---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to version 10.0.7
---END_METADATA---

Description Summary:
An OS command injection vulnerability in OneUptime allows authenticated users to execute arbitrary commands on the Probe server via the monitor destination field.

Executive Summary:
Authenticated users can achieve full remote code execution on OneUptime Probe servers by exploiting a command injection vulnerability in the traceroute functionality.

Vulnerability Details

CVE-ID: CVE-2026-27728

Affected Software: OneUptime OneUptime

Affected Versions: Prior to version 10.0.7

Vulnerability: The vulnerability exists in the NetworkPathMonitor.performTraceroute() function, which fails to properly sanitize shell metacharacters in the destination field. This allows an authenticated project user to inject and execute arbitrary operating system commands on the underlying Probe server.

Business Impact

A successful exploit allows an attacker to take complete control of the Probe server, potentially using it as a pivot point to attack other internal network resources. This leads to a total loss of confidentiality, integrity, and availability for the affected monitoring infrastructure. The CVSS score of 9.9 reflects the critical risk of authenticated remote code execution.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.7 or later immediately to patch the command injection flaw.

Proactive Monitoring: Inspect Probe server logs for suspicious shell commands or unusual outbound network connections originating from the monitoring service.

Compensating Controls: Use containerization to isolate the Probe service and implement strict AppArmor or SELinux profiles to limit the commands the service can execute.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly mitigates the risk, but any compromised user account could be used to trigger the exploit.

Analyst Recommendation

Remote code execution vulnerabilities in monitoring tools are particularly dangerous as these tools often have broad network access. Immediate patching is required to secure the Probe servers and prevent lateral movement within the corporate network.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Cloud (SaaS)
AFFECTED_VERSIONS: Prior to version 3.30.4
---END_METADATA---

Description Summary:
Budibase Cloud suffers from an unsafe eval() vulnerability in its view filtering, allowing authenticated users to execute arbitrary JavaScript and access sensitive environment secrets.

Executive Summary:
An authenticated remote code execution vulnerability in Budibase Cloud allows users to compromise the server environment and extract highly sensitive administrative credentials.

Vulnerability Details

CVE-ID: CVE-2026-27702

Affected Software: Budibase Budibase Cloud (SaaS)

Affected Versions: Prior to version 3.30.4

Vulnerability: This flaw involves an unsafe eval() call within the inMemoryView.ts component where user-controlled input is processed without sanitization. Any authenticated user, including those on free tier accounts, can trigger this to execute arbitrary code with the privileges of the application service.

Business Impact

A successful exploit grants an attacker access to the pod's environment variables, which include critical secrets such as INTERNAL_API_KEY, JWT_SECRET, and AWS keys. This leads to total database compromise, the ability to enumerate all tenant databases, and unauthorized access to sensitive user records and email addresses. With a CVSS score of 9.9, this represents a critical risk to data confidentiality and platform integrity.

Remediation Plan

Immediate Action: Budibase Cloud users must ensure they are using version 3.30.4 or later; as this is a SaaS product, confirm with the vendor that the patch is applied.

Proactive Monitoring: Security teams should review access logs for unusual view filtering activity and rotate any credentials or API keys that may have been exposed in the environment.

Compensating Controls: Implement strict egress filtering on the application environment to prevent the exfiltration of environment variables to external attacker-controlled servers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the sensitivity of the exposed secrets, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, as it exposes the foundational secrets of the Budibase Cloud infrastructure. Organizations must verify that their instances are running the patched version and immediately rotate all administrative secrets to mitigate the risk of persistent access by a malicious actor.

---METADATA---
VENDOR: Hono
PRODUCT: Hono
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Hono web application framework is affected by a high-severity vulnerability that could impact any JavaScript runtime environment it supports.

Executive Summary:
A high-severity vulnerability in the Hono web framework poses a significant risk to applications deployed across various JavaScript runtimes, requiring urgent updates.

Vulnerability Details

CVE-ID: CVE-2026-27700

Affected Software: Hono Hono

Affected Versions: See vendor advisory for affected versions

Vulnerability: Hono is a web framework supporting multiple JavaScript runtimes. This vulnerability, carrying a CVSS score of 8.2, indicates a significant flaw in the framework's handling of web requests or runtime execution, though specific technical details are currently withheld by the vendor.

Business Impact

Applications built on the Hono framework may be susceptible to exploitation, leading to unauthorized data access or service disruption. Because Hono is runtime-agnostic, the vulnerability could manifest across diverse cloud and edge computing environments. The High severity rating reflects the potential for widespread impact across the framework's user base.

Remediation Plan

Immediate Action: Developers should update the Hono framework to the latest version in their project dependencies and redeploy affected applications.

Proactive Monitoring: Monitor application logs for anomalous request patterns or runtime errors that could indicate attempted exploitation of the framework.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming traffic and provide an additional layer of protection while updates are being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public exploit code provides a window for organizations to patch before widespread attacks occur.

Analyst Recommendation

The Hono framework is a critical component for many modern web applications. To maintain a strong security posture, it is essential to apply the latest security updates immediately and verify the integrity of application deployments.

---METADATA---
VENDOR: SAP
PRODUCT: Approuter
AFFECTED_VERSIONS: SAP Approuter node.js package < 20.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SAP Approuter is vulnerable to HTTP Request Smuggling, allowing unauthenticated attackers to desynchronize requests, leading to potential information disclosure and denial-of-service.

Executive Summary:
An unauthenticated HTTP request smuggling vulnerability in SAP Approuter poses a critical risk to data confidentiality and service availability.

Vulnerability Details

CVE-ID: CVE-2026-27690

Affected Software: SAP Approuter

Affected Versions: SAP Approuter node.js package < 20.10.0

Vulnerability: This vulnerability (CWE-444) stems from inconsistent interpretation of HTTP requests between the Approuter and downstream components, allowing an unauthenticated attacker to manipulate request processing.

Business Impact

Successful exploitation allows an attacker to intercept or corrupt user responses, leading to the exposure of sensitive session data or unauthorized content. Furthermore, the ability to trigger system unavailability directly threatens business continuity, justifying the 9.1 CVSS score.

Remediation Plan

Immediate Action: Update the SAP Approuter node.js package to version 20.10.0 or higher.

Proactive Monitoring: Review web server and application logs for malformed HTTP requests or unusual patterns of request-response desynchronization.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to normalize and inspect incoming HTTP traffic for non-compliant headers or smuggling patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires specific knowledge of the target's HTTP parsing behavior to weaponize effectively.

Analyst Recommendation

Given the critical severity of this vulnerability and the potential for unauthenticated remote exploitation, organizations must prioritize patching. Update all instances of the SAP Approuter node.js package to the latest version immediately to eliminate the underlying request parsing inconsistency.

---METADATA---
VENDOR: SAP
PRODUCT: NetWeaver Enterprise Portal
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
SAP NetWeaver Enterprise Portal is vulnerable to a critical deserialization flaw that allows privileged users to compromise the confidentiality, integrity, and availability of the host system.

Executive Summary:
Privileged users can compromise the SAP NetWeaver Enterprise Portal host system by uploading malicious content that triggers an unsafe deserialization process.

Vulnerability Details

CVE-ID: CVE-2026-27685

Affected Software: SAP NetWeaver Enterprise Portal

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the Administration interface where a privileged user can upload untrusted content. Upon deserialization by the system, this content can execute arbitrary code, leading to a high impact on the host system's security posture. This is an authenticated vulnerability requiring administrative or portal-management privileges.

Business Impact

With a CVSS score of 9.1, the impact is severe. A malicious insider or a compromised administrative account could gain full control over the SAP NetWeaver host. This jeopardizes sensitive corporate data, business processes, and the overall availability of the portal, potentially leading to significant financial and reputational damage.

Remediation Plan

Immediate Action: Apply the specific security patches detailed in the SAP vendor advisory for NetWeaver Enterprise Portal Administration.

Proactive Monitoring: Audit portal upload logs for unusual file types or content and monitor for unauthorized changes to system configurations or unexpected process activity.

Compensating Controls: Restrict administrative access to the SAP NetWeaver Portal to trusted networks and implement multi-factor authentication (MFA) to prevent account takeover.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation. Deserialization vulnerabilities are highly reliable for attackers once a payload is successfully delivered, making this a high-risk flaw.

Analyst Recommendation

SAP environments are critical to business operations. It is essential to apply the vendor-recommended patches immediately. Organizations should also enforce the principle of least privilege to ensure only necessary personnel have the ability to upload content to the portal.

---METADATA---
VENDOR: SAP
PRODUCT: Business Planning and Consolidation / Business Warehouse
AFFECTED_VERSIONS: HANABPC 810, BPC4HANA 300, SAP_BW 750, 752, 753, 754, 755, 756
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse allow authenticated users to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in SAP Business Planning and Consolidation and Business Warehouse allows authenticated attackers to manipulate, exfiltrate, or destroy sensitive database data.

Vulnerability Details

CVE-ID: CVE-2026-27681

Affected Software: SAP Business Planning and Consolidation, SAP Business Warehouse

Affected Versions: HANABPC 810, BPC4HANA 300, SAP_BW 750, 752, 753, 754, 755, 756

Vulnerability: This is an SQL injection vulnerability arising from insufficient authorization checks. An authenticated user can supply crafted SQL statements to the application to interact directly with the backend database.

Business Impact

The ability for an authenticated user to perform unauthorized SQL operations poses a major risk to the confidentiality, integrity, and availability of sensitive business data. With a CVSS score of 9.9, this vulnerability could allow an attacker to bypass business logic, escalate privileges, or completely wipe critical enterprise databases.

Remediation Plan

Immediate Action: Apply the relevant SAP Security Notes (referenced in SAP Note 3719353) to address the authorization and input validation gaps.

Proactive Monitoring: Audit database logs for unusual SQL queries, particularly those involving unexpected table modifications or mass data exports, initiated by standard user accounts.

Compensating Controls: Ensure that database service accounts operate with the principle of least privilege, restricting the ability of the application to execute destructive SQL commands.

Exploitation Status

Public Exploit Available: Unknown — there is no confirmed evidence of public exploits or weaponized code in the provided data.

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it allows direct database manipulation by authenticated actors.

Analyst Recommendation

SAP environments are critical to business operations, and this vulnerability represents a severe threat. Organizations must consult SAP Security Note 3719353 immediately and apply the necessary patches to protect against potential database compromise.

---METADATA---
VENDOR: SAP
PRODUCT: NetWeaver Application Server ABAP
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the SAP Kernel allows unauthenticated attackers to trigger crashes or execute code via crafted RFC requests.

Executive Summary:
A critical memory corruption flaw in the SAP Kernel enables unauthenticated remote attackers to compromise the confidentiality, integrity, and availability of SAP NetWeaver environments.

Vulnerability Details

CVE-ID: CVE-2026-27671

Affected Software: SAP NetWeaver Application Server ABAP (Kernel)

Affected Versions: See vendor advisory

Vulnerability: The vulnerability stems from improper RFC protocol validation within the SAP Kernel, allowing an unauthenticated attacker to inject crafted requests. These requests exploit logical errors in memory management, resulting in memory corruption.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk that could lead to full system compromise. Successful exploitation allows for remote code execution, which could result in the exfiltration of core business data, complete loss of system control, and prolonged service outages, severely impacting business continuity.

Remediation Plan

Immediate Action: Update the SAP Kernel to the latest version provided by the vendor to remediate the RFC protocol validation errors.

Proactive Monitoring: Monitor network traffic for malformed or suspicious RFC requests directed at the SAP Application Server.

Compensating Controls: Utilize a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) to filter and block non-standard or malformed RFC traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to trigger memory corruption makes this a high-priority threat. Organizations should treat this as a top-tier patching requirement and ensure all SAP Kernel components are updated to the latest secure versions immediately.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions prior to 1.25.5 contain an authorization flaw that permits unauthorized access to draft release data and attachments.

Executive Summary:
An authorization vulnerability in Gitea allows unauthenticated or unauthorized users to access sensitive draft release content and attachments.

Vulnerability Details

CVE-ID: CVE-2026-27660

Affected Software: Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: This vulnerability (CWE-284) stems from a failure to enforce correct access control checks when retrieving draft release information, allowing actors to bypass security requirements for sensitive project data.

Business Impact

This flaw may lead to the premature exposure of proprietary software releases, documentation, or internal attachments, potentially resulting in intellectual property leakage or the exposure of sensitive security information before a product is officially launched. With a CVSS score of 7.5, the vulnerability represents a substantial risk to the confidentiality of development project lifecycles.

Remediation Plan

Immediate Action: Update Gitea to version 1.25.5 or later to resolve the underlying access control bypass.

Proactive Monitoring: Monitor access logs for unauthorized requests directed at release-related endpoints, particularly those targeting draft or unreleased content.

Compensating Controls: Restrict public network access to the Gitea instance if possible, or employ a WAF to filter requests targeting release and attachment APIs.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user who can reach the release endpoints, regardless of their authentication status.

Analyst Recommendation

Administrators should treat this as a high-priority update to ensure that draft release information remains confidential. Immediate patching to version 1.25.5 is strongly recommended to prevent the unauthorized disclosure of sensitive project data.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions before 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 contain an authorization bypass vulnerability allowing an attacker to modify the primary email address of other users.

Executive Summary:
A critical authorization bypass vulnerability in Gitea Open Source Git Server allows unauthorized modification of user account information, posing a significant risk to account integrity.

Vulnerability Details

CVE-ID: CVE-2026-27657

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: Gitea versions before 1.25.5

Vulnerability: This vulnerability is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). It permits an unauthenticated attacker to manipulate the primary email settings of arbitrary users, effectively enabling account takeover vectors.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation could allow malicious actors to hijack user accounts by modifying primary email addresses, leading to unauthorized access to sensitive source code repositories and potentially facilitating further lateral movement within the development environment.

Remediation Plan

Immediate Action: Upgrade all Gitea instances to version 1.25.5 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Review audit logs for unusual account modifications, specifically looking for unexpected changes to user profile email addresses or suspicious administrative activity.

Compensating Controls: Implement strict network access controls to limit exposure of the Gitea interface to untrusted networks and utilize a Web Application Firewall (WAF) to block anomalous HTTP requests targeting profile management endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the vulnerability is automatable and requires no authentication, the potential for exploitation is significant.

Analyst Recommendation

Given the high impact of authorization bypass vulnerabilities in source control systems, administrators must prioritize the update to version 1.25.5. Organizations using Gitea should treat this as a high-priority maintenance task to prevent potential account takeovers and the resulting compromise of intellectual property.

---METADATA---
VENDOR: OpenHarmony
PRODUCT: OpenHarmony
AFFECTED_VERSIONS: v5.0.3 through v6.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
OpenHarmony v5.0.3 through v6.0 contains an out-of-bounds write vulnerability that could allow a low-privileged local or network-based attacker to cause system instability or execute code.

Executive Summary:
An out-of-bounds write vulnerability in OpenHarmony versions 5.0.3 through 6.0 poses a severe risk of system corruption or unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-27648

Affected Software: OpenHarmony OpenHarmony

Affected Versions: v5.0.3 through v6.0

Vulnerability: The software contains an out-of-bounds write vulnerability (CWE-787), which can be triggered by an attacker with low privileges. This flaw allows for memory corruption that may result in arbitrary code execution or denial of service.

Business Impact

With a CVSS score of 8.8, this vulnerability is highly dangerous as it permits an attacker to potentially gain elevated control over the underlying device or system. In enterprise environments, this could lead to the compromise of sensitive data or the total unavailability of critical OpenHarmony-based services.

Remediation Plan

Immediate Action: Review the official OpenHarmony security disclosures and apply the latest vendor-supplied patches or firmware updates as soon as they become available.

Proactive Monitoring: Monitor system logs for unusual crashes or service restarts that may indicate attempted exploitation of memory corruption vulnerabilities.

Compensating Controls: Limit the exposure of OpenHarmony services to untrusted networks and enforce strict least-privilege policies for all system users to minimize the potential attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Out-of-bounds write vulnerabilities are inherently complex and often serve as the foundation for sophisticated exploit chains.

Analyst Recommendation

Organizations utilizing OpenHarmony 5.0.3 through 6.0 should urgently monitor the vendor's security portal for a patch. Given the high CVSS score, any device running these versions should be treated as high-risk until the vulnerability is addressed.

---METADATA---
VENDOR: Flask-Reuploaded
PRODUCT: Flask-Reuploaded
AFFECTED_VERSIONS: Versions prior to 1.5.0
---END_METADATA---

Description Summary:
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows for arbitrary file writes and remote code execution (RCE) via Server-Side Template Injection (SSTI).

Executive Summary:
Attackers can bypass file upload restrictions in Flask-Reuploaded to write malicious files to the server, leading to full remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27641

Affected Software: Flask-Reuploaded

Affected Versions: Versions prior to 1.5.0

Vulnerability: The flaw involves a combination of path traversal and extension bypass. Attackers can manipulate the name parameter to write files to unintended locations. If these files are processed as templates, it leads to SSTI and subsequent RCE.

Business Impact

Successful exploitation allows an attacker to gain a persistent foothold on the server. By achieving RCE, they can steal application data, access backend databases, or use the server as a pivot point for further internal network attacks. The CVSS score of 9.8 reflects the high probability of total system compromise.

Remediation Plan

Immediate Action: Update Flask-Reuploaded to version 1.5.0. If an immediate update is not possible, ensure that user input is never passed to the name parameter and use auto-generated filenames.

Proactive Monitoring: Scan the application's upload directories for files with unexpected extensions or those containing template syntax (e.g., {{ ... }}).

Compensating Controls: Implement strict input validation for all upload parameters and run the application in a containerized environment with a read-only root filesystem where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, no active exploitation has been confirmed. However, file upload vulnerabilities are among the most commonly exploited vectors for gaining initial access to web servers.

Analyst Recommendation

The risk of RCE via SSTI makes this a critical priority for any Flask-based application using this library. We strongly recommend immediate migration to version 1.5.0 and the adoption of secure file-naming conventions to prevent similar path traversal issues in the future.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Versions prior to 1.8.206
---END_METADATA---

Description Summary:
A critical authentication bypass in FreeScout allows attackers to compute valid session tokens and take over any user account, including administrators, if the application key is exposed.

Executive Summary:
Predictable authentication tokens in FreeScout allow attackers to perform full account takeovers, potentially compromising all help desk communications and administrative controls.

Vulnerability Details

CVE-ID: CVE-2026-27637

Affected Software: FreeScout

Affected Versions: Versions prior to 1.8.206

Vulnerability: The TokenAuth middleware uses a predictable MD5 hash of the user ID, creation timestamp, and the APP_KEY. If an attacker obtains the APP_KEY, they can generate valid, non-expiring tokens for any user account without needing a password.

Business Impact

Full account takeover of an administrator allows an attacker to read all private communications, delete data, and modify system settings. The CVSS score of 9.8 indicates a critical risk, especially given how frequently Laravel APP_KEY values are accidentally exposed in logs or environment files.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.206. After upgrading, it is highly recommended to rotate the Laravel APP_KEY to invalidate any potentially compromised tokens.

Proactive Monitoring: Inspect logs for suspicious logins using API tokens and verify the security of the .env file and other configuration backups.

Compensating Controls: Ensure that environment files are not accessible via the web and implement multi-factor authentication (MFA) where supported to provide an additional layer of security.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no evidence of active exploitation. This vulnerability is often paired with CVE-2026-27636, making the update to 1.8.206 essential.

Analyst Recommendation

The reliance on a predictable hash for authentication is a severe architectural flaw. Organizations must update FreeScout immediately and treat their APP_KEY as a high-value secret that requires immediate rotation if exposure is suspected.

---METADATA---
VENDOR: OliveTin
PRODUCT: OliveTin
AFFECTED_VERSIONS: Versions up to and including 3000.10.0
---END_METADATA---

Description Summary:
OliveTin is vulnerable to unauthenticated remote code execution (RCE) via two vectors: shell argument injection and unsafe webhook processing.

Executive Summary:
OliveTin is susceptible to unauthenticated remote code execution, allowing attackers to take full control of the host system via malicious webhooks or shell command manipulation.

Vulnerability Details

CVE-ID: CVE-2026-27626

Affected Software: OliveTin

Affected Versions: Versions up to and including 3000.10.0

Vulnerability: Vector 1 involves a failure in checkShellArgumentSafety to block the password argument type, allowing authenticated RCE. Vector 2 allows unauthenticated RCE by bypassing type safety checks for JSON values extracted from webhooks before they reach sh -c.

Business Impact

This vulnerability allows for total system takeover. Since OliveTin is often used to manage server operations, an attacker could execute any command the OliveTin process is authorized to run. The CVSS score of 9.9 is justified by the ease of unauthenticated exploitation via the webhook vector.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should immediately disable the webhook feature or restrict access to the OliveTin web interface via firewall/VPN.

Proactive Monitoring: Review system logs for unauthorized shell command execution and monitor for suspicious incoming webhook requests from unknown sources.

Compensating Controls: Implement strict network-level access controls and consider using a proxy to sanitize incoming webhook payloads before they reach OliveTin.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no patched version. The default configuration of "authType: none" significantly increases the risk for any instance exposed to the network.

Analyst Recommendation

The lack of a current patch necessitates extreme caution. We recommend taking OliveTin instances offline or isolating them entirely from external networks until a security update is released. Prioritize securing the webhook ingest points as they represent the most dangerous unauthenticated entry path.

---METADATA---
VENDOR: Stirling-PDF
PRODUCT: Stirling-PDF
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Stirling-PDF, a locally hosted web application for PDF operations, is affected by a high-severity vulnerability that could lead to unauthorized data access.

Executive Summary:
A security vulnerability in Stirling-PDF could allow attackers to compromise PDF document security and gain unauthorized access to the hosting server.

Vulnerability Details

CVE-ID: CVE-2026-27625

Affected Software: Stirling-PDF

Affected Versions: See vendor advisory for affected versions

Vulnerability: Stirling-PDF contains a flaw in its web-based PDF processing logic. With a CVSS score of 8.1, the vulnerability likely involves a path traversal or remote code execution (RCE) vector, potentially allowing an attacker to interact with the underlying host system via specially crafted PDF files or web requests.

Business Impact

An exploit could result in the theft of sensitive documents processed by the application or the full compromise of the server hosting the Stirling-PDF instance. The high CVSS score of 8.1 indicates a significant risk to organizational data privacy and infrastructure security, especially if the application is exposed to the internet.

Remediation Plan

Immediate Action: Apply the latest security updates for Stirling-PDF immediately and restrict network access to the application to trusted users only.

Proactive Monitoring: Review application logs for unusual file upload patterns or unexpected system commands being executed by the web server user.

Compensating Controls: Deploy Stirling-PDF within an isolated network segment and use a Web Application Firewall (WAF) to filter malicious requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, PDF processing tools are frequent targets for exploitation due to the complexity of the PDF format.

Analyst Recommendation

Organizations using Stirling-PDF should apply the vendor-provided patch immediately. Given the high severity, it is also recommended to review the deployment architecture to ensure the application is properly firewalled and isolated from sensitive internal networks.

---METADATA---
VENDOR: Valkey
PRODUCT: Valkey
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security issue in the Valkey key-value database management system may lead to unauthorized exploitation of database functions or service disruption.

Executive Summary:
The Valkey distributed database faces a high-severity risk that could lead to unauthorized access or service disruption within key-value storage environments.

Vulnerability Details

CVE-ID: CVE-2026-27623

Affected Software: Valkey

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a secondary high-severity vulnerability identified in the Valkey distributed key-value database. It likely involves a different attack vector or functional component than previous entries, potentially allowing an attacker to manipulate the database state or crash the service.

Business Impact

The potential for unauthorized data manipulation or denial of service poses a significant threat to business continuity. With a CVSS score of 7.5, the impact is classified as High, as it could lead to the exposure of sensitive cached information or the failure of mission-critical applications that depend on the Valkey storage layer.

Remediation Plan

Immediate Action: Apply the recommended security patches from the Valkey project immediately to all production and staging environments.

Proactive Monitoring: Implement real-time alerting for database crashes and audit configuration changes to ensure no unauthorized modifications have occurred.

Compensating Controls: Restrict database access to trusted internal networks using firewalls and implement strong authentication mechanisms for all clients connecting to the Valkey cluster.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, the discovery of multiple vulnerabilities in a short period often attracts increased scrutiny from the research community and threat actors.

Analyst Recommendation

We strongly recommend an immediate audit of all Valkey installations to ensure they are running the latest secured versions. Given the High severity rating, this vulnerability should be treated as a priority for remediation to prevent potential data breaches or prolonged system downtime.

---METADATA---
VENDOR: Bugsink
PRODUCT: Bugsink
AFFECTED_VERSIONS: Versions prior to 2.0.13
---END_METADATA---

Description Summary:
An unauthenticated stored cross-site scripting (XSS) vulnerability in Bugsink allows attackers to execute arbitrary JavaScript in an administrator's browser, leading to account takeover.

Executive Summary:
Unauthenticated attackers can inject malicious scripts into Bugsink error logs, which execute when viewed by an administrator, potentially resulting in full administrative compromise.

Vulnerability Details

CVE-ID: CVE-2026-27614

Affected Software: Bugsink Error Tracking Tool

Affected Versions: Versions prior to 2.0.13

Vulnerability: The vulnerability is located in the _pygmentize_lines() function within theme/templatetags/issues.py. An unauthenticated attacker can submit a crafted event that triggers a raw input fallback, which is then passed to mark_safe() without sanitization, allowing for stored XSS.

Business Impact

A successful exploit allows an attacker to hijack administrative sessions, modify project settings, or access sensitive error data and source code snippets. The CVSS score of 9.3 reflects the critical nature of this vulnerability, as it requires no authentication to plant the payload and targets high-privilege users.

Remediation Plan

Immediate Action: Update Bugsink to version 2.0.13 immediately to ensure that all stacktrace outputs are properly sanitized before rendering.

Proactive Monitoring: Review web server and application logs for unusual DSN endpoint activity or suspicious JavaScript payloads within the event database.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter common XSS patterns and restrict access to the Bugsink web UI to known administrative IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no public information indicating active exploitation. The requirement for an administrator to view the specific event provides a small window for detection, but the unauthenticated nature of the injection makes it a high-risk flaw.

Analyst Recommendation

The ability for unauthenticated external actors to target internal administrators via standard error reporting protocols is a significant risk. We strongly recommend immediate deployment of version 2.0.13 and a thorough audit of existing stored events for any suspicious scripts.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: 0.5.4 through 0.7.9
---END_METADATA---

Description Summary:
An authorization bypass in the FOSSBilling API allows unauthenticated attackers to invoke administrative system functions by accessing restricted endpoints.

Executive Summary:
FOSSBilling contains a critical authentication bypass vulnerability that permits unauthenticated attackers to execute administrative API methods, risking full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27604

Affected Software: FOSSBilling FOSSBilling

Affected Versions: 0.5.4 through 0.7.9

Vulnerability: An authorization flaw in the API role handling logic fails to enforce proper credentials for /api/system/* endpoints. This allows an unauthenticated user to assume the identity of the cron administrator and execute sensitive system-level commands.

Business Impact

With a CVSS score of 10.0, this vulnerability allows for total unauthorized control over the billing and client management system. Attackers could exfiltrate sensitive client data, modify billing records, or gain persistent access to the server, leading to severe reputational and financial damage.

Remediation Plan

Immediate Action: Upgrade to FOSSBilling version 0.8.0 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Review API access logs for any requests directed at /api/system/* originating from untrusted sources and treat such activity as a potential security incident.

Compensating Controls: Block external access to /api/system/* endpoints at the reverse proxy or WAF level and restrict API access to known, trusted source IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw allows for trivial exploitation, elevating the overall risk.

Analyst Recommendation

Immediate remediation is required to secure the FOSSBilling environment. Beyond updating the software, administrators should rotate all API tokens and invalidate existing sessions to ensure that any potential unauthorized access that occurred prior to patching is terminated.

---METADATA---
VENDOR: Enclave
PRODUCT: enclave-vm
AFFECTED_VERSIONS: Versions prior to 2.11.1
---END_METADATA---

Description Summary:
A security boundary escape vulnerability in the Enclave JavaScript sandbox core allows attackers to bypass restrictions and achieve remote code execution (RCE).

Executive Summary:
A critical vulnerability in Enclave allows for a complete escape of the JavaScript sandbox, enabling unauthorized remote code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-27597

Affected Software: Enclave enclave-vm

Affected Versions: Versions prior to 2.11.1

Vulnerability: This flaw exists within the @enclave-vm/core component, where insufficient isolation allows code to break out of the intended sandbox environment. An attacker capable of submitting code for execution can leverage this escape to execute arbitrary commands with the privileges of the sandbox process.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as the primary security control of the product—the sandbox—is rendered ineffective. Given the CVSS score of 10.0, this represents the highest possible risk, potentially leading to total loss of confidentiality, integrity, and availability of the host infrastructure and sensitive AI agent data.

Remediation Plan

Immediate Action: Administrators must upgrade the Enclave environment to version 2.11.1 or later immediately to restore sandbox integrity.

Proactive Monitoring: Implement strict logging of sandbox execution attempts and monitor for unusual system calls or outbound network connections originating from the sandbox process.

Compensating Controls: Restrict the permissions of the user account running the Enclave process to the absolute minimum required to limit the impact of a potential escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of sandbox escapes in AI execution environments, the potential for targeted exploitation is extremely high.

Analyst Recommendation

This vulnerability represents a total failure of the product's primary security function. Organizations utilizing Enclave for AI agent execution must prioritize the application of the version 2.11.1 patch immediately. Failure to do so leaves the underlying infrastructure exposed to complete remote takeover.

---METADATA---
VENDOR: Statamic
PRODUCT: Statamic CMS
AFFECTED_VERSIONS: Prior to versions 6.3.3 and 5.73.10
---END_METADATA---

Description Summary:
Statamic CMS contains a flaw in its password reset feature that allows attackers to capture reset tokens. By knowing a user's email, an attacker can hijack the reset process and take over accounts.

Executive Summary:
Statamic CMS is vulnerable to a critical account takeover flaw where attackers can intercept password reset tokens to gain unauthorized access to valid user accounts.

Vulnerability Details

CVE-ID: CVE-2026-27593

Affected Software: Statamic CMS

Affected Versions: Prior to versions 6.3.3 and 5.73.10

Vulnerability: The vulnerability exists in the password reset logic, allowing an unauthenticated attacker to capture a user's reset token. While the attack requires the attacker to know a target's email address and involves some user interaction, the technical flaw allows for a complete bypass of the intended authentication security.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a significant risk to data integrity and confidentiality. Unauthorized access to a CMS can lead to website defacement, the injection of malicious scripts (Magecart-style attacks), or the theft of sensitive customer data. For organizations relying on Statamic for business operations, this could result in severe reputational damage.

Remediation Plan

Immediate Action: Update Statamic CMS to version 6.3.3 or 5.73.10 (depending on your major version branch) immediately to resolve the token capture flaw.

Proactive Monitoring: Audit user account logs for unexpected password changes or logins from unfamiliar geographic locations, especially following password reset requests.

Compensating Controls: Implement multi-factor authentication (MFA) for all CMS users, which would prevent account takeover even if a password is reset by an attacker.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation. The requirement for a user to click a link increases the complexity slightly, but the high CVSS score reflects the ease of token capture once initiated.

Analyst Recommendation

Account takeover vulnerabilities in web-facing applications are prime targets for automated attacks. We recommend that administrators apply the relevant security patches immediately. Furthermore, educating users to be wary of unsolicited password reset emails is a critical supplementary defense against this specific exploit vector.

---METADATA---
VENDOR: Winter
PRODUCT: Winter CMS
AFFECTED_VERSIONS: Prior to 1.0.477, 1.1.12, and 1.2.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Winter CMS is vulnerable to privilege escalation where authenticated backend users can modify their roles and permissions via specially crafted requests.

Executive Summary:
A privilege escalation vulnerability in Winter CMS versions prior to 1.0.477, 1.1.12, and 1.2.12 allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-27591

Affected Software: Winter, Winter CMS

Affected Versions: Prior to 1.0.477, 1.1.12, and 1.2.12

Vulnerability: The CMS fails to properly validate role and permission changes for authenticated backend users. An attacker with existing low-level access can escalate their privileges by submitting crafted requests to the backend.

Business Impact

A CVSS score of 9.9 indicates an extreme risk, as it allows for trivial escalation to full administrative control. This could lead to total data exposure, content modification, and full system takeover, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Upgrade to Winter CMS version 1.0.477, 1.1.12, or 1.2.12, depending on your current release branch.

Proactive Monitoring: Audit backend access logs for unusual account modifications or unauthorized permission changes.

Compensating Controls: Implement strict role-based access control (RBAC) and restrict backend access to trusted internal IP addresses using a WAF or VPN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents an critical risk for CMS integrity. All administrators should verify their current version of Winter CMS and apply the necessary updates immediately to prevent unauthorized privilege escalation.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: 9.5.13 and below
---END_METADATA---

Description Summary:
A sandbox escape in OneUptime allows users with low privileges or anonymous access to execute arbitrary code and gain full access to cluster credentials and environment variables.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows unauthenticated or low-privileged users to achieve full cluster compromise and steal sensitive infrastructure credentials within seconds.

Vulnerability Details

CVE-ID: CVE-2026-27574

Affected Software: OneUptime

Affected Versions: 9.5.13 and below

Vulnerability: This vulnerability stems from the use of the insecure node:vm module for custom JavaScript monitoring, which permits a trivial sandbox escape. Exploitation is possible by unauthenticated users if open registration is enabled, or by users with the "ProjectMember" role.

Business Impact

A successful exploit grants an attacker full access to the underlying process and host networking. This results in the immediate exposure of critical secrets, including ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, and CLICKHOUSE_PASSWORD. Given the CVSS score of 9.9, this represents a total loss of confidentiality, integrity, and availability for the entire monitoring cluster.

Remediation Plan

Immediate Action: Administrators must upgrade OneUptime to version 10.0.5 or later immediately to resolve the insecure code execution path.

Proactive Monitoring: Review system environment logs and audit project member activity for any unauthorized custom JavaScript monitors created prior to patching.

Compensating Controls: Disable open registration and restrict the "ProjectMember" role's ability to create custom monitors until the environment is fully patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the trivial nature of the sandbox escape and the high-value credentials at risk, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path from low-privileged access to full infrastructure control. Organizations using OneUptime must prioritize the update to version 10.0.5 immediately to prevent catastrophic data breaches and system takeover.

---METADATA---
VENDOR: QuarkA
PRODUCT: QA Analytics
AFFECTED_VERSIONS: n/a through 5.2.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
QuarkA QA Analytics plugin for WordPress contains an unauthenticated remote code execution vulnerability due to improper control of code generation.

Executive Summary:
An unauthenticated remote code execution vulnerability in the QuarkA QA Analytics plugin poses a critical risk to WordPress environments by allowing total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27544

Affected Software: QuarkA QA Analytics

Affected Versions: n/a through 5.2.0.0

Vulnerability: This vulnerability is a code injection flaw (CWE-94) that allows unauthenticated remote attackers to execute arbitrary code on the underlying server. Because the plugin fails to perform necessary input validation or capability checks, any remote user can trigger the execution of malicious code.

Business Impact

The potential for unauthenticated remote code execution represents a total system impact. An attacker could gain full control over the web server, leading to unauthorized data exfiltration, site defacement, or the deployment of persistent backdoors. Given the CVSS score of 10.0, this vulnerability is classified as critical, necessitating immediate remediation to prevent complete service disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: Update the WordPress QA Analytics plugin to version 5.2.0.1 or the latest available version immediately.

Proactive Monitoring: Review web server access logs for unusual POST requests directed at plugin files or suspicious code execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common code injection payloads and unauthorized access attempts to plugin directories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication requirements and the ability to achieve total system impact.

Analyst Recommendation

This vulnerability is highly critical and requires immediate attention. Administrators must prioritize updating the QA Analytics plugin to the patched version, as the lack of authentication makes this an easily automatable target for attackers. Failure to patch will leave the entire server environment exposed to full remote compromise.

---METADATA---
VENDOR: Rymera Web Co Pty Ltd
PRODUCT: Woocommerce Wholesale Lead Capture
AFFECTED_VERSIONS: n/a through 2.0.3.1
---END_METADATA---

Description Summary:
The Woocommerce Wholesale Lead Capture plugin is vulnerable to incorrect privilege assignment, which allows attackers to escalate their privileges within the WordPress environment.

Executive Summary:
A critical privilege escalation vulnerability in the Woocommerce Wholesale Lead Capture plugin allows users to gain unauthorized elevated permissions, potentially compromising the entire WordPress site.

Vulnerability Details

CVE-ID: CVE-2026-27542

Affected Software: Rymera Web Co Pty Ltd Woocommerce Wholesale Lead Capture

Affected Versions: n/a through 2.0.3.1

Vulnerability: The plugin contains an "Incorrect Privilege Assignment" flaw. This typically occurs when a plugin fails to properly validate user roles during registration or profile updates, allowing a standard user to assign themselves administrative or other high-level privileges.

Business Impact

Successful exploitation allows an attacker to take full control of the WordPress site, leading to data breaches, site defacement, or the installation of malware. The CVSS score of 9.8 reflects the extreme severity of allowing an unprivileged user to become an administrator, resulting in a total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Woocommerce Wholesale Lead Capture plugin to version 2.0.3.2 or the latest version available from the vendor.

Proactive Monitoring: Audit WordPress user accounts for any unauthorized changes to user roles, particularly new administrator accounts created through the wholesale lead capture forms.

Compensating Controls: Implement a "Least Privilege" model and use security plugins that alert on any changes to the administrator user group.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. Given the high impact of privilege escalation, this vulnerability is likely to be targeted by attackers once the update is publicized.

Analyst Recommendation

This vulnerability poses a critical threat to site integrity. Organizations must apply the latest security updates for the Woocommerce Wholesale Lead Capture plugin immediately to prevent unauthorized users from gaining administrative control.

---METADATA---
VENDOR: Rymera Web Co Pty Ltd
PRODUCT: Woocommerce Wholesale Lead Capture
AFFECTED_VERSIONS: n/a through 2.0.3.1
---END_METADATA---

Description Summary:
The Woocommerce Wholesale Lead Capture plugin allows for the unrestricted upload of files with dangerous types, enabling attackers to upload and execute malicious files on the server.

Executive Summary:
A critical file upload vulnerability in the Woocommerce Wholesale Lead Capture plugin allows attackers to upload web shells and execute arbitrary code on the WordPress server.

Vulnerability Details

CVE-ID: CVE-2026-27540

Affected Software: Rymera Web Co Pty Ltd Woocommerce Wholesale Lead Capture

Affected Versions: n/a through 2.0.3.1

Vulnerability: The plugin fails to restrict the types of files uploaded through its lead capture forms. This allows an attacker to upload files with dangerous extensions (such as .php), which can then be accessed via the web to execute arbitrary code (RCE).

Business Impact

With a CVSS score of 9.0, this vulnerability poses a severe threat. Successful exploitation results in a full site compromise, allowing attackers to steal customer data, modify site content, or use the server for malicious purposes. This leads to significant reputational damage and potential financial loss.

Remediation Plan

Immediate Action: Update the Woocommerce Wholesale Lead Capture plugin to the latest version (2.0.3.2 or later). Ensure that the upload directory is configured to prevent the execution of scripts.

Proactive Monitoring: Review the plugin's upload directory for any suspicious files, particularly those with .php, .html, or .js extensions that do not correspond to legitimate user data.

Compensating Controls: Use a Web Application Firewall (WAF) to block the upload of executable file types and implement server-side restrictions that prevent script execution in public upload folders.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 19, 2026, there is no public evidence of active exploitation. Unrestricted file upload is a common and high-impact vulnerability that is frequently targeted by automated scanners.

Analyst Recommendation

Organizations must prioritize this update. The ability to upload and execute files is a direct path to server compromise. Immediate patching and the implementation of strict file upload controls are essential to secure the environment.