---METADATA---
VENDOR: Docker
PRODUCT: Docker Model Runner (DMR)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Docker Model Runner (DMR), used for managing AI models, contains a high-severity vulnerability that could lead to unauthorized access or model manipulation.

Executive Summary:
A security vulnerability in Docker Model Runner (DMR) poses a high risk to AI deployment environments, potentially allowing for the unauthorized execution of commands or manipulation of AI models.

Vulnerability Details

CVE-ID: CVE-2026-28400

Affected Software: Docker Docker Model Runner (DMR)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Docker Model Runner (DMR) software. With a CVSS score of 7.5, the flaw likely involves improper isolation or inadequate access controls within the model deployment pipeline, potentially allowing an attacker to interact with the containerized environment in an unauthorized manner.

Business Impact

Exploitation of this vulnerability could lead to the compromise of proprietary AI models, unauthorized data access within the Docker environment, or the use of infrastructure for malicious computing. The CVSS score of 7.5 indicates a high severity, particularly for organizations integrating AI into their core production workflows.

Remediation Plan

Immediate Action: Apply the latest security updates for Docker Model Runner immediately to ensure all components are patched against this flaw.

Proactive Monitoring: Audit container logs and network traffic for unusual activity originating from or directed toward DMR-managed instances.

Compensating Controls: Implement strict network segmentation for AI model deployment environments and use container security scanning tools to detect anomalous configurations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the critical role of AI infrastructure makes it a significant point of failure if left unpatched.

Analyst Recommendation

Organizations utilizing Docker Model Runner for AI deployments should prioritize this update. Immediate remediation is necessary to maintain the integrity of AI models and the security of the underlying Docker infrastructure.

---METADATA---
VENDOR: NocoDB
PRODUCT: NocoDB
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
NocoDB is affected by a high-severity vulnerability that could compromise the security of database-driven spreadsheets and the underlying platform.

Executive Summary:
NocoDB faces a high-severity security flaw that threatens the confidentiality and integrity of database assets managed within its spreadsheet-like interface.

Vulnerability Details

CVE-ID: CVE-2026-28399

Affected Software: NocoDB NocoDB

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited, the CVSS score of 8.8 suggests a critical flaw, likely involving unauthenticated or low-privilege access to the database management interface. This typically involves improper access controls or injection vulnerabilities within the NocoDB platform.

Business Impact

A breach of NocoDB could lead to the exposure of sensitive business data stored in connected databases. Given the CVSS score of 8.8, the vulnerability could allow attackers to modify, delete, or exfiltrate critical information, leading to severe regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the NocoDB maintainers immediately to secure the application.

Proactive Monitoring: Monitor database access logs for any unauthorized query patterns or administrative actions that do not align with known user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and restrict access to the NocoDB interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score suggests that the potential for a high-impact exploit is significant once technical details are reversed.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate action. IT teams should treat this as a priority update and ensure that all NocoDB instances are patched to the latest version to prevent unauthorized access to sensitive database environments.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Prior to version 2026.2.14
---END_METADATA---

Description Summary:
OpenClaw versions prior to 2026.2.14 contain a privilege escalation flaw in the Slack slash-command handler that allows unauthorized users to execute privileged commands via direct messages.

Executive Summary:
A privilege escalation vulnerability in OpenClaw’s Slack integration allows attackers to bypass security restrictions and execute administrative commands via direct messages.

Vulnerability Details

CVE-ID: CVE-2026-28392

Affected Software: OpenClaw

Affected Versions: Prior to version 2026.2.14

Vulnerability: The vulnerability exists in the Slack slash-command handler when the dmPolicy is configured to "open." This allows an authenticated Slack user to bypass allowlist and access-group restrictions by sending direct messages that the system incorrectly authorizes as privileged commands.

Business Impact

This flaw allows standard users or external entities with DM access to escalate their privileges to an administrative level within the OpenClaw environment. Successful exploitation can lead to unauthorized system changes, data access, and the bypass of established security governance. The CVSS score of 9.8 highlights the critical risk associated with unauthorized command execution in a trusted communication platform.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.2.14 or later to ensure the slash-command handler correctly validates user permissions.

Proactive Monitoring: Audit Slack integration logs and OpenClaw command execution history for any suspicious or unauthorized slash commands initiated via direct messages.

Compensating Controls: Temporarily disable the "open" dmPolicy configuration or restrict Slack DM access to the OpenClaw bot until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the misconfiguration requirement makes this a high-risk target for internal threats or compromised Slack accounts.

Analyst Recommendation

Organizations utilizing OpenClaw with Slack integrations must immediately verify their dmPolicy settings and apply the 2026.2.14 update. Given the privilege escalation potential, it is critical to ensure that only authorized personnel can trigger backend operations through chat interfaces.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Prior to version 2026.2.2
---END_METADATA---

Description Summary:
OpenClaw prior to 2026.2.2 is vulnerable to command injection because it fails to sanitize Windows cmd.exe metacharacters, allowing attackers to bypass command approval restrictions.

Executive Summary:
A critical command injection vulnerability in OpenClaw allows remote attackers to bypass security allowlists and execute unauthorized Windows shell commands using metacharacters.

Vulnerability Details

CVE-ID: CVE-2026-28391

Affected Software: OpenClaw

Affected Versions: Prior to version 2026.2.2

Vulnerability: This vulnerability stems from improper input validation of Windows cmd.exe metacharacters (such as & or %) within allowlist-gated exec requests. A remote attacker can craft malicious command strings that break out of the intended application logic to execute arbitrary system commands.

Business Impact

A successful exploit allows an attacker to circumvent all command approval restrictions, leading to full control over the host operating system. This can result in unauthorized data access, system disruption, and the deployment of malware. The CVSS score of 9.8 indicates that this is a critical remote threat requiring minimal attacker effort.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.2.2 or higher to implement proper sanitization of shell metacharacters.

Proactive Monitoring: Review system logs for unusual command-line arguments containing shell metacharacters and monitor for unexpected child processes originating from the OpenClaw service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block common shell injection patterns in incoming requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation. However, command injection vulnerabilities are frequently targeted by automated scanning tools and are highly reliable for attackers.

Analyst Recommendation

The ability to bypass allowlists via simple metacharacters represents a significant failure in security controls. It is recommended to apply the vendor-provided patch immediately. Furthermore, ensure the service is running with the least privilege possible to limit the impact of any potential command execution.

---METADATA---
VENDOR: Grafana
PRODUCT: Snowflake Datasource
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Grafana Snowflake Datasource allows authenticated users to read or write arbitrary files between the local Grafana server and the Snowflake host.

Executive Summary:
A critical vulnerability in the Grafana Snowflake Datasource allows an authenticated user to perform unauthorized file system operations between the server and the database host.

Vulnerability Details

CVE-ID: CVE-2026-28381

Affected Software: Grafana Snowflake Datasource

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists due to improper validation of commands within the Snowflake datasource. Any authenticated user with access to the data source can execute GET/PUT commands to manipulate files on the underlying infrastructure.

Business Impact

The CVSS score of 9.6 reflects the severe potential for unauthorized data access and system modification. An attacker could leverage this vulnerability to gain sensitive configuration files, overwrite critical system binaries, or pivot further into the network, leading to a complete breach of the Grafana environment.

Remediation Plan

Immediate Action: Update the Grafana Snowflake Datasource plugin to the latest version released by the vendor to remediate the insecure command execution flaw.

Proactive Monitoring: Review Grafana access logs and audit trails to identify any suspicious or unauthorized usage of the Snowflake datasource by existing user accounts.

Compensating Controls: Restrict permissions for the Snowflake datasource to only necessary users and utilize network-level segmentation to limit the impact of a compromised Grafana server.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to data integrity and system security. Organizations should immediately update the affected plugin and audit current user permissions to ensure that only authorized personnel have access to sensitive data sources.

---METADATA---
VENDOR: Stackfield
PRODUCT: Stackfield Desktop App
AFFECTED_VERSIONS: Before 1.10.2 for macOS and Windows
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Stackfield Desktop App's decryption functionality allows malicious exports to write arbitrary content to any path on the victim's filesystem.

Executive Summary:
The Stackfield Desktop App for macOS and Windows is vulnerable to a critical path traversal flaw that allows attackers to overwrite arbitrary system files via malicious content exports.

Vulnerability Details

CVE-ID: CVE-2026-28373

Affected Software: Stackfield Stackfield Desktop App

Affected Versions: Before 1.10.2 for macOS and Windows

Vulnerability: Improper sanitization of the filePath property during the decryption of exported data allows a path traversal attack. This enables a malicious file to escape the intended directory and write data to sensitive locations.

Business Impact

An attacker can use this flaw to overwrite critical system files, plant malware, or gain persistence on a user's workstation. The CVSS score of 9.6 highlights the critical risk to endpoint security and the potential for complete workstation compromise.

Remediation Plan

Immediate Action: Force an update of the Stackfield Desktop App to version 1.10.2 or later across all Windows and macOS endpoints.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor for unexpected file-write operations originating from the Stackfield application process.

Compensating Controls: Restrict user permissions to prevent applications from writing to sensitive system directories where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. The vulnerability relies on a user processing a malicious export, making it a likely target for social engineering or phishing campaigns.

Analyst Recommendation

Path traversal leading to arbitrary file writes is a high-impact vulnerability. It is essential to ensure all employees update their desktop clients immediately to version 1.10.2 to protect against potential workstation compromise.

---METADATA---
VENDOR: OpenStack
PRODUCT: Vitrage
AFFECTED_VERSIONS: Before 12.0.1, 13.0.0, 14.0.0, and 15.0.0
---END_METADATA---

Description Summary:
OpenStack Vitrage contains a code execution vulnerability in its query parser, allowing authenticated API users to execute arbitrary code on the service host.

Executive Summary:
A code execution vulnerability in OpenStack Vitrage allows authenticated users to compromise the underlying service host, leading to unauthorized infrastructure access.

Vulnerability Details

CVE-ID: CVE-2026-28370

Affected Software: OpenStack Vitrage

Affected Versions: Before 12.0.1, 13.0.0, 14.0.0, and 15.0.0

Vulnerability: The flaw occurs in the _create_query_function within vitrage/graph/query.py. An authenticated user with API access can craft a query that triggers arbitrary code execution under the privileges of the Vitrage service account.

Business Impact

While this exploit requires authentication, the ability to execute code on the host can lead to a complete compromise of the Vitrage service and potentially the broader OpenStack environment. Attackers could gain unauthorized visibility into cloud topology or manipulate infrastructure monitoring data. The CVSS score of 9.1 reflects the high impact on system integrity and confidentiality.

Remediation Plan

Immediate Action: Update OpenStack Vitrage to the appropriate patched version (12.0.1, 13.0.0, 14.0.0, or 15.0.0).

Proactive Monitoring: Review Vitrage API logs for unusual query patterns and monitor the host for unauthorized process execution stemming from the Vitrage service user.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit API access to only highly trusted users and utilize containerization to isolate the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, the complexity of OpenStack environments makes this a high-value target for lateral movement.

Analyst Recommendation

Organizations running OpenStack Vitrage should apply the security updates immediately. Although authentication is required, internal threats or compromised low-level credentials could be used to trigger this RCE, making prompt patching essential.

---METADATA---
VENDOR: Red Hat
PRODUCT: Undertow (JBoss EAP / Apache Camel / Data Grid / Fuse / Process Automation / SSO)
AFFECTED_VERSIONS: Red Hat Undertow; Red Hat JBoss Enterprise Application Platform 7.0.0 and 8.0.0; Red Hat Build of Apache Camel - Hawtio 4.0; Red Hat Build of Apache Camel for Spring Boot 4.0; Red Hat Data Grid 8.0; Red Hat Fuse 7.0.0; Red Hat Process Automation 7.0; Red Hat Single Sign-On 7.0; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Enterprise Linux 9.0
---END_METADATA---

Description Summary:
A request smuggling vulnerability in Red Hat Undertow allows attackers to bypass authentication and access restricted information by exploiting inconsistent HTTP header processing.

Executive Summary:
An authentication bypass flaw in Red Hat Undertow, caused by improper HTTP request header handling, allows attackers to manipulate requests and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-28369

Affected Software: Red Hat Undertow and related enterprise products

Affected Versions: See individual product versions listed in the metadata above.

Vulnerability: This is an authentication bypass vulnerability stemming from request smuggling. The Undertow server incorrectly strips leading whitespace from HTTP header lines instead of rejecting malformed input, allowing attackers to manipulate request interpretation.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to enterprise environments. Successful exploitation allows unauthorized parties to bypass security controls, access sensitive information, or manipulate web caches, potentially leading to widespread data exposure and loss of confidentiality across the affected JBoss and Red Hat ecosystems.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for all affected Red Hat product versions immediately.

Proactive Monitoring: Inspect web server logs for irregular HTTP request structures or attempts to smuggle headers that deviate from standard protocol compliance.

Compensating Controls: Utilize a hardened reverse proxy or load balancer that enforces strict HTTP request validation to mitigate request smuggling attempts before they reach the backend server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant architectural risk due to its potential to bypass core authentication mechanisms. Security teams must audit their environments to identify all instances of the affected Red Hat software and prioritize patching to eliminate the underlying request smuggling vector.

---METADATA---
VENDOR: Red Hat
PRODUCT: Undertow
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A technical flaw in the Undertow web server component could allow for remote exploitation, potentially impacting application stability and security.

Executive Summary:
A high-severity vulnerability in the Undertow web server poses a significant risk to Java-based applications relying on this middleware for HTTP handling.

Vulnerability Details

CVE-ID: CVE-2026-28368

Affected Software: Red Hat Undertow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw within the Undertow web server engine. While specific technical details are limited in the initial disclosure, the high severity indicates a likely issue in request parsing or header handling that could be reached by an unauthenticated remote attacker.

Business Impact

A successful exploit of this vulnerability could lead to significant service disruptions or unauthorized system access. Given the CVSS score of 8.7, the flaw is classified as High severity, suggesting that it could result in a total loss of availability or partial compromise of data integrity and confidentiality. For organizations using Undertow as an embedded server, this represents a critical infrastructure risk.

Remediation Plan

Immediate Action: IT administrators should immediately apply the latest security patches provided by Red Hat or the relevant upstream project to update the Undertow library.

Proactive Monitoring: Security teams should monitor web server logs for unusual HTTP request patterns or malformed headers that may indicate exploitation attempts.

Compensating Controls: Deploying a Web Application Firewall (WAF) with updated signatures for common Java middleware exploits can provide a layer of protection until patching is completed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its position in the network stack, the potential for exploitation remains high once technical details emerge.

Analyst Recommendation

The high CVSS score of 8.7 necessitates urgent action. Organizations should prioritize identifying all instances of Undertow within their environment—including those embedded in other applications—and apply the necessary vendor updates immediately to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Undertow
PRODUCT: Undertow
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity security flaw has been discovered in Undertow, a flexible performant web server used in many Java-based applications.

Executive Summary:
Undertow web server contains a high-severity vulnerability that could lead to significant security breaches in applications relying on this web server component.

Vulnerability Details

CVE-ID: CVE-2026-28367

Affected Software: Undertow

Affected Versions: See vendor advisory for affected versions

Vulnerability: A flaw was identified in Undertow, a web server component. Based on the CVSS score of 8.7, the vulnerability likely involves a critical failure in request handling, such as request smuggling, header injection, or a bypass of security constraints.

Business Impact

The impact of this vulnerability is high, as Undertow is a core component for many enterprise Java applications (including WildFly). Exploitation could lead to unauthorized data access, session hijacking, or the bypass of security filters, resulting in a broad compromise of any application served by the vulnerable Undertow version. The 8.7 CVSS score reflects a high degree of urgency for organizations using this middleware.

Remediation Plan

Immediate Action: Update the Undertow library or the parent application server (e.g., WildFly, Quarkus) to the latest version containing the fix.

Proactive Monitoring: Check web server logs for malformed HTTP headers or unusual request patterns that may indicate an attempt to exploit server-level flaws.

Compensating Controls: Deploy a robust Web Application Firewall (WAF) to normalize HTTP traffic and block requests that deviate from standard protocol specifications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, server-side flaws in widely used libraries like Undertow are frequently researched and exploited by sophisticated actors.

Analyst Recommendation

Given that Undertow is often embedded within other products, administrators must identify all instances of the library in their environment. Applying the primary vendor patch is the only definitive way to mitigate the risk associated with this high-severity vulnerability.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.2.23
---END_METADATA---

Description Summary:
OpenClaw contains an input validation bypass in its tools.exec.safeBins component, where GNU long-option abbreviations can be used to execute unauthorized commands.

Executive Summary:
An input validation bypass in OpenClaw allows attackers to execute unauthorized commands by using abbreviated GNU options, bypassing intended security approval workflows.

Vulnerability Details

CVE-ID: CVE-2026-28363

Affected Software: OpenClaw

Affected Versions: Versions before 2026.2.23

Vulnerability: The vulnerability exists in the tools.exec.safeBins validation logic for the sort command. While full strings like --compress-program were denied, attackers can use abbreviations like --compress-prog to bypass the allowlist and execute arbitrary paths without required approval.

Business Impact

This bypass allows for the execution of commands that should be restricted, potentially leading to unauthorized system changes or data access. The CVSS score of 9.9 indicates a near-total compromise of system security controls and a high risk of malicious command execution.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.2.23 or later, which contains the fix for the validation logic.

Proactive Monitoring: Audit execution logs for the sort command and search for any use of GNU long-option abbreviations that may indicate an exploitation attempt.

Compensating Controls: Implement strict OS-level permissions to limit what the application user can execute and use endpoint detection and response (EDR) tools to monitor for suspicious process spawning.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, the logic flaw is straightforward to exploit once the vulnerable parameters are identified.

Analyst Recommendation

The high CVSS score of 9.9 demands immediate patching. Administrators should verify that the update to version 2026.2.23 is applied to close the gap in command validation and prevent unauthorized execution paths.

---METADATA---
VENDOR: SolarWinds
PRODUCT: Web Help Desk
AFFECTED_VERSIONS: 2026.1 and all previous versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SolarWinds Web Help Desk contains a SAML authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access if SAML 2.0 is enabled.

Executive Summary:
A critical authentication bypass vulnerability in SolarWinds Web Help Desk enables unauthenticated attackers to gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2026-28323

Affected Software: SolarWinds Web Help Desk

Affected Versions: 2026.1 and all previous versions

Vulnerability: The vulnerability is an improper authentication flaw (CWE-287) affecting the SAML 2.0 integration. It allows an unauthenticated remote attacker to bypass authentication mechanisms entirely, provided the SAML 2.0 authentication method is active.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to the confidentiality, integrity, and availability of sensitive help desk data. Unauthorized access could allow attackers to view internal support tickets, sensitive user information, or administrative configurations, leading to significant data breaches and reputational damage.

Remediation Plan

Immediate Action: Upgrade SolarWinds Web Help Desk to version 2026.2.1 immediately as recommended by the vendor.

Proactive Monitoring: Review authentication logs for irregular login patterns or unauthorized access attempts originating from external sources.

Compensating Controls: Disable SAML 2.0 authentication temporarily if the upgrade cannot be performed immediately, or restrict access to the Web Help Desk interface via network-level controls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authentication bypasses are highly attractive targets for attackers due to the ease of access they provide to protected systems.

Analyst Recommendation

The severity of this authentication bypass necessitates immediate action. Administrators must prioritize upgrading to version 2026.2.1 to close this security gap, as the vulnerability is easily exploitable over the network and poses a direct threat to the security of the help desk environment.

---METADATA---
VENDOR: SolarWinds
PRODUCT: Serv-U
AFFECTED_VERSIONS: all Serv-U versions up to and including 15.5.4 without the hotfix, base 15.5.4 included
---END_METADATA---

Description Summary:
SolarWinds Serv-U is vulnerable to an uncontrolled resource consumption flaw allowing unauthenticated attackers to crash the service via specially crafted POST requests.

Executive Summary:
This critical vulnerability in SolarWinds Serv-U is currently being exploited in the wild and requires immediate attention to prevent service disruption.

Vulnerability Details

CVE-ID: CVE-2026-28318

Affected Software: SolarWinds Serv-U

Affected Versions: all Serv-U versions up to and including 15.5.4 without the hotfix, base 15.5.4 included

Vulnerability: This is an uncontrolled resource consumption vulnerability triggered by sending a specially crafted POST request using the "Content-Encoding: deflate" header. The attack is unauthenticated and requires zero user interaction to successfully crash the Serv-U service.

Business Impact

With a CVSS score of 9.5, this vulnerability represents a severe risk to operational continuity. While the impact is limited to denial of service, the confirmed active exploitation in the wild and inclusion in the CISA KEV catalog elevate the urgency for remediation to prevent unauthorized service outages and potential operational downtime.

Remediation Plan

Immediate Action: Update the affected software to version 15.5.4 HF1 as specified by the vendor's security advisory.

Proactive Monitoring: Monitor server logs and resource utilization metrics for sudden spikes in CPU or memory consumption associated with malformed POST requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter incoming traffic, specifically blocking requests containing suspicious "Content-Encoding: deflate" headers.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, this vulnerability is confirmed to be actively exploited in the wild. CISA has added this entry to the Known Exploited Vulnerabilities (KEV) catalog, signifying that threat actors are using this flaw in real-world attacks.

Analyst Recommendation

Given the critical CVSS severity and confirmed active exploitation, organizations must prioritize patching SolarWinds Serv-U to version 15.5.4 HF1. Failure to apply this update leaves the environment vulnerable to trivial denial-of-service attacks by unauthenticated remote actors.

---METADATA---
VENDOR: simple-git
PRODUCT: simple-git
AFFECTED_VERSIONS: 3.15.0 through 3.32.2
---END_METADATA---

Description Summary:
The simple-git library is vulnerable to a remote code execution bypass that allows attackers to circumvent previous security fixes and achieve full host compromise.

Executive Summary:
A critical vulnerability in the simple-git library allows an attacker to bypass existing security controls and execute arbitrary code on the host machine.

Vulnerability Details

CVE-ID: CVE-2026-28292

Affected Software: simple-git

Affected Versions: 3.15.0 through 3.32.2

Vulnerability: This issue is a regression or bypass of previous fixes (CVE-2022-25860 and CVE-2022-25912). It allows an attacker to manipulate git command execution via the Node.js interface to achieve full remote code execution on the host machine. The vulnerability is typically exploited through maliciously crafted input passed to git commands.

Business Impact

A successful exploit grants the attacker the ability to run any command on the server hosting the Node.js application. This could lead to full system takeover, theft of source code, and unauthorized access to connected databases. The CVSS score of 9.8 reflects the high probability of exploitation and the devastating impact on the host environment.

Remediation Plan

Immediate Action: Update the simple-git dependency in your Node.js applications to version 3.23.0 or the latest available version immediately.

Proactive Monitoring: Review application logs for unusual git command parameters or unexpected shell execution patterns originating from the Node.js process.

Compensating Controls: Implement strict input validation and sanitization for any user-supplied data that is passed to the simple-git interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. However, because this bypasses previous well-known fixes, security researchers and attackers are likely to identify exploitation vectors quickly.

Analyst Recommendation

Due to the widespread use of simple-git in CI/CD pipelines and web applications, this vulnerability poses a significant risk. Developers must audit their package.json files and update to version 3.23.0 immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: 1.8.206 and earlier
---END_METADATA---

Description Summary:
A TOCTOU flaw in FreeScout's file upload sanitization allows authenticated users to achieve RCE by uploading malicious .htaccess files using zero-width space prefixes.

Executive Summary:
FreeScout is vulnerable to a critical remote code execution flaw where authenticated users can bypass security filters to upload malicious configuration files and take control of the server.

Vulnerability Details

CVE-ID: CVE-2026-28289

Affected Software: FreeScout

Affected Versions: 1.8.206 and earlier

Vulnerability: A Time-of-Check to Time-of-Use (TOCTOU) flaw exists in the sanitizeUploadedFileName() function. An authenticated user with upload permissions can bypass the dot-prefix check by using a zero-width space, allowing the upload of a malicious .htaccess file that leads to RCE.

Business Impact

This vulnerability has a CVSS score of 10, the highest possible severity. It allows any user with basic file upload permissions to escalate their privileges to full server control. This could result in the theft of all help desk data, customer communications, and total infrastructure compromise.

Remediation Plan

Immediate Action: Update FreeScout to version 1.8.207 immediately to patch the sanitization logic and prevent the upload of configuration files.

Proactive Monitoring: Inspect the web root and upload directories for hidden files, specifically .htaccess files or files containing zero-width space characters (U+200B).

Compensating Controls: Disable the execution of scripts in upload directories via web server configuration and implement strict file extension whitelisting at the web server level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. This is a patch bypass for a previous CVE, indicating that attackers are likely already looking for ways to circumvent these specific checks.

Analyst Recommendation

The CVSS 10 rating necessitates immediate action. Organizations using FreeScout must prioritize this update to prevent internal or compromised accounts from achieving full remote code execution.

---METADATA---
VENDOR: Vikunja
PRODUCT: Vikunja (vikunja/api)
AFFECTED_VERSIONS: Versions prior to 2.1.0
---END_METADATA---

Description Summary:
A logic flaw in the Vikunja password reset mechanism allows reset tokens to be reused indefinitely, enabling persistent account takeover if a token is intercepted.

Executive Summary:
A critical flaw in Vikunja’s password reset logic allows attackers to reuse intercepted tokens for permanent account takeover, bypassing all standard authentication controls.

Vulnerability Details

CVE-ID: CVE-2026-28268

Affected Software: Vikunja Task Management Platform

Affected Versions: Versions prior to 2.1.0

Vulnerability: This is a business logic vulnerability within the vikunja/api component. Due to a failure to invalidate tokens upon use and a malfunctioning cleanup cron job, an unauthenticated attacker who gains access to a single reset token can use it repeatedly to change user passwords.

Business Impact

The ability to reuse tokens allows for persistent, long-term unauthorized access to user accounts and sensitive task data. Given the CVSS score of 9.8, this flaw presents a severe risk of data loss and reputational damage, as an attacker can maintain access even after a user attempts to secure their account.

Remediation Plan

Immediate Action: Upgrade Vikunja to version 2.1.0 or later to ensure that password reset tokens are properly invalidated after a single use.

Proactive Monitoring: Review API logs for multiple password reset requests for the same user and check for anomalous token usage patterns in the database.

Compensating Controls: Implement multi-factor authentication (MFA) to provide an additional layer of security that remains effective even if a password is reset by an attacker.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. The technical complexity to exploit this is low once a token is obtained via logs or phishing.

Analyst Recommendation

This logic bug effectively breaks the security of the authentication lifecycle. Organizations using Vikunja must apply the version 2.1.0 patch immediately to prevent unauthorized account access and potential data exfiltration.

---METADATA---
VENDOR: ArgoProj
PRODUCT: Argo Workflows
AFFECTED_VERSIONS: Prior to 4.0.2 and 3.7.11
---END_METADATA---

Description Summary:
Argo Workflows template endpoints allow unauthenticated clients to leak sensitive WorkflowTemplates and Secret manifests by providing a malformed "Bearer nothing" authorization token.

Executive Summary:
A critical authentication bypass in Argo Workflows allows unauthenticated attackers to exfiltrate sensitive secrets and configuration data from Kubernetes environments.

Vulnerability Details

CVE-ID: CVE-2026-28229

Affected Software: ArgoProj Argo Workflows

Affected Versions: Prior to 4.0.2 and 3.7.11

Vulnerability: The application fails to properly validate authorization tokens on WorkflowTemplates and ClusterWorkflowTemplates endpoints. By submitting an "Authorization: Bearer nothing" header, an unauthenticated attacker can bypass security checks to retrieve sensitive template content, including embedded Kubernetes Secret manifests.

Business Impact

The exposure of Secret manifests can lead to the compromise of cloud credentials, database passwords, and API keys, facilitating a full-scale breach of the Kubernetes cluster. With a CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality and integrity of automated CI/CD pipelines and infrastructure.

Remediation Plan

Immediate Action: Upgrade Argo Workflows to version 4.0.2, 3.7.11, or later to patch the authentication logic.

Proactive Monitoring: Audit Kubernetes logs for unusual access patterns to the WorkflowTemplates endpoints, specifically looking for requests with malformed or placeholder Bearer tokens.

Compensating Controls: Implement Network Policies to restrict access to the Argo Workflows API to authorized users and services within the cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of exploitation via a simple header manipulation makes this a high-priority target for attackers.

Analyst Recommendation

The risk of secret leakage in a containerized environment is a critical threat that can lead to catastrophic downstream compromises. Immediate application of the official patches is required to secure sensitive workflow configurations and prevent unauthorized data exfiltration.

---METADATA---
VENDOR: Wazuh
PRODUCT: Wazuh
AFFECTED_VERSIONS: >= 4.0.0, < 4.14.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Wazuh is susceptible to a deserialization vulnerability, which could allow a highly privileged attacker to achieve remote code execution.

Executive Summary:
A critical deserialization vulnerability in the Wazuh platform could allow an authenticated user with high privileges to execute arbitrary code or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-28220

Affected Software: Wazuh Wazuh

Affected Versions: >= 4.0.0, < 4.14.5

Vulnerability: This vulnerability involves the deserialization of untrusted data. An attacker with high-level privileges can supply malicious serialized objects to the platform, leading to potential remote code execution or total system compromise.

Business Impact

Successful exploitation of this flaw allows for total system impact, including loss of confidentiality, integrity, and availability. Given the CVSS score of 8.4, this poses a severe risk to the security monitoring infrastructure, potentially allowing an attacker to disable security controls or pivot into the wider network.

Remediation Plan

Immediate Action: Upgrade to Wazuh version 4.14.5 or higher to resolve the deserialization flaw.

Proactive Monitoring: Monitor for suspicious process execution or unusual deserialization-related errors within internal platform logs.

Compensating Controls: Restrict access to administrative interfaces and ensure that the Wazuh manager instance is isolated within a secure network segment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly technical and requires privileged access to trigger.

Analyst Recommendation

Because this vulnerability affects the core security platform, it requires immediate attention. Organizations should prioritize patching all Wazuh components to version 4.14.5 to mitigate the risk of remote code execution and maintain the integrity of their security monitoring environment.

---METADATA---
VENDOR: Hoppscotch
PRODUCT: Hoppscotch
AFFECTED_VERSIONS: Prior to version 2026.2.0
---END_METADATA---

Description Summary:
A critical flaw in Hoppscotch allows unauthenticated attackers to overwrite infrastructure configurations via the onboarding endpoint, leading to SSO hijacking and full credential exposure.

Executive Summary:
An unauthenticated configuration overwrite vulnerability in Hoppscotch allows attackers to hijack OAuth authentication and steal sensitive recovery tokens, leading to a total instance compromise.

Vulnerability Details

CVE-ID: CVE-2026-28215

Affected Software: Hoppscotch

Affected Versions: Prior to version 2026.2.0

Vulnerability: This vulnerability resides in the POST /v1/onboarding/config endpoint, which lacks authentication guards and fails to verify if onboarding is complete. An unauthenticated attacker can send a single HTTP request to replace OAuth credentials and retrieve a plaintext recovery token for all stored secrets.

Business Impact

A successful exploit allows an attacker to intercept OAuth tokens and email addresses for all users logging in via SSO. By replacing legitimate credentials with their own, the attacker gains persistent access to user accounts and sensitive infrastructure secrets, including SMTP passwords. With a CVSS score of 9.1, this represents a critical risk to data confidentiality and system integrity.

Remediation Plan

Immediate Action: Update the self-hosted Hoppscotch instance to version 2026.2.0 or later immediately to close the vulnerable onboarding endpoint.

Proactive Monitoring: Review access logs for unauthorized POST requests to the /v1/onboarding/config endpoint and monitor for unexpected changes in OAuth provider settings.

Compensating Controls: Restrict access to the Hoppscotch management interface using network-level access control lists (ACLs) or a VPN until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the high impact on identity security, the potential for exploitation is extremely high.

Analyst Recommendation

This vulnerability presents a catastrophic risk to identity management and data privacy within self-hosted environments. It is imperative that administrators apply the version 2026.2.0 patch immediately to prevent unauthorized configuration changes and SSO hijacking.

---METADATA---
VENDOR: EverShop
PRODUCT: EverShop
AFFECTED_VERSIONS: Versions prior to 2.1.1
---END_METADATA---

Description Summary:
The EverShop eCommerce platform leaks password reset tokens in API responses, enabling unauthenticated attackers to bypass authentication and take over any user account.

Executive Summary:
A critical flaw in EverShop's "Forgot Password" functionality allows unauthenticated attackers to compromise any account by obtaining reset tokens directly from API responses.

Vulnerability Details

CVE-ID: CVE-2026-28213

Affected Software: EverShop eCommerce Platform

Affected Versions: Versions prior to 2.1.1

Vulnerability: The vulnerability exists in the "Forgot Password" API. When a password reset is requested, the server incorrectly includes the secret reset token in its response, allowing an unauthenticated attacker to reset the password for any email address.

Business Impact

This vulnerability has a CVSS score of 9.8, as it facilitates trivial account takeover for any user, including administrators. For an eCommerce platform, this leads to the potential theft of customer data, financial fraud, and total loss of platform integrity and consumer trust.

Remediation Plan

Immediate Action: Update EverShop to version 2.1.1 or later immediately to ensure password reset tokens are no longer exposed in API responses.

Proactive Monitoring: Review account activity logs for a surge in password reset requests followed by immediate logins from different locations.

Compensating Controls: If patching is delayed, consider temporarily disabling the password reset functionality or implementing strict rate-limiting on the forgot password API endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation. The simplicity of this flaw makes it highly likely to be exploited once the vulnerability details become widely known.

Analyst Recommendation

The ability to take over any account without credentials makes this a critical security emergency. IT teams must prioritize the update to EverShop version 2.1.1 to protect user accounts and prevent catastrophic data breaches.

---METADATA---
VENDOR: rtCamp
PRODUCT: Log in with Google
AFFECTED_VERSIONS: n/a through 1.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The rtCamp Log in with Google plugin for WordPress versions 1.4.2 and earlier contains an unauthenticated broken authentication vulnerability.

Executive Summary:
An unauthenticated broken authentication vulnerability in the Log in with Google plugin allows remote attackers to bypass security controls and compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-28185

Affected Software: rtCamp Log in with Google

Affected Versions: n/a through 1.4.2

Vulnerability: This vulnerability (CWE-345) involves insufficient verification of data authenticity during the authentication flow. This allows an unauthenticated attacker to manipulate the login process and potentially gain unauthorized access to the application.

Business Impact

A CVSS score of 9.8 indicates a critical risk. Successful exploitation could allow attackers to impersonate legitimate users or administrators, leading to unauthorized data access, privilege escalation, and total compromise of the WordPress site's integrity and confidentiality.

Remediation Plan

Immediate Action: Update the Log in with Google plugin to version 1.4.3 or later immediately to address the authentication flaw.

Proactive Monitoring: Review authentication and login logs for suspicious activity or unauthorized account access patterns.

Compensating Controls: Implement multi-factor authentication at the server or platform level to provide a layer of defense even if the plugin is compromised.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authentication bypass flaws are high-value targets for attackers looking to gain unauthorized access to administrative functions.

Analyst Recommendation

The vulnerability presents a direct risk to the authentication integrity of the affected WordPress site. Administrators must prioritize updating the plugin to the patched version to prevent unauthorized access and potential account takeover.

---METADATA---
VENDOR: Booking
PRODUCT: Booking Activities
AFFECTED_VERSIONS: n/a through 1.18.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated PHP object injection vulnerability in the Booking Activities plugin for WordPress allows attackers to execute arbitrary code.

Executive Summary:
A high-severity PHP object injection vulnerability in the Booking Activities plugin for WordPress could allow unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28176

Affected Software: Booking Activities (WordPress Plugin)

Affected Versions: n/a through 1.18.4

Vulnerability: This is a deserialization of untrusted data vulnerability, classified as CWE-502. The vulnerability allows an unauthenticated attacker to inject malicious PHP objects, which, when processed by the application, can lead to remote code execution or other unauthorized system impacts.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe risk to any WordPress site utilizing the affected plugin. Successful exploitation could lead to full site compromise, unauthorized data access, and the potential for the server to be used as a pivot point for further network attacks. The ability for an unauthenticated attacker to exploit this increases the risk significantly.

Remediation Plan

Immediate Action: Update the WordPress Booking Activities plugin to version 1.18.5 or higher immediately.

Proactive Monitoring: Review web server logs for suspicious POST requests or unusual patterns that might indicate attempts to inject serialized data into the plugin.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious input and inspect for signs of object injection attempts before they reach the plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. However, deserialization vulnerabilities are inherently dangerous due to their potential for remote code execution.

Analyst Recommendation

Given the potential for complete system compromise, administrators must update the Booking Activities plugin to the latest version immediately. If an update cannot be performed at this time, consider deactivating the plugin until a secure version is deployed.

---METADATA---
VENDOR: Aonetheme
PRODUCT: Service Finder Booking
AFFECTED_VERSIONS: n/a through 6.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the Aonetheme Service Finder Booking WordPress plugin allows authenticated subscribers to elevate their privileges to higher roles.

Executive Summary:
A vulnerability in the Service Finder Booking plugin for WordPress allows authenticated subscribers to perform unauthorized privilege escalation, posing a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-28161

Affected Software: Aonetheme Service Finder Booking

Affected Versions: n/a through 6.2

Vulnerability: This vulnerability is caused by an incorrect privilege assignment (CWE-266), which permits authenticated users with low-level subscriber access to perform administrative actions or escalate their account privileges.

Business Impact

The ability for a subscriber to escalate privileges can lead to total system compromise, unauthorized data exfiltration, and the modification of critical booking information. With a CVSS score of 8.8, this high-severity flaw represents a major threat to the integrity and confidentiality of the platform.

Remediation Plan

Immediate Action: Administrators should verify if their plugin version is 6.2 or lower and monitor vendor communications for a security patch. If no patch is currently available, disable the plugin to prevent exploitation.

Proactive Monitoring: Review WordPress user account logs for suspicious account role changes and monitor for unusual administrative activity originating from low-privileged accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests attempting to invoke administrative functions by low-privileged users.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease with which a subscriber can abuse the plugin functionality.

Analyst Recommendation

Given the high CVSS severity and the potential for complete control over the WordPress site, immediate action is required. Organizations using the Service Finder Booking plugin must audit their current installations and restrict access until a vendor-supplied patch is successfully deployed.

---METADATA---
VENDOR: Silicon Labs
PRODUCT: SiSDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A cryptographic flaw in Silicon Labs SiSDK for EFR32xG27 chips results in predictable keys, potentially undermining device security and encryption.

Executive Summary:
An incorrect implementation of PUF key generation in Silicon Labs SiSDK creates predictable cryptographic keys, significantly weakening the security posture of affected EFR32xG27 hardware.

Vulnerability Details

CVE-ID: CVE-2026-2815

Affected Software: Silicon Labs SiSDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue stems from the improper use of the Physical Unclonable Function (PUF) for user key generation. This flaw permits the derivation of predictable keys, effectively bypassing the intended security guarantees of the hardware-backed encryption.

Business Impact

Predictable cryptographic keys negate the primary security value of hardware-based root-of-trust mechanisms, leading to potential unauthorized decryption of sensitive data and loss of device integrity. With a CVSS score of 8.4, this vulnerability represents a critical failure in the hardware security chain, which could lead to widespread data compromise in embedded deployments.

Remediation Plan

Immediate Action: Consult Silicon Labs' security advisories to determine if a firmware or SDK update is available to correct the key generation logic.

Proactive Monitoring: Monitor for anomalous cryptographic operations or failures in authentication protocols that rely on these generated keys.

Compensating Controls: If patching is not immediately feasible, restrict physical access to devices and ensure that sensitive communications are wrapped in additional, independent layers of encryption.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical hardware-level security concern that cannot be easily mitigated without vendor intervention. Impacted organizations must coordinate closely with Silicon Labs to implement the necessary firmware updates to restore the integrity of the device's cryptographic operations.