---METADATA---
VENDOR: Isaacs
PRODUCT: minimatch
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability in the minimatch JavaScript library could lead to system resource exhaustion or security bypasses when processing glob expressions.

Executive Summary:
The minimatch library is affected by an additional high-severity flaw that enables attackers to disrupt application availability or circumvent security filters via malicious input strings.

Vulnerability Details

CVE-ID: CVE-2026-27904

Affected Software: minimatch

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to other flaws in glob-matching utilities, this vulnerability likely stems from inefficient processing of complex patterns. An unauthenticated attacker could provide a malicious string that causes the library to consume excessive resources or fail to match patterns as expected.

Business Impact

The high CVSS score of 7.5 highlights the potential for this vulnerability to cause significant service disruptions. For enterprises relying on Node.js for customer-facing applications, an exploit could lead to service outages and financial loss. Furthermore, if minimatch is used for access control lists (ACLs), an attacker might bypass security boundaries to access restricted files.

Remediation Plan

Immediate Action: Update all instances of the minimatch dependency to the latest patched version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review application logs for failed requests or timeouts associated with file uploads or path-based queries.

Compensating Controls: Use rate-limiting on endpoints that accept user-defined search patterns or file paths to reduce the impact of potential resource exhaustion attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Utility library flaws are often exploited silently in automated attacks, making proactive patching essential.

Analyst Recommendation

Given the high CVSS score and the widespread use of this library, administrators and developers must act swiftly. Ensure that all package-lock.json or yarn.lock files are updated to include the remediated version of minimatch to prevent the introduction of this vulnerability during automated builds.

---METADATA---
VENDOR: Isaacs
PRODUCT: minimatch
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The minimatch library, a JavaScript utility for glob matching, is vulnerable to a flaw that could result in application instability or unauthorized processing of malicious expressions.

Executive Summary:
The minimatch JavaScript library contains a high-severity vulnerability that could allow attackers to trigger a denial-of-service or compromise application logic through malformed glob expressions.

Vulnerability Details

CVE-ID: CVE-2026-27903

Affected Software: minimatch

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the way the minimatch utility converts glob expressions into JavaScript Regular Expressions. An attacker providing a specially crafted input string could potentially trigger a Regular Expression Denial of Service (ReDoS) or bypass intended matching logic.

Business Impact

Because minimatch is a foundational dependency in many Node.js applications and build tools, a vulnerability here has a wide-reaching impact. Exploitation could result in significant application downtime, increased CPU consumption on servers, or the bypassing of security filters that rely on glob matching for file or path authorization. The CVSS score of 7.5 reflects these substantial operational risks.

Remediation Plan

Immediate Action: Update the minimatch package to the latest version via npm or your preferred package manager and redeploy affected applications.

Proactive Monitoring: Monitor application performance for sudden spikes in CPU usage, which may indicate an attempt to exploit a ReDoS vulnerability.

Compensating Controls: Implement input validation to sanitize and limit the length and complexity of user-provided strings that are passed to glob-matching functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in widely used utility libraries are often targeted quickly once details are released to the developer community.

Analyst Recommendation

It is critical to identify all internal applications and CI/CD pipelines that utilize the minimatch library. Immediate updates are required to ensure that these applications remain resilient against denial-of-service attacks and to maintain the integrity of path-matching security controls.

---METADATA---
VENDOR: Vociferous
PRODUCT: Vociferous
AFFECTED_VERSIONS: Prior to 4.4.2
---END_METADATA---

Description Summary:
Vociferous prior to 4.4.2 contains an unauthenticated directory traversal vulnerability in the export_file route, enabling arbitrary file writes to any location accessible by the application.

Executive Summary:
Vociferous versions prior to 4.4.2 are vulnerable to a critical unauthenticated directory traversal attack that allows remote actors to overwrite system files or deploy malicious payloads.

Vulnerability Details

CVE-ID: CVE-2026-27897

Affected Software: Vociferous

Affected Versions: Prior to 4.4.2

Vulnerability: The vulnerability exists in src/api/system.py within the export_file route. Because the API is unauthenticated and lacks filename validation, an attacker can use directory traversal sequences (e.g., ../) to bypass the intended UI and write arbitrary data to any path reachable by the user running the application.

Business Impact

With a CVSS score of 10.0, this is a maximum-severity vulnerability. Attackers can achieve full system compromise by overwriting critical configuration files or placing executable scripts in startup directories. The overly permissive CORS configuration further increases the risk of exploitation via cross-site requests.

Remediation Plan

Immediate Action: Update Vociferous to version 4.4.2 or later immediately to resolve the lack of input validation in the filesystem logic.

Proactive Monitoring: Review filesystem integrity for unauthorized changes in sensitive directories and monitor API logs for requests containing directory traversal patterns in the JSON payload.

Compensating Controls: Restrict network access to the Vociferous API using a firewall and modify the CORS configuration to disallow wildcard origins, limiting the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. However, the combination of unauthenticated access and arbitrary file write makes this an extremely attractive target for attackers.

Analyst Recommendation

The ability to write arbitrary files as an unauthenticated user is a critical failure in the application's security architecture. The urgency to apply the 4.4.2 patch cannot be overstated; failure to do so leaves the host system entirely exposed to remote compromise.

---METADATA---
VENDOR: NeoRazorX
PRODUCT: FacturaScripts
AFFECTED_VERSIONS: < 2026.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FacturaScripts is susceptible to improper input validation and unrestricted file uploads, which could allow an authenticated administrator to execute arbitrary code.

Executive Summary:
An authenticated administrator-level vulnerability in FacturaScripts allows for arbitrary file uploads, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27891

Affected Software: NeoRazorX FacturaScripts

Affected Versions: < 2026.1

Vulnerability: The application fails to properly validate input and restricts file uploads, allowing an authenticated user with administrative privileges to upload and execute malicious files on the host server.

Business Impact

Successful exploitation allows an attacker with administrative access to achieve remote code execution, potentially leading to total system compromise, data exfiltration, or complete disruption of accounting services. With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of sensitive financial data.

Remediation Plan

Immediate Action: Update FacturaScripts to version 2026.1 or later immediately to address the underlying input validation and file upload flaws.

Proactive Monitoring: Review web server and application logs for suspicious file uploads or access to non-standard executable files within the upload directories.

Compensating Controls: Implement strict file type validation at the Web Application Firewall (WAF) level and restrict administrative access to the application to trusted, internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from insufficient server-side validation of user-supplied files.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize patching FacturaScripts to version 2026.1. While the vulnerability requires administrative authentication, the impact of a breach in an accounting system is severe and warrants immediate remediation.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Piwigo photo gallery application, potentially impacting web-based image hosting security.

Executive Summary:
An additional high-severity security vulnerability in Piwigo requires immediate administrative review to ensure the integrity of web-hosted content.

Vulnerability Details

CVE-ID: CVE-2026-27885

Affected Software: Piwigo Photo Gallery

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An unspecified security vulnerability exists within the Piwigo application. Further technical details remain pending; however, the severity necessitates proactive patching.

Business Impact

With a CVSS score of 7.2, this vulnerability poses a high risk to organizational web assets. Successful exploitation could facilitate unauthorized access to private content or administrative functions, potentially leading to data loss or service disruption.

Remediation Plan

Immediate Action: Update all Piwigo instances to the latest available version provided by the vendor.

Proactive Monitoring: Review application logs for any irregular activity or unauthorized configuration changes to the photo gallery.

Compensating Controls: Use a Web Application Firewall (WAF) with updated rulesets to protect against potential web-based attack vectors targeting Piwigo.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency. Ensure that all instances of Piwigo are patched and that security configurations are reviewed to defend against potential exploitation.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana
AFFECTED_VERSIONS: See vendor advisory; affects OSS and Enterprise versions
---END_METADATA---

Description Summary:
A chained attack involving SQL Expressions and a Grafana Enterprise plugin enables remote arbitrary code execution (RCE) when the sqlExpressions feature toggle is active.

Executive Summary:
Grafana instances with the sqlExpressions feature enabled are at critical risk of Remote Code Execution (RCE) through a chained vulnerability in Enterprise plugins.

Vulnerability Details

CVE-ID: CVE-2026-27876

Affected Software: Grafana (OSS and Enterprise)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a chained vulnerability where the "sqlExpressions" feature toggle in Grafana OSS interacts with a Grafana Enterprise plugin to allow Remote Code Execution. An attacker can exploit this chain to execute arbitrary code on the host system.

Business Impact

The CVSS score of 9.1 indicates a critical risk to the organization. Successful exploitation allows an attacker to gain full control over the Grafana server, potentially leading to lateral movement within the network, data exfiltration, and complete compromise of the monitoring infrastructure. This could result in prolonged service outages and significant security remediation costs.

Remediation Plan

Immediate Action: Update Grafana and all Enterprise plugins to the latest versions immediately. If patching is not possible, disable the sqlExpressions feature toggle in the Grafana configuration.

Proactive Monitoring: Monitor system logs for unauthorized shell execution or unexpected network connections originating from the Grafana server.

Compensating Controls: Restrict access to the Grafana web interface to authorized internal users only and ensure the service is running with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of the chain may limit widespread exploitation, but the RCE impact makes it a high-priority target.

Analyst Recommendation

Due to the potential for Remote Code Execution, this vulnerability must be addressed with the highest urgency. Administrators should prioritize upgrading their Grafana environment and verifying that the sqlExpressions feature is only enabled if absolutely necessary and properly secured.

---METADATA---
VENDOR: Dovecot
PRODUCT: Doveadm
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Doveadm credentials are verified using direct comparison, creating a timing oracle vulnerability that allows attackers to potentially guess sensitive information.

Executive Summary:
A high-severity timing oracle vulnerability in Doveadm credential verification could allow attackers to perform unauthorized authentication by analyzing response times.

Vulnerability Details

CVE-ID: CVE-2026-27856

Affected Software: Dovecot (Doveadm)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The doveadm utility uses direct string comparison for credential verification instead of constant-time comparison. This unauthenticated remote flaw allows an attacker to measure the time taken for the server to respond, eventually deducing the correct credentials through a timing oracle attack.

Business Impact

A successful timing attack can lead to unauthorized access to the mail system, resulting in data breaches, unauthorized reading of emails, and potential administrative control over the mail server. The CVSS score of 7.4 reflects the high risk to confidentiality and access control.

Remediation Plan

Immediate Action: Apply the latest security updates from Dovecot immediately to ensure that credential comparisons are performed in constant time.

Proactive Monitoring: Review authentication logs for an abnormally high number of failed login attempts from single IP addresses, which may indicate a timing attack in progress.

Compensating Controls: Implement fail2ban or similar rate-limiting tools to block IP addresses that exceed a threshold of failed authentication attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation. Timing attacks require high precision and low network jitter but are a proven method for credential recovery.

Analyst Recommendation

While timing attacks are more complex to execute than buffer overflows, they are highly effective against poorly implemented authentication routines. Organizations should apply vendor patches immediately to move to constant-time verification.

---METADATA---
VENDOR: SenseLive
PRODUCT: X3050
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the SenseLive X3050 web management interface allows unauthorized modification of configuration parameters, leading to a persistent Denial-of-Service (DoS).

Executive Summary:
A critical vulnerability in the SenseLive X3050 web management interface allows unauthenticated attackers to trigger a persistent lockout, resulting in total denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-27843

Affected Software: SenseLive X3050

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The web management interface lacks sufficient authentication and validation for critical configuration parameters. Attackers can inject disruptive values, rendering the device unreachable without physical console intervention.

Business Impact

A CVSS score of 9.1 reflects the severe operational impact of this vulnerability. Because the device lacks a physical reset button, a successful exploit forces a costly, manual technical recovery, causing significant downtime for both the gateway and downstream RS-485 systems.

Remediation Plan

Immediate Action: Update the firmware to the latest version provided by SenseLive and restrict web management interface access to authorized internal networks.

Proactive Monitoring: Monitor for unauthorized attempts to access the device management page and audit configuration changes.

Compensating Controls: Use a dedicated management VLAN and firewall rules to strictly limit access to the X3050 web interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the difficulty of recovering from this DoS condition, it is imperative to secure the management interface immediately. We recommend applying the latest firmware and implementing strict network-level access controls to prevent unauthorized configuration changes.

---METADATA---
VENDOR: Micro Research Ltd.
PRODUCT: MR-GM5L-S1 and MR-GM5A-L1
AFFECTED_VERSIONS: firmware versions prior to v2.01.04N1_02
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Micro Research Ltd. MR-GM5L-S1 and MR-GM5A-L1 firmware allows unauthenticated attackers to modify device configurations.

Executive Summary:
A critical authentication bypass vulnerability in Micro Research Ltd. industrial networking devices allows unauthenticated remote attackers to gain unauthorized control over device configurations.

Vulnerability Details

CVE-ID: CVE-2026-27842

Affected Software: Micro Research Ltd. MR-GM5L-S1 and MR-GM5A-L1

Affected Versions: Firmware versions prior to v2.01.04N1_02

Vulnerability: This is an authentication bypass (CWE-288) that allows an unauthenticated attacker to interact with the device as if they were a legitimate administrator. The vulnerability leverages an alternate path or channel to circumvent standard login procedures.

Business Impact

Successful exploitation allows an adversary to alter critical device configurations, which could lead to unauthorized network access, traffic interception, or the total compromise of the affected network infrastructure. With a CVSS score of 9.8, this vulnerability poses a severe risk to operational continuity and data integrity.

Remediation Plan

Immediate Action: Upgrade all affected MR-GM5L-S1 and MR-GM5A-L1 units to firmware version v2.01.04N1_02 or later immediately.

Proactive Monitoring: Review device access logs for unauthorized configuration changes and monitor network traffic for suspicious management requests originating from untrusted sources.

Compensating Controls: Restrict management interface access to trusted internal IP addresses using hardware firewalls or ACLs to prevent exposure to the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this authentication bypass and the potential for full device control, immediate patching is required. Organizations should prioritize firmware updates for all internet-facing or critical infrastructure deployments of these devices to eliminate the risk of unauthorized configuration manipulation.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
phpMyFAQ, an open-source FAQ web application, is affected by a high-severity vulnerability that could allow for unauthorized system interaction.

Executive Summary:
A high-severity flaw in the phpMyFAQ application poses a risk to the confidentiality and integrity of the knowledge base, potentially allowing for unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-27836

Affected Software: phpMyFAQ phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability impacts phpMyFAQ, an open-source FAQ management system. The CVSS score of 7.5 suggests a high-impact flaw, likely involving improper input validation or an authentication bypass that could be exploited by an attacker to gain unauthorized access to the application’s administrative or data functions.

Business Impact

Successful exploitation could result in the unauthorized modification of FAQ content or the exposure of sensitive internal documentation. Given the CVSS score of 7.5, this represents a significant risk to organizations that rely on phpMyFAQ for providing critical information to users or employees.

Remediation Plan

Immediate Action: Update phpMyFAQ to the latest stable version immediately to apply necessary security patches.

Proactive Monitoring: Review application access logs for suspicious activity, particularly around administrative functions and user management pages.

Compensating Controls: Use a Web Application Firewall (WAF) to block common web attack vectors and ensure the application is running on a secured, hardened web server environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. As an open-source application, the disclosure of this flaw may lead to the rapid development of exploits.

Analyst Recommendation

It is strongly recommended that administrators of phpMyFAQ installations apply the latest security updates immediately. Addressing this high-severity vulnerability is essential to maintaining the security and reliability of the knowledge base.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Piwigo, an open-source photo gallery application for the web.

Executive Summary:
A high-severity security vulnerability in the Piwigo photo gallery application could allow attackers to compromise web-hosted image repositories.

Vulnerability Details

CVE-ID: CVE-2026-27834

Affected Software: Piwigo Photo Gallery

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to an unspecified security flaw within the Piwigo application. Users should verify their version against vendor advisories to assess the risk of unauthorized access or data exposure.

Business Impact

With a CVSS score of 7.2, this vulnerability represents a significant risk to the security of web-based media hosting. Potential impacts include unauthorized access to private galleries, data exfiltration, or defacement of the web portal, which could damage organizational reputation.

Remediation Plan

Immediate Action: Update the Piwigo installation to the most recent version provided by the project maintainers.

Proactive Monitoring: Monitor web server logs for suspicious URL requests or unauthorized administrative access attempts within the Piwigo interface.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the Piwigo application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators of Piwigo instances must prioritize the application of security patches. Given the public-facing nature of these applications, prompt remediation is necessary to prevent exploitation by external actors.

---METADATA---
VENDOR: Piwigo
PRODUCT: Piwigo
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Piwigo, an open-source photo gallery application, contains a security vulnerability that could allow for unauthorized access or site compromise.

Executive Summary:
A security flaw in Piwigo photo gallery software could allow attackers to gain unauthorized access to media or compromise the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-27833

Affected Software: Piwigo

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists in Piwigo, a web-based photo gallery. Although the specific flaw is not detailed, it likely involves vulnerabilities common to PHP-based gallery software, such as insecure file uploads, XSS, or SQL injection.

Business Impact

A successful exploit could lead to the theft of private images, unauthorized modification of the gallery, or full server compromise if the attacker can execute arbitrary code. This poses a significant risk to data privacy and system integrity. The CVSS score of 7.5 reflects the High severity of the risk.

Remediation Plan

Immediate Action: Update Piwigo to the latest available version immediately to apply the necessary security fixes.

Proactive Monitoring: Monitor the web server for the creation of unusual files, especially in upload directories, and review application logs for unauthorized administrative logins.

Compensating Controls: Restrict file upload permissions and use a Web Application Firewall (WAF) to block malicious web traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Web-based gallery applications are frequently targeted by automated exploit kits.

Analyst Recommendation

Maintaining the security of web-facing applications like Piwigo is essential. Administrators should prioritize the installation of the latest security patches and ensure the underlying server environment is hardened against common web attacks.

---METADATA---
VENDOR: Model Context Protocol (MCP)
PRODUCT: MCP Atlassian Server
AFFECTED_VERSIONS: Versions prior to 0.17.0
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the MCP Atlassian server allows attackers to write arbitrary files to the server, potentially leading to remote code execution.

Executive Summary:
A critical file-write vulnerability in the MCP Atlassian server allows attackers to achieve remote code execution by bypassing directory boundaries.

Vulnerability Details

CVE-ID: CVE-2026-27825

Affected Software: MCP Atlassian (Server for Confluence and Jira)

Affected Versions: Prior to version 0.17.0

Vulnerability: The confluence_download_attachment tool fails to enforce directory boundaries on the download_path parameter. An attacker who can invoke this tool can write malicious content (such as a cron job) to any path the server process can access, leading to unauthenticated remote code execution (RCE).

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the host system, leading to a total compromise of the MCP server and potentially the linked Confluence or Jira instances. With a CVSS score of 9.0, this vulnerability presents an immediate threat to corporate data and server stability, as it allows for persistent access via malicious system files.

Remediation Plan

Immediate Action: Update the MCP Atlassian server to version 0.17.0 or higher immediately to implement the necessary path validation fixes.

Proactive Monitoring: Scan the server for unauthorized files in sensitive directories like /etc/cron.d/, /tmp/, or web root folders.

Compensating Controls: Run the MCP server process with the least privilege possible to limit the scope of files an attacker can overwrite if the vulnerability is triggered.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. However, the ability to achieve RCE via a simple path traversal in a download function is a well-known and highly effective attack pattern.

Analyst Recommendation

This RCE vulnerability is highly critical and should be patched immediately. Organizations using the MCP Atlassian server must prioritize the update to version 0.17.0. Additionally, administrators should review the permissions of the service account running the MCP server to ensure it does not have unnecessary write access to system-critical directories.

---METADATA---
VENDOR: EGroupware
PRODUCT: egroupware
AFFECTED_VERSIONS: <= 26.2.20260216, <= 23.1.20260131
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in EGroupware allows an authenticated user to achieve remote code execution due to improper authorization checks.

Executive Summary:
An improper authorization vulnerability in EGroupware poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-27823

Affected Software: EGroupware egroupware

Affected Versions: <= 26.2.20260216, <= 23.1.20260131

Vulnerability: The application fails to properly enforce authorization controls, which can be leveraged by an authenticated attacker to execute arbitrary code on the underlying server.

Business Impact

Successful exploitation of this vulnerability could lead to a complete system compromise, allowing an attacker to steal sensitive data, modify application records, or disrupt business operations. With a CVSS score of 8.7, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Update EGroupware to the latest patched version as identified in the vendor security advisory.

Proactive Monitoring: Audit application access logs for unusual command execution patterns or unauthorized requests directed at administrative functions.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious payloads that attempt to bypass application authorization.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for remote code execution, making it a high priority for remediation.

Analyst Recommendation

The high CVSS score reflects the significant risk posed by this authorization bypass. Administrators must prioritize applying the vendor provided patches to all affected instances to eliminate the possibility of unauthorized code execution.

---METADATA---
VENDOR: RustFS
PRODUCT: RustFS Console
AFFECTED_VERSIONS: Versions prior to 1.0.0-alpha.83
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the RustFS Console allows attackers to steal administrator credentials and achieve full system compromise.

Executive Summary:
Attackers can exploit a stored XSS flaw in the RustFS management console to hijack administrator sessions and gain complete control over the distributed storage system.

Vulnerability Details

CVE-ID: CVE-2026-27822

Affected Software: RustFS Console

Affected Versions: Versions prior to 1.0.0-alpha.83

Vulnerability: The vulnerability exists in the PDF preview logic of the management console. By bypassing this logic, an attacker can store a malicious payload that executes arbitrary JavaScript in the browser of any administrator who views it, enabling the theft of credentials from localStorage.

Business Impact

Compromise of the RustFS Console grants an attacker full access to the distributed object storage system. This could lead to massive data breaches, unauthorized data deletion, or the injection of malicious files into the storage network. The CVSS score of 9.0 reflects this high potential for system-wide impact.

Remediation Plan

Immediate Action: Update RustFS to version 1.0.0-alpha.83 to resolve the XSS vulnerability and secure the PDF preview component.

Proactive Monitoring: Monitor the RustFS Console for unusual administrative logins and audit the storage system for any unauthorized file uploads or configuration changes.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts the execution of inline scripts and prevents data from being sent to unauthorized external domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, active exploitation has not been observed. However, the ability to pivot from a stored payload to full administrative takeover makes this a critical priority.

Analyst Recommendation

Storage infrastructure is a primary target for ransomware and data exfiltration. We strongly urge administrators to apply the 1.0.0-alpha.83 update immediately and review console access logs for any signs of session hijacking.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Versions before 1.26.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Gitea versions before 1.26.0 fail to handle errors correctly during pre-receive hook processing, allowing attackers to bypass branch-protection checks using oversized input.

Executive Summary:
An authorization bypass vulnerability in Gitea versions prior to 1.26.0 allows attackers to circumvent critical branch-protection security controls.

Vulnerability Details

CVE-ID: CVE-2026-27780

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: Versions before 1.26.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) resulting from a failure to close connections or halt processes when a bufio.Scanner error occurs. By providing specifically crafted, oversized input during the pre-receive hook process, an attacker can cause the system to ignore security checks, effectively bypassing branch protections.

Business Impact

The ability to bypass branch protections with a CVSS score of 9.8 poses a catastrophic risk to the integrity of the software development lifecycle. Unauthorized code changes can be pushed to protected branches, potentially allowing the introduction of malicious backdoors or unauthorized modifications to production-critical source code.

Remediation Plan

Immediate Action: Upgrade to Gitea version 1.26.0 or higher to ensure proper input validation and error handling for pre-receive hooks.

Proactive Monitoring: Review repository push logs for abnormal activity or attempts to push to protected branches that should have been rejected.

Compensating Controls: Implement strict CI/CD pipeline checks that verify code integrity independently of the Git server's native branch protection mechanisms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the criticality of the bypass necessitates immediate attention.

Analyst Recommendation

This vulnerability is critical due to the potential for total compromise of repository integrity. Administrators must upgrade to version 1.26.0 or later immediately to restore the effectiveness of branch-protection policies and prevent unauthorized code modifications.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 are vulnerable to canonical URL spoofing due to improper validation of forwarded-proto headers.

Executive Summary:
A vulnerability in Gitea allows attackers to spoof canonical URLs by injecting malformed forwarded-proto headers, potentially leading to unauthorized redirection or phishing risks.

Vulnerability Details

CVE-ID: CVE-2026-27779

Affected Software: Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: The application incorrectly handles forwarded-proto values when detecting the public URL of the server. An unauthenticated attacker can manipulate these headers to influence how the server generates canonical URLs, which could be used to redirect users to malicious sites or poison cache/link generation.

Business Impact

While the CVSS score is 7.5, the primary risk involves the integrity of links generated by the server. An attacker could trick users into clicking malicious links that appear to originate from the legitimate Gitea instance, potentially leading to credential harvesting or the distribution of malicious content, damaging organizational trust.

Remediation Plan

Immediate Action: Update the Gitea instance to version 1.25.5 or later.

Proactive Monitoring: Monitor access logs for anomalous requests containing unexpected or malformed headers, particularly those targeting URL generation or proxy-related headers.

Compensating Controls: Configure your reverse proxy (e.g., Nginx, HAProxy) to strip or sanitize X-Forwarded-Proto headers to ensure only trusted values are passed to the Gitea backend.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered automatable, increasing the risk of widespread scanning for vulnerable instances.

Analyst Recommendation

Organizations hosting Gitea should prioritize the update to version 1.25.5 to prevent potential URL spoofing attacks. In addition to patching, ensuring that the reverse proxy is correctly configured to sanitize incoming headers provides a necessary layer of defense-in-depth against header injection attacks.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cache misconfiguration in Gitea 1.25.5 allows authenticated users to escalate privileges by reusing branch-specific write permissions across unauthorized repository references.

Executive Summary:
A privilege escalation vulnerability in Gitea 1.25.5 could allow an authenticated user to gain unauthorized full write access to a repository.

Vulnerability Details

CVE-ID: CVE-2026-27775

Affected Software: Gitea Open Source Git Server

Affected Versions: 1.25.5

Vulnerability: This is an improper authorization flaw (CWE-863) where the application incorrectly caches write-permission results during a pre-receive hook session, allowing authenticated users with limited scope to bypass access controls.

Business Impact

Successful exploitation allows a low-privileged user to modify code, inject malicious commits, or disrupt project integrity, leading to potential supply chain compromise. With a CVSS score of 8.8, this high-severity flaw poses a significant risk to development environments, as it undermines the fundamental access control mechanisms protecting source code repositories.

Remediation Plan

Immediate Action: Upgrade Gitea to version 1.26.3 or later to apply the necessary security patches.

Proactive Monitoring: Review repository access logs for unusual commit activity or unauthorized modifications made by users outside of their assigned branches.

Compensating Controls: Implement strict branch protection rules and enforce mandatory code reviews for all incoming changes to limit the impact of potential unauthorized writes.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is rooted in session-level caching logic, making it a targeted vector for sophisticated actors.

Analyst Recommendation

Given the critical nature of repository integrity, organizations utilizing Gitea must prioritize this update immediately. Failure to patch allows authenticated users to potentially gain unauthorized control over the entire codebase, necessitating an urgent deployment of the available fix.

---METADATA---
VENDOR: OCPP-compliant Charging Infrastructure
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
WebSocket endpoints lack authentication, allowing unauthenticated attackers to impersonate charging stations and manipulate backend data via the Open Charge Point Protocol.

Executive Summary:
A critical vulnerability in OCPP WebSocket endpoints allows unauthenticated attackers to impersonate charging stations, potentially leading to unauthorized control of charging infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27772

Affected Software: OCPP-compliant Charging Infrastructure

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw involves a lack of authentication mechanisms on WebSocket endpoints. An unauthenticated attacker can connect to the OCPP endpoint using a discovered charging station identifier to issue or receive commands as a legitimate charger.

Business Impact

A successful exploit allows for complete unauthorized control over electric vehicle charging infrastructure. This could lead to privilege escalation, corruption of charging network data reported to the backend, and significant reputational damage. The CVSS score of 9.4 reflects the critical nature of this flaw and its potential to disrupt essential energy infrastructure.

Remediation Plan

Immediate Action: Update the affected software to the latest version provided by the vendor to implement mandatory authentication for all WebSocket connections.

Proactive Monitoring: Review access logs for the OCPP WebSocket endpoint for any connections originating from unknown IP addresses or using duplicated station identifiers.

Compensating Controls: Implement network-level access control lists (ACLs) or a VPN to restrict access to the WebSocket endpoints to known, authorized charging station IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the unauthenticated nature of the flaw and the sensitivity of charging infrastructure, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of charging networks. It is highly recommended that administrators apply the relevant security patches immediately. Failure to secure these endpoints could allow attackers to manipulate power delivery or compromise the entire backend management system.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea and Forgejo versions prior to 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated access vulnerability in the Gitea and Forgejo container registry allows remote attackers to pull private container images due to missing authentication checks.

Executive Summary:
A critical unauthenticated access vulnerability in the Gitea container registry allows remote attackers to exfiltrate private images, potentially exposing sensitive credentials and source code.

Vulnerability Details

CVE-ID: CVE-2026-27771

Affected Software: Gitea and Forgejo Open Source Git Server

Affected Versions: Gitea's built-in container (OCI) registry in all versions prior to 1.26.2; Forgejo versions prior to 1.26.2.

Vulnerability: This is an unauthenticated access vulnerability in the container registry component. Remote attackers can pull private container images because the software fails to perform mandatory authentication checks before serving registry data.

Business Impact

With a CVSS score of 8.2, this vulnerability is highly severe as it facilitates the unauthorized exposure of proprietary source code, API keys, and database credentials stored within container images. This exposure provides attackers with the necessary intelligence to escalate access, leading to broader infrastructure compromise and potential data breaches.

Remediation Plan

Immediate Action: Update Gitea or Forgejo to version 1.26.2 or later immediately to enforce proper authentication on the container registry.

Proactive Monitoring: Audit access logs for the container registry to identify unusual pull requests or unauthorized attempts to access sensitive container images.

Compensating Controls: If an immediate update is not feasible, restrict network access to the Gitea/Forgejo registry service to trusted internal IP ranges using a firewall or WAF.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 4, 2026, public proof-of-concept exploits are available for this vulnerability. Given the ease of access and the sensitivity of the data at risk, immediate patching is required.

Analyst Recommendation

This vulnerability is critical due to the availability of public exploits and the potential for massive data exposure. Administrators must treat this as a top-priority security event and apply the 1.26.2 update across all affected deployments to prevent unauthorized data exfiltration.

---METADATA---
VENDOR: OCPP Implementations
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Unauthenticated attackers can perform station impersonation and manipulate backend data due to a lack of authentication on OCPP WebSocket endpoints.

Executive Summary:
The absence of authentication on OCPP WebSocket endpoints allows unauthenticated attackers to hijack charging station identities and manipulate backend infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-27767

Affected Software: OCPP WebSocket Implementations

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from the lack of authentication mechanisms on WebSocket endpoints. Attackers can connect using a known charger ID and interact with the backend as a legitimate station without providing credentials.

Business Impact

Attackers can gain unauthorized control over charging infrastructure and corrupt the data reported to the backend. This can lead to financial loss, privilege escalation, and significant reputational damage. The CVSS score of 9.4 underscores the critical risk to charging network operators.

Remediation Plan

Immediate Action: Apply security updates to the OCPP backend to require authentication for all incoming WebSocket connections.

Proactive Monitoring: Audit backend logs for station IDs that connect from multiple locations or show unusual data patterns.

Compensating Controls: Deploy a secure proxy or gateway that requires authentication before forwarding traffic to the OCPP WebSocket endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, the lack of authentication is a fundamental security gap that is likely to be exploited.

Analyst Recommendation

Immediate action is required to secure the OCPP communication channel. Enforcing strong, per-device authentication is the only way to mitigate the risk of station impersonation and data corruption.

---METADATA---
VENDOR: SODOLA
PRODUCT: SL902-SWTGW124AS Firmware
AFFECTED_VERSIONS: Versions through 200.1.20
---END_METADATA---

Description Summary:
SODOLA SL902-SWTGW124AS firmware generates predictable MD5-based session identifiers, allowing attackers to forge authenticated sessions and bypass the login flow.

Executive Summary:
Predictable session identifier generation in SODOLA switches allows attackers to forge administrative cookies and bypass authentication entirely to gain unauthorized device access.

Vulnerability Details

CVE-ID: CVE-2026-27755

Affected Software: SODOLA SL902-SWTGW124AS Firmware

Affected Versions: Versions through 200.1.20

Vulnerability: The firmware uses a weak algorithm to generate session cookies based on predictable MD5 hashes. An attacker who can calculate these values can forge a valid session identifier and gain authenticated access without knowing the actual user password.

Business Impact

This vulnerability allows for an authentication bypass that grants full control over the network switch. With a CVSS score of 9.8, the business risk includes unauthorized network reconfiguration, traffic monitoring, and potential denial-of-service attacks against critical infrastructure.

Remediation Plan

Immediate Action: Update the device firmware to the latest version which includes a cryptographically secure random session generation mechanism.

Proactive Monitoring: Review device access logs for successful logins that do not correspond to known administrative activity or originate from anomalous sources.

Compensating Controls: Isolate the management interface behind a VPN or a secure jump host to prevent external actors from attempting to forge session cookies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. The predictable nature of MD5-based tokens makes this vulnerability a prime candidate for custom exploit development.

Analyst Recommendation

The use of weak session identifiers is a critical flaw in device security. It is imperative to update the firmware immediately to transition to secure session management and protect the integrity of the network environment.

---METADATA---
VENDOR: SODOLA
PRODUCT: SL902-SWTGW124AS Firmware
AFFECTED_VERSIONS: Versions through 200.1.20
---END_METADATA---

Description Summary:
SODOLA SL902-SWTGW124AS firmware contains hardcoded default credentials, allowing remote attackers to gain full administrative control over the device management interface.

Executive Summary:
The use of hardcoded default credentials in SODOLA firmware allows unauthenticated remote attackers to seize total administrative control of affected network switches.

Vulnerability Details

CVE-ID: CVE-2026-27751

Affected Software: SODOLA SL902-SWTGW124AS Firmware

Affected Versions: Versions through 200.1.20

Vulnerability: This is a default credentials vulnerability where the management interface is accessible using factory-set logins. An unauthenticated remote attacker can bypass security controls because the system does not enforce a password change upon initial setup.

Business Impact

An attacker gaining administrative access to a network switch can intercept traffic, redirect data, or disable network segments entirely. With a CVSS score of 9.8, this vulnerability represents a critical risk to network infrastructure security and data privacy, potentially leading to a complete breach of the internal network.

Remediation Plan

Immediate Action: Update the firmware to the latest version and immediately change all default administrative passwords to unique, complex strings.

Proactive Monitoring: Audit management logs for successful logins from unexpected IP addresses and monitor for unauthorized configuration changes.

Compensating Controls: Disable the web management interface on public-facing ports and restrict management access to a dedicated, isolated Management VLAN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. However, default credential vulnerabilities are frequently targeted by automated botnets and are trivial to exploit.

Analyst Recommendation

The presence of default credentials on network infrastructure is a critical security failure. Administrators must update the firmware and rotate all passwords immediately to prevent unauthorized remote management of the hardware.

---METADATA---
VENDOR: Avira
PRODUCT: Internet Security
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component, potentially allowing for arbitrary code execution.

Executive Summary:
A high-severity deserialization vulnerability in Avira Internet Security's System Speedup component could allow attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-27749

Affected Software: Avira Internet Security (System Speedup component)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability occurs when the System Speedup component deserializes data from an untrusted source without sufficient validation. An attacker could provide a specially crafted serialized object that, when processed, triggers the execution of malicious code with the privileges of the Avira service.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a significant risk to endpoint security. Successful exploitation could lead to full system compromise, allowing an attacker to bypass security software, install persistent malware, or exfiltrate sensitive data from the local machine.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Avira immediately. Ensure that the automatic update feature for Avira Internet Security is enabled and functioning correctly.

Proactive Monitoring: Monitor systems for unusual process creation originating from Avira service executables and review system logs for errors related to the System Speedup component.

Compensating Controls: Use endpoint detection and response (EDR) tools to identify and block suspicious behavior resulting from successful deserialization attacks, such as unexpected shell launches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation. Deserialization vulnerabilities in security software are particularly dangerous as they often run with high system privileges.

Analyst Recommendation

It is critical to apply the vendor-provided security patches immediately. Security software is a high-value target for local privilege escalation, and maintaining up-to-date versions is essential to ensuring the overall security posture of the organization's endpoints.

---METADATA---
VENDOR: Avira
PRODUCT: Internet Security
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Avira Internet Security's Software Updater component contains an improper link resolution vulnerability that could allow for unauthorized file manipulation or privilege escalation.

Executive Summary:
Avira Internet Security is vulnerable to a high-severity improper link resolution flaw within its Software Updater component, potentially allowing an attacker to escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-27748

Affected Software: Avira Internet Security

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves improper link resolution (such as a symlink attack) within the Software Updater component. An attacker with local access could exploit this flaw to redirect file operations to sensitive system locations, typically requiring local authentication to execute.

Business Impact

A successful exploit could lead to local privilege escalation, allowing a standard user to gain administrative rights on the host system. Given the CVSS score of 7.8, this represents a significant risk to the integrity of the endpoint, potentially leading to the installation of persistent malware or the disabling of security software. System downtime and the need for extensive forensic cleanup are primary concerns for affected organizations.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Avira to ensure the Software Updater component is patched against link resolution flaws.

Proactive Monitoring: Monitor system logs for unusual file system activities or unauthorized modifications to system directories originating from the Avira update service.

Compensating Controls: Implement strict principle of least privilege (PoLP) across all endpoints to limit the ability of local users to create symbolic links in sensitive directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its location within a privileged security service, the potential for exploitation remains high once technical details emerge.

Analyst Recommendation

The high CVSS score of 7.8 necessitates immediate attention from IT security teams. Organizations should prioritize the deployment of Avira’s latest patches to all managed endpoints to mitigate the risk of local privilege escalation. Ensuring that security software itself is not used as a vector for compromise is critical for maintaining a robust defense posture.