.

Vulnerability Details

CVE-ID: CVE-2026-30303

Affected Software: Axon Code Axon Code

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the command auto-approval module where a Unix-based shell-quote library is used to validate commands on Windows. An unauthenticated attacker can use the ^ character to deceive the parser into auto-approving a command that contains a malicious payload executed by the underlying Windows CMD interpreter.

Business Impact

The impact is critical, as it allows for arbitrary Remote Code Execution (RCE). Attackers can gain complete control over the affected server, leading to data breaches, service disruption, and potential lateral movement within the corporate network. The CVSS score of 9.8 reflects the high exploitability and severe impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Axon Code software to the latest version which contains the corrected command parsing logic.

Proactive Monitoring: Monitor Windows event logs for suspicious cmd.exe child processes originating from the Axon Code service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming requests containing shell metacharacters and escape sequences directed at the auto-approval module.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. The technical details provided in the description, however, are sufficient for a skilled attacker to craft a functional exploit.

Analyst Recommendation

The reliance on incompatible libraries for security-critical functions creates a significant vulnerability. It is imperative that administrators apply the vendor-provided patch immediately. Failure to do so leaves the environment exposed to high-impact RCE attacks that can be triggered without any user interaction or authentication.

---METADATA---
VENDOR: CodeRider
PRODUCT: CodeRider-Kilo
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
CodeRider-Kilo contains an OS command injection vulnerability due to improper parsing of Windows escape sequences using a Unix-based library, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated attacker can achieve full Remote Code Execution (RCE) on Windows-based CodeRider-Kilo installations by bypassing the command whitelist via crafted escape characters.

Vulnerability Details

CVE-ID: CVE-2026-30302

Affected Software: CodeRider CodeRider-Kilo

Affected Versions: See vendor advisory

Vulnerability: This is an OS Command Injection vulnerability occurring in the command auto-approval module. An unauthenticated attacker can exploit a discrepancy between the Unix-based shell-quote parser and the Windows CMD interpreter by using the ^ escape character to hide malicious commands within a legitimate Git whitelist request.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands with the privileges of the application service. This can lead to total system compromise, unauthorized data exfiltration, and the installation of persistent backdoors. Given the CVSS score of 10.0, this represents the highest possible technical risk to the organization's infrastructure.

Remediation Plan

Immediate Action: Update CodeRider-Kilo to the latest available version immediately to resolve the parser incompatibility.

Proactive Monitoring: Review system logs for unusual Git command patterns, specifically those containing unusual escape characters like ^, &, or nested quotes.

Compensating Controls: Implement strict egress filtering on the host to prevent the server from communicating with unknown external IP addresses following a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its maximum CVSS severity, the potential for rapid exploit development is extremely high.

Analyst Recommendation

This vulnerability is critical because it bypasses primary security whitelists through a fundamental logic error in environment-specific parsing. Organizations running CodeRider-Kilo on Windows environments must prioritize this update above all other maintenance tasks. Immediate patching is the only effective way to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: UXGROUP LLC
PRODUCT: Cast to TV Screen Mirroring
AFFECTED_VERSIONS: v2.2.77
---END_METADATA---

Description Summary:
UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 is vulnerable to an arbitrary file overwrite during the import process, leading to code execution or data exposure.

Executive Summary:
An arbitrary file overwrite vulnerability in the Cast to TV Screen Mirroring application allows attackers to replace critical system files, potentially leading to full remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30282

Affected Software: UXGROUP LLC Cast to TV Screen Mirroring

Affected Versions: v2.2.77

Vulnerability: This vulnerability occurs during the file import process of the application. An attacker can craft a malicious file that, when processed, overwrites critical internal application or system files, allowing for arbitrary code execution (ACE) or sensitive information exposure.

Business Impact

The ability to overwrite arbitrary files is a high-impact flaw that typically leads to complete system compromise. With a CVSS score of 9.0, a successful exploit could allow an attacker to gain a persistent foothold on the device, steal user data, or pivot to other systems on the network. This represents a significant risk to both individual user privacy and corporate network security.

Remediation Plan

Immediate Action: Users should immediately update the Cast to TV Screen Mirroring application to the latest available version provided by UXGROUP LLC.

Proactive Monitoring: Monitor device file systems for unauthorized changes to application directories and review system logs for unusual process executions following file imports.

Compensating Controls: Restrict application permissions to the minimum necessary for operation and avoid importing files from untrusted or unknown sources until the software is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, file overwrite vulnerabilities are a well-known vector for achieving code execution, making this a high-priority target for attackers.

Analyst Recommendation

The potential for arbitrary code execution necessitates an immediate response. We strongly recommend that all users of the Cast to TV Screen Mirroring application update to a secure version immediately. Organizations should also consider mobile device management (MDM) policies to ensure third-party applications are kept current.

---METADATA---
VENDOR: Doorman
PRODUCT: Doorman
AFFECTED_VERSIONS: 0.1.0, 1.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper access control vulnerability in Doorman allows authenticated users to escalate their account role to high-privileged levels via the account update endpoint.

Executive Summary:
A critical privilege escalation vulnerability in Doorman allows authenticated users to perform unauthorized role changes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-30269

Affected Software: Doorman Doorman

Affected Versions: 0.1.0, 1.0.2

Vulnerability: This vulnerability involves a missing authorization check within the /platform/user/{username} endpoint. An authenticated user can manipulate the role parameter during a profile update to grant themselves administrative or other high-privileged roles.

Business Impact

The ability for a standard user to escalate privileges poses a severe threat to data integrity, confidentiality, and operational control. With a CVSS score of 9.9, this vulnerability represents an imminent risk of unauthorized administrative access, which could lead to complete system takeover, unauthorized data exfiltration, and significant reputational damage.

Remediation Plan

Immediate Action: Restrict user access to the profile update functionality until an official patch is applied or verify if the vendor has provided a specific update for these versions.

Proactive Monitoring: Review application access logs for anomalous POST or PUT requests to the /platform/user/ endpoint, specifically looking for role changes associated with non-administrative accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the profile update endpoint that contain unauthorized role assignments.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators should prioritize identifying all instances of Doorman within their environment. Immediately restrict user profile modification capabilities and prepare to apply the vendor-supplied patch as soon as it is released to prevent potential privilege escalation.

---METADATA---
VENDOR: Plane
PRODUCT: Plane
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Plane open-source project management tool allows for potential unauthorized actions, threatening the confidentiality of sensitive project data and organizational workflows.

Executive Summary:
The Plane project management platform is affected by a high-severity vulnerability that could lead to unauthorized data access or system manipulation, endangering proprietary project information.

Vulnerability Details

CVE-ID: CVE-2026-30242

Affected Software: Plane

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Plane project management tool's core logic. Given its high CVSS score, it likely involves an authentication bypass or an insecure direct object reference (IDOR) that allows an attacker to access or modify data without proper authorization.

Business Impact

Exploitation of this flaw could result in the theft of intellectual property, exposure of strategic roadmaps, and unauthorized modification of project tasks. The CVSS score of 8.5 indicates a High severity, suggesting that a successful attack could significantly disrupt business operations and lead to a loss of stakeholder trust in the platform's security.

Remediation Plan

Immediate Action: Deploy the latest security patches or container image updates for the Plane platform immediately to secure the environment.

Proactive Monitoring: Audit application access logs for unusual patterns of data export or administrative actions performed by standard user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter for common injection or unauthorized access patterns and implement strict role-based access controls (RBAC).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, because Plane is an open-source tool, the source code is available for researchers and threat actors to identify exploitation vectors quickly.

Analyst Recommendation

The severity of this vulnerability (CVSS 8.5) requires immediate remediation to protect sensitive organizational data. We recommend that IT teams treat this as a high-priority update and verify the integrity of project data following the application of the patch.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase (PWA Component)
AFFECTED_VERSIONS: 3.31.5 and earlier
---END_METADATA---

Description Summary:
A path traversal vulnerability in Budibase's PWA ZIP processing allows authenticated builders to exfiltrate sensitive server files, including environment variables and encryption keys.

Executive Summary:
Authenticated users with builder privileges can completely compromise the Budibase platform by using a path traversal flaw to steal cryptographic secrets and service credentials.

Vulnerability Details

CVE-ID: CVE-2026-30240

Affected Software: Budibase

Affected Versions: 3.31.5 and earlier

Vulnerability: A path traversal flaw exists in the POST /api/pwa/process-zip endpoint. By crafting a malicious icons.json file inside a ZIP upload, an authenticated builder can force the server to read arbitrary files like /proc/1/environ and upload them to public-facing object storage.

Business Impact

This vulnerability leads to a total platform compromise. By exfiltrating environment variables, an attacker gains access to JWT secrets, database credentials, and API tokens. The CVSS score of 9.6 is justified because the flaw allows a user with limited "builder" permissions to elevate their access to a full system administrator and compromise the underlying infrastructure.

Remediation Plan

Immediate Action: Update Budibase to the latest version (post-3.31.5) which includes sanitized path joining and input validation for the PWA processing endpoint.

Proactive Monitoring: Monitor MinIO or S3 object stores for unexpected file uploads, and review builder activity logs for suspicious ZIP processing requests.

Compensating Controls: Implement the principle of least privilege by restricting builder access to trusted personnel and rotate all secrets (JWT, DB, API keys) if exploitation is suspected.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation. The severity is exceptionally high because it facilitates the mass exfiltration of all service credentials in a single request.

Analyst Recommendation

The ability to exfiltrate the server's environment variables is a "game-over" scenario for any application. Organizations using Budibase must update their installations immediately and consider rotating all platform secrets as a precautionary measure.

---METADATA---
VENDOR: OliveTin
PRODUCT: OliveTin Web Interface
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
OliveTin, a web interface for shell commands, contains a high-severity vulnerability that could lead to unauthorized command execution.

Executive Summary:
OliveTin is affected by a high-severity vulnerability that could allow unauthorized individuals to execute predefined or arbitrary shell commands via the web interface.

Vulnerability Details

CVE-ID: CVE-2026-30223

Affected Software: OliveTin

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability impacts the way OliveTin manages access to shell commands. Given its function as a command execution wrapper, a flaw in this area typically involves improper access control or command injection.

Business Impact

Unauthorized access to OliveTin could allow an attacker to execute system-level commands, leading to server compromise, data loss, or service disruption. The CVSS score of 8.8 reflects the high risk associated with a tool designed specifically to execute shell operations.

Remediation Plan

Immediate Action: Apply vendor security updates immediately and ensure that all access to the OliveTin interface requires strong authentication.

Proactive Monitoring: Review OliveTin execution logs for any commands triggered by unauthorized users or at unusual times.

Compensating Controls: Place the OliveTin interface behind a VPN or an identity-aware proxy (IAP) to restrict access to trusted personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. However, tools that bridge web interfaces to shell commands are naturally high-risk targets.

Analyst Recommendation

Immediate patching is required. Furthermore, administrators should strictly audit which commands are available via OliveTin and ensure the service is not exposed to the public internet.

---METADATA---
VENDOR: bitbank2
PRODUCT: AnimatedGIF
AFFECTED_VERSIONS: v2.2.0
---END_METADATA---

Description Summary:
The bitbank2 AnimatedGIF library contains a buffer overflow in the DecodeLZW function that can lead to remote code execution or denial of service via a crafted GIF file.

Executive Summary:
A critical buffer overflow in the bitbank2 AnimatedGIF library allows remote attackers to cause a crash or execute arbitrary code via malicious GIF files.

Vulnerability Details

CVE-ID: CVE-2026-30141

Affected Software: bitbank2 AnimatedGIF

Affected Versions: v2.2.0

Vulnerability: The vulnerability exists in the DecodeLZW function, which fails to properly handle bounds checking during GIF decompression. An attacker can supply a specially crafted GIF file that causes a buffer overflow, leading to application crashes or the execution of arbitrary code.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical for any application utilizing this library to process image uploads or user-provided files. Successful exploitation could lead to full application compromise or service disruption, causing significant reputational and operational harm to businesses relying on the library for image processing.

Remediation Plan

Immediate Action: Update the bitbank2 AnimatedGIF library to the latest patched version.

Proactive Monitoring: Implement strict file type validation and scanning for all user-uploaded images before they reach the processing layer.

Compensating Controls: Run image processing tasks within a sandboxed, low-privilege container environment to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and security teams must audit their software supply chain to identify applications that depend on the bitbank2 AnimatedGIF library. Updating to the latest version is essential to mitigate the risk of remote code execution via malicious image files.

---METADATA---
VENDOR: Samba
PRODUCT: Samba
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw exists in Samba's certificate auto-enrollment Group Policy handling mechanism.

Executive Summary:
An authentication-related vulnerability in Samba’s Group Policy handling could allow attackers to compromise certificate auto-enrollment processes.

Vulnerability Details

CVE-ID: CVE-2026-3012

Affected Software: Samba

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the certificate auto-enrollment Group Policy handling component. It requires the attacker to have a level of authenticated network access to manipulate policy objects, potentially leading to unauthorized certificate management.

Business Impact

Successful exploitation of this flaw could allow unauthorized entities to manipulate certificate enrollment, potentially leading to a total compromise of trust within the domain environment. With a CVSS score of 8.0, this represents a high-severity risk that could facilitate man-in-the-middle attacks or unauthorized access to encrypted data streams.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Samba project or your Linux distribution vendor immediately.

Proactive Monitoring: Monitor domain controller logs for unusual modifications to Group Policy Objects (GPOs) and abnormal certificate enrollment requests.

Compensating Controls: Restrict administrative access to Group Policy management to only verified and essential personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of identity and certificate services, the potential for exploitation is high.

Analyst Recommendation

Given the central role of Samba in enterprise identity management, this vulnerability poses a significant risk to organizational integrity. Administrators are urged to prioritize the deployment of vendor-supplied patches and audit current certificate auto-enrollment configurations to ensure no unauthorized changes have occurred.

---METADATA---
VENDOR: Changing
PRODUCT: IDExpert Windows Logon Agent
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
IDExpert Windows Logon Agent is vulnerable to unauthenticated remote code execution via unauthorized remote DLL downloads and execution.

Executive Summary:
The IDExpert Windows Logon Agent is susceptible to a critical remote code execution flaw that allows unauthenticated attackers to execute malicious DLLs on target systems.

Vulnerability Details

CVE-ID: CVE-2026-3000

Affected Software: Changing IDExpert Windows Logon Agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The software contains a Remote Code Execution (RCE) vulnerability. An unauthenticated attacker can remotely force the system to download arbitrary DLL files from a malicious source and execute them, bypassing standard security boundaries.

Business Impact

The impact of this vulnerability is critical, as it allows for unauthorized code execution at the system level without requiring user interaction or credentials. This could lead to the total compromise of sensitive authentication infrastructure and the theft of user credentials. The CVSS score of 9.8 underscores the extreme risk to organizational security and business continuity.

Remediation Plan

Immediate Action: Apply the latest security updates for IDExpert Windows Logon Agent as provided by the vendor to mitigate this RCE risk.

Proactive Monitoring: Inspect system logs for the loading of unsigned or suspicious DLLs and monitor for unusual network activity originating from the logon agent service.

Compensating Controls: Implement strict firewall rules to prevent the logon agent from initiating connections to untrusted external domains and employ application whitelisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical ease of exploiting unauthenticated RCE flaws makes this a high-priority target for attackers.

Analyst Recommendation

Given the Critical severity and the potential for complete system takeover, IT administrators should treat this as a top-priority patching task. Immediate remediation is necessary to protect Windows logon environments from remote compromise.

---METADATA---
VENDOR: Changing
PRODUCT: IDExpert Windows Logon Agent
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A remote code execution vulnerability in IDExpert Windows Logon Agent allows unauthenticated attackers to force arbitrary file downloads and execution from remote sources.

Executive Summary:
Unauthenticated remote attackers can achieve full system compromise on hosts running IDExpert Windows Logon Agent by forcing the execution of malicious remote files.

Vulnerability Details

CVE-ID: CVE-2026-2999

Affected Software: Changing IDExpert Windows Logon Agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Remote Code Execution (RCE) vulnerability. It allows an unauthenticated remote attacker to manipulate the agent into downloading arbitrary executable files from an attacker-controlled remote source and executing them with system-level privileges.

Business Impact

A successful exploit grants an attacker the ability to execute arbitrary code, leading to complete takeover of the affected Windows workstation or server. This presents a severe risk of data exfiltration, ransomware deployment, and lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and high impact on system integrity.

Remediation Plan

Immediate Action: Update the IDExpert Windows Logon Agent to the latest available version provided by Changing immediately to close the execution vector.

Proactive Monitoring: Monitor network traffic for unauthorized outbound connections to unknown external IP addresses from logon agents and review Windows event logs for unexpected process creations.

Compensating Controls: Restrict outbound internet access for internal agents to only known-good update servers and utilize Endpoint Detection and Response (EDR) tools to block unauthorized file executions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical 9.8 CVSS score, the potential for rapid exploitation by threat actors is extremely high.

Analyst Recommendation

This vulnerability is categorized as Critical and requires immediate attention from security teams. Organizations using Changing's IDExpert solution must prioritize the deployment of the vendor's patch to prevent unauthenticated remote code execution.

---METADATA---
VENDOR: eAI Technologies
PRODUCT: ERP
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A DLL Hijacking vulnerability in eAI Technologies ERP allows authenticated local attackers to execute arbitrary code by placing a malicious DLL in the application directory.

Executive Summary:
Authenticated local attackers can achieve arbitrary code execution on systems running eAI Technologies ERP by exploiting a DLL hijacking flaw.

Vulnerability Details

CVE-ID: CVE-2026-2998

Affected Software: eAI Technologies ERP

Affected Versions: See vendor advisory for affected versions

Vulnerability: The application fails to securely validate or specify the full path of required DLL files. This allows an authenticated local attacker to place a malicious DLL in the program's directory, which the application then loads and executes with the program's privileges.

Business Impact

Successful exploitation allows an attacker to escalate privileges or maintain persistence on a local workstation or server. This could lead to the theft of corporate data or further lateral movement within the corporate network. The CVSS score of 7.8 indicates a High severity, primarily limited by the requirement for local access and authentication.

Remediation Plan

Immediate Action: Apply the official security updates from eAI Technologies immediately to ensure the application uses secure library loading mechanisms.

Proactive Monitoring: Monitor for the creation of unexpected DLL files in application directories and review system logs for unauthorized administrative-level process executions.

Compensating Controls: Implement strict folder permissions to prevent non-administrative users from writing files to the ERP application directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, DLL hijacking is a well-understood attack vector that is frequently used in multi-stage compromises.

Analyst Recommendation

While this vulnerability requires local access, the potential for arbitrary code execution makes it a significant risk for environments where multiple users share systems. IT administrators should verify directory permissions and deploy the vendor's patch as soon as possible to mitigate the risk of privilege escalation.

---METADATA---
VENDOR: HSC
PRODUCT: MailInspector
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A Local File Inclusion (LFI) and path traversal vulnerability in HSC MailInspector 5 allows unauthorized access to files on the host system.

Executive Summary:
A critical LFI and path traversal vulnerability in HSC MailInspector 5 allows unauthenticated attackers to read arbitrary files from the server.

Vulnerability Details

CVE-ID: CVE-2026-29963

Affected Software: HSC MailInspector 5

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves Local File Inclusion (LFI) and path traversal, allowing an unauthenticated attacker (AV:N/AC:L/PR:N) to bypass directory restrictions and access sensitive files on the underlying file system.

Business Impact

An LFI vulnerability allows attackers to read configuration files, application source code, or sensitive system files, potentially leading to full system compromise. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the host server.

Remediation Plan

Immediate Action: Contact the vendor (HSC) immediately for security updates and verify if your specific version is vulnerable.

Proactive Monitoring: Monitor file system access logs for suspicious traversal patterns (e.g., ../../) and unauthorized attempts to access system-level files.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to detect and block path traversal and LFI payloads.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of May 20, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public PoC significantly increases the likelihood of opportunistic exploitation.

Analyst Recommendation

This vulnerability is highly dangerous due to the existence of public exploit code. Administrators must treat this as an urgent issue and immediately implement WAF protections while awaiting a formal patch from the vendor.