---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Prior to version 8.0.0
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the OpenEMR Patient REST API allows authenticated users to execute arbitrary queries and access protected health information.

Executive Summary:
A critical SQL injection vulnerability in OpenEMR allows authenticated users to bypass security controls and access sensitive patient data, leading to a major breach of PHI.

Vulnerability Details

CVE-ID: CVE-2026-24908

Affected Software: OpenEMR OpenEMR

Affected Versions: Prior to version 8.0.0

Vulnerability: The vulnerability exists in the Patient REST API endpoint due to the lack of proper validation on the _sort parameter. An authenticated attacker with API access can inject malicious SQL commands into the ORDER BY clause, enabling unauthorized database interaction.

Business Impact

The impact of this flaw is severe, potentially resulting in the full exposure of Protected Health Information (PHI) and a violation of HIPAA regulations. Beyond data theft, attackers could compromise administrative credentials or manipulate medical records, leading to significant legal, financial, and reputational damage. The CVSS score of 9.9 underscores the critical nature of this injection flaw.

Remediation Plan

Immediate Action: Administrators must upgrade OpenEMR installations to version 8.0.0 or higher to eliminate the vulnerable code path in the REST API.

Proactive Monitoring: Review database logs for anomalous queries containing SQL keywords in the ORDER BY clauses and monitor API traffic for suspicious sorting requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to intercept and block malicious payloads targeting the REST API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. Given that OpenEMR is widely used in healthcare, the incentive for exploitation by threat actors is high.

Analyst Recommendation

Protecting patient data is a primary requirement for healthcare providers. Organizations using OpenEMR must prioritize this update immediately to prevent unauthorized access to sensitive medical databases and ensure regulatory compliance.

Executive Summary:
A high-severity vulnerability has been identified in the TrustTunnel VPN protocol affecting multiple products from the vendor "prior". This flaw, a Server-Side Request Forgery (SSRF), could allow a remote attacker to bypass network security restrictions and force the VPN server to make unauthorized requests to internal network resources, potentially leading to data exposure and further network compromise.

Vulnerability Details

CVE-ID: CVE-2026-24902

Affected Software: prior Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Server-Side Request Forgery (SSRF) combined with a private network restriction bypass within the TrustTunnel VPN protocol. An unauthenticated remote attacker can craft a malicious request to the vulnerable VPN server. The server fails to properly validate this input, causing it to initiate a new connection to an arbitrary destination on the internal network, effectively acting as a proxy for the attacker. This allows the attacker to scan internal networks, access internal services, and potentially exfiltrate sensitive data from systems that were presumed to be protected from external access.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.1. Successful exploitation could have a significant negative impact on the organization. An attacker could gain unauthorized access to sensitive internal systems, such as databases, file servers, and internal applications, bypassing perimeter defenses. This could lead to the exfiltration of confidential corporate data, intellectual property theft, service disruption, and lateral movement within the corporate network. The resulting consequences include potential data breaches, financial loss, reputational damage, and non-compliance with regulatory requirements.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected products immediately. After patching, it is crucial to review access logs for the VPN server and connected internal systems for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for signs of exploitation. This includes scrutinizing VPN server logs for unusual or malformed connection requests. Monitor network traffic for unexpected outbound connections from the VPN server to internal IP addresses and ports. Internal application logs should also be reviewed for anomalous requests originating from the VPN server's IP address.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Apply strict firewall rules to limit the VPN server's ability to initiate connections to other systems on the internal network. Enforce an "allow-list" model, only permitting access to explicitly required resources.
• Deploy an Intrusion Prevention System (IPS) or Web Application Firewall (WAF) to inspect traffic to the VPN server for known SSRF attack patterns.
• Enhance network segmentation to isolate the VPN server from critical internal assets, preventing lateral movement in case of a compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 31, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, SSRF vulnerabilities are well-understood by attackers, and it is highly likely that exploits will be developed. Organizations should assume that threat actors will begin scanning for and attempting to exploit this flaw.

Analyst Recommendation

Given the high severity (CVSS 7.1) and the critical function of VPN servers as gateways to internal networks, this vulnerability poses a significant risk. The analyst strongly recommends that organizations prioritize the immediate application of vendor-supplied patches to all affected systems. While this CVE is not currently listed on the CISA KEV list, its potential for granting initial access to a network makes it an attractive target for attackers. The remediation and monitoring steps outlined in this report should be implemented without delay to prevent unauthorized access and protect sensitive internal resources.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR (MedEx Module)
AFFECTED_VERSIONS: Prior to 8.0.0
---END_METADATA---

Description Summary:
An unauthenticated token disclosure in OpenEMR's MedEx callback endpoint leaks API tokens, leading to PHI exfiltration and HIPAA violations.

Executive Summary:
OpenEMR contains a critical vulnerability where an unauthenticated attacker can steal MedEx API tokens, resulting in the exposure of sensitive patient health information.

Vulnerability Details

CVE-ID: CVE-2026-24898

Affected Software: OpenEMR

Affected Versions: Prior to 8.0.0

Vulnerability: The MedEx callback endpoint explicitly bypasses authentication ($ignoreAuth = true). By providing a callback_key via POST, an unauthenticated visitor triggers a login process that returns the full JSON response, including sensitive MedEx API tokens.

Business Impact

This vulnerability carries a CVSS score of 10. The exposure of API tokens allows for complete third-party service compromise, unauthorized actions on the MedEx platform, and the exfiltration of Protected Health Information (PHI). This constitutes a major security failure and a direct violation of HIPAA regulations.

Remediation Plan

Immediate Action: Upgrade OpenEMR to version 8.0.0 immediately. Following the upgrade, revoke and rotate all MedEx API tokens to ensure any previously leaked tokens are invalidated.

Proactive Monitoring: Review access logs for the MedEx callback endpoint for unauthorized POST requests and monitor MedEx platform logs for suspicious activity.

Compensating Controls: Implement IP whitelisting for the MedEx callback endpoint so that only legitimate MedEx servers can communicate with the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. Given the sensitivity of the data involved, this vulnerability is a prime target for attackers seeking medical records.

Analyst Recommendation

This is a critical security flaw with severe legal and financial implications. We strongly urge immediate patching and token rotation to protect patient data and maintain regulatory compliance.

Executive Summary:
A critical vulnerability has been identified in the Erugo self-hosted file-sharing platform, allowing a low-privileged authenticated user to gain full control of the server. An attacker can exploit this flaw by uploading a malicious file to a web-accessible location, leading to remote code execution. This complete system compromise poses a severe risk of data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-24897

Affected Software: Erugo is a Multiple Products

Affected Versions: Versions up to and including 0.2.14

Vulnerability: The vulnerability exists due to insufficient path validation in the file-sharing creation feature. An authenticated attacker with low-level privileges can specify a crafted file path, such as one using path traversal sequences (../), when creating a new share. This allows them to bypass directory restrictions and designate a share location anywhere on the filesystem where the application has write permissions, including the public web root directory. By subsequently uploading a web shell or other executable script to this share, the attacker can place malicious code in a publicly accessible location and execute it by simply visiting the corresponding URL, resulting in full remote code execution on the server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10. Successful exploitation results in a complete compromise of the server hosting the Erugo platform. This could lead to the theft or destruction of all stored data, installation of ransomware, or the use of the compromised server to launch further attacks against the internal network. The potential business impact includes significant data breach costs, regulatory fines, operational downtime, and severe reputational damage. Since the only prerequisite for an attacker is a low-privileged account, the risk of exploitation is high in any environment where user registration is open or multiple users have access.

Remediation Plan

Immediate Action: Immediately upgrade all instances of Erugo to version 0.2.15 or later, which contains the fix for this vulnerability. After patching, review server access logs and application logs for any signs of suspicious activity, such as unusual file creation requests or access to unexpected files in the web root.

Proactive Monitoring: Implement enhanced monitoring of the Erugo application and underlying server. Specifically, monitor application logs for share creation events containing path traversal sequences (../). Use file integrity monitoring (FIM) to alert on any new files, especially those with executable extensions (.php, .sh, .jsp, etc.), being written to the web root directory outside of normal deployment processes.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules to detect and block path traversal attacks.
• Strictly enforce file system permissions to prevent the web server's user account from writing to the web root or other sensitive directories.
• If business functionality allows, temporarily disable file upload capabilities for all non-administrative users.
• Audit all existing user accounts and remove any that are unnecessary or have excessive privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Jan 28, 2026), there are no publicly available exploits or reports of active exploitation in the wild. However, given the critical impact and the relative simplicity of the attack vector, proof-of-concept (PoC) exploits are expected to be developed and published quickly. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the critical severity (CVSS 10.0) and the potential for a low-privileged user to achieve complete system compromise, this vulnerability requires immediate attention. All organizations using affected versions of Erugo must prioritize applying the update to version 0.2.15 or later. The low barrier to exploitation makes this an attractive target for attackers, and organizations should assume it will be actively targeted in the near future.

---METADATA---
VENDOR: Arch (Node.js Library)
PRODUCT: Compressing
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the 'Compressing' Node.js library could allow for arbitrary file manipulation during the compression or decompression process.

Executive Summary:
The 'Compressing' library for Node.js contains a high-severity vulnerability that could allow attackers to perform unauthorized file writes on the host system.

Vulnerability Details

CVE-ID: CVE-2026-24884

Affected Software: Compressing (Node.js library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability likely involves a "Zip Slip" or path traversal flaw within the compression/uncompression functions. An attacker providing a malicious archive could potentially write files to arbitrary locations on the server, often without authentication if the library processes user-uploaded files.

Business Impact

A CVSS score of 8.4 reflects the high risk of Remote Code Execution (RCE) or system takeover. By overwriting critical system files or application code, an attacker can gain persistent access to the server, leading to data theft and significant operational impact.

Remediation Plan

Immediate Action: Developers should update the 'Compressing' dependency in their package.json to the latest secure version and redeploy affected applications.

Proactive Monitoring: Audit application code to ensure that all file paths extracted from archives are validated and sanitized before being written to the disk.

Compensating Controls: Run Node.js applications in a restricted environment (e.g., containers with read-only file systems where possible) to limit the impact of unauthorized file writes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Library vulnerabilities are particularly dangerous as they can affect a wide range of downstream applications.

Analyst Recommendation

We strongly recommend that development teams audit their Node.js projects for the 'Compressing' library and update it immediately. Failure to patch this library could leave servers vulnerable to full system compromise via malicious file uploads.

---METADATA---
VENDOR: themrdemonized
PRODUCT: xray-monolith
AFFECTED_VERSIONS: 0 up to (excluding) 2025.12.30
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion vulnerability in themrdemonized xray-monolith allows unauthenticated remote attackers to potentially access or manipulate system resources.

Executive Summary:
A critical type confusion vulnerability in xray-monolith (before 2025.12.30) poses a high risk of unauthorized data access or integrity compromise to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-24874

Affected Software: themrdemonized xray-monolith

Affected Versions: 0 up to (excluding) 2025.12.30

Vulnerability: This is a Type Confusion vulnerability (CWE-843) occurring within the application. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is exploitable by an unauthenticated remote attacker without requiring user interaction.

Business Impact

The vulnerability carries a CVSS score of 9.1, reflecting its high potential for severe impact. Successful exploitation could lead to unauthorized access to sensitive data or modification of critical system information, potentially resulting in significant operational disruption and data breach consequences.

Remediation Plan

Immediate Action: Upgrade to version 2025.12.30 or later to apply the necessary security fixes provided by the vendor.

Proactive Monitoring: Monitor system logs for unusual traffic patterns or errors that might indicate an attempt to exploit memory-related vulnerabilities.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets to identify and block malformed requests that may attempt to trigger type confusion.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for remote, unauthenticated code execution or data manipulation.

Analyst Recommendation

Given the critical CVSS severity and the low complexity required for exploitation, organizations using xray-monolith should prioritize patching immediately. Ensure that the updated version is deployed across all affected environments to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: ProjectSkyfire
PRODUCT: SkyFire_548
AFFECTED_VERSIONS: 0 up to (excluding) 5.4.8-stable5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper pointer arithmetic vulnerability in ProjectSkyfire SkyFire_548 allows unauthenticated remote attackers to cause system crashes or potentially execute arbitrary code.

Executive Summary:
A critical improper pointer arithmetic vulnerability in SkyFire_548 (before 5.4.8-stable5) allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-24872

Affected Software: ProjectSkyfire SkyFire_548

Affected Versions: 0 up to (excluding) 5.4.8-stable5

Vulnerability: The vulnerability involves improper pointer arithmetic, which can lead to memory corruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms that this is exploitable by an unauthenticated remote attacker.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk to infrastructure. Exploitation could lead to a total compromise of the affected system, including unauthorized data access and the potential for full system control, severely impacting business continuity.

Remediation Plan

Immediate Action: Update to version 5.4.8-stable5 or newer immediately to resolve the identified memory management flaw.

Proactive Monitoring: Review system and application logs for segmentation faults, abnormal crashes, or unexpected memory usage patterns.

Compensating Controls: Utilize memory protection mechanisms and restrict network access to the affected software to only trusted IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly susceptible to exploitation if exposed to the network.

Analyst Recommendation

Due to the critical severity and the lack of authentication required to exploit this flaw, this patch should be considered a high-priority emergency deployment. Organizations must update their SkyFire_548 installations immediately to prevent potential system-wide compromise.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiAnalyzer
AFFECTED_VERSIONS: FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiManager 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiNAC-F 7.6.3-7.6.5; FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in various Fortinet products allows attackers to log into devices registered to other accounts if FortiCloud SSO is enabled.

Executive Summary:
Multiple Fortinet products are affected by a critical authentication bypass vulnerability that permits unauthorized account access via FortiCloud SSO.

Vulnerability Details

CVE-ID: CVE-2026-24858

Affected Software: Fortinet FortiAnalyzer (and other listed Fortinet products)

Affected Versions: See "Affected Versions" in metadata for full scope of impacted firmware across FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy, and FortiWeb.

Vulnerability: This is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. It allows an attacker who possesses a legitimate FortiCloud account and a registered device to authenticate to other devices registered to different accounts, provided FortiCloud SSO is enabled.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of unauthorized access to sensitive network management infrastructure. Exploitation could allow attackers to gain control over security appliances, access logs, or modify firewall policies, leading to severe data breaches or complete network compromise.

Remediation Plan

Immediate Action: Update all affected Fortinet devices to the latest patched firmware versions as specified in the official Fortinet security advisory.

Proactive Monitoring: Review access logs for suspicious login patterns originating from unexpected FortiCloud accounts and monitor for unauthorized changes to administrative settings.

Compensating Controls: If patching is delayed, consider disabling FortiCloud SSO authentication as a temporary measure to block the attack vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of January 27, 2026, this vulnerability is listed in the CISA KEV catalog. While there is no public exploit code, the inclusion in the KEV catalog indicates that the vulnerability is being actively exploited in the wild.

Analyst Recommendation

This vulnerability poses a severe threat to organizational security due to the potential for cross-account unauthorized access. Organizations should treat this as a high-priority update and ensure all affected Fortinet infrastructure is updated immediately to mitigate the risk of compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple ChurchCRM products, a widely used open-source church management system. This flaw, tracked as CVE-2026-24854, could allow a remote, unauthenticated attacker to compromise the application, potentially leading to a complete loss of data confidentiality, integrity, and availability. Immediate patching is required to prevent unauthorized access to sensitive member information and financial data.

Vulnerability Details

CVE-ID: CVE-2026-24854

Affected Software: ChurchCRM Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an unauthenticated SQL injection flaw within the application's public-facing API endpoints. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL queries to a vulnerable endpoint. Successful exploitation allows the attacker to bypass authentication, execute arbitrary code on the database server, and potentially gain full administrative control over the underlying server operating system.

Business Impact

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 8.8. Successful exploitation could lead to the complete compromise of the ChurchCRM system. The potential consequences include unauthorized access to and exfiltration of sensitive Personally Identifiable Information (PII) of church members, disclosure of confidential financial and donation records, and reputational damage. An attacker could also deface the application or use the compromised server as a pivot point for further attacks against the internal network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. System administrators should prioritize the deployment of these patches across all affected ChurchCRM instances. Following the update, it is crucial to review web server and application access logs for any signs of exploitation attempts that may have occurred prior to patching.

Proactive Monitoring: Implement enhanced monitoring on the systems running ChurchCRM. Security teams should look for suspicious activity in web server logs, such as unusual URL requests containing SQL keywords (e.g., UNION, SELECT, SLEEP). Monitor for unexpected outbound network connections from the server and any unauthorized changes to files within the web application's directory.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attacks.
• Restrict access to the ChurchCRM application and its administrative interfaces to trusted IP addresses only.
• Ensure the database user account used by the application adheres to the principle of least privilege and cannot execute system-level commands.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of February 1, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, given the high severity and relative ease of exploitation for this type of flaw, it is highly probable that threat actors will develop and begin using exploits in the near future.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the critical nature of the data managed by ChurchCRM, this vulnerability requires immediate attention. Organizations must prioritize applying the vendor-supplied patches to all affected systems without delay. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime candidate for future inclusion and a high-value target for attackers. If patching is delayed, the compensating controls listed above should be implemented as an urgent temporary measure.

---METADATA---
VENDOR: Caido
PRODUCT: Caido
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Caido web security auditing toolkit is affected by a high-severity vulnerability that could compromise the security of the auditing environment.

Executive Summary:
Caido, a professional web auditing toolkit, contains a high-severity vulnerability that could allow for unauthorized access or compromise of sensitive security testing data.

Vulnerability Details

CVE-ID: CVE-2026-24853

Affected Software: Caido

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Caido auditing toolkit. Given Caido's function as a proxy and analysis tool for web traffic, a high-severity flaw (CVSS 8.1) in this software could potentially allow an attacker to intercept or manipulate the security professional's auditing session.

Business Impact

A compromise of a security professional's toolkit is a critical event. An attacker could potentially gain access to the sensitive vulnerabilities, session tokens, and request data captured during a security audit. This not only compromises the integrity of the audit itself but could also lead to the exposure of the client systems being tested, resulting in significant legal and reputational liabilities.

Remediation Plan

Immediate Action: Users should update their Caido installation to the latest version immediately to secure their auditing environment.

Proactive Monitoring: Monitor the local workstation and network for any anomalous traffic that suggests the toolkit is being remotely controlled or data is being exfiltrated.

Compensating Controls: Run security auditing tools within isolated virtual machines or containers to prevent a compromise of the tool from affecting the host operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. Security tools are frequently targeted by sophisticated actors to gain insight into what vulnerabilities are being discovered by defenders.

Analyst Recommendation

Security practitioners must ensure their own tools are secure before testing others. We recommend that all Caido users apply the latest updates immediately. Because this tool handles highly sensitive data, the CVSS score of 8.1 reflects a substantial risk to the confidentiality of audit findings.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Versions prior to 7.0.4
---END_METADATA---

Description Summary:
An arbitrary file read vulnerability in OpenEMR allows any authenticated user to access sensitive files on the server filesystem via the EtherFax component.

Executive Summary:
Any authenticated user in OpenEMR can read sensitive server files, potentially exposing credentials, configuration data, and patient information.

Vulnerability Details

CVE-ID: CVE-2026-24849

Affected Software: OpenEMR

Affected Versions: Versions prior to 7.0.4

Vulnerability: The disposeDocument() method in EtherFaxActions.php fails to properly validate file paths. This allows any authenticated user, regardless of their privilege level, to perform path traversal and read arbitrary files from the server.

Business Impact

The exposure of sensitive files can lead to a total breach of patient confidentiality (HIPAA violation) and provide attackers with the credentials needed for further lateral movement or full system compromise. The CVSS score of 9.9 reflects the high impact on data integrity and confidentiality.

Remediation Plan

Immediate Action: Update OpenEMR to version 7.0.4 immediately to patch the insecure file handling logic in the EtherFax component.

Proactive Monitoring: Audit application logs for unusual calls to EtherFaxActions.php and check for attempts to access system files like /etc/passwd or configuration files.

Compensating Controls: Restrict filesystem permissions for the web server user to ensure it cannot access sensitive system directories outside of the application root.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, active exploitation has not been reported. However, because any low-privileged user can exploit this, the internal threat risk is significantly elevated.

Analyst Recommendation

Healthcare organizations must prioritize this update due to the sensitive nature of the data handled by OpenEMR. Applying the patch to version 7.0.4 is the only effective way to prevent unauthorized file access by authenticated users.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability has been identified in the Melange apk package builder's declarative pipeline system.

Executive Summary:
Melange is affected by a high-severity vulnerability that poses a risk to the security and integrity of package build pipelines.

Vulnerability Details

CVE-ID: CVE-2026-24844

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to other recent flaws in the product, this vulnerability involves the processing of declarative pipelines. An attacker could exploit this flaw to perform unauthorized actions within the build environment, potentially impacting the final apk output.

Business Impact

With a CVSS score of 7.9, this vulnerability represents a significant threat to the software supply chain. An attacker could potentially introduce malicious code or backdoors into packages, leading to a loss of trust and potential compromise of downstream users.

Remediation Plan

Immediate Action: Apply the latest security updates to the Melange toolset immediately to protect build pipelines.

Proactive Monitoring: Implement integrity checks for all generated apk packages and monitor build environments for unauthorized process execution.

Compensating Controls: Restrict access to pipeline configuration files and utilize signed commits for all changes to the build infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the repeated identification of flaws in pipeline processing highlights a critical area of risk for Melange users.

Analyst Recommendation

The urgency for remediation is high due to the potential for supply chain contamination. Organizations should update Melange immediately and review their build security posture to ensure defense-in-depth.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw in Melange, a tool for building apk packages using declarative pipelines, could allow for unauthorized actions during the build process.

Executive Summary:
The Melange package builder is vulnerable to a high-severity flaw that could allow attackers to compromise the integrity of the apk package build pipeline.

Vulnerability Details

CVE-ID: CVE-2026-24843

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the declarative pipeline processing in Melange. An attacker with the ability to influence pipeline definitions could potentially execute unauthorized commands or manipulate the resulting apk packages during the build phase.

Business Impact

A compromise of the build pipeline is a critical supply chain risk. With a CVSS score of 8.2, this vulnerability could allow for the injection of malicious code into software packages before they are distributed, leading to widespread downstream compromise of users and systems.

Remediation Plan

Immediate Action: Update Melange to the latest version to ensure that pipeline processing logic is properly secured against exploitation.

Proactive Monitoring: Audit build logs for any anomalous activities or unauthorized changes to the declarative pipeline configurations.

Compensating Controls: Implement strict code review processes for all pipeline definitions and ensure the build environment is isolated from sensitive internal networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Supply chain tools like Melange are increasingly targeted by sophisticated actors to facilitate large-scale attacks.

Analyst Recommendation

Security teams should prioritize updating their build infrastructure. Ensuring the integrity of the software supply chain is paramount, and applying this patch is a critical step in preventing malicious package injection.

Executive Summary:
A critical command injection vulnerability has been identified in the Dokploy PaaS, affecting versions prior to 0.26.6. This flaw allows an authenticated attacker to execute arbitrary commands on the underlying server, potentially leading to a complete system compromise, data theft, and service disruption. Due to the high severity (CVSS 9.9), immediate patching is required to prevent a full takeover of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-24841

Affected Software: Dokploy is a Multiple Products

Affected Versions: All versions prior to 0.26.6

Vulnerability: The vulnerability is a command injection flaw within the /docker-container-terminal WebSocket endpoint. The endpoint accepts containerId and activeWay parameters which are insecurely passed to a shell command on the host server without proper sanitization or validation. An authenticated attacker can manipulate these parameters to inject and execute arbitrary shell commands with the privileges of the Dokploy service, leading to remote code execution (RCE) on the host.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9. Successful exploitation would result in a complete compromise of the server hosting Dokploy, granting the attacker full control. The potential business impact includes theft or modification of sensitive data, deployment of ransomware, complete disruption of all applications managed by Dokploy, and the ability for an attacker to use the compromised server as a pivot point to attack other systems within the internal network. This represents a total loss of confidentiality, integrity, and availability for the affected system and its hosted services.

Remediation Plan

Immediate Action: Immediately upgrade all Dokploy instances to version 0.26.6 or later, which contains the fix for this vulnerability. After patching, review system and application logs for any signs of compromise or suspicious activity preceding the update.

Proactive Monitoring:

• Monitor WebSocket connection logs for unusual or malformed requests to the /docker-container-terminal endpoint.
• Implement host-based monitoring to detect anomalous process execution, especially unexpected shell commands spawned by the Dokploy user/service.
• Analyze outbound network traffic from the Dokploy server for connections to unknown or malicious destinations.
• Review Dokploy access logs for unauthorized or suspicious authentication events.

Compensating Controls: If patching cannot be performed immediately, implement the following controls:

• Restrict network access to the Dokploy management interface and API endpoints to trusted IP addresses using a firewall.
• Deploy a Web Application Firewall (WAF) with rules specifically designed to inspect and block malicious WebSocket payloads targeting command injection.
• Enforce the principle of least privilege for all user accounts with access to Dokploy, and ensure multi-factor authentication is enabled.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jan 28, 2026, there are no widespread reports of active exploitation in the wild. However, command injection vulnerabilities of this nature are trivial to exploit once discovered. It is highly probable that functional proof-of-concept (PoC) exploit code will become publicly available shortly, significantly increasing the risk. The only mitigating factor is the requirement for the attacker to be authenticated.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the risk of complete system compromise, it is imperative that organizations treat this vulnerability with the highest priority. The provided remediation to upgrade to version 0.26.6 or later should be applied immediately across all affected systems. Although this vulnerability is not currently listed on the CISA KEV list, its severity makes it a prime candidate for future inclusion. Do not delay patching.

Executive Summary:
A critical vulnerability exists in multiple DNN products that allows an attacker to inject malicious scripts into module titles. When a user views a page with a compromised module, this script can execute in their browser, potentially leading to account takeover, data theft, or website defacement. Organizations are urged to apply the available security updates immediately to mitigate this high-risk threat.

Vulnerability Details

CVE-ID: CVE-2026-24838

Affected Software: DNN Multiple Products

Affected Versions: All versions prior to 9.13.10 and 10.2.0

Vulnerability: The vulnerability is a stored Cross-Site Scripting (XSS) flaw within the module title field. Because this field improperly sanitizes rich text input, an authenticated attacker with permissions to edit module titles can inject malicious HTML and JavaScript code. When any user, including administrators, views the page containing the malicious module title, the injected script executes within the context of their browser session, compromising that session.

Business Impact

With a critical severity rating and a CVSS score of 9.1, this vulnerability poses a significant threat to the organization. Successful exploitation could lead to the theft of sensitive user data, session cookies, and administrative credentials, enabling complete account and site takeover. Further consequences include website defacement, redirection of users to malicious phishing sites, and the deployment of malware, resulting in severe reputational damage, loss of customer trust, and potential regulatory non-compliance.

Remediation Plan

Immediate Action: The primary remediation is to upgrade affected systems. Administrators must update their DNN instances to version 9.13.10, 10.2.0, or a later patched version immediately. Refer to the official DNN security advisory for specific patch instructions and details.

Proactive Monitoring: Security teams should actively monitor web application and server logs for attempts to inject script tags (<script>, <iframe>, onerror) into POST requests associated with module title updates. Review existing module titles across the site for any suspicious code. Implement alerts for unusual client-side script execution or unexpected outbound network traffic from user browsers interacting with the site.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads.
• Restrict permissions for editing module titles to a minimal number of highly trusted administrators.
• Implement a strong Content Security Policy (CSP) to prevent the execution of untrusted inline scripts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jan 28, 2026, there is no known public exploit code or active exploitation of this vulnerability in the wild. However, XSS vulnerabilities in widely used platforms like DNN are often targeted by threat actors shortly after disclosure. The simplicity of exploiting this type of flaw increases the likelihood that proof-of-concept exploits will be developed and published by security researchers.

Analyst Recommendation

Given the critical CVSS score of 9.1, this vulnerability requires immediate attention. We strongly recommend that all organizations using affected DNN products prioritize the deployment of the security patches to versions 9.13.10 or 10.2.0. Although this CVE is not currently on the CISA KEV list, its high severity and potential for complete system compromise present an unacceptable risk. If patching is delayed, the compensating controls outlined above should be implemented as an urgent temporary measure.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (DotNetNuke) web content management system, which operates within the Microsoft ecosystem. This flaw allows a remote, authenticated attacker with low-level privileges to read sensitive files from the underlying server. Successful exploitation could lead to the exposure of confidential data, including configuration details and credentials, potentially enabling further unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-24837

Affected Software: DNN (DotNetNuke)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a path traversal flaw within a component of the DNN platform responsible for file management. The application fails to properly sanitize user-supplied input that specifies a file path. An authenticated attacker can exploit this by crafting a malicious request containing "dot-dot-slash" (../) sequences to navigate outside of the intended web root directory, allowing them to read arbitrary files on the server's file system to which the web server process has access.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. The primary business impact is a breach of confidentiality. Exploitation could allow an attacker to exfiltrate sensitive information, such as the web.config file containing database connection strings and other application secrets, source code, or internal documents stored on the server. This exposure could lead to a full compromise of the application and its data, regulatory penalties for data breaches, and significant reputational damage.

Remediation Plan

Immediate Action: Apply the security updates released by the vendor immediately to all affected DNN instances. Following the update, security teams should monitor for any potential exploitation attempts that may have occurred prior to patching by carefully reviewing web server access logs for suspicious requests.

Proactive Monitoring: Monitor web server logs (e.g., IIS logs) for GET or POST requests containing path traversal sequences like ../, ..\\, or their URL-encoded equivalents (%2e%2e%2f). Implement alerts for any attempts to access critical system files (e.g., web.config, boot.ini, /etc/passwd) via the web application. Utilize a Web Application Firewall (WAF) to detect and block malicious requests matching path traversal signatures.

Compensating Controls: If patching cannot be performed immediately, implement a WAF with strict rules to block path traversal patterns. Additionally, enforce the principle of least privilege by ensuring the web server's service account has the minimum necessary file system permissions, restricting its access to directories outside of the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there are no known public proof-of-concept exploits or active attacks leveraging this vulnerability. However, given the low complexity of path traversal attacks, it is highly likely that exploit code will be developed and released publicly in the near future. Threat actors are expected to begin scanning for vulnerable systems shortly.

Analyst Recommendation

Given the high severity score (CVSS 7.6) and the low complexity required for exploitation, this vulnerability poses a significant risk to the organization. We strongly recommend prioritizing the immediate patching of all internet-facing DNN applications. Although this CVE is not currently listed on the CISA KEV catalog, its characteristics make it an attractive target for attackers. Where immediate patching is not feasible, the compensating controls outlined above should be implemented as a matter of urgency to mitigate the risk of a data breach.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (DotNetNuke) web content management system, a platform that operates within the Microsoft ecosystem. This flaw could allow a remote attacker to gain elevated privileges on a targeted website, potentially leading to a full system compromise. Successful exploitation could result in unauthorized data access, website defacement, or the execution of arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-24836

Affected Software: DNN (DotNetNuke)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a privilege escalation flaw within a core component of the DNN platform. An authenticated attacker with low-level user permissions can exploit an improper input validation weakness in a specific API endpoint. By sending a specially crafted request to this endpoint, the attacker can bypass security checks and grant their own account administrative-level privileges, effectively taking full control of the CMS.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. Exploitation could have a significant negative impact on the business. Potential consequences include the theft or exposure of sensitive company or customer data stored within the website's database, reputational damage resulting from website defacement or compromise, and operational disruption if the website is rendered inaccessible. A compromised web server could also be used as a foothold to launch further attacks against the organization's internal network.

Remediation Plan

Immediate Action: Apply the security updates released by the vendor immediately to patch the vulnerability. After patching, it is critical to review web server and application access logs for any evidence of suspicious activity or unauthorized privilege escalation that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on DNN application logs, specifically looking for unusual or malformed requests to API endpoints, unexpected changes in user role permissions, and unauthorized modifications to site content or configuration files. Monitor for newly created administrative accounts or any activity from low-privilege accounts that mimics administrative actions.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rulesets designed to block common privilege escalation attack patterns.
• Restrict access to the DNN administrative login page to trusted IP addresses only.
• Enforce Multi-Factor Authentication (MFA) on all accounts, especially those with administrative privileges.
• Conduct a thorough review of all user accounts and remove or downgrade any that are unnecessary or have excessive permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, vulnerabilities in widely-used CMS platforms are attractive targets for threat actors, and it is likely that exploits will be developed and utilized in the near future.

Analyst Recommendation

Given the high severity of this vulnerability (CVSS 7.6) and its potential for complete system compromise, organizations are strongly urged to prioritize the application of vendor-supplied patches across all affected DNN instances. Although this CVE is not currently listed on the CISA KEV catalog, its impact makes it a significant risk. In addition to patching, organizations should implement the recommended monitoring and compensating controls to build a defense-in-depth security posture and protect against potential exploitation.

---METADATA---
VENDOR: Kata Containers
PRODUCT: Kata Containers
AFFECTED_VERSIONS: prior to 3.27.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Kata Containers allows a container user to modify the guest VM file system, resulting in arbitrary code execution as root within the micro VM.

Executive Summary:
A critical vulnerability in Kata Containers allows local guest users to achieve arbitrary code execution as root by modifying the guest micro VM file system.

Vulnerability Details

CVE-ID: CVE-2026-24834

Affected Software: Kata Containers

Affected Versions: Prior to 3.27.0

Vulnerability: This is a privilege escalation and code execution vulnerability occurring within the Cloud Hypervisor implementation. A local attacker with access to a container can manipulate the guest micro VM file system to execute arbitrary commands with root privileges.

Business Impact

The ability for a container user to escalate privileges to root within a Guest VM represents a critical security failure, justifying the 9.3 CVSS score. While the impact is largely contained to the specific micro VM, it undermines the isolation guarantees of the containerized environment, potentially leading to unauthorized data access and persistent local compromise.

Remediation Plan

Immediate Action: Upgrade all Kata Containers deployments to version 3.27.0 or later immediately to patch the hypervisor integration.

Proactive Monitoring: Review guest VM runtime logs for unexpected file system modifications or anomalous process execution by non-privileged accounts.

Compensating Controls: Ensure strict container resource limits and, where applicable, avoid running untrusted code within multi-tenant Kata environments until patching is complete.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant breach of container isolation boundaries. Given the potential for root-level code execution within the guest environment, organizations should prioritize updating to version 3.27.0 in all production clusters to restore security parity.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (formerly DotNetNuke) web content management system, which operates within the Microsoft ecosystem. Successful exploitation could allow a remote attacker to execute arbitrary code on the server, potentially leading to a complete system compromise, data theft, or website defacement. Organizations utilizing the affected software are at significant risk and should take immediate action to mitigate this threat.

Vulnerability Details

CVE-ID: CVE-2026-24833

Affected Software: DNN (DotNetNuke) Platform

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is an insecure deserialization flaw within a core component of the DNN platform. An unauthenticated remote attacker can exploit this by sending a specially crafted serialized object to a publicly accessible application endpoint. The application fails to properly validate this input before deserializing it, allowing the attacker's malicious object to be processed, which results in arbitrary code execution in the security context of the web server's application pool identity.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. A successful exploit could have a severe impact on the business, leading to a full compromise of the web server hosting the DNN application. Potential consequences include the theft or exposure of sensitive data stored in the website's database (such as customer information, user credentials, or proprietary content), reputational damage from website defacement, and financial loss due to system downtime. Furthermore, a compromised server could be used as a staging point for attackers to pivot into the broader corporate network, escalating the incident significantly.

Remediation Plan

Immediate Action: The primary and most effective remediation is to apply the security updates provided by the vendor to all affected DNN instances immediately. After patching, it is crucial to review web server and application logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring:

• Log Analysis: Scrutinize web server access logs (e.g., IIS logs) for unusual or malformed POST requests, particularly those with large or strangely encoded payloads which may indicate serialized objects. Monitor application and system event logs for unexpected process execution originating from the web server process (e.g., w3wp.exe spawning cmd.exe or powershell.exe).
• Network Traffic: Monitor for anomalous outbound connections from the web server to unknown or suspicious IP addresses, as this could be a sign of a reverse shell or data exfiltration.
• File Integrity: Implement file integrity monitoring on the web application's directory to detect unauthorized file modifications or additions.

Compensating Controls: If immediate patching is not feasible, the following controls can help reduce risk:

• Deploy a Web Application Firewall (WAF) and create virtual patching rules to inspect and block requests containing known insecure deserialization patterns.
• Restrict administrative access to the DNN portal to a limited set of trusted IP addresses.
• Ensure the web application is running under a least-privilege service account to limit the impact of a potential code execution event.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there are no known public proof-of-concept exploits or active attacks targeting this vulnerability. However, given the severity and potential for remote code execution, it is highly probable that threat actors will reverse-engineer the patch and develop functional exploits in the near future.

Analyst Recommendation

This is a high-impact vulnerability that could allow for a full compromise of public-facing web servers. Due to the high CVSS score and the critical nature of the flaw, immediate patching should be considered the top priority. While this vulnerability is not currently listed on the CISA KEV catalog, its severity makes it a strong candidate for future inclusion. Organizations are strongly advised to apply the vendor-supplied security updates to all affected DNN instances without delay and implement the recommended monitoring controls to detect any potential exploitation attempts.

---METADATA---
VENDOR: ixray-team
PRODUCT: ixray-1.6-stcop
AFFECTED_VERSIONS: 0 up to (excluding) 1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in ixray-team ixray-1.6-stcop allows unauthenticated remote attackers to potentially corrupt memory or achieve arbitrary code execution.

Executive Summary:
A critical out-of-bounds write vulnerability in ixray-1.6-stcop (before 1.3) allows unauthenticated remote attackers to trigger memory corruption and potentially achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-24832

Affected Software: ixray-team ixray-1.6-stcop

Affected Versions: 0 up to (excluding) 1.3

Vulnerability: This is an Out-of-bounds Write vulnerability (CWE-787) that allows for memory corruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that no authentication or user interaction is required to trigger this flaw remotely.

Business Impact

The CVSS score of 9.8 underscores the severity of this vulnerability. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the application, leading to a complete breach of confidentiality, integrity, and availability of the affected host.

Remediation Plan

Immediate Action: Upgrade to version 1.3 or later to remediate the vulnerability.

Proactive Monitoring: Monitor for suspicious network traffic directed at the application and review server logs for signs of buffer overflow attempts or repeated service crashes.

Compensating Controls: Use memory-safe compilation flags and restrict access to the application via network segmentation or WAF filtering to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory corruption flaws of this type are high-value targets for attackers and should be treated with extreme urgency.

Analyst Recommendation

This vulnerability represents a significant security risk. Administrators must prioritize the upgrade to version 1.3 to eliminate the out-of-bounds write condition and safeguard their infrastructure against potential remote exploitation.

---METADATA---
VENDOR: Ralim
PRODUCT: IronOS
AFFECTED_VERSIONS: 0 up to (excluding) v2.23-rc2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow or wraparound vulnerability exists in Ralim IronOS prior to v2.23-rc2, potentially allowing for memory corruption or unpredictable application behavior.

Executive Summary:
A critical integer overflow vulnerability in Ralim IronOS could allow unauthenticated attackers to trigger memory corruption or system instability.

Vulnerability Details

CVE-ID: CVE-2026-24830

Affected Software: Ralim IronOS

Affected Versions: 0 up to (excluding) v2.23-rc2

Vulnerability: This vulnerability is a CWE-190 Integer Overflow or Wraparound issue. It occurs due to improper calculation handling within the software, allowing an unauthenticated attacker to exploit the flaw remotely.

Business Impact

The CVSS score of 9.8 reflects a critical severity, indicating that successful exploitation could lead to full system compromise, including unauthorized code execution or denial of service. This presents a significant risk to operational continuity and system integrity, particularly for hardware devices utilizing IronOS in production environments.

Remediation Plan

Immediate Action: Update Ralim IronOS to version v2.23-rc2 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Monitor device logs for unexpected crashes, reboots, or abnormal memory usage patterns that may indicate exploitation attempts.

Compensating Controls: Ensure devices are isolated within trusted network segments to limit exposure to untrusted external traffic until patches are applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for memory corruption, making rapid patching essential.

Analyst Recommendation

Given the critical CVSS score and the potential for total system impact, organizations should prioritize the deployment of the v2.23-rc2 update. Immediate remediation is necessary to prevent potential exploitation of this memory-related vulnerability.

---METADATA---
VENDOR: OpenHarmony
PRODUCT: OpenHarmony
AFFECTED_VERSIONS: v5.0.3 through v6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A signal handler race condition exists in OpenHarmony v5.0.3 through v6.0, which may allow an authenticated attacker to compromise system integrity or availability.

Executive Summary:
A signal handler race condition vulnerability in OpenHarmony versions 5.0.3 through 6.0 poses a significant risk of unauthorized data access and denial of service.

Vulnerability Details

CVE-ID: CVE-2026-24792

Affected Software: OpenHarmony OpenHarmony

Affected Versions: v5.0.3 through v6.0

Vulnerability: This vulnerability is a signal handler race condition (CWE-364). According to the CVSS vector (PR:L), this flaw requires an authenticated user with low-level privileges to trigger the race condition, potentially leading to information disclosure or system instability.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk. Successful exploitation could lead to the exposure of sensitive data or the disruption of critical system services, directly impacting the availability and confidentiality of the affected device or environment.

Remediation Plan

Immediate Action: Update all deployments of OpenHarmony to a version beyond 6.0 as specified in the official vendor disclosure.

Proactive Monitoring: Monitor system logs for unusual process terminations or unexpected signal-related errors that may indicate exploitation attempts.

Compensating Controls: Implement strict access control lists (ACLs) to limit the number of users capable of executing processes that interact with sensitive system signals.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions are inherently complex to exploit and typically require precise timing by the attacker.

Analyst Recommendation

Given the high severity score, administrators should prioritize patching OpenHarmony systems. Organizations should review their current version footprint and apply the necessary updates provided by the vendor to prevent potential privilege escalation or service interruption.

---METADATA---
VENDOR: Unknown
PRODUCT: PLC Device
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The underlying Programmable Logic Controller (PLC) of the device can be remotely influenced due to a lack of proper safeguards or authentication mechanisms.

Executive Summary:
A critical lack of authentication in the PLC component allows remote attackers to manipulate industrial control processes, posing a severe risk to physical operations.

Vulnerability Details

CVE-ID: CVE-2026-24790

Affected Software: PLC Device

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a lack of authentication and safeguards on the remote management interface of a PLC. An unauthenticated attacker can send remote commands to influence the controller's logic and operation.

Business Impact

Insecure PLC interfaces can lead to the disruption of critical infrastructure, damage to physical equipment, and potential safety hazards for personnel. The CVSS score of 8.2 highlights the significant operational risk and the high potential for impact on availability and integrity in industrial environments.

Remediation Plan

Immediate Action: Isolate the PLC from all external networks and ensure it is only accessible via a secure, authenticated management workstation.

Proactive Monitoring: Review PLC diagnostic logs and network traffic for unauthorized protocol commands or unexpected changes in logic states.

Compensating Controls: Implement industrial firewalls and deep packet inspection (DPI) to block unauthorized control traffic at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. Vulnerabilities in industrial control systems (ICS) are highly sought after by sophisticated threat actors for sabotage purposes.

Analyst Recommendation

Protecting industrial assets requires strict network segmentation. We strongly recommend that organizations audit their ICS environment to ensure no PLCs are exposed to the internet and that all control traffic is strictly authenticated and monitored.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unprotected API endpoint in the affected software allows unauthenticated remote attackers to change the device password, leading to complete unauthorized administrative control.

Executive Summary:
A critical API flaw allows unauthenticated attackers to remotely reset device passwords, granting them full control over the affected hardware.

Vulnerability Details

CVE-ID: CVE-2026-24789

Affected Software: Multiple Products (refer to vendor advisory for specific hardware/software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device exposes an unprotected API endpoint that does not require authentication for password modification. This allows a remote, unauthenticated attacker to submit a password change request and lock out legitimate administrators.

Business Impact

This vulnerability poses a severe risk of total device lockout and unauthorized takeover. By changing the administrative password, an attacker can gain full access to the device's settings and data. The CVSS score of 9.8 reflects the high impact on availability and integrity, as the attack is trivial to perform.

Remediation Plan

Immediate Action: Apply the vendor-provided patch immediately to secure the API endpoint and enforce authentication for all administrative actions.

Proactive Monitoring: Monitor API logs for password change requests originating from unexpected or external IP addresses.

Compensating Controls: Disable access to the management API from the public internet and place the affected devices behind a secure gateway or VPN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 11, 2026, there is no public information indicating active exploitation. The simplicity of this flaw makes it a highly attractive target for automated scanning and mass exploitation.

Analyst Recommendation

The ability to change administrative credentials without authentication is a fundamental security failure. Immediate patching is the only effective solution. Organizations should also perform a credential audit to ensure that passwords have not already been modified by unauthorized parties.

Executive Summary:
A high-severity vulnerability has been identified in RaspAP webgui versions prior to 3. This flaw could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device, leading to a full system compromise. Successful exploitation could result in data theft, network disruption, or the use of the compromised device to launch further attacks against the internal network.

Vulnerability Details

CVE-ID: CVE-2026-24788

Affected Software: RaspAP raspap-webgui

Affected Versions: All versions prior to 3.0

Vulnerability: The vulnerability is a command injection flaw within the web-based management interface of RaspAP. An unauthenticated attacker can send a specially crafted HTTP request to a specific API endpoint that fails to properly sanitize user-supplied input. This input is then passed directly to a system shell command, allowing the attacker to inject and execute arbitrary commands on the underlying operating system with the privileges of the web server user.

Business Impact

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 8.8. An attacker successfully exploiting this flaw could gain complete control over the RaspAP device. This could lead to severe consequences, including the interception and theft of sensitive network traffic, unauthorized access to internal network segments, deployment of malware, and disruption of network services. A compromised RaspAP device could serve as a persistent foothold for an attacker to pivot and escalate their attack across the corporate network.

Remediation Plan

Immediate Action: Immediately identify all instances of RaspAP raspap-webgui within the environment and upgrade them to version 3.0 or later, as recommended by the vendor. After patching, review web server and system access logs for any signs of compromise or unusual activity preceding the update.

Proactive Monitoring: Monitor web server logs for suspicious requests containing shell metacharacters (e.g., ;, |, &, $(, `) directed at the RaspAP interface. System-level monitoring should be configured to alert on unexpected processes being spawned by the web server user (e.g., www-data). Network monitoring should focus on identifying anomalous outbound traffic from RaspAP devices.

Compensating Controls: If immediate patching is not feasible, restrict network access to the RaspAP management interface to a dedicated, trusted administrative network or specific IP addresses. If the interface must be exposed, place it behind a Web Application Firewall (WAF) with rulesets configured to detect and block command injection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 2, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity score (8.8) and the nature of the flaw (unauthenticated RCE), it is highly probable that security researchers and threat actors will develop a functional exploit in the near future.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for complete system compromise, we strongly recommend that organizations prioritize the immediate patching of all affected RaspAP devices. Although this CVE is not currently listed on the CISA KEV catalog, its high-impact nature makes it a prime target for future exploitation. All internet-facing instances should be considered critically at risk and addressed immediately, followed by internal instances to prevent lateral movement by an attacker.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
A sandbox breakout vulnerability in the vm2 library's inspect function allows attackers to escape the sandbox and execute arbitrary commands on the host.

Executive Summary:
A critical sandbox breakout vulnerability in the vm2 library's inspect function allows attackers to escape the sandbox and execute arbitrary commands on the host.

Vulnerability Details

CVE-ID: CVE-2026-24781

Affected Software: vm2 (Node.js)

Affected Versions: Prior to 3.11.0

Vulnerability: The inspect function in vm2 allows an attacker to manipulate objects in a way that escapes the sandbox environment. This facilitates arbitrary code execution on the host system running the Node.js environment.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat. Successful exploitation grants the attacker the same permissions as the Node.js process, which can lead to data exfiltration, system destruction, or unauthorized lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 dependency to version 3.11.0 or later to mitigate this sandbox breakout vector.

Proactive Monitoring: Monitor for anomalous usage of the inspect function or unexpected object manipulation patterns within the application.

Compensating Controls: Implement robust ingress and egress filtering on the host system to prevent unauthorized command-and-control communication in the event of an escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The frequency of sandbox escape vulnerabilities in vm2 suggests that it is not a secure solution for running untrusted code. Organizations are strongly advised to update the library and investigate safer alternatives for code isolation if the requirement for running untrusted code persists.