---METADATA---
VENDOR: miniOrange
PRODUCT: OAuth Single Sign On – SSO (OAuth Client)
AFFECTED_VERSIONS: n/a through 7.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The miniOrange OAuth Single Sign On plugin for WordPress contains an unauthenticated authentication bypass vulnerability that allows attackers to spoof identities.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the miniOrange OAuth Single Sign On plugin enables attackers to spoof user sessions and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-28008

Affected Software: miniOrange OAuth Single Sign On – SSO (OAuth Client)

Affected Versions: n/a through 7.0.0

Vulnerability: This is an authentication bypass vulnerability (CWE-290) stemming from improper verification of OAuth responses. The flaw allows unauthenticated remote attackers to manipulate the authentication flow and gain unauthorized access to the application.

Business Impact

Successful exploitation results in unauthorized access to the WordPress environment, potentially allowing attackers to impersonate administrative users. With a CVSS score of 9.8, this represents a critical risk to the security of the entire web application, including sensitive user data and configuration settings.

Remediation Plan

Immediate Action: Update the miniOrange OAuth Single Sign On plugin to version 7.0.1 or later immediately.

Proactive Monitoring: Monitor authentication logs for unusual login patterns or sessions created without corresponding OAuth handshake activity.

Compensating Controls: If an update cannot be performed immediately, deactivate the plugin to prevent unauthorized access until a patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning.

Analyst Recommendation

The severity of this flaw necessitates an immediate update to the plugin. Administrators should treat this as a high-priority task, as the bypass allows for total compromise of the authentication mechanism, which is a cornerstone of site security.

---METADATA---
VENDOR: Nexcess
PRODUCT: Kadence WooCommerce Email Designer
AFFECTED_VERSIONS: n/a through 1.5.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Kadence WooCommerce Email Designer plugin for WordPress contains a missing authorization vulnerability that allows unauthenticated attackers to escalate privileges.

Executive Summary:
This critical privilege escalation vulnerability in the Kadence WooCommerce Email Designer plugin allows unauthenticated attackers to achieve full administrative control over the affected WordPress installation.

Vulnerability Details

CVE-ID: CVE-2026-28005

Affected Software: Nexcess Kadence WooCommerce Email Designer

Affected Versions: n/a through 1.5.19

Vulnerability: The plugin fails to perform necessary capability checks, resulting in a CWE-862 Missing Authorization flaw. This allows an unauthenticated attacker to execute unauthorized actions, effectively bypassing security controls.

Business Impact

A successful exploit grants an attacker administrative privileges, leading to complete site compromise, data theft, and potential malware distribution. Given the CVSS score of 9.8, this vulnerability represents an existential threat to the integrity and availability of the affected web application.

Remediation Plan

Immediate Action: Update the Nexcess Kadence WooCommerce Email Designer plugin to version 1.5.19.1 or later immediately.

Proactive Monitoring: Review administrative user accounts for unauthorized creations or modifications and monitor server logs for suspicious POST requests targeting plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized administrative requests and suspicious traffic patterns directed at the WordPress plugin directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication, making it trivial to exploit if reachable by external traffic.

Analyst Recommendation

This vulnerability carries a critical severity rating and requires immediate attention from security teams. Organizations using this plugin must prioritize applying the vendor-provided patch to prevent unauthorized access and potential full system takeover.

---METADATA---
VENDOR: Mozilla
PRODUCT: DOM: Core & HTML component
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the DOM: Core & HTML component could allow for memory corruption and potential code execution via malicious web content.

Executive Summary:
A critical use-after-free vulnerability in the DOM component of web browsers allows unauthenticated attackers to execute arbitrary code through specially crafted web pages.

Vulnerability Details

CVE-ID: CVE-2026-2798

Affected Software: Mozilla DOM: Core & HTML component

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a use-after-free vulnerability occurring within the DOM: Core & HTML component. An unauthenticated remote attacker can exploit this by enticing a user to visit a malicious website, leading to memory corruption and potentially arbitrary code execution within the context of the browser.

Business Impact

Exploitation of this vulnerability can lead to the total compromise of the user's workstation, allowing for data theft, malware installation, and further lateral movement within the corporate network. With a CVSS score of 8.8, this represents a high risk to organizational security, particularly for employees accessing the internet from corporate devices.

Remediation Plan

Immediate Action: Update all affected web browsers to the latest versions provided by the vendor to patch the underlying memory management flaw.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for suspicious browser child processes or unexpected memory access patterns.

Compensating Controls: Implement web filtering to block access to known malicious domains and use browser isolation technologies to execute untrusted web content in a secure sandbox.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Use-after-free flaws in browser engines are frequently targeted by advanced persistent threat (APT) groups for initial access.

Analyst Recommendation

Browser vulnerabilities are a primary vector for initial entry into corporate environments. It is vital to ensure that all client-side software is automatically updated and that robust endpoint security measures are in place to detect and block exploitation attempts.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: Prior to version 1.8.0
---END_METADATA---

Description Summary:
Langflow's CSV Agent node improperly enables dangerous code execution by default, allowing unauthenticated attackers to achieve remote code execution via prompt injection.

Executive Summary:
The hardcoded enablement of dangerous code execution in Langflow's CSV Agent node allows unauthenticated attackers to execute arbitrary commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-27966

Affected Software: Langflow

Affected Versions: Prior to version 1.8.0

Vulnerability: The CSV Agent node in Langflow hardcodes the allow_dangerous_code parameter to True, which exposes LangChain’s Python REPL tool. An unauthenticated attacker can leverage prompt injection to execute arbitrary Python and operating system commands.

Business Impact

A successful exploit results in full Remote Code Execution (RCE) on the underlying server, potentially leading to complete system takeover. Attackers could steal proprietary AI models, access sensitive datasets, or use the server as a pivot point for lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this unauthenticated execution flaw.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.8.0 or later, which disables the dangerous default configuration.

Proactive Monitoring: Audit Langflow logs for suspicious prompt patterns or unexpected Python execution errors within the CSV Agent node.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block prompt injection patterns aimed at LLM-integrated tools.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing prevalence of prompt injection attacks against AI frameworks, exploitation is likely if systems remain unpatched.

Analyst Recommendation

The exposure of a Python REPL tool to unauthenticated input constitutes a severe security failure. Organizations utilizing Langflow must prioritize the update to version 1.8.0 to mitigate the risk of full server compromise and data exfiltration.

---METADATA---
VENDOR: Authlib
PRODUCT: Authlib
AFFECTED_VERSIONS: Prior to version 1.6.9
---END_METADATA---

Description Summary:
A JWK Header Injection vulnerability in Authlib's JWS implementation allows unauthenticated attackers to forge arbitrary JWT tokens by embedding a malicious public key in the header.

Executive Summary:
Authlib is vulnerable to a critical authentication bypass that allows unauthenticated attackers to forge cryptographically valid tokens and gain unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2026-27962

Affected Software: Authlib

Affected Versions: Prior to version 1.6.9

Vulnerability: This is a JWK Header Injection vulnerability occurring when the library extracts cryptographic keys directly from attacker-controlled JWT headers. An unauthenticated attacker can sign a token with their own private key and embed the matching public key, tricking the server into validating the forged token.

Business Impact

A successful exploit results in a total bypass of the authentication and authorization framework. Attackers can impersonate any user, including administrators, leading to full data compromise and unauthorized system control. The CVSS score of 9.1 reflects the critical nature of this flaw, as it undermines the core security trust model of the OAuth and OpenID Connect implementation.

Remediation Plan

Immediate Action: Update the Authlib library to version 1.6.9 or later immediately to ensure the JWS deserialization functions no longer accept untrusted keys from headers.

Proactive Monitoring: Review application logs for unusual token signatures or unexpected administrative logins and monitor for any JWS deserialization calls where the key parameter is explicitly set to None.

Compensating Controls: Implement strict validation of the "iss" (issuer) and "aud" (audience) claims and restrict allowed signing algorithms at the application layer until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this flaw allows for a complete authentication bypass with minimal effort, the potential for exploitation is extremely high for any public-facing OIDC/OAuth server.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for the creation of "golden tokens" that bypass all security checks. IT teams must prioritize updating the Authlib Python package to version 1.6.9 immediately. Failure to remediate this flaw leaves the entire identity infrastructure exposed to trivial compromise.

---METADATA---
VENDOR: OpenCTI
PRODUCT: OpenCTI Platform
AFFECTED_VERSIONS: 6.6.0 through 6.9.12
---END_METADATA---

Description Summary:
OpenCTI contains a privilege escalation vulnerability allowing unauthenticated attackers to query the API as any user, including the default administrator.

Executive Summary:
This critical privilege escalation vulnerability in OpenCTI enables unauthenticated attackers to gain administrative control over the platform, posing a severe risk to threat intelligence data.

Vulnerability Details

CVE-ID: CVE-2026-27960

Affected Software: OpenCTI Platform

Affected Versions: 6.6.0 through 6.9.12

Vulnerability: This is a privilege escalation vulnerability within the OpenCTI API authentication logic. It allows an unauthenticated remote attacker to bypass authorization checks and perform actions as any user, including the primary administrator.

Business Impact

The ability for an unauthenticated actor to assume administrative privileges allows for full data exfiltration, deletion of threat intelligence, and potential persistent backdooring of the platform. With a CVSS score of 9.8, the impact is considered critical as it compromises the integrity and confidentiality of sensitive cybersecurity intelligence workflows.

Remediation Plan

Immediate Action: Upgrade the OpenCTI platform to version 6.9.13 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Audit API access logs for anomalous requests, particularly those originating from unknown IPs attempting to access administrative endpoints.

Compensating Controls: If patching is delayed, disable the default admin account using the APP__ADMIN__EXTERNALLY_MANAGED configuration setting to limit the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the security of your threat intelligence operations. Organizations should prioritize the deployment of the vendor-provided patch immediately to prevent unauthorized administrative access and potential platform compromise.

---METADATA---
VENDOR: Coolify
PRODUCT: Coolify
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Coolify self-hosted server and application management platform.

Executive Summary:
A critical security vulnerability in the Coolify management platform poses a high risk of unauthorized system control and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-27957

Affected Software: Coolify Coolify

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Coolify platform, which is designed for managing servers, applications, and databases. The nature of the flaw allows for potential unauthorized actions that could compromise the integrity of the entire managed environment.

Business Impact

Because Coolify is used to manage critical server infrastructure and databases, a successful exploit could grant an attacker full control over the underlying assets. The CVSS score of 8.8 highlights the severity of this risk, which could result in complete system takeover, data exfiltration, and significant operational downtime for all services managed by the Coolify instance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Coolify project immediately to mitigate risks of unauthorized access.

Proactive Monitoring: Monitor server and database logs for unauthorized configuration changes or unexpected administrative sessions initiated from unknown IP addresses.

Compensating Controls: Isolate the Coolify management instance within a secure network segment and restrict access to authorized personnel via secure administrative gateways.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with the highest priority, as Coolify serves as a central point of control for multiple infrastructure components. Immediate patching is required to prevent potential lateral movement and full-scale compromise of the managed server environment.

---METADATA---
VENDOR: Nginx UI Team
PRODUCT: Nginx UI
AFFECTED_VERSIONS: Prior to version 2.3.3
---END_METADATA---

Description Summary:
Nginx UI prior to 2.3.3 allows unauthenticated access to the backup endpoint, exposing encryption keys in response headers and enabling full system backup decryption and theft.

Executive Summary:
An unauthenticated remote attacker can download and decrypt full system backups of Nginx UI, resulting in the total compromise of sensitive credentials, SSL private keys, and server configurations.

Vulnerability Details

CVE-ID: CVE-2026-27944

Affected Software: Nginx UI Team Nginx UI

Affected Versions: Prior to version 2.3.3

Vulnerability: This vulnerability is an authentication bypass and sensitive information disclosure located at the /api/backup endpoint. An unauthenticated attacker can retrieve encryption keys from the X-Backup-Security response header, allowing for the immediate decryption of hijacked system backups.

Business Impact

A successful exploit poses a catastrophic risk to organizational security, as backups contain session tokens, user credentials, and SSL private keys. Exposure of this data allows for impersonation, man-in-the-middle attacks, and persistent unauthorized access to the Nginx infrastructure. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and the high impact on confidentiality and integrity.

Remediation Plan

Immediate Action: Update Nginx UI to version 2.3.3 or later immediately to close the unauthenticated endpoint and secure the backup process.

Proactive Monitoring: Review web server access logs for unauthorized GET requests to the /api/backup endpoint and inspect headers in historical traffic if possible.

Compensating Controls: Restrict access to the Nginx UI management interface using IP allowlisting or a VPN to prevent exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows for unauthenticated remote data exfiltration of critical secrets, the potential for rapid exploitation by threat actors is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to full system compromise. IT administrators must prioritize the update to version 2.3.3 immediately. Following the update, it is strongly recommended to rotate all SSL keys and user credentials that were stored within the Nginx UI environment, as they should be considered compromised.

---METADATA---
VENDOR: OpenLIT
PRODUCT: OpenLIT
AFFECTED_VERSIONS: Prior to version 1.37.1
---END_METADATA---

Description Summary:
OpenLIT GitHub Actions workflows are vulnerable to unauthorized code execution via forked pull requests, leading to the potential theft of sensitive secrets and cloud service keys.

Executive Summary:
A critical security flaw in OpenLIT's CI/CD pipeline allows external attackers to execute malicious code and exfiltrate sensitive API keys and Google Cloud service credentials.

Vulnerability Details

CVE-ID: CVE-2026-27941

Affected Software: OpenLIT OpenLIT

Affected Versions: Prior to version 1.37.1

Vulnerability: The vulnerability stems from the improper use of the pull_request_target event in GitHub Actions, which executes untrusted code from forked repositories within the security context of the base repository. This provides an unauthenticated attacker with access to a write-privileged GITHUB_TOKEN and various sensitive secrets.

Business Impact

Exploitation of this vulnerability could lead to the total compromise of the OpenLIT repository and linked cloud environments. The exposure of Google Cloud service account keys and vector store tokens allows attackers to manipulate or steal proprietary AI engineering data and infrastructure. The CVSS score of 9.9 reflects the catastrophic potential for unauthorized resource access and data exfiltration.

Remediation Plan

Immediate Action: Update OpenLIT to version 1.37.1 immediately and audit all GitHub Actions workflows for the insecure use of the pull_request_target trigger.

Proactive Monitoring: Monitor GitHub Action logs for suspicious workflow runs initiated from forked repositories and review Google Cloud audit logs for unauthorized service account activity.

Compensating Controls: Restrict the permissions of the GITHUB_TOKEN to read-only by default and use OpenID Connect (OIDC) for cloud authentication instead of long-lived service account keys.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the misconfiguration of CI/CD pipelines is a common target for supply chain attacks, making the risk of exploitation significant.

Analyst Recommendation

This vulnerability poses a direct threat to the integrity of the OpenLIT project and its users' cloud environments. It is imperative to apply the update immediately and rotate all secrets, including Google Cloud keys and database tokens, that were stored as GitHub Actions secrets.

---METADATA---
VENDOR: Statamic
PRODUCT: Statamic CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Statamic CMS, a Laravel and Git-powered content management system, contains a high-severity vulnerability that could allow for unauthorized system manipulation.

Executive Summary:
A high-severity vulnerability in Statamic CMS poses a significant risk to web application integrity and data confidentiality, potentially allowing attackers to compromise the underlying Laravel framework.

Vulnerability Details

CVE-ID: CVE-2026-27939

Affected Software: Statamic Statamic CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Statamic CMS, a platform built on the Laravel framework. While the specific flaw type is not detailed in the summary, the CVSS score of 8.8 indicates a high-impact issue likely involving significant access bypass or remote execution capabilities, potentially accessible to unauthenticated or low-privileged users.

Business Impact

A successful exploit of this vulnerability could lead to a total compromise of the CMS environment, resulting in unauthorized content modification, data exfiltration, or complete site downtime. With a CVSS score of 8.8, the risk is categorized as High, as it directly threatens the integrity of the web presence and any sensitive data managed within the Laravel-based architecture.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Statamic development team immediately to patch the core CMS files.

Proactive Monitoring: Review web server and application logs for unusual POST requests or unauthorized changes to the Git-managed content repository.

Compensating Controls: Implement a Web Application Firewall (WAF) with rulesets configured to block common Laravel and CMS-specific exploit patterns to mitigate risk during the update window.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score of 8.8, the potential for rapid exploit development is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention from IT security teams. Organizations utilizing Statamic should prioritize the application of vendor-supplied patches to prevent potential unauthorized access and ensure the continued security of their web infrastructure.