---METADATA---
VENDOR: Formwork
PRODUCT: Formwork CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Formwork, a flat file-based CMS, is susceptible to a high-severity vulnerability that could allow for unauthorized file access or system compromise.

Executive Summary:
A critical security flaw in the Formwork CMS could allow attackers to bypass security controls, potentially leading to unauthorized data access or site takeover.

Vulnerability Details

CVE-ID: CVE-2026-27198

Affected Software: Formwork

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: As a flat file-based CMS, Formwork relies on the file system for data storage. This vulnerability likely involves improper sanitization of file paths or administrative inputs, which could be exploited by an attacker to manipulate the CMS's internal files.

Business Impact

A compromise of the CMS can lead to the defacement of websites, theft of sensitive content, and the distribution of malware to site visitors. The CVSS score of 8.8 indicates a high level of risk to the integrity and confidentiality of any web presence powered by Formwork.

Remediation Plan

Immediate Action: Update the Formwork CMS installation to the latest version immediately to apply necessary security patches.

Proactive Monitoring: Review web server logs for unusual POST requests or attempts to access sensitive file paths (e.g., configuration files).

Compensating Controls: Apply strict file system permissions to the Formwork directory, ensuring the web server only has the minimum necessary write access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. CMS vulnerabilities are frequently targeted by automated scanners for large-scale exploitation.

Analyst Recommendation

Maintaining the security of web-facing content management systems is vital. We recommend an immediate audit of all Formwork installations and the application of the latest security updates to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry (SAML SSO)
AFFECTED_VERSIONS: 21.12.0 through 26.1.0
---END_METADATA---

Description Summary:
A critical flaw in Sentry's SAML SSO implementation allows account takeover via malicious Identity Providers in multi-organization or specifically configured self-hosted instances.

Executive Summary:
A critical vulnerability in Sentry's SAML implementation enables attackers to take over any user account by exploiting weaknesses in multi-organization SSO configurations.

Vulnerability Details

CVE-ID: CVE-2026-27197

Affected Software: Sentry

Affected Versions: 21.12.0 through 26.1.0

Vulnerability: The SAML SSO implementation fails to properly isolate organizations, allowing an attacker with a malicious SAML Identity Provider to impersonate users from another organization on the same instance. This requires the instance to have multiple organizations or specific SSO modification permissions enabled.

Business Impact

A successful account takeover gives attackers access to sensitive error logs, source code snippets, and performance data. Given the CVSS score of 9.1, this represents a high-impact risk to corporate intellectual property and security monitoring integrity.

Remediation Plan

Immediate Action: Update Sentry to version 26.2.0 immediately to resolve the SAML isolation flaw.

Proactive Monitoring: Audit SAML configuration changes and review login logs for unexpected authentication events originating from unfamiliar Identity Providers.

Compensating Controls: As a workaround, mandate individual user-based two-factor authentication (2FA), which prevents attackers from completing the login process even if the SAML bypass is successful.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 21, 2026, there is no public information indicating active exploitation. The vulnerability is most dangerous in multi-tenant environments or large self-hosted installations.

Analyst Recommendation

Updating to version 26.2.0 is the most effective way to mitigate this risk. Additionally, administrators should strongly encourage or enforce 2FA for all users, as it provides a critical second layer of defense against account takeover vulnerabilities like this one.

---METADATA---
VENDOR: Deno
PRODUCT: Deno Runtime
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Deno JavaScript and TypeScript runtime that could potentially allow for unauthorized code execution or system interference.

Executive Summary:
A high-severity vulnerability in the Deno runtime poses a significant risk to the security and stability of applications executing JavaScript or TypeScript code.

Vulnerability Details

CVE-ID: CVE-2026-27190

Affected Software: Deno

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the current disclosure, the flaw involves the core Deno runtime environment. The vulnerability likely impacts the boundary between the runtime and the host system, potentially requiring specific user-driven execution.

Business Impact

Compromise of a runtime environment like Deno can lead to arbitrary code execution, allowing attackers to bypass security sandboxes. With a CVSS score of 8.1, this vulnerability could result in significant data exfiltration or unauthorized access to the host server's resources and sensitive files.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Deno Land team immediately to ensure the runtime environment is secured.

Proactive Monitoring: Monitor application logs for unusual crashes or unexpected system calls originating from the Deno process.

Compensating Controls: Implement strict file system and network permission flags (e.g., --allow-net, --allow-read) to limit the potential impact of a runtime compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. Given the high CVSS score, security teams should treat this as a priority update for all Deno-based infrastructure.

Analyst Recommendation

The Deno runtime is often used in security-sensitive backend environments. It is critical that administrators identify all instances of Deno within their stack and apply the necessary updates immediately to mitigate the risk of remote or local exploitation.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via update URL poisoning, allowing an attacker to force the system to download and extract a malicious update package.

Executive Summary:
A critical supply chain vulnerability in MajorDoMo allows unauthenticated attackers to hijack the system update process and deploy webshells by poisoning the update URL.

Vulnerability Details

CVE-ID: CVE-2026-27180

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This unauthenticated RCE vulnerability exists in the saverestore module. An attacker can use a crafted request to change the system's update URL to a malicious server, then trigger a "force update" that downloads and extracts an unverified tarball containing arbitrary PHP files into the webroot.

Business Impact

This vulnerability is assigned a CVSS score of 9.8 due to the ease with which an attacker can achieve full system compromise. By poisoning the update mechanism, an attacker can gain persistent access through webshells, bypass all traditional security controls, and effectively own the entire MajorDoMo environment and its data.

Remediation Plan

Immediate Action: Update to the latest version of MajorDoMo, which includes improved authentication checks and secure update verification.

Proactive Monitoring: Monitor network traffic for outbound connections to unknown or suspicious update servers and check the webroot for newly created or modified PHP files.

Compensating Controls: Use egress filtering to restrict the server's ability to communicate with unauthorized external IP addresses and implement file integrity monitoring (FIM).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the multi-step nature of this exploit (poisoning then triggering) can be easily scripted, making it a high-risk flaw for any internet-facing instance.

Analyst Recommendation

The ability to redirect system updates to a malicious source is a severe architectural flaw. Organizations must apply the latest security updates immediately. Furthermore, ensure that the system is not exposed to the public internet without additional layers of authentication, such as a reverse proxy or VPN.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo is vulnerable to unauthenticated remote code execution via a race condition and unsanitized user input in the rc/index.php and cycle_execs.php components.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on MajorDoMo systems by exploiting a race condition in the command queuing mechanism, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27175

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves unauthenticated OS command injection where user input is interpolated into shell commands without sanitization. By exploiting a race condition between the web-accessible rc endpoint and the cycle_execs.php polling loop, an attacker can inject shell metacharacters that are executed with the permissions of the web server.

Business Impact

The impact of this vulnerability is critical, as reflected in its CVSS score of 9.8. Successful exploitation grants the attacker full remote code execution (RCE) without requiring any credentials. This can lead to the complete takeover of the host system, lateral movement within the network, and the deployment of ransomware or data exfiltration tools.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the MajorDoMo project immediately or disable web access to the rc/ directory and cycle_execs.php.

Proactive Monitoring: Inspect system logs for unusual shell command executions or suspicious activity originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block shell metacharacters (e.g., semicolons, backticks, pipes) in HTTP GET and POST requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit requires no authentication and targets a common home automation platform, the risk of rapid exploit development is extremely high.

Analyst Recommendation

This vulnerability represents a "worst-case" scenario for networked software: unauthenticated RCE. IT administrators must treat this as a top priority and apply updates immediately. Given the complexity of the race condition, manual sanitization is not recommended; a full vendor-supplied patch is the only reliable solution.

---METADATA---
VENDOR: MajorDoMo
PRODUCT: Major Domestic Module (MajorDoMo)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
MajorDoMo allows unauthenticated remote code execution via the admin panel's PHP console due to a logic error that bypasses authentication and passes input to the eval() function.

Executive Summary:
MajorDoMo systems are at risk of complete takeover due to a flaw that allows unauthenticated attackers to execute arbitrary PHP code through the administrative console feature.

Vulnerability Details

CVE-ID: CVE-2026-27174

Affected Software: MajorDoMo Major Domestic Module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A logic error in modules/panel.class.php fails to terminate execution after a redirect, allowing unauthenticated requests to reach an AJAX handler. This handler passes user-supplied GET parameters directly to the eval() function, facilitating unauthenticated remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a catastrophic risk to the confidentiality, integrity, and availability of the affected system. An attacker can execute arbitrary PHP code, which allows for database manipulation, file system access, and the ability to use the compromised host as a staging point for further internal network attacks.

Remediation Plan

Immediate Action: Update MajorDoMo to the latest version immediately to resolve the authentication bypass and remove the insecure use of the eval() function.

Proactive Monitoring: Review web server access logs for requests to /admin.php containing ajax_panel, op, and command parameters from unauthorized IP addresses.

Compensating Controls: Restrict access to the /admin.php endpoint using IP whitelisting or a VPN to prevent external exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of exploiting an eval()-based vulnerability makes it a highly attractive target for automated scanning and exploitation scripts.

Analyst Recommendation

The presence of an unauthenticated eval() sink is a critical security failure. Administrators should not wait for evidence of exploitation before acting. The primary remediation—applying the vendor patch—must be performed immediately to prevent unauthorized remote command execution.

---METADATA---
VENDOR: Kubernetes
PRODUCT: Apache Airflow CNCF Kubernetes provider
AFFECTED_VERSIONS: 0 up to (excluding) 10.17.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A sensitive information exposure vulnerability in the Apache Airflow CNCF Kubernetes provider allows users with read-only access to view worker JWT tokens.

Executive Summary:
Sensitive JWT tokens used by workers in Kubernetes Executors are exposed to users with read-only access to Pods, creating a risk of unauthorized privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-27173

Affected Software: Apache Airflow CNCF Kubernetes provider

Affected Versions: 0 up to (excluding) 10.17.0

Vulnerability: Sensitive JWT tokens are improperly stored or exposed within Kubernetes Pods, allowing authenticated users with limited read-only permissions to access credentials used by executors.

Business Impact

Exposure of JWT tokens allows an attacker to impersonate worker accounts, potentially gaining elevated access or executing unauthorized operations within the Airflow environment. With a CVSS score of 8.7, this vulnerability presents a high risk to the overall security and integrity of the orchestration platform.

Remediation Plan

Immediate Action: Update the apache-airflow-providers-cncf-kubernetes package to version 10.17.0 or later.

Proactive Monitoring: Audit Kubernetes RBAC policies and review access logs for accounts that have recently accessed Pod configurations to identify potential credential abuse.

Compensating Controls: Rotate all potentially exposed JWT tokens immediately following the update to ensure that any previously compromised credentials are invalidated.

Exploitation Status

Public Exploit Available: No — there is no confirmed public weaponized exploit available at this time.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

This vulnerability requires urgent attention, especially in multi-tenant or shared-access Kubernetes environments. Organizations should prioritize updating the affected provider package and rotating any sensitive tokens that may have been exposed to unauthorized users.

---METADATA---
VENDOR: SAIL
PRODUCT: SAIL Image Library
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SAIL image library contains a high-severity vulnerability that could lead to memory corruption or arbitrary code execution when processing malicious image files.

Executive Summary:
A vulnerability in the SAIL image library allows attackers to potentially execute code or crash applications by providing specially crafted image files.

Vulnerability Details

CVE-ID: CVE-2026-27168

Affected Software: SAIL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: SAIL is a library used for loading and saving various image formats. The vulnerability likely involves improper handling of metadata, ICC profiles, or animation frames, which can be triggered during the parsing of an untrusted image.

Business Impact

Applications using the SAIL library to process user-uploaded content are at high risk. A successful exploit could lead to full system compromise or a significant denial-of-service condition. The CVSS score of 8.8 reflects the high severity and the potential for remote exploitation through common web or desktop application workflows.

Remediation Plan

Immediate Action: Developers should update the SAIL library to the latest patched version and recompile any dependent applications.

Proactive Monitoring: Implement robust input validation and use sandboxed processes for image parsing to contain potential exploits.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and filter suspicious image uploads that may contain exploit payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. Image parsing vulnerabilities are common vectors for initial access and should be addressed with high priority.

Analyst Recommendation

Given the high CVSS score, organizations should immediately identify all applications utilizing the SAIL library. Ensuring these libraries are updated is essential to preventing remote code execution via malicious media files.

---METADATA---
VENDOR: Strimzi
PRODUCT: Strimzi Kafka Operator
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Strimzi deployment configuration for Apache Kafka on Kubernetes or OpenShift could allow for unauthorized access or cluster compromise.

Executive Summary:
A significant security flaw in Strimzi’s Kafka deployment framework on Kubernetes poses a critical risk to data streaming infrastructure and cluster security.

Vulnerability Details

CVE-ID: CVE-2026-27134

Affected Software: Strimzi (Apache Kafka on Kubernetes)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While the specific technical vector is not detailed in the summary, the high CVSS score of 8.1 in the context of Strimzi suggests a flaw in how Kafka clusters are orchestrated or secured within Kubernetes/OpenShift environments. This likely involves improper access control or insecure default configurations in the operator.

Business Impact

A successful exploit could lead to the unauthorized interception of data streams, disruption of critical messaging services, or full compromise of the Kubernetes namespace. Given that Kafka often handles sensitive real-time data, the business impact includes potential regulatory non-compliance and significant operational downtime. The CVSS score of 8.1 indicates a High-severity threat that requires immediate attention.

Remediation Plan

Immediate Action: Apply the latest security updates for the Strimzi operator and associated Kafka container images immediately.

Proactive Monitoring: Monitor Kubernetes audit logs for unauthorized changes to Custom Resource Definitions (CRDs) related to Kafka and review network policy logs for unexpected traffic patterns.

Compensating Controls: Enforce strict NetworkPolicies to isolate Kafka clusters and use Role-Based Access Control (RBAC) to limit who can modify Strimzi-managed resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of Kubernetes orchestration makes these types of vulnerabilities highly attractive targets for attackers seeking to compromise cloud-native infrastructure.

Analyst Recommendation

Security teams must prioritize the update of the Strimzi operator across all environments. Given the central role Kafka plays in modern data architectures, a compromise of this component could have cascading effects across the entire enterprise. Immediate patching is the only effective mitigation.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: 0.26.6 and below
---END_METADATA---

Description Summary:
Dokploy 0.26.6 and below contain an OS command injection vulnerability in the appName parameter, allowing authenticated attackers to execute arbitrary commands with server-level privileges.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows attackers to achieve server-level code execution, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27130

Affected Software: Dokploy

Affected Versions: 0.26.6 and below

Vulnerability: The application fails to properly sanitize the appName parameter before passing it to system shell commands, allowing an authenticated attacker to inject shell metacharacters.

Business Impact

The CVSS score of 9.9 reflects the high severity of this command injection. An authenticated attacker can escalate their access to full server control, potentially destroying the PaaS environment or gaining access to all hosted applications and their associated data.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.26.7 or later.

Proactive Monitoring: Review application logs for unexpected shell commands or character sequences in the appName field.

Compensating Controls: Implement strict input validation on the application creation interface and limit user access to sensitive administrative functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: Syarif Mobile
PRODUCT: Mobile App Editor
AFFECTED_VERSIONS: 0 through 1.3.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in the Mobile App Editor plugin allows authenticated users with administrative privileges to upload arbitrary files, potentially leading to remote code execution.

Executive Summary:
The Mobile App Editor plugin for WordPress is vulnerable to arbitrary file uploads, posing a critical risk of remote code execution for sites using versions 1.3.1 and earlier.

Vulnerability Details

CVE-ID: CVE-2026-27067

Affected Software: Syarif Mobile Mobile App Editor

Affected Versions: 0 through 1.3.1

Vulnerability: This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. It requires an attacker to have administrative-level privileges to interact with the vulnerable upload function.

Business Impact

Successful exploitation allows an attacker to upload a web shell to the server, resulting in full control over the affected web application. Given the CVSS score of 9.1, this represents a critical risk of total system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and uninstall the Mobile App Editor plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server and WordPress audit logs for unusual file creation events in the uploads directory, particularly files with executable extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and monitor for suspicious traffic patterns targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high severity is driven by the potential for complete system compromise if an attacker successfully authenticates with administrative access.

Analyst Recommendation

Given the critical nature of this vulnerability and the lack of an available security patch, immediate removal of the affected software is the only viable path to eliminate risk. Organizations should prioritize decommissioning the plugin to prevent potential malicious file execution and subsequent server takeover.

---METADATA---
VENDOR: ThimPress
PRODUCT: BuilderPress
AFFECTED_VERSIONS: n/a through 2.0.1
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
BuilderPress by ThimPress contains a PHP Local File Inclusion (LFI) vulnerability caused by improper control of filenames in include/require statements.

Executive Summary:
ThimPress BuilderPress versions through 2.0.1 are vulnerable to a critical Local File Inclusion flaw, permitting attackers to read sensitive system files or execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-27065

Affected Software: ThimPress BuilderPress

Affected Versions: n/a through 2.0.1

Vulnerability: The application exhibits improper control of filenames used in include or require statements, resulting in a PHP Local File Inclusion vulnerability that allows attackers to manipulate file paths.

Business Impact

This vulnerability, rated with a critical CVSS score of 9.8, allows an attacker to access sensitive information or execute malicious code on the server. The potential for full system compromise and unauthorized data access makes this an urgent priority for remediation to prevent complete breach of the application environment.

Remediation Plan

Immediate Action: Update the BuilderPress plugin to the latest version provided by ThimPress to fix the file inclusion logic.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences or attempts to access system files (e.g., /etc/passwd).

Compensating Controls: Configure the web server to restrict directory access and utilize a WAF to block requests containing directory traversal characters or suspicious file path patterns.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, LFI vulnerabilities are frequently targeted due to their high impact.

Analyst Recommendation

Given the critical nature of this LFI vulnerability, it is imperative that administrators update to the latest version of the BuilderPress plugin immediately. Failure to patch may result in unauthorized access to sensitive configuration files or remote code execution.

---METADATA---
VENDOR: Reputeinfosystems
PRODUCT: ARMember Premium
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A PHP Object Injection vulnerability in ARMember Premium allows authenticated contributors to execute arbitrary code.

Executive Summary:
A critical PHP Object Injection vulnerability in ARMember Premium poses a significant risk of remote code execution by authenticated contributors.

Vulnerability Details

CVE-ID: CVE-2026-27060

Affected Software: Reputeinfosystems ARMember Premium

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a PHP Object Injection flaw triggered by a contributor-level user. An attacker can manipulate serialized objects to execute arbitrary code or perform unauthorized actions within the WordPress environment.

Business Impact

The ability for a contributor to perform object injection could lead to a full site compromise, including unauthorized data access and potential server-side execution. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity, potentially leading to total system takeover.

Remediation Plan

Immediate Action: Update the ARMember Premium plugin to the latest version as recommended by Reputeinfosystems.

Proactive Monitoring: Inspect server logs for unusual PHP error patterns and monitor for unexpected file modifications or unauthorized user activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block malicious serialized object payloads directed at the web application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ARMember Premium must prioritize this update, as the vulnerability allows for privilege escalation and arbitrary code execution. Patching immediately is necessary to prevent unauthorized access and potential data exfiltration by malicious actors.

---METADATA---
VENDOR: WordPress
PRODUCT: Broadcast Live Video
AFFECTED_VERSIONS: < 7.1.3
---END_METADATA---

Description Summary:
An unauthenticated PHP object injection vulnerability in the Broadcast Live Video plugin for WordPress allows remote code execution.

Executive Summary:
A critical PHP object injection vulnerability in the Broadcast Live Video WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-27053

Affected Software: WordPress Broadcast Live Video

Affected Versions: < 7.1.3

Vulnerability: This vulnerability involves the insecure deserialization of user-supplied data. An unauthenticated attacker can inject a malicious PHP object, leading to remote code execution within the context of the web server.

Business Impact

With a 9.8 CVSS score, this is a Critical vulnerability. Code execution allows an attacker to gain full control over the web server, potentially compromising the entire hosting environment, stealing data, or utilizing the server as a node for further malicious activities.

Remediation Plan

Immediate Action: Update the Broadcast Live Video plugin to version 7.1.3 or later immediately.

Proactive Monitoring: Monitor for suspicious outbound network connections originating from the web server, which may indicate command-and-control communication.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out serialized PHP objects in HTTP requests, which can mitigate the risk of object injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

PHP object injection is a severe vulnerability that grants an attacker significant control. Organizations must prioritize the patch and consider resetting any credentials stored on the server, as they must be assumed compromised if the system was potentially exposed to this attack.

---METADATA---
VENDOR: TotalSuite
PRODUCT: Total Poll Lite
AFFECTED_VERSIONS: From n/a through 4.12.0
---END_METADATA---

Description Summary:
Total Poll Lite is vulnerable to Remote Code Inclusion (RCI) due to improper control of code generation. This affects versions up to and including 4.12.0.

Executive Summary:
The Total Poll Lite WordPress plugin contains a critical Remote Code Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-27044

Affected Software: Total Poll Lite (WordPress Plugin)

Affected Versions: From n/a through 4.12.0

Vulnerability: This is a Remote Code Inclusion (RCI) vulnerability caused by the improper control of code generation within the totalpoll-lite component. An unauthenticated attacker can manipulate the plugin to include and execute remote files or malicious code strings.

Business Impact

RCI vulnerabilities are among the most severe, as they provide a direct path to Remote Code Execution (RCE). An attacker can take full control of the web server, deface the website, or use the server as a jumping-off point for further internal network attacks. The CVSS score of 9.9 reflects a near-maximum severity level.

Remediation Plan

Immediate Action: Immediately update Total Poll Lite to a version newer than 4.12.0. If no patch is available, deactivate and remove the plugin until a fix is released.

Proactive Monitoring: Check for the presence of unauthorized PHP files in the WordPress uploads directory and review logs for requests fetching remote assets.

Compensating Controls: Use a WAF to block requests containing external URLs in parameters and disable allow_url_include in the PHP configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. However, RCI vulnerabilities are highly sought after by botnet operators for mass website compromise.

Analyst Recommendation

The critical nature of this vulnerability (CVSS 9.9) necessitates immediate action. Organizations must update or remove this plugin immediately. RCI allows for total system takeover, making this the highest priority for WordPress administrators in this batch.

---METADATA---
VENDOR: OCPP-compliant Charging Infrastructure
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Unauthenticated attackers can perform station impersonation and manipulate backend data due to a lack of proper authentication on OCPP WebSocket endpoints.

Executive Summary:
An unauthenticated attacker can exploit a lack of authentication in OCPP WebSocket endpoints to gain unauthorized control over charging infrastructure and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-27028

Affected Software: OCPP-compliant Charging Infrastructure

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists because WebSocket endpoints fail to validate the identity of connecting chargers. An unauthenticated attacker can bypass security controls by using a known charging station identifier to intercept or forge OCPP commands.

Business Impact

The potential for unauthorized manipulation of charging data and infrastructure control poses a severe threat to operational continuity. With a CVSS score of 9.4, this vulnerability could result in significant financial loss, data corruption within the charging network, and safety risks associated with unmanaged power equipment.

Remediation Plan

Immediate Action: Deploy the latest security updates from the vendor immediately to enforce robust authentication for all charging station connections.

Proactive Monitoring: Enable detailed logging for WebSocket handshakes and monitor for anomalies, such as multiple concurrent connections using the same station identifier.

Compensating Controls: Utilize a Web Application Firewall (WAF) capable of inspecting WebSocket traffic or implement mTLS (Mutual TLS) to ensure only authorized hardware can connect.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical details suggest that crafting an exploit would be straightforward for a motivated actor.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Organizations should prioritize patching all affected OCPP-compliant gateways and backend systems to prevent unauthorized station impersonation and protect the integrity of the charging network.

---METADATA---
VENDOR: OpenSTAManager
PRODUCT: OpenSTAManager
AFFECTED_VERSIONS: 2.9.8 and earlier
---END_METADATA---

Description Summary:
An authentication bypass in OpenSTAManager allows attackers to arbitrarily modify user groups, leading to full administrative privilege escalation.

Executive Summary:
A critical privilege escalation vulnerability in OpenSTAManager allows any attacker to promote themselves to the administrator group by directly accessing a vulnerable script.

Vulnerability Details

CVE-ID: CVE-2026-27012

Affected Software: OpenSTAManager

Affected Versions: 2.9.8 and earlier

Vulnerability: A flaw in modules/utenti/actions.php allows for authentication bypass and unauthorized group modification. An attacker can directly call this script to change the 'idgruppo' parameter of any user, effectively granting themselves administrative rights or demoting existing admins.

Business Impact

With a CVSS score of 9.8, the business impact is severe. An attacker can gain full access to invoicing, technical assistance records, and sensitive customer data. By demoting existing administrators, an attacker can also lock legitimate users out of the system, causing significant operational downtime.

Remediation Plan

Immediate Action: Update OpenSTAManager to a version newer than 2.9.8. If a patch is not immediately available, restrict access to the modules/utenti/ directory.

Proactive Monitoring: Audit the 'utenti' (users) table in the database for unauthorized changes to user groups and review web logs for direct requests to actions.php.

Compensating Controls: Use a Web Application Firewall (WAF) to block unauthorized direct access to PHP scripts in the modules directory that should require a valid session.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. The ability to bypass authentication to modify user roles is a highly critical flaw that is relatively easy to exploit once identified.

Analyst Recommendation

Immediate remediation is required to prevent unauthorized access to sensitive business management data. Administrators should verify the integrity of all administrative accounts after applying the update.

---METADATA---
VENDOR: Unknown
PRODUCT: Affected Software
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An authenticated file upload vulnerability allows attackers to upload and execute malicious files, leading to remote code execution on the server.

Executive Summary:
An authenticated remote code execution vulnerability exists due to improper file upload restrictions, allowing users to compromise the host server by executing malicious scripts.

Vulnerability Details

CVE-ID: CVE-2026-2701

Affected Software: Affected Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly validate the contents and extensions of uploaded files. An authenticated user can bypass existing checks to upload a malicious script (such as a web shell) and execute it, resulting in full Remote Code Execution (RCE).

Business Impact

While this exploit requires authentication, the impact is critical as it allows any user with upload privileges to escalate their access to the server level. This can lead to lateral movement within the network, data exfiltration, and the installation of persistent malware, justifying the CVSS score of 9.1.

Remediation Plan

Immediate Action: Update the affected software to the latest version and implement strict file-type validation (MIME-type and extension) for all upload fields.

Proactive Monitoring: Audit all recently uploaded files in the application's storage directories for suspicious scripts (.php, .asp, .exe) and review web server execution logs.

Compensating Controls: Configure the upload directory with "no-execute" permissions at the web server level and utilize an antivirus/malware scanner to inspect all incoming files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. Authenticated RCE is frequently used by disgruntled employees or attackers who have obtained legitimate credentials via phishing.

Analyst Recommendation

Organizations should immediately apply the available patch to secure the file upload mechanism. Furthermore, the principle of least privilege should be applied to ensure that only necessary users have file upload permissions, reducing the overall attack surface.

---METADATA---
VENDOR: OpenClaw
PRODUCT: tool sandbox
AFFECTED_VERSIONS: Prior to version 2026.2.15
---END_METADATA---

Description Summary:
OpenClaw's Docker tool sandbox is vulnerable to configuration injection, allowing dangerous Docker options that can lead to container escape and host data access.

Executive Summary:
A critical configuration injection vulnerability in OpenClaw's Docker sandbox enables attackers to escape container environments and access sensitive host system data.

Vulnerability Details

CVE-ID: CVE-2026-27002

Affected Software: Docker tool sandbox (OpenClaw)

Affected Versions: Prior to version 2026.2.15

Vulnerability: This issue involves the injection of dangerous Docker configuration options (such as bind mounts and host networking) into the sandbox environment. This allows an attacker to bypass container isolation, potentially achieving a full container escape or gaining unauthorized access to the host file system.

Business Impact

An exploit could lead to the total compromise of the host server supporting the AI assistant. Attackers could steal sensitive host data, escalate privileges, or move laterally within the network. The CVSS score of 9.8 underscores the critical risk to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.2.15 or later, which implements runtime enforcement and validation of Docker arguments.

Proactive Monitoring: Audit Docker logs for unauthorized container creations with network=host or unconfined profiles and monitor host file systems for unauthorized access.

Compensating Controls: As a workaround, ensure that sandbox configurations do not use system directory bind mounts, keep networking set to none or bridge, and enforce strict seccomp/AppArmor profiles.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation. The vendor has proactively released a patch and detailed workarounds to mitigate the risk.

Analyst Recommendation

Organizations using OpenClaw must prioritize the update to version 2026.2.15. In environments where immediate updates are not possible, the provided configuration workarounds should be applied manually to prevent the use of dangerous Docker options that facilitate container escapes.

---METADATA---
VENDOR: Citrix
PRODUCT: ShareFile Storage Zones Controller (SZC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Citrix ShareFile Storage Zones Controller (SZC) contains a flaw allowing unauthenticated attackers to access restricted configuration pages, leading to system changes and remote code execution.

Executive Summary:
Unauthenticated attackers can bypass access controls on Citrix ShareFile Storage Zones Controllers to modify system configurations and execute arbitrary code, posing a critical risk to data sovereignty.

Vulnerability Details

CVE-ID: CVE-2026-2699

Affected Software: Citrix ShareFile Storage Zones Controller (SZC)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability allows an unauthenticated remote attacker to bypass authorization checks and access restricted administrative configuration pages. By manipulating these settings, the attacker can achieve Remote Code Execution (RCE) on the SZC instance.

Business Impact

The ShareFile Storage Zones Controller is responsible for managing sensitive data storage; a compromise here allows an attacker to intercept, modify, or delete corporate data. With a CVSS score of 9.8, this vulnerability represents a near-total loss of security controls, potentially leading to significant regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor for the ShareFile Storage Zones Controller immediately to close the unauthorized access path.

Proactive Monitoring: Review web server logs for unauthorized hits to administrative URL paths (e.g., /config) originating from external or unexpected IP addresses.

Compensating Controls: Restrict access to the SZC management interface using IP whitelisting or a VPN, and ensure a Web Application Firewall (WAF) is configured to block unauthorized administrative requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, unauthenticated RCE vulnerabilities in edge-facing storage controllers are frequent targets for ransomware groups and state-sponsored actors.

Analyst Recommendation

Given that this vulnerability requires no authentication and can lead to full system takeover, it must be treated as a top-tier priority. Organizations should assume that any SZC exposed to the internet is at immediate risk and must apply the vendor-supplied patches without delay.

---METADATA---
VENDOR: LibreNMS
PRODUCT: LibreNMS
AFFECTED_VERSIONS: 25.12.0 and below
---END_METADATA---

Description Summary:
LibreNMS contains an SQL injection vulnerability in the ajax_table.php endpoint due to improper sanitization of IPv6 address parameters, allowing unauthorized database access.

Executive Summary:
A critical SQL injection vulnerability in LibreNMS allows attackers to execute arbitrary database commands and potentially compromise sensitive network monitoring data.

Vulnerability Details

CVE-ID: CVE-2026-26988

Affected Software: LibreNMS

Affected Versions: 25.12.0 and below

Vulnerability: The vulnerability exists within the ajax_table.php endpoint during the processing of IPv6 searches. The application fails to sanitize the "address" parameter, specifically concatenating the prefix portion directly into an SQL query string, allowing for unauthenticated or low-privileged SQL injection.

Business Impact

A successful SQL injection attack could result in the disclosure of sensitive network topology data, device credentials, and configuration information stored in the LibreNMS database. With a CVSS score of 9.1, this represents a high risk to the confidentiality and integrity of the organization’s network monitoring infrastructure.

Remediation Plan

Immediate Action: Update LibreNMS to version 26.2.0 or higher to apply the security fix for the ajax_table.php endpoint.

Proactive Monitoring: Review database query logs for unusual syntax or errors related to IPv6 address lookups and monitor for unauthorized data export attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block SQL injection patterns in AJAX requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation. However, SQL injection in a core monitoring tool is a high-value target for attackers looking to gain network intelligence.

Analyst Recommendation

The immediate application of the version 26.2.0 patch is critical. Because LibreNMS holds sensitive information about the entire network, any database compromise could serve as a stepping stone for wider corporate network infiltration.

---METADATA---
VENDOR: Ghost Foundation
PRODUCT: Ghost CMS
AFFECTED_VERSIONS: 3.24.0 through 6.19.0
---END_METADATA---

Description Summary:
Ghost CMS is vulnerable to unauthenticated arbitrary database reads, allowing attackers to extract sensitive information directly from the underlying database.

Executive Summary:
Ghost CMS versions 3.24.0 through 6.19.0 contain a critical vulnerability allowing unauthenticated attackers to perform arbitrary database reads, risking total data exposure.

Vulnerability Details

CVE-ID: CVE-2026-26980

Affected Software: Ghost CMS

Affected Versions: 3.24.0 through 6.19.0

Vulnerability: The vulnerability allows an unauthenticated attacker to bypass standard access controls to read arbitrary data from the database. This occurs due to insufficient input validation within the Node.js-based content management system's core logic.

Business Impact

The ability to read arbitrary database content poses a severe risk to confidentiality, potentially exposing user credentials, private posts, and configuration secrets. The CVSS score of 9.4 reflects the high impact on data integrity and confidentiality, which could lead to significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Administrators must upgrade Ghost CMS to version 6.19.1 or later to resolve the information disclosure flaw.

Proactive Monitoring: Inspect database access logs for unusual query patterns or high volumes of data requests originating from the CMS application layer.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious SQL-like injection patterns or unauthorized REST API requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation of this vulnerability. Given that the exploit is unauthenticated, the likelihood of automated scanning and exploitation is high.

Analyst Recommendation

This vulnerability grants unauthenticated access to the heart of the CMS data layer. Security teams should treat this as a high-priority incident and apply the version 6.19.1 update immediately to prevent unauthorized data exfiltration.