---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Prior to version 24.0
---END_METADATA---

Description Summary:
WWBN AVideo prior to 24.0 is vulnerable to an unauthenticated SQL injection in multiple components due to improper sanitization of JSON-formatted POST request bodies.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in WWBN AVideo allows remote attackers to compromise the backend database and exfiltrate sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-28501

Affected Software: WWBN AVideo (formerly YouPHPTube)

Affected Versions: Prior to version 24.0

Vulnerability: This unauthenticated SQL injection exists in the objects/videos.json.php and objects/video.php components. The application fails to sanitize the catName parameter when it is delivered via a JSON POST request, effectively bypassing global security filters that are only applied to standard form-encoded data.

Business Impact

This vulnerability carries a CVSS score of 9.8. An attacker can exploit this flaw to read, modify, or delete any data within the database, including user credentials, private video metadata, and site configurations. In many environments, this can be further escalated to remote code execution (RCE) on the underlying server.

Remediation Plan

Immediate Action: Update WWBN AVideo to version 24.0 or later immediately to address the insecure handling of JSON-based input parameters.

Proactive Monitoring: Monitor database logs for unusual query patterns and review web logs for POST requests to the affected PHP files containing SQL keywords or suspicious JSON structures.

Compensating Controls: Configure a Web Application Firewall (WAF) to inspect JSON bodies for SQL injection payloads and block any requests that attempt to exploit the catName parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. However, SQL injection flaws in media platforms are frequently exploited for data harvesting and site defacement.

Analyst Recommendation

Applying the version 24.0 update is critical for all AVideo installations. Given that this is an unauthenticated flaw, the window for remediation is narrow, and the patch should be treated as a top-priority security emergency.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: Prior to 0.8.0
---END_METADATA---

Description Summary:
FOSSBilling versions prior to 0.8.0 are susceptible to Server-Side Template Injection (SSTI) in the Twig rendering engine, enabling remote code execution for authenticated administrators.

Executive Summary:
A critical Server-Side Template Injection (SSTI) vulnerability in FOSSBilling allows authenticated administrators to execute arbitrary code and compromise the underlying server environment.

Vulnerability Details

CVE-ID: CVE-2026-28496

Affected Software: FOSSBilling FOSSBilling

Affected Versions: Prior to 0.8.0

Vulnerability: The application renders Twig templates without a sandbox, exposing the dependency injection container and internal API context. This vulnerability is triggered via features that process templates, such as email campaigns or the string_render API endpoint, requiring administrative authentication.

Business Impact

With a CVSS score of 9.4, this vulnerability represents a severe threat to the entire hosting environment. Successful exploitation allows an attacker with administrative privileges to achieve remote code execution, leading to full system compromise, database exfiltration, and potential lateral movement across the network.

Remediation Plan

Immediate Action: Upgrade to FOSSBilling version 0.8.0 or later to implement proper Twig template sandboxing.

Proactive Monitoring: Audit existing email templates and mass mail campaign configurations for suspicious or unauthorized Twig expressions.

Compensating Controls: Restrict access to the /api/system/* endpoints at the Web Application Firewall (WAF) or reverse proxy level to prevent unauthorized interaction with sensitive system functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe for administrative users. Organizations must update to version 0.8.0 immediately and perform a full audit of all custom templates and API usage to ensure that no malicious payloads have been previously injected.

---METADATA---
VENDOR: GetSimple CMS
PRODUCT: GetSimple CMS
AFFECTED_VERSIONS: GetSimpleCMS-CE v3.3.22 (with massiveAdmin plugin v6.0.3)
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
GetSimple CMS is vulnerable to Remote Code Execution via a CSRF-based attack on the massiveAdmin plugin's configuration editor.

Executive Summary:
A critical vulnerability in the GetSimple CMS massiveAdmin plugin allows an unauthenticated attacker to achieve remote code execution via Cross-Site Request Forgery.

Vulnerability Details

CVE-ID: CVE-2026-28495

Affected Software: GetSimple CMS GetSimple CMS

Affected Versions: GetSimpleCMS-CE v3.3.22 (with massiveAdmin plugin v6.0.3)

Vulnerability: The massiveAdmin plugin lacks Cross-Site Request Forgery (CSRF) protections when interacting with the gsconfig.php file editor. This allows a remote unauthenticated attacker to force an authenticated administrator to inadvertently overwrite the configuration file with malicious PHP code.

Business Impact

Successful exploitation results in Remote Code Execution (RCE), granting the attacker full control over the underlying web server. With a CVSS score of 9.6, this vulnerability allows for complete site defacement, data theft, or the deployment of persistent backdoors, severely impacting the organization's security posture.

Remediation Plan

Immediate Action: Update the GetSimple CMS environment and ensure the massiveAdmin plugin is removed or updated to a secure version if available.

Proactive Monitoring: Monitor server file integrity for unexpected modifications to gsconfig.php and review administrative access logs for unusual activity.

Compensating Controls: Implement strict CSRF protection mechanisms or enforce administrative IP whitelisting to restrict access to sensitive configuration modules.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for full server takeover. Administrators must immediately secure the configuration editor or disable the vulnerable plugin to prevent exploitation through CSRF vectors.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Multiple Products
AFFECTED_VERSIONS: Prior to 2026.2.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an option injection vulnerability in the pre-commit hook that allows attackers to inject Git flags and add sensitive ignored files to the repository history.

Executive Summary:
An option injection vulnerability in OpenClaw pre-commit hooks allows unauthorized actors to exfiltrate sensitive files, posing a critical risk to repository integrity.

Vulnerability Details

CVE-ID: CVE-2026-28484

Affected Software: OpenClaw Multiple Products

Affected Versions: Prior to 2026.2.15

Vulnerability: The vulnerability exists in the git-hooks/pre-commit hook where improper handling of filenames allows for option injection. An unauthenticated attacker can create files with malicious names starting with dashes, which are then passed to git add without proper separator delimitation, allowing arbitrary flag injection.

Business Impact

The ability to force the inclusion of sensitive files, such as .env files containing API keys or credentials, into version control systems can lead to catastrophic data breaches. Given the CVSS score of 9.8, this flaw represents a critical threat to organizational security, potentially exposing intellectual property and production secrets to unauthorized parties with access to the repository.

Remediation Plan

Immediate Action: Upgrade all instances of OpenClaw to version 2026.2.15 or later immediately.

Proactive Monitoring: Audit existing Git repository histories for the presence of sensitive files that should have been ignored.

Compensating Controls: Implement strict file naming policies and repository scanning tools (e.g., secret scanners) to detect and block the commit of sensitive configuration files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to the confidentiality of development environments. Administrators must prioritize the update to version 2026.2.15 to prevent unauthorized exposure of sensitive environment variables and credentials.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Nextcloud Talk plugin
AFFECTED_VERSIONS: Versions prior to 2026.2.6
---END_METADATA---

Description Summary:
OpenClaw's Nextcloud Talk plugin uses mutable display names for allowlist validation. Attackers can bypass access controls by changing their display name to match an allowlisted ID.

Executive Summary:
The OpenClaw Nextcloud Talk plugin contains a critical logic flaw that allows attackers to bypass conversation allowlists and gain unauthorized access to restricted chats.

Vulnerability Details

CVE-ID: CVE-2026-28474

Affected Software: OpenClaw Nextcloud Talk plugin

Affected Versions: Versions prior to 2026.2.6

Vulnerability: The plugin performs allowlist validation by checking the mutable actor.name field (display name) instead of a unique, immutable user ID. An attacker can change their display name to match a known authorized user, tricking the system into granting access to restricted Direct Messages (DM) and chat rooms.

Business Impact

This flaw allows for unauthorized access to sensitive internal communications. Confidential business discussions, credentials shared in chat, and private user data could be exposed to unauthorized parties. The CVSS score of 9.8 underscores the total failure of the authorization mechanism within the plugin.

Remediation Plan

Immediate Action: Update the OpenClaw Nextcloud Talk plugin to version 2026.2.6 or later, which implements validation based on immutable user identifiers.

Proactive Monitoring: Review Nextcloud audit logs for frequent display name changes followed by access to restricted chat rooms.

Compensating Controls: Disable the ability for users to change their own display names within Nextcloud until the patch is applied, or implement secondary authentication for sensitive rooms.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation. However, this is a trivial logic bypass that requires very little technical skill to execute.

Analyst Recommendation

Relying on user-controlled fields for security validation is a critical design error. Administrators must apply the update immediately to ensure that chat room access is governed by secure, immutable IDs. Prioritize this update to protect the confidentiality of organizational communications.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an incorrect authorization vulnerability that allows an authenticated user to bypass security checks via the 'approve' chat command.

Executive Summary:
An incorrect authorization vulnerability in OpenClaw allows an authenticated attacker to bypass intended security restrictions via malicious chat commands.

Vulnerability Details

CVE-ID: CVE-2026-28473

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.2.2

Vulnerability: This vulnerability (CWE-863) involves a failure to correctly enforce authorization checks when processing the 'approve' chat command. An authenticated attacker can manipulate this function to perform unauthorized actions, bypassing the application's intended security controls.

Business Impact

While the CVSS score is 8.1, the requirement for authentication limits the initial attack surface. However, successful exploitation could lead to unauthorized administrative actions, potentially resulting in data manipulation or service disruption within the OpenClaw environment.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.2.2 via the npm package manager.

Proactive Monitoring: Monitor chat command logs for suspicious or unauthorized usage of the 'approve' function by non-privileged accounts.

Compensating Controls: Temporarily restrict the usage of chat commands for non-administrative roles if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically straightforward, involving a logic error in command authorization.

Analyst Recommendation

All OpenClaw deployments should be updated to version 2026.2.2 immediately. Given the availability of a specific fix in the npm package repository, the remediation effort is low-complexity and should be prioritized to prevent potential privilege escalation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to a device identity check bypass within the gateway websocket connect handshake due to missing authentication for critical functions.

Executive Summary:
An unauthenticated device identity check bypass vulnerability in OpenClaw allows remote attackers to compromise critical system functions.

Vulnerability Details

CVE-ID: CVE-2026-28472

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.2.2

Vulnerability: This vulnerability (CWE-306) occurs because the application fails to perform necessary authentication during the gateway websocket handshake process, allowing unauthenticated remote attackers to bypass identity verification.

Business Impact

Successful exploitation allows an unauthenticated attacker to interact with sensitive gateway functions, potentially leading to unauthorized system access or control. Given the CVSS score of 8.1, this represents a high-severity risk that could result in significant operational disruption and data integrity loss.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.2.2 or later to apply the necessary authentication checks.

Proactive Monitoring: Monitor websocket traffic for unexpected connection patterns or unauthorized handshake attempts originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway to filter and validate incoming websocket traffic, blocking requests that do not adhere to expected authentication protocols.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication on a critical communication channel.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing OpenClaw must prioritize updating to version 2026.2.2 to close the authentication gap and prevent unauthorized access to the gateway infrastructure.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Multiple Products
AFFECTED_VERSIONS: Prior to 2026.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an allowlist bypass vulnerability in its execution approval feature, allowing attackers to execute arbitrary commands via command substitution syntax.

Executive Summary:
A critical command injection vulnerability in OpenClaw allows attackers to bypass security allowlists and execute arbitrary code on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-28470

Affected Software: OpenClaw Multiple Products

Affected Versions: Prior to 2026.2.2

Vulnerability: The vulnerability is located in the execution approval mechanism, which fails to properly sanitize inputs. An unauthenticated attacker can embed command substitution syntax, such as $() or backticks, within double-quoted strings to bypass established security allowlists and execute unauthorized system commands.

Business Impact

Successful exploitation allows for full Remote Code Execution (RCE) on the host system, granting an attacker the ability to steal data, deploy malware, or pivot deeper into the corporate network. With a CVSS score of 9.8, this represents a critical threat to system availability and data confidentiality, requiring immediate remediation.

Remediation Plan

Immediate Action: Apply the update to version 2026.2.2 or later immediately to patch the command injection vulnerability.

Proactive Monitoring: Review system execution logs for unusual command patterns or unauthorized processes spawned by the OpenClaw service.

Compensating Controls: Ensure the service runs with the principle of least privilege, minimizing the impact if RCE is achieved, and utilize WAF rules to detect and drop common command injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of Remote Code Execution makes this vulnerability a high-priority item. Organizations should verify their current version and update to 2026.2.2 immediately to neutralize the threat of arbitrary command execution.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Google Chat monitor
AFFECTED_VERSIONS: Versions prior to 2026.2.14
---END_METADATA---

Description Summary:
A webhook routing vulnerability in OpenClaw's Google Chat monitor allows cross-account policy misrouting. Attackers can bypass allowlists by exploiting first-match request verification semantics.

Executive Summary:
OpenClaw Google Chat monitor is vulnerable to a critical policy bypass that allows attackers to misroute webhook events and bypass session security controls.

Vulnerability Details

CVE-ID: CVE-2026-28469

Affected Software: OpenClaw Google Chat monitor

Affected Versions: Versions prior to 2026.2.14

Vulnerability: The Google Chat monitor component contains a webhook routing flaw where multiple targets sharing the same HTTP path lead to context misrouting. An unauthenticated attacker can exploit "first-match" verification logic to force the system to process events under an incorrect account context, effectively bypassing session policies and allowlists.

Business Impact

This vulnerability compromises the multi-tenancy and access control integrity of the OpenClaw platform. An attacker could gain unauthorized access to data or trigger actions within another user's account context, leading to data leaks and unauthorized configuration changes. The CVSS score of 9.8 highlights the severity of this architectural failure in enforcing account isolation.

Remediation Plan

Immediate Action: Update the OpenClaw Google Chat monitor to version 2026.2.14 or later to resolve the webhook routing logic error.

Proactive Monitoring: Audit webhook delivery logs for requests that appear to be processed under mismatched account IDs or originate from unexpected sources.

Compensating Controls: Use unique, non-predictable HTTP paths for each webhook target to prevent path collisions and minimize the risk of misrouting.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the logic flaw is significant, and organizations using multi-tenant webhook configurations are at high risk.

Analyst Recommendation

The ability to bypass account-level security policies through routing manipulation is a critical security failure. Security teams must ensure that OpenClaw instances are updated to the patched version immediately. Furthermore, verify that all webhook configurations utilize unique identifiers to ensure robust isolation between different account contexts.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Multiple Products
AFFECTED_VERSIONS: Prior to 2026.2.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw uses non-constant-time string comparison for hook token validation, enabling remote attackers to infer tokens through timing side-channel attacks.

Executive Summary:
A timing side-channel vulnerability in OpenClaw allows remote attackers to perform unauthorized actions by gradually inferring authentication tokens through timing analysis.

Vulnerability Details

CVE-ID: CVE-2026-28464

Affected Software: OpenClaw Multiple Products

Affected Versions: Prior to 2026.2.12

Vulnerability: The vulnerability stems from the use of non-constant-time string comparison functions when validating hook authentication tokens. An unauthenticated remote attacker with network access to the hooks endpoint can measure the time taken for validation responses across multiple requests to reconstruct and eventually bypass the authentication mechanism.

Business Impact

By successfully inferring valid authentication tokens, an attacker can gain unauthorized access to sensitive hook endpoints. This compromises the integrity of automated workflows and potentially allows for further unauthorized actions within the system, justifying the critical 9.8 CVSS score.

Remediation Plan

Immediate Action: Upgrade all OpenClaw installations to version 2026.2.12 or later to implement constant-time comparison logic.

Proactive Monitoring: Monitor network logs for high volumes of repeated requests to the hooks endpoint, which may indicate an ongoing timing attack.

Compensating Controls: Implement rate limiting on the hooks endpoint to significantly slow down the speed at which an attacker can perform timing measurements, making the attack impractical.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Timing attacks can be subtle and difficult to detect without specific monitoring. It is imperative to patch to version 2026.2.12 to ensure that token validation is resistant to side-channel analysis and to prevent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw's webhook mode is susceptible to authorization bypass due to insufficient verification of data authenticity when processing incoming requests.

Executive Summary:
An authorization bypass vulnerability in OpenClaw's webhook mode allows unauthenticated attackers to manipulate data processing via forged requests.

Vulnerability Details

CVE-ID: CVE-2026-28454

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.2.2

Vulnerability: This flaw (CWE-345) involves the failure to properly verify the authenticity of incoming webhook payloads, permitting unauthenticated remote attackers to bypass authorization controls.

Business Impact

Exploitation of this vulnerability could allow an attacker to inject unauthorized data or trigger malicious actions within the webhook processing workflow. With a CVSS score of 7.5, this high-severity issue poses a significant risk to application integrity and could lead to unauthorized state changes.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.2.1 or later to implement proper verification of webhook authenticity.

Proactive Monitoring: Review application and webhook logs for anomalous payloads or requests that fail validation checks.

Compensating Controls: Implement strict IP whitelisting for incoming webhook traffic to ensure that only trusted sources can communicate with the endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on unverified webhook data makes the system susceptible to external manipulation.

Analyst Recommendation

Security teams should immediately upgrade to the patched version of OpenClaw to ensure that all incoming webhooks are cryptographically verified. Failure to patch may allow attackers to bypass critical authorization logic.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authentication bypass in the voice-call extension's inbound allowlist policy, allowing remote unauthenticated attackers to execute tools via manipulated caller IDs.

Executive Summary:
A critical authentication bypass in OpenClaw’s voice-call extension enables remote, unauthenticated attackers to execute unauthorized commands, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-28446

Affected Software: OpenClaw

Affected Versions: 0 up to (excluding) 2026.2.1

Vulnerability: This is an authentication bypass flaw caused by improper validation of inbound caller IDs. The extension incorrectly uses suffix-based matching instead of strict equality, allowing unauthenticated attackers to spoof or manipulate caller IDs to bypass access controls.

Business Impact

The ability for an unauthenticated attacker to execute tools via the voice-call agent carries a critical business impact, potentially leading to unauthorized data access, system manipulation, or complete service disruption. With a CVSS score of 9.8, the vulnerability represents the highest level of risk, as it requires no user interaction or prior authentication to exploit.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.2.2 or later as specified by the OSV advisory.

Proactive Monitoring: Audit inbound voice-call logs for unusual caller IDs or repeated attempts to initiate agent tools from unknown or unauthorized numbers.

Compensating Controls: If an immediate update is not feasible, disable the voice-call extension entirely to neutralize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its "automatable" nature and lack of authentication requirements.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation, organizations must prioritize patching this vulnerability immediately. Ensure all instances of OpenClaw are updated to version 2026.2.2 to remediate the flaw and prevent potential unauthorized remote tool execution.

---METADATA---
VENDOR: Statamic
PRODUCT: Statamic CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Statamic CMS, built on Laravel and Git, is vulnerable to a high-severity security flaw that could compromise the integrity of the content management system.

Executive Summary:
A significant security vulnerability in Statamic CMS poses a high risk of unauthorized system access and data manipulation within the Laravel-based environment.

Vulnerability Details

CVE-ID: CVE-2026-28425

Affected Software: Statamic Statamic CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts Statamic CMS. With a CVSS score of 8.0, the flaw likely facilitates significant unauthorized actions, possibly through improper input handling or session management, allowing attackers to interact with the system at an elevated privilege level.

Business Impact

A successful exploit could lead to the unauthorized disclosure of sensitive information or the alteration of critical website content. The CVSS score of 8.0 reflects a high level of risk to business continuity and data integrity, particularly for organizations relying on Statamic for public-facing web services.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for Statamic CMS immediately to mitigate the risk of exploitation.

Proactive Monitoring: Regularly audit the Git repository associated with the CMS for unauthorized commits or unexpected changes to configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block suspicious traffic patterns targeting Laravel-based applications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high-severity rating indicates that the flaw is serious and requires prompt remediation.

Analyst Recommendation

The severity of this vulnerability requires an immediate response to protect the web application environment. It is strongly recommended that administrators apply the latest security updates to Statamic CMS to prevent unauthorized access and potential data compromise.

---METADATA---
VENDOR: Gradio
PRODUCT: Gradio
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in Gradio, an open-source Python package used for rapid prototyping of machine learning models.

Executive Summary:
A high-severity flaw in the Gradio Python library could allow for the compromise of machine learning prototyping environments and associated data.

Vulnerability Details

CVE-ID: CVE-2026-28416

Affected Software: Gradio

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Gradio is susceptible to a security flaw within its web-based prototyping interface. Due to the high CVSS score, this vulnerability likely involves a mechanism where an attacker can achieve unauthorized code execution or sensitive file disclosure through the exposed Gradio application.

Business Impact

A successful exploit could lead to the theft of proprietary machine learning models, training data, or unauthorized access to the underlying server hosting the Gradio instance. The CVSS score of 8.2 places this in the High-severity category, indicating that the vulnerability is highly exploitable and carries a significant risk of system compromise.

Remediation Plan

Immediate Action: Update the Gradio Python package to the latest version using pip install --upgrade gradio and restart all active Gradio interfaces.

Proactive Monitoring: Monitor system processes for unexpected child processes originating from the Gradio application and review network traffic for unauthorized outbound connections.

Compensating Controls: Avoid exposing Gradio instances to the public internet without additional authentication layers, such as a reverse proxy with Basic Auth or a VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the popularity of Gradio in the AI/ML community makes it an attractive target for attackers seeking to steal intellectual property.

Analyst Recommendation

We recommend that developers and data scientists prioritize the remediation of this vulnerability immediately. Given the CVSS score of 8.2, the risk to development environments is substantial, and the primary update should be applied before continuing any public-facing prototyping.

---METADATA---
VENDOR: Gradio
PRODUCT: Gradio
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Gradio Python package could allow attackers to compromise applications built for rapid machine learning prototyping.

Executive Summary:
Gradio is affected by a high-severity vulnerability that poses a significant risk to the security and isolation of machine learning application prototypes.

Vulnerability Details

CVE-ID: CVE-2026-28414

Affected Software: Gradio

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core Gradio package, which is used to create web interfaces for Python scripts. The flaw may allow an attacker to bypass security restrictions or interact with the host system in an unintended manner, depending on the specific implementation of the Gradio app.

Business Impact

The potential for unauthorized access to development environments can lead to the exposure of sensitive datasets and internal toolsets. With a CVSS score of 7.5, this High-severity issue could result in a loss of confidentiality and integrity for projects currently in the prototyping phase.

Remediation Plan

Immediate Action: Apply the latest security patches by upgrading the Gradio library to the most recent version provided by the maintainers.

Proactive Monitoring: Audit logs for unusual input patterns or unexpected errors in the Gradio interface that could indicate an attempt to exploit the underlying flaw.

Compensating Controls: Implement strict network-level access controls and ensure that Gradio applications are not running with elevated system privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. The nature of the flaw suggests it could be leveraged if an attacker gains access to the network where the prototype is hosted.

Analyst Recommendation

The urgency for this remediation is high due to the widespread use of Gradio in sensitive research and development contexts. We strongly advise all users to upgrade their Gradio installations immediately to the latest version to ensure their prototyping environments remain secure.

---METADATA---
VENDOR: WeGIA
PRODUCT: WeGIA
AFFECTED_VERSIONS: Prior to version 3.6.5
---END_METADATA---

Description Summary:
Unsafe use of the PHP extract() function in WeGIA allows unauthenticated attackers to overwrite local variables and bypass administrative authentication checks.

Executive Summary:
WeGIA is vulnerable to a critical variable overwrite flaw that enables unauthenticated attackers to bypass security controls and gain full administrative access to the application.

Vulnerability Details

CVE-ID: CVE-2026-28411

Affected Software: WeGIA

Affected Versions: Prior to version 3.6.5

Vulnerability: Multiple PHP scripts utilize the extract() function on the $_REQUEST superglobal without proper sanitization. This allows an unauthenticated attacker to overwrite critical variables, effectively neutralizing authentication and authorization logic.

Business Impact

A successful exploit allows an attacker to gain unauthorized access to administrative and protected areas, leading to a complete compromise of sensitive data held by the charitable institution. The CVSS score of 9.8 reflects the severity of this authentication bypass, which can result in total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the update to WeGIA version 3.6.5 immediately, as this release removes the unsafe use of the extract() function.

Proactive Monitoring: Monitor web server logs for requests containing suspicious parameter names that match internal variable names, which may indicate an attempt to overwrite application logic.

Compensating Controls: Disable the use of extract() in the PHP configuration if possible, or use a WAF to filter out suspicious global variable names in incoming HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, variable overwrite vulnerabilities are a well-known vector for gaining administrative access, making this a high-priority target for attackers.

Analyst Recommendation

The ability for an unauthenticated attacker to gain administrative privileges via a simple variable overwrite is a critical risk. Immediate deployment of version 3.6.5 is the only reliable way to mitigate this flaw and protect the application from total takeover.

---METADATA---
VENDOR: WeGIA
PRODUCT: WeGIA Web Manager
AFFECTED_VERSIONS: Versions prior to 3.6.5
---END_METADATA---

Description Summary:
A critical RCE vulnerability in WeGIA's database restoration allows administrative users to execute arbitrary OS commands via crafted filenames in backup uploads.

Executive Summary:
A critical remote code execution vulnerability in WeGIA allows administrative users to achieve full system compromise by uploading malicious backup files.

Vulnerability Details

CVE-ID: CVE-2026-28409

Affected Software: WeGIA Web Manager

Affected Versions: Versions prior to 3.6.5

Vulnerability: This vulnerability involves an arbitrary OS command injection within the database restoration functionality. While it requires administrative-level authentication, the risk is compounded by the existence of known authentication bypasses that can grant an attacker the necessary privileges to exploit this flaw.

Business Impact

Successful exploitation allows for complete control over the underlying server, potentially leading to the theft of sensitive charitable organization data, total service disruption, and permanent loss of database integrity. The CVSS score of 10.0 reflects the maximum possible severity, indicating that the integrity, availability, and confidentiality of the entire system are at extreme risk.

Remediation Plan

Immediate Action: Update the WeGIA application to version 3.6.5 or later immediately to patch the vulnerable database restoration logic.

Proactive Monitoring: Review system logs for unusual OS command execution originating from the web server user and monitor file upload directories for suspicious filenames.

Compensating Controls: Restrict access to the administrative interface to trusted IP addresses only and implement a Web Application Firewall (WAF) to detect command injection patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its potential pairing with authentication bypasses, the risk of exploitation is exceptionally high.

Analyst Recommendation

The CVSS 10.0 rating necessitates immediate intervention. IT administrators must prioritize the update to version 3.6.5, as this vulnerability provides a direct path to full server takeover once administrative access is obtained.

---METADATA---
VENDOR: WeGIA
PRODUCT: WeGIA
AFFECTED_VERSIONS: Prior to version 3.6.5
---END_METADATA---

Description Summary:
A missing authentication and permission check in WeGIA allows unauthenticated attackers to inject massive amounts of unauthorized data into the application server's storage.

Executive Summary:
The WeGIA web manager contains a critical security flaw where a specific script lacks authentication checks, allowing unauthenticated attackers to perform unauthorized data injection.

Vulnerability Details

CVE-ID: CVE-2026-28408

Affected Software: WeGIA

Affected Versions: Prior to version 3.6.5

Vulnerability: The script adicionar_tipo_docs_atendido.php fails to implement central controller checks or independent authentication. This allows an unauthenticated external party to bypass permission levels and access features intended only for employees.

Business Impact

The ability for external parties to inject massive quantities of unauthorized data can lead to storage exhaustion and database corruption, resulting in significant system downtime. With a CVSS score of 9.8, this vulnerability represents a critical threat to data integrity and availability, potentially disrupting the core services of charitable institutions using the platform.

Remediation Plan

Immediate Action: Update the WeGIA installation to version 3.6.5 or later immediately to apply the necessary authentication and permission logic.

Proactive Monitoring: Review application storage and database logs for anomalous growth or entries created by unauthorized IP addresses, specifically targeting the adicionar_tipo_docs_atendido.php endpoint.

Compensating Controls: Restrict access to the application via IP whitelisting or implement a robust authentication proxy if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of making direct requests to the vulnerable script via tools like Postman makes the likelihood of exploitation very high.

Analyst Recommendation

This vulnerability exposes the application to massive data manipulation and potential denial-of-service through storage exhaustion. Organizations must apply the version 3.6.5 update immediately to secure the application against unauthenticated external requests.

---METADATA---
VENDOR: Kaniko Project
PRODUCT: Kaniko
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in Kaniko, a container image builder, could allow attackers to compromise build environments within Kubernetes clusters.

Executive Summary:
Kaniko is affected by a high-severity vulnerability that could allow for the compromise of container build processes, potentially leading to supply chain attacks.

Vulnerability Details

CVE-ID: CVE-2026-28406

Affected Software: Kaniko

Affected Versions: See vendor advisory for affected versions

Vulnerability: Kaniko, which builds container images from Dockerfiles inside Kubernetes clusters, contains a flaw with a CVSS score of 8.2. This suggests a vulnerability that could allow an attacker to escape the build container or inject malicious code into resulting images.

Business Impact

A vulnerability in a build tool like Kaniko presents a significant supply chain risk. Attackers could potentially modify container images during the build process, leading to the deployment of backdoored software across the entire enterprise infrastructure. The high CVSS score justifies urgent attention to prevent unauthorized access to the cluster environment.

Remediation Plan

Immediate Action: Update Kaniko to the latest version as specified in the project's security advisory and rebuild any images created during the potential window of vulnerability.

Proactive Monitoring: Audit Kubernetes audit logs for unusual pod behavior associated with Kaniko build jobs and monitor container registries for unauthorized image modifications.

Compensating Controls: Implement strict Pod Security Policies or Admission Controllers to limit the privileges of Kaniko build pods, following the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, build tools are high-value targets for sophisticated attackers looking to compromise the software supply chain.

Analyst Recommendation

The security of the container build pipeline is paramount. Organizations using Kaniko within their CI/CD pipelines must apply vendor-provided security updates immediately to ensure the integrity of their container images and the safety of their Kubernetes clusters.

---METADATA---
VENDOR: Textream
PRODUCT: Textream Teleprompter
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Textream for macOS is affected by a security vulnerability that could allow for unauthorized interactions with the teleprompter application environment.

Executive Summary:
The Textream teleprompter application for macOS contains a high-severity vulnerability that may allow attackers to compromise the application and potentially access local system resources.

Vulnerability Details

CVE-ID: CVE-2026-28403

Affected Software: Textream Textream for macOS

Affected Versions: See vendor advisory for affected versions

Vulnerability: Textream is a macOS-based teleprompter application. The vulnerability, rated at a CVSS of 7.6, likely involves a flaw in how the application handles local inputs or remote control requests, potentially allowing an attacker to execute unauthorized actions within the context of the user.

Business Impact

A successful exploit could lead to the unauthorized disclosure of script content or the use of the application as a vector for further local privilege escalation on macOS workstations. This poses a risk to media organizations and executives who rely on the software for secure communication and presentations.

Remediation Plan

Immediate Action: Update the Textream application to the latest version available on the macOS App Store or the developer's website.

Proactive Monitoring: Review macOS system logs for any unusual process spawning from the Textream application.

Compensating Controls: Use macOS system permissions to restrict the application's access to only the necessary files and network resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score suggests that users should remain vigilant and update the software promptly.

Analyst Recommendation

While this application may not be considered core infrastructure, the 7.6 CVSS score indicates a significant risk to individual workstations. Users should apply the available updates immediately to ensure their macOS environment remains secure against potential exploits targeting third-party applications.

---METADATA---
VENDOR: Nimiq
PRODUCT: core-rs-albatross
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Nimiq Proof-of-Stake protocol implementation within the Albatross consensus algorithm, potentially impacting network stability or integrity.

Executive Summary:
A high-severity vulnerability in the Nimiq core-rs-albatross implementation poses a significant risk to the integrity and reliability of the Albatross consensus mechanism.

Vulnerability Details

CVE-ID: CVE-2026-28402

Affected Software: Nimiq core-rs-albatross

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Rust-based implementation of the Nimiq Proof-of-Stake protocol. While specific technical details regarding the exploit vector are limited, the flaw resides within the Albatross consensus algorithm logic, potentially allowing an attacker to disrupt network synchronization or validator operations.

Business Impact

A successful exploit of this vulnerability could lead to significant network downtime, loss of consensus, or the potential for double-spending if the Proof-of-Stake mechanism is compromised. With a CVSS score of 7.1, this is classified as a High-severity issue, representing a substantial risk to the financial integrity and availability of the Nimiq blockchain ecosystem.

Remediation Plan

Immediate Action: Administrators and node operators should apply the latest security updates provided by the Nimiq development team immediately to secure the Albatross consensus implementation.

Proactive Monitoring: Monitor node logs for unusual consensus delays, frequent re-organizations, or anomalous peer-to-peer communication patterns that may indicate exploitation attempts.

Compensating Controls: Ensure that nodes are behind well-configured firewalls and limit peer connections to known, trusted participants where possible to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw within a core consensus protocol, the potential for exploitation is high once technical details are reverse-engineered.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from all stakeholders operating Nimiq infrastructure. Failure to patch may lead to a total loss of confidence in the network's consensus state. We strongly recommend applying the official vendor updates immediately to mitigate the risk of protocol-level exploitation.