---METADATA---
VENDOR: newbee-mall
PRODUCT: newbee-mall
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The newbee-mall application utilizes pre-seeded administrator accounts with predictable default passwords, allowing unauthenticated attackers to gain full administrative control upon deployment.

Executive Summary:
The presence of hardcoded, predictable administrative credentials in newbee-mall poses a critical risk, potentially allowing unauthenticated attackers to seize complete control of the application.

Vulnerability Details

CVE-ID: CVE-2026-26218

Affected Software: newbee-mall

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the use of hardcoded, pre-seeded administrator accounts within the database initialization script. Unauthenticated attackers can leverage these predictable default credentials to bypass security controls and access the administrative interface.

Business Impact

A successful exploit grants an attacker full administrative privileges, leading to a total compromise of the application's integrity, confidentiality, and availability. With a CVSS score of 9.8, the impact is categorized as Critical, potentially resulting in the theft of customer data, financial fraud, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Change all default administrative passwords immediately and remove any unnecessary pre-seeded accounts from the database.

Proactive Monitoring: Monitor authentication logs for successful logins to administrative accounts from unrecognized IP addresses or at unusual times.

Compensating Controls: Implement multi-factor authentication (MFA) for all administrative accounts and restrict access to the admin panel to trusted network ranges via an IP allowlist.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the credentials are predictable and included in public scripts, the potential for exploitation is extremely high.

Analyst Recommendation

The reliance on default credentials is a severe security oversight that must be addressed immediately. It is highly recommended that administrators audit their database initialization processes to ensure all default accounts are secured or disabled before the application is exposed to any network.

---METADATA---
VENDOR: Crawl4AI
PRODUCT: Docker API deployment
AFFECTED_VERSIONS: Versions prior to 0.8.0
---END_METADATA---

Description Summary:
Crawl4AI versions prior to 0.8.0 allow unauthenticated remote code execution via the /crawl endpoint by exploiting the hooks parameter to import arbitrary Python modules.

Executive Summary:
An unauthenticated remote code execution vulnerability in Crawl4AI's Docker API allows attackers to achieve full server compromise, including data exfiltration and lateral movement.

Vulnerability Details

CVE-ID: CVE-2026-26216

Affected Software: Crawl4AI

Affected Versions: Versions prior to 0.8.0

Vulnerability: The /crawl endpoint accepts a hooks parameter containing Python code executed via exec(). Because the __import__ builtin was not restricted, unauthenticated attackers can import arbitrary modules and execute system commands on the host.

Business Impact

This vulnerability carries a CVSS score of 10, the highest possible severity. Successful exploitation allows for complete system takeover, sensitive data theft, and the ability for attackers to pivot into internal networks, resulting in catastrophic operational and financial damage.

Remediation Plan

Immediate Action: Update the Crawl4AI Docker API deployment to version 0.8.0 or later immediately to remove the vulnerable code execution path.

Proactive Monitoring: Review API logs for requests to the /crawl endpoint that include suspicious Python code or attempts to use the hooks parameter.

Compensating Controls: Place the Docker API behind a Web Application Firewall (WAF) with rules designed to block Python-style injection and restrict API access to authenticated users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation. However, the technical nature of the flaw makes it trivial to exploit once the endpoint is identified.

Analyst Recommendation

A CVSS 10.0 vulnerability requires immediate, out-of-band patching. Organizations must ensure that no Crawl4AI instances are exposed to the public internet without authentication and that all instances are updated to version 0.8.0 or higher.

---METADATA---
VENDOR: KTransformers
PRODUCT: KTransformers
AFFECTED_VERSIONS: 0 through 0.5.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
KTransformers versions 0 through 0.5.3 are vulnerable to unsafe deserialization via the balance_serve backend mode, allowing unauthenticated remote code execution.

Executive Summary:
A critical unsafe deserialization vulnerability in KTransformers allows unauthenticated attackers to achieve remote code execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-26210

Affected Software: KTransformers

Affected Versions: 0 through 0.5.3

Vulnerability: The application binds a ZMQ ROUTER socket to all interfaces without authentication and uses pickle.loads() to process incoming messages, which is an unsafe deserialization practice.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to any environment running KTransformers. An attacker can execute arbitrary code with the privileges of the service, potentially leading to full server compromise, data exfiltration, or the deployment of persistent malware.

Remediation Plan

Immediate Action: Upgrade to the latest version of KTransformers immediately. If an update is not available, cease use of the 'balance_serve' feature or isolate the service from all untrusted networks.

Proactive Monitoring: Inspect network traffic for unauthorized connections to the ZMQ socket port and monitor server process behavior for anomalous activity.

Compensating Controls: Implement strict network segmentation to ensure the ZMQ socket is not exposed to the public internet or untrusted internal segments.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The use of pickle for deserializing untrusted data is a high-risk practice that should be avoided entirely.

Analyst Recommendation

This vulnerability is highly critical due to the ease of exploitation. Security teams must ensure that instances of KTransformers are not exposed to the internet and should prioritize upgrading to a version that replaces unsafe deserialization methods.

---METADATA---
VENDOR: ADB Explorer
PRODUCT: ADB Explorer
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
ADB Explorer, a fluent UI for ADB on Windows, contains a high-severity vulnerability that could lead to unauthorized system access or data manipulation.

Executive Summary:
ADB Explorer for Windows is affected by a high-severity vulnerability that could allow for unauthorized access to connected devices or the host system.

Vulnerability Details

CVE-ID: CVE-2026-26208

Affected Software: ADB Explorer

Affected Versions: See vendor advisory for affected versions

Vulnerability: The specific nature of this vulnerability is currently undisclosed, but the CVSS score of 7.8 indicates a high-risk security flaw. Given the application's function, it likely involves insecure handling of ADB commands or local privilege escalation.

Business Impact

A successful exploit could allow an attacker to gain unauthorized access to Android devices connected to the Windows host or potentially escalate privileges on the host machine itself. This poses a risk to sensitive data stored on mobile devices and the security of the developer workstation.

Remediation Plan

Immediate Action: Update ADB Explorer to the most recent version available and limit the use of the tool to trusted administrative users.

Proactive Monitoring: Monitor for unusual ADB traffic or unauthorized attempts to access the ADB daemon on Windows workstations.

Compensating Controls: Ensure that "USB Debugging" is disabled on mobile devices when not actively in use to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, no active exploitation has been reported. Users should remain vigilant and apply updates as they become available from the project maintainers.

Analyst Recommendation

Due to the high severity score, users of ADB Explorer should prioritize updating the software. Until a patch is confirmed, exercise caution when connecting devices to workstations running this software.

---METADATA---
VENDOR: Ormar
PRODUCT: Ormar ORM
AFFECTED_VERSIONS: 0.9.9 through 0.22.0
---END_METADATA---

Description Summary:
Ormar ORM aggregate queries lack sanitization in min() and max() methods, allowing unauthenticated attackers to inject raw SQL and extract entire database contents via subqueries.

Executive Summary:
A critical SQL injection vulnerability in the Ormar ORM for Python allows unauthenticated attackers to exfiltrate sensitive database contents by manipulating aggregate query parameters.

Vulnerability Details

CVE-ID: CVE-2026-26198

Affected Software: Ormar ORM

Affected Versions: 0.9.9 through 0.22.0

Vulnerability: This SQL injection flaw occurs because user-supplied column names are passed directly into sqlalchemy.text() without validation. An unauthenticated attacker can exploit the min() and max() methods to embed raw SQL subqueries into aggregate function calls.

Business Impact

Successful exploitation allows an unauthorized actor to read the entire database, including tables completely unrelated to the application's models. Given the CVSS score of 9.8, this represents a near-total loss of data confidentiality and could lead to significant regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Administrators must upgrade the Ormar package to version 0.23.0 or later immediately to resolve the unsanitized SQL construction.

Proactive Monitoring: Review database logs for unusual subqueries within aggregate functions and monitor for unexpected data egress patterns.

Compensating Controls: Implement strict input validation at the application layer to ensure only known-good column names are passed to aggregate methods.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of injecting SQL via standard ORM methods, the potential for exploitation is extremely high for any application exposing these aggregate functions to user input.

Analyst Recommendation

This vulnerability is categorized as Critical due to the lack of authentication required and the high impact on data confidentiality. Organizations using affected versions of Ormar must prioritize the update to version 0.23.0 to mitigate the risk of full database compromise.

---METADATA---
VENDOR: Milvus
PRODUCT: Milvus Vector Database
AFFECTED_VERSIONS: Prior to 2.5.27 and 2.6.10
---END_METADATA---

Description Summary:
Milvus vector database contains multiple authentication bypass vulnerabilities via exposed TCP ports and unauthenticated REST API endpoints, allowing full data manipulation and credential access.

Executive Summary:
Milvus vector database is subject to a critical authentication bypass that allows unauthenticated attackers to perform arbitrary business operations, including data manipulation and credential theft.

Vulnerability Details

CVE-ID: CVE-2026-26190

Affected Software: Milvus Vector Database

Affected Versions: Prior to 2.5.27 and 2.6.10

Vulnerability: This critical flaw stems from the default exposure of TCP port 9091 and an unauthenticated REST API. Unauthenticated attackers can exploit a predictable debug token or access the management port to evaluate arbitrary expressions and perform unauthorized data operations.

Business Impact

A successful exploit grants an attacker full control over the vector database, which is often the backbone of generative AI applications. This can result in the total loss of data integrity, unauthorized access to sensitive proprietary information, and the potential compromise of downstream AI services. The CVSS score of 9.8 reflects the catastrophic impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Administrators must immediately upgrade Milvus deployments to version 2.5.27, 2.6.10, or later to close the exposed debug and management endpoints.

Proactive Monitoring: Security teams should review network logs for unauthorized connections to TCP port 9091 and inspect application logs for unusual activity on the /expr and /api/v1 endpoints.

Compensating Controls: Restrict network access to Milvus management ports using firewalls or VPNs, ensuring only trusted internal services can communicate with the database infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the use of predictable default tokens, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to total database compromise without authentication. Organizations utilizing Milvus for AI workloads must prioritize the application of the official security patches immediately to mitigate the risk of data exfiltration and manipulation.

---METADATA---
VENDOR: Treeverse
PRODUCT: lakeFS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
lakeFS, an open-source data versioning tool for object storage, contains a high-severity vulnerability that may affect repository security.

Executive Summary:
A security vulnerability in lakeFS poses a high risk to the integrity and confidentiality of data stored within Git-like object storage repositories.

Vulnerability Details

CVE-ID: CVE-2026-26187

Affected Software: Treeverse lakeFS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects lakeFS, a tool designed to transform object storage into versioned repositories. The flaw is rated with a CVSS score of 8.1, indicating a High severity impact on the security operations of the data management layer, though the specific exploit vector is currently undisclosed.

Business Impact

A compromise of lakeFS could allow a threat actor to manipulate data versions, delete critical datasets, or gain unauthorized access to sensitive object storage buckets (e.g., S3, GCS). With a CVSS score of 8.1, the business impact includes potential data loss, loss of data lineage, and the introduction of malicious data into production environments, which could disrupt data science and engineering workflows.

Remediation Plan

Immediate Action: Apply the latest security patches from the lakeFS GitHub repository or official vendor distribution immediately.

Proactive Monitoring: Audit lakeFS access logs and S3/object storage logs for unauthorized API calls or unexpected data modifications.

Compensating Controls: Implement strict IAM policies on the underlying object storage to ensure that lakeFS only has the minimum necessary permissions (Principle of Least Privilege).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of data versioning tools often hides vulnerabilities that, once discovered, are highly sought after by actors targeting big data infrastructure.

Analyst Recommendation

Organizations relying on lakeFS for data versioning should treat this vulnerability as a high priority. The potential for data manipulation in a production environment is a significant risk that can only be mitigated through rapid patching. We recommend an immediate audit of lakeFS configurations following the update.

---METADATA---
VENDOR: Microsoft
PRODUCT: Power Apps
AFFECTED_VERSIONS: Microsoft Power Apps Desktop Client: 1.0.0 up to (excluding) 3.26032.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Microsoft Power Apps contains a vulnerability in the handling of escape sequences that allows an authorized attacker to bypass security features.

Executive Summary:
An authorized attacker can bypass security features in Microsoft Power Apps due to improper neutralization of control sequences.

Vulnerability Details

CVE-ID: CVE-2026-26149

Affected Software: Microsoft Power Apps

Affected Versions: Microsoft Power Apps Desktop Client: 1.0.0 up to (excluding) 3.26032.10.0

Vulnerability: The application improperly neutralizes escape, meta, or control sequences, allowing an authenticated (authorized) attacker to bypass security controls over the network.

Business Impact

By bypassing security features, an attacker can perform unauthorized actions within the Power Apps environment that they would otherwise be restricted from executing. This could lead to unauthorized data access, modification of business logic, or escalation of privileges within the application. The CVSS score of 9.0 highlights the potential for significant disruption to business processes and security policy enforcement.

Remediation Plan

Immediate Action: Update the Microsoft Power Apps Desktop Client to version 3.26032.10.0 or later as advised by Microsoft.

Proactive Monitoring: Review application access logs for irregular activity or unauthorized attempts to perform administrative functions within Power Apps.

Compensating Controls: Enforce strict access control lists (ACLs) and Principle of Least Privilege (PoLP) for all users interacting with the Power Apps environment to minimize the impact of a potential security bypass.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires the attacker to be authorized, which limits the initial access vector but allows for significant post-authentication escalation.

Analyst Recommendation

Although this vulnerability requires the attacker to be authorized, the high severity score indicates that it poses a significant risk to the security posture of the platform. Security teams should deploy the provided update across all affected desktop client installations to ensure security controls are correctly enforced.

---METADATA---
VENDOR: Nuance
PRODUCT: PowerScribe
AFFECTED_VERSIONS: PowerScribe One (2019.x and 2023.1 lines) and PowerScribe 360 4.0.x
---END_METADATA---

Description Summary:
An insecure deserialization vulnerability in Nuance PowerScribe allows an unauthenticated attacker to execute arbitrary code over a network.

Executive Summary:
A critical deserialization flaw in Nuance PowerScribe exposes clinical infrastructure to unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-26142

Affected Software: Nuance PowerScribe

Affected Versions: PowerScribe One (2019.x and 2023.1 lines) and PowerScribe 360 4.0.x

Vulnerability: This vulnerability involves the deserialization of untrusted data, which permits an unauthenticated attacker to execute code over a network. Exploitation is contingent upon network reachability to the PowerScribe server, which is often deployed within segmented clinical environments.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a severe risk to healthcare operations. Successful exploitation could lead to full system compromise, unauthorized access to sensitive patient data, and significant disruption to critical clinical workflows.

Remediation Plan

Immediate Action: Review vendor documentation for available updates and apply the latest security patches to all PowerScribe instances immediately.

Proactive Monitoring: Monitor network traffic for anomalous deserialization patterns or unauthorized attempts to reach PowerScribe servers from untrusted segments.

Compensating Controls: Ensure the PowerScribe server remains isolated within a strictly segmented network and utilize a Web Application Firewall (WAF) to inspect and block malicious serialized payloads.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS rating and the potential for total system takeover, administrators should prioritize the identification and patching of all affected PowerScribe installations. Immediate isolation of these assets is recommended until updates can be verified and applied.

---METADATA---
VENDOR: MLflow
PRODUCT: MLflow
AFFECTED_VERSIONS: unspecified up to (excluding) 3.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the _create_model_version() handler of MLflow allows unauthenticated attackers to access restricted files on the server.

Executive Summary:
An unauthenticated path traversal vulnerability in MLflow versions prior to 3.10.0 allows attackers to read sensitive files, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-2614

Affected Software: MLflow

Affected Versions: All versions prior to 3.10.0

Vulnerability: The _create_model_version() handler fails to properly sanitize path inputs (CWE-22), allowing unauthenticated remote attackers to perform path traversal attacks to access unauthorized files.

Business Impact

This vulnerability could lead to the unauthorized disclosure of sensitive server-side configuration files, credentials, or model data. With a CVSS score of 7.5, the risk of data compromise is significant, potentially leading to full system compromise if attackers successfully exfiltrate sensitive environment information.

Remediation Plan

Immediate Action: Update MLflow to version 3.10.0 or later immediately to apply the required input sanitization fixes.

Proactive Monitoring: Monitor server access logs for path traversal patterns (e.g., ../ sequences) directed at the model versioning API endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences or suspicious path characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a patch and the presence of a proof-of-concept, upgrading to MLflow 3.10.0 is the highest priority. Organizations should complete this update as soon as possible to prevent potential exploitation of the path traversal flaw.

---METADATA---
VENDOR: Microsoft
PRODUCT: 365 Copilot Business Chat
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft 365 Copilot's Business Chat allows an authenticated attacker to elevate privileges across a network.

Executive Summary:
A high-severity SSRF vulnerability in Microsoft 365 Copilot Business Chat enables authenticated attackers to perform unauthorized network requests and escalate their privileges within the environment.

Vulnerability Details

CVE-ID: CVE-2026-26137

Affected Software: Microsoft 365 Copilot Business Chat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a Server-Side Request Forgery (SSRF) flaw where an authorized user can manipulate the application into making unauthorized requests to internal or external resources. This can be leveraged to bypass network security controls and achieve privilege escalation.

Business Impact

Successful exploitation allows an attacker to interact with internal services that are not intended to be public-facing. This can lead to the exposure of sensitive internal data, lateral movement within the Microsoft 365 environment, and elevated access to corporate resources. The CVSS score of 8.9 reflects the significant risk to network security and data confidentiality.

Remediation Plan

Immediate Action: Apply the security updates provided by Microsoft immediately. Administrators should refer to the official Microsoft Security Response Center (MSRC) advisory for specific deployment instructions.

Proactive Monitoring: Monitor network traffic for unusual outbound requests originating from the Copilot service and review audit logs for unauthorized privilege escalation attempts.

Compensating Controls: Implement strict egress filtering and network segmentation to limit the ability of the Copilot service to reach sensitive internal endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, SSRF in AI-driven chat interfaces is a known area of interest for researchers and attackers alike.

Analyst Recommendation

Due to the integration of Microsoft 365 Copilot with sensitive corporate data, this high-severity SSRF must be addressed urgently. Organizations should prioritize the application of Microsoft's security patches to prevent potential privilege escalation and unauthorized internal network access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Custom Locations
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) in the Azure Custom Locations Resource Provider allows authenticated attackers to elevate privileges over a network.

Executive Summary:
Azure Custom Locations contains an SSRF vulnerability that allows an authorized attacker to escalate their privileges, potentially compromising the underlying resource provider.

Vulnerability Details

CVE-ID: CVE-2026-26135

Affected Software: Azure Custom Locations Resource Provider (RP)

Affected Versions: See vendor advisory

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability that requires the attacker to be authorized (authenticated). An authenticated user can exploit the Resource Provider to make unauthorized requests, leading to privilege escalation within the Azure environment.

Business Impact

While this requires prior authentication, the CVSS score of 9.6 indicates a critical risk. An attacker with low-level access could escalate to administrative levels, gaining control over custom location resources and potentially pivoting to other connected Azure services, resulting in unauthorized data access and infrastructure manipulation.

Remediation Plan

Immediate Action: Update the Azure Custom Locations Resource Provider to the latest version immediately through the Azure portal or CLI.

Proactive Monitoring: Monitor for anomalous API calls to the Custom Locations Resource Provider and review logs for unexpected internal network traffic originating from the RP.

Compensating Controls: Enforce the principle of least privilege for all users and service principals interacting with Custom Locations to limit the potential scope of an SSRF-based escalation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 3, 2026, there is no evidence of active exploitation. The requirement for authentication slightly reduces the attack surface compared to unauthenticated flaws, but the high CVSS score reflects the severity of the post-authentication impact.

Analyst Recommendation

Organizations utilizing hybrid or custom Azure locations should apply this update immediately. Even though authentication is required, the potential for an insider threat or a compromised low-privilege account to escalate to full control makes this a critical priority for security teams.