---METADATA---
VENDOR: SumatraPDF
PRODUCT: SumatraPDF
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
SumatraPDF for Windows is affected by a high-severity vulnerability. The flaw resides in the handling of multi-format files, potentially allowing for unauthorized actions on the host system.

Executive Summary:
A vulnerability in the SumatraPDF multi-format reader for Windows poses a significant risk of exploitation through the processing of untrusted document files.

Vulnerability Details

CVE-ID: CVE-2026-25961

Affected Software: SumatraPDF SumatraPDF

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves the SumatraPDF multi-format reader and likely stems from improper input validation when parsing document headers or content. An unauthenticated attacker could exploit this by convincing a user to open a specific, malicious file.

Business Impact

The impact of this vulnerability is significant, as reflected by its CVSS score of 7.5. Exploitation could result in the compromise of individual workstations, leading to unauthorized access to sensitive user data and potential lateral movement within the corporate network. System downtime and the need for forensic investigation following a breach could incur substantial operational costs.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the SumatraPDF development team to all affected Windows endpoints immediately.

Proactive Monitoring: Monitor for anomalous network traffic originating from workstations that have recently opened external PDF or multi-format documents.

Compensating Controls: Implement "Least Privilege" principles to ensure that the PDF reader operates with the minimum necessary permissions, reducing the impact of a potential sandbox escape.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 10, 2026, there is no public information indicating active exploitation of this vulnerability. The high severity indicates that once a technical proof-of-concept is developed, it could be quickly integrated into exploit kits.

Analyst Recommendation

Given the High severity rating, this vulnerability should be prioritized within the current patch cycle. Organizations should ensure that all users are running the most recent version of SumatraPDF to prevent exploitation through common social engineering and phishing vectors.

---METADATA---
VENDOR: Authentik
PRODUCT: Authentik
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Authentik, an open-source identity provider, is affected by a high-severity vulnerability that could compromise authentication processes or user identity data.

Executive Summary:
The Authentik identity provider contains a high-severity vulnerability that poses a significant risk to the security of organizational authentication and identity management.

Vulnerability Details

CVE-ID: CVE-2026-25922

Affected Software: Authentik

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are not provided in the summary, the CVSS score of 8.8 indicates a critical flaw in this identity provider. Vulnerabilities in such products typically involve authentication bypass, session hijacking, or unauthorized access to identity metadata.

Business Impact

A compromise of an identity provider like Authentik can lead to a total breakdown of an organization's security perimeter. Attackers could potentially impersonate users, gain unauthorized access to integrated applications (SSO), and exfiltrate sensitive identity data, leading to widespread unauthorized access.

Remediation Plan

Immediate Action: Update the Authentik installation to the latest version immediately to resolve the identified security flaw.

Proactive Monitoring: Review authentication logs for anomalous login patterns, unauthorized administrative changes, or unusual service provider (SP) registrations.

Compensating Controls: Ensure that Multi-Factor Authentication (MFA) is enforced for all accounts to provide an additional layer of security in the event of a primary credential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation. Because Authentik is a central security component, any vulnerability with an 8.8 score must be treated as a critical priority.

Analyst Recommendation

Identity management infrastructure is a tier-0 asset. Administrators must prioritize the remediation of this vulnerability above all others to ensure the continued integrity of the organization's authentication and authorization framework.

---METADATA---
VENDOR: Zarinpal
PRODUCT: Zarinpal Gateway for WooCommerce plugin
AFFECTED_VERSIONS: Up to and including 5
---END_METADATA---

Description Summary:
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to improper access control, allowing unauthorized modification of payment status updates.

Executive Summary:
A high-severity access control vulnerability in the Zarinpal Gateway plugin could allow attackers to manipulate payment statuses, leading to financial loss and order fulfillment fraud.

Vulnerability Details

CVE-ID: CVE-2026-2592

Affected Software: Zarinpal Gateway for WooCommerce (WordPress Plugin)

Affected Versions: Up to and including 5

Vulnerability: The plugin fails to properly validate access controls during payment status updates. This allows an attacker to potentially mark unpaid orders as "paid" or otherwise manipulate the transaction lifecycle without proper authorization.

Business Impact

This vulnerability directly impacts the financial integrity of e-commerce operations. Attackers could obtain goods or services without payment, resulting in direct revenue loss. The CVSS score of 7.7 reflects the high risk to business logic and financial transactions.

Remediation Plan

Immediate Action: Update the Zarinpal Gateway for WooCommerce plugin to the latest version immediately.

Proactive Monitoring: Audit recent WooCommerce orders to ensure that payment statuses match actual transactions in the Zarinpal merchant portal.

Compensating Controls: Implement additional verification steps for high-value orders and use a Web Application Firewall (WAF) to filter suspicious requests to payment callback endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, no public exploitation has been confirmed. However, payment gateway vulnerabilities are highly sought after by financially motivated threat actors.

Analyst Recommendation

E-commerce site administrators must prioritize this update to protect their revenue streams. In addition to patching, a manual audit of recent transactions is recommended to ensure no exploitation has already occurred.

---METADATA---
VENDOR: fast-xml-parser
PRODUCT: fast-xml-parser
AFFECTED_VERSIONS: 4.1.3 to before 5.3.5
---END_METADATA---

Description Summary:
A regex wildcard handling error in fast-xml-parser's DOCTYPE entity replacement allows attackers to shadow built-in entities, leading to Cross-Site Scripting (XSS).

Executive Summary:
A vulnerability in fast-xml-parser allows attackers to bypass entity encoding and execute malicious scripts in the user's browser via a specially crafted XML payload.

Vulnerability Details

CVE-ID: CVE-2026-25896

Affected Software: fast-xml-parser

Affected Versions: 4.1.3 to before 5.3.5

Vulnerability: The parser incorrectly treats a dot (.) in a DOCTYPE entity name as a regex wildcard during replacement. This allows an unauthenticated attacker to shadow standard entities (like <) with arbitrary values, bypassing security filters and leading to Cross-Site Scripting (XSS) when the output is rendered.

Business Impact

Successful exploitation can lead to the theft of session cookies, account hijacking, and the delivery of further client-side attacks. While XSS is often categorized as Medium, the CVSS score of 9.3 reflects the critical nature of this specific bypass within a widely used parsing library that handles sensitive data.

Remediation Plan

Immediate Action: Update the fast-xml-parser library to version 5.3.5 or later to resolve the regex wildcard replacement flaw.

Proactive Monitoring: Review application logs for XML payloads containing suspicious DOCTYPE declarations or attempts to redefine built-in XML entities.

Compensating Controls: Implement a Content Security Policy (CSP) to limit the impact of potential script injection and use a Web Application Firewall (WAF) to filter malicious XML input.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation. However, because this library is common in many JavaScript environments, the impact surface is broad.

Analyst Recommendation

Developers should immediately verify the version of fast-xml-parser used in their projects. Upgrading to version 5.3.5 is essential to prevent attackers from bypassing encoding mechanisms and executing unauthorized scripts on the client side.

---METADATA---
VENDOR: Chartbrew
PRODUCT: Chartbrew
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Chartbrew, an open-source data visualization platform, contains a vulnerability that could allow unauthorized access to connected databases and APIs.

Executive Summary:
Chartbrew is affected by a high-severity vulnerability that could enable attackers to gain unauthorized access to sensitive backend databases and external API services.

Vulnerability Details

CVE-ID: CVE-2026-25888

Affected Software: Chartbrew

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the core web application of Chartbrew, which manages connections to external data sources. The flaw likely involves an authentication bypass or an injection vulnerability, potentially allowing an unauthenticated or low-privileged attacker to intercept or manipulate data queries.

Business Impact

The business impact is significant due to Chartbrew's role as a centralized hub for sensitive organizational data. A CVSS score of 8.8 reflects the high risk of a data breach, where an attacker could extract proprietary information from connected databases or manipulate business intelligence reports, leading to financial loss and reputational damage.

Remediation Plan

Immediate Action: Update the Chartbrew application to the latest version immediately to patch the vulnerability in the data connection logic.

Proactive Monitoring: Review database access logs for any anomalous queries or connection attempts originating from the Chartbrew host.

Compensating Controls: Restrict database user permissions for the account used by Chartbrew to "read-only" and utilize a Web Application Firewall (WAF) to filter suspicious traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, because Chartbrew is open-source and handles direct database credentials, the incentive for discovery and exploitation by malicious actors is high.

Analyst Recommendation

With a CVSS score of 8.8, this vulnerability is nearing the "Critical" threshold. Organizations must apply the vendor's security updates immediately and rotate any database or API credentials stored within the Chartbrew platform to ensure long-term security.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Versions prior to 0.8.31
---END_METADATA---

Description Summary:
SandboxJS versions before 0.8.31 contain a sandbox escape vulnerability via prototype pollution, potentially allowing sandboxed code to achieve remote code execution (RCE) on the host.

Executive Summary:
A critical sandbox escape in SandboxJS allows malicious code to bypass security boundaries and execute arbitrary commands on the host system through prototype pollution.

Vulnerability Details

CVE-ID: CVE-2026-25881

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.31

Vulnerability: The vulnerability exists in how the library handles global prototype references within array literals, which strips the "isGlobal" protection flag. This unauthenticated flaw allows sandboxed code to mutate host built-in prototypes, leading to persistent prototype pollution and potential Remote Code Execution (RCE).

Business Impact

The ability to escape a JavaScript sandbox undermines the primary security control of the library. With a CVSS score of 9.0, this vulnerability allows an attacker to transition from a restricted environment to full host compromise. This could lead to unauthorized data access, system-wide instability, and the execution of malicious payloads in the application's context.

Remediation Plan

Immediate Action: Update the SandboxJS library to version 0.8.31 or later to resolve the prototype mutation flaw.

Proactive Monitoring: Audit application code for uses of sensitive sinks (like execSync) that could be influenced by polluted object properties.

Compensating Controls: Implement strict Content Security Policies (CSP) and use object freezing techniques on global prototypes to prevent unauthorized modifications at runtime.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical details provided in the disclosure significantly lower the barrier for developing a functional exploit.

Analyst Recommendation

Developers using SandboxJS must treat this as a high-priority update. Because prototype pollution can have far-reaching effects across an entire Node.js process, immediate migration to version 0.8.31 is the only reliable way to ensure host integrity.

---METADATA---
VENDOR: SumatraPDF
PRODUCT: SumatraPDF
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in SumatraPDF for Windows. This flaw could allow for exploitation when the reader processes specially crafted multi-format documents.

Executive Summary:
SumatraPDF for Windows contains a high-severity vulnerability that could lead to system compromise if a user opens a maliciously crafted document.

Vulnerability Details

CVE-ID: CVE-2026-25880

Affected Software: SumatraPDF SumatraPDF

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the SumatraPDF multi-format reader for Windows. While the specific technical vector is not detailed, the flaw typically involves an unauthenticated attacker providing a malicious file that triggers a memory corruption or logic error during parsing.

Business Impact

A successful exploit could lead to unauthorized code execution or application crashes, resulting in the loss of data integrity and system availability. With a CVSS score of 7.8, the risk is classified as High, as it targets a common end-user application used for handling diverse document formats. This could serve as an initial entry point for broader network compromise or intellectual property theft.

Remediation Plan

Immediate Action: IT administrators should update SumatraPDF installations to the latest version provided by the vendor immediately to mitigate the risk of document-based exploitation.

Proactive Monitoring: Security teams should monitor endpoint detection and response (EDR) logs for unusual child processes spawning from SumatraPDF.exe or unexpected file system modifications.

Compensating Controls: Restrict the opening of untrusted document formats from external sources and ensure email gateways are configured to scan for suspicious attachments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a popular document reader, the potential for exploitation via phishing or web-based delivery is high.

Analyst Recommendation

The high CVSS score of 7.8 necessitates immediate attention from patch management teams. Because document readers are frequently targeted by threat actors to gain a foothold on workstations, applying the vendor-supplied security update is the only effective way to ensure the security of the environment.

---METADATA---
VENDOR: Perl (CPAN)
PRODUCT: Crypt::NaCl::Sodium
AFFECTED_VERSIONS: Through 2.001
---END_METADATA---

Description Summary:
Crypt::NaCl::Sodium for Perl contains an integer overflow on 32-bit systems when casting length pointers, potentially leading to memory corruption or cryptographic failures.

Executive Summary:
A critical integer overflow vulnerability in the Crypt::NaCl::Sodium Perl module on 32-bit systems could allow attackers to cause memory corruption or bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-2588

Affected Software: Crypt::NaCl::Sodium (Perl module)

Affected Versions: Through 2.001

Vulnerability: An integer overflow exists on 32-bit systems where a 32-bit size_t is cast to a 64-bit unsigned long long when passing length pointers to libsodium. This discrepancy can lead to incorrect memory allocation or processing within the cryptographic library.

Business Impact

Exploitation of this flaw can lead to application crashes, memory corruption, or the compromise of cryptographic operations. On 32-bit platforms, this poses a significant risk to the integrity of encrypted data and the overall stability of applications relying on this library. The CVSS score is 9.1.

Remediation Plan

Immediate Action: Update the Crypt::NaCl::Sodium Perl module to the latest version via CPAN and recompile the module to ensure the fix is applied.

Proactive Monitoring: Monitor 32-bit systems for application crashes or unexpected behavior during cryptographic operations.

Compensating Controls: Migrate critical applications to 64-bit architectures where this specific integer overflow does not occur.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 23, 2026, there is no public information indicating active exploitation. This vulnerability specifically targets legacy 32-bit environments, which may still be present in industrial or embedded systems.

Analyst Recommendation

Organizations running Perl applications on 32-bit systems must update this library immediately. The potential for memory corruption in a cryptographic module is a high-risk scenario that could undermine the security of the entire application stack.

---METADATA---
VENDOR: Langroid
PRODUCT: Langroid Framework
AFFECTED_VERSIONS: Prior to 0.63.0
---END_METADATA---

Description Summary:
The Langroid framework is vulnerable to remote code execution due to insecure handling of SQL produced by large language models.

Executive Summary:
An insecure SQL execution vulnerability in the Langroid framework allows prompt injection to trigger remote code execution on database hosts.

Vulnerability Details

CVE-ID: CVE-2026-25879

Affected Software: Langroid Framework

Affected Versions: Prior to 0.63.0

Vulnerability: The SQLChatAgent component executes SQL generated by an LLM without adequate sanitization, allowing an attacker to use prompt injection to execute dialect-specific system commands (e.g., xp_cmdshell) on the database host.

Business Impact

Successful exploitation allows an attacker to gain system-level access to the database server, leading to data exfiltration or total server takeover. With a CVSS score of 9.8, this flaw presents a critical risk to any application utilizing Langroid for LLM-powered database interaction.

Remediation Plan

Immediate Action: Upgrade to Langroid v0.63.0, which implements a secure allowlist for SQL operations and blocks dangerous patterns.

Proactive Monitoring: Review database audit logs for execution of dangerous system commands or unexpected queries originating from the application service.

Compensating Controls: Ensure the database user account utilized by the application has the minimum necessary privileges, explicitly denying access to system-level commands like xp_cmdshell or FILE.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Frameworks integrating LLMs with database access must be configured with the principle of least privilege. Organizations should update to version 0.63.0 immediately and verify that database roles are restricted from performing administrative or system-level actions.

---METADATA---
VENDOR: OmniGen2-RL
PRODUCT: Reward Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The OmniGen2-RL reward server contains an unauthenticated remote code execution (RCE) vulnerability due to insecure pickle deserialization of HTTP POST request bodies.

Executive Summary:
An unauthenticated RCE vulnerability in the OmniGen2-RL reward server allows attackers to execute arbitrary commands on the host system via malicious HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-25873

Affected Software: OmniGen2-RL Reward Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The reward server component insecurely deserializes request bodies using the Python pickle module. Because this occurs before authentication, any remote attacker can send a crafted HTTP POST request containing a malicious pickle payload to achieve code execution on the server.

Business Impact

This vulnerability is critical, as evidenced by its CVSS score of 9.8. It permits complete system takeover by an unauthenticated remote attacker. The business impact includes the potential for total data loss, deployment of ransomware, and the use of the compromised server as a pivot point for further internal network attacks.

Remediation Plan

Immediate Action: Update the OmniGen2-RL reward server to the latest version immediately. If the service is not strictly necessary for external operations, disable network access to the reward server port.

Proactive Monitoring: Inspect network traffic for suspicious HTTP POST requests directed at the reward server and monitor the host for unauthorized process creation or unexpected network connections.

Compensating Controls: Place the reward server behind a firewall and restrict access to specific, trusted IP addresses. Replace pickle-based communication with safer formats like JSON where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. However, insecure deserialization is a well-known attack vector, and unauthenticated RCE vulnerabilities are frequently exploited shortly after discovery.

Analyst Recommendation

Immediate patching is required. The ability for an unauthenticated attacker to execute code remotely represents the highest possible risk tier. Organizations should isolate the affected service until the patch is verified and applied.

---METADATA---
VENDOR: Oracle
PRODUCT: GlassFish
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A remote code execution vulnerability in the GlassFish server-side template rendering mechanism allows attackers to execute arbitrary commands via malicious Expression Language (EL) injection.

Executive Summary:
A critical remote code execution vulnerability in the GlassFish server allows unauthenticated attackers to gain full control of the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-2587

Affected Software: Oracle GlassFish

Affected Versions: See vendor advisory

Vulnerability: The application improperly sanitizes user-supplied values during template rendering, enabling Expression Language (EL) injection. This allows an unauthenticated attacker to execute arbitrary OS commands on the host server.

Business Impact

This vulnerability carries a CVSS score of 9.6, indicating a catastrophic potential for business operations. Successful exploitation results in complete system compromise, enabling data exfiltration, persistence, and lateral movement within the network, which could lead to a total loss of confidentiality and integrity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor to remediate the template rendering mechanism.

Proactive Monitoring: Monitor server logs for suspicious XML input patterns and expressions (e.g., #{...}) that deviate from standard operational traffic.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious EL injection patterns in incoming requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for full system compromise, this vulnerability requires immediate attention. Security teams must ensure that all GlassFish instances are patched and that input validation controls are reviewed and strengthened to prevent further injection attempts.

---METADATA---
VENDOR: WordPress
PRODUCT: Conditional Fields for Contact Form 7
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Conditional Fields for Contact Form 7 WordPress plugin, potentially allowing for unauthorized actions.

Executive Summary:
A high-severity vulnerability in the Conditional Fields for Contact Form 7 plugin requires an immediate update to maintain the security of the WordPress environment.

Vulnerability Details

CVE-ID: CVE-2026-25863

Affected Software: WordPress plugin "Conditional Fields for Contact Form 7"

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Conditional Fields for Contact Form 7 plugin. While the specific nature is not fully detailed, vulnerabilities in such plugins often involve improper capability checks, allowing unauthorized users to modify forms or access data.

Business Impact

Assigned a CVSS score of 7.5, this vulnerability represents a significant risk. If exploited, it could allow unauthorized individuals to manipulate form submissions or access sensitive information collected through the contact forms.

Remediation Plan

Immediate Action: Update the "Conditional Fields for Contact Form 7" plugin to the latest version via the WordPress admin dashboard.

Proactive Monitoring: Review form submission logs for any suspicious activity or unauthorized configuration changes within the plugin.

Compensating Controls: If an update is not immediately available, disable the plugin or implement a Web Application Firewall (WAF) rule to block malicious requests targeting the plugin's endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin vulnerabilities are a common attack vector for WordPress sites. Administrators must ensure all plugins are updated to the latest versions to mitigate the risk of compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: GlassFish
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An authenticated remote code execution vulnerability exists in the GlassFish Administration Console, allowing users with console access to execute arbitrary commands.

Executive Summary:
An authenticated remote code execution vulnerability in the GlassFish Administration Console allows an attacker with panel access to execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-2586

Affected Software: Oracle GlassFish

Affected Versions: See vendor advisory

Vulnerability: The Administration Console fails to properly sanitize requests, allowing an authenticated user to perform arbitrary command execution with the privileges of the application service user.

Business Impact

With a CVSS score of 9.1, this flaw poses a severe risk to internal security, as it allows a compromised or malicious administrative account to escalate privileges to the OS level. This could result in unauthorized data access or the complete takeover of the application server.

Remediation Plan

Immediate Action: Update GlassFish to the latest patched version and audit current administrative accounts for unauthorized activity.

Proactive Monitoring: Review logs for command execution attempts within the Administration Console and limit access to the console to trusted IP addresses only.

Compensating Controls: Implement Multi-Factor Authentication (MFA) for all administrative access and utilize the principle of least privilege for service accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires authentication, the impact is severe. Organizations should immediately review who has access to the GlassFish Administration Console and apply the vendor's security patches to prevent potential privilege escalation.

---METADATA---
VENDOR: OpenBullet
PRODUCT: OpenBullet2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in OpenBullet2 allows for potential unauthorized operations.

Executive Summary:
OpenBullet2 contains a high-severity vulnerability that may allow attackers to compromise system integrity or access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-25856

Affected Software: OpenBullet, OpenBullet2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within the OpenBullet2 framework. Given the nature of the application, this flaw likely allows for unauthenticated or low-privileged remote interaction with the automation engine.

Business Impact

The identified vulnerability carries a CVSS score of 8.8, classifying it as High severity. Exploitation could lead to unauthorized control over automated testing workflows, resulting in potential data exfiltration, service disruption, or the execution of arbitrary commands on the hosting environment.

Remediation Plan

Immediate Action: Audit current deployments and apply all available security updates provided by the OpenBullet project immediately.

Proactive Monitoring: Monitor server logs for unusual outbound traffic or unauthorized process execution initiated by the OpenBullet service account.

Compensating Controls: Implement strict network segmentation and ensure the OpenBullet instance is not exposed to the public internet without a Web Application Firewall (WAF) or VPN access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant and requires immediate attention.

Analyst Recommendation

Organizations utilizing OpenBullet2 must prioritize this update to prevent potential system compromise. We recommend performing a thorough review of the application's environment and ensuring that the most recent stable version is deployed to mitigate this high-risk vulnerability.

---METADATA---
VENDOR: OpenBullet
PRODUCT: OpenBullet2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability has been identified in OpenBullet2, requiring urgent review and remediation by administrators.

Executive Summary:
OpenBullet2 is impacted by a high-severity security vulnerability that could lead to unauthorized system access or broader environment compromise.

Vulnerability Details

CVE-ID: CVE-2026-25855

Affected Software: OpenBullet2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the OpenBullet2 framework. Similar to other high-severity flaws in this software, it presents a significant risk to the application's integrity and requires immediate patching.

Business Impact

The vulnerability poses a severe risk to any environment running OpenBullet2. With a CVSS score of 8.8, the potential for exploitation could result in full application compromise, potentially exposing the data processed or managed by the tool.

Remediation Plan

Immediate Action: Ensure the OpenBullet2 installation is updated to the latest available version as specified by the vendor.

Proactive Monitoring: Monitor for unexpected process execution or unauthorized changes to the application environment.

Compensating Controls: Isolate the OpenBullet2 instance from public-facing networks and restrict administrative access to trusted personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All organizations running OpenBullet2 should prioritize the remediation of this vulnerability. Promptly applying vendor-provided updates is the most effective way to secure the application against potential exploitation and protect against associated risks.

---METADATA---
VENDOR: OCPP Implementations
PRODUCT: OCPP WebSocket Endpoint
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
OCPP WebSocket endpoints lack authentication, allowing unauthenticated attackers to impersonate legitimate charging stations and issue unauthorized commands.

Executive Summary:
The failure to authenticate OCPP WebSocket connections allows attackers to impersonate charging stations and manipulate critical infrastructure data.

Vulnerability Details

CVE-ID: CVE-2026-25851

Affected Software: OCPP WebSocket Implementations

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An unauthenticated attacker can connect to an OCPP WebSocket endpoint using a discovered charging station ID. Without authentication, the backend accepts the attacker as a legitimate charger, allowing for full command issuance and reception.

Business Impact

Successful exploitation leads to privilege escalation and unauthorized control over the charging network. This can result in the corruption of charging data, unauthorized free charging, or disruption of service. The CVSS score of 9.4 indicates a critical vulnerability that directly impacts the security of the energy distribution chain.

Remediation Plan

Immediate Action: Enable and enforce authentication on the OCPP backend immediately, following the OCPP 1.6 or 2.0.1 security whitepapers.

Proactive Monitoring: Monitor for anomalous OCPP command sequences that deviate from standard charging station behavior.

Compensating Controls: Implement IP whitelisting for charging stations if they operate on static IP addresses or within a private APN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation. The risk remains high due to the critical nature of the affected infrastructure.

Analyst Recommendation

Protecting charging infrastructure from unauthorized access is essential for maintaining public trust and operational stability. Immediate implementation of robust authentication for all WebSocket endpoints is required.

---METADATA---
VENDOR: JetBrains
PRODUCT: Hub
AFFECTED_VERSIONS: Prior to 2025.3.119807
---END_METADATA---

Description Summary:
JetBrains Hub versions prior to 2025.3.119807 contain an authentication bypass vulnerability that allows unauthenticated attackers to perform administrative actions.

Executive Summary:
An authentication bypass in JetBrains Hub allows unauthenticated remote attackers to gain administrative control over the platform, compromising all managed user accounts and integrations.

Vulnerability Details

CVE-ID: CVE-2026-25848

Affected Software: JetBrains Hub

Affected Versions: Prior to 2025.3.119807

Vulnerability: The vulnerability allows an unauthenticated attacker to bypass the standard login process. Once bypassed, the attacker can perform actions with administrative privileges, granting them full control over the Hub instance.

Business Impact

JetBrains Hub serves as a central authorization and user management point. A CVSS score of 9.1 reflects the critical risk; a successful exploit allows an attacker to modify user permissions, access sensitive integration tokens, and potentially pivot into other JetBrains tools like YouTrack or TeamCity, leading to a massive supply chain or data breach.

Remediation Plan

Immediate Action: Update JetBrains Hub to version 2025.3.119807 or later immediately.

Proactive Monitoring: Review administrative audit logs for any actions performed by unexpected IP addresses or during unusual timeframes.

Compensating Controls: Place the Hub instance behind a VPN or implement IP-based access control lists (ACLs) to restrict access to the administrative interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. Because Hub manages identities for other critical development tools, this vulnerability is a high-value target for attackers.

Analyst Recommendation

Given that this is an unauthenticated authentication bypass, it must be treated with the highest urgency. Organizations should apply the update immediately to prevent unauthorized access to their identity management infrastructure.

---METADATA---
VENDOR: HMS Networks
PRODUCT: Ewon Flexy and Cosy+
AFFECTED_VERSIONS: Ewon Flexy < 15.0s4, Cosy+ 22.xx < 22.1s6, Cosy+ 23.xx < 23.0s3
---END_METADATA---

Description Summary:
A stack buffer overflow in HMS Networks Ewon Flexy and Cosy+ devices allows unauthenticated remote code execution or denial of service via malicious network requests.

Executive Summary:
Critical stack buffer overflow vulnerabilities in HMS Networks industrial gateways allow unauthenticated attackers to remotely execute code or crash devices, threatening industrial control stability.

Vulnerability Details

CVE-ID: CVE-2026-25823

Affected Software: HMS Networks Ewon Flexy and Cosy+

Affected Versions: Ewon Flexy < 15.0s4, Cosy+ 22.xx < 22.1s6, Cosy+ 23.xx < 23.0s3

Vulnerability: This vulnerability is a classic stack-based buffer overflow occurring within the device firmware. An unauthenticated remote attacker can send specially crafted packets to the device that overwrite memory, leading to either a system crash or the execution of arbitrary commands with high privileges.

Business Impact

The impact on industrial operations is severe, as these gateways often manage critical connectivity between OT and IT networks. A CVSS score of 9.8 reflects the potential for unauthenticated remote code execution, which could allow an attacker to pivot into the internal industrial network. This could lead to production downtime, physical equipment damage, or theft of operational data.

Remediation Plan

Immediate Action: Apply firmware updates provided by HMS Networks (15.0s4 for Flexy, 22.1s6 or 23.0s3 for Cosy+) to patch the overflow vulnerability.

Proactive Monitoring: Monitor industrial network traffic for anomalous packets directed at gateway management ports and track device stability for unexpected reboots.

Compensating Controls: Restrict access to the device management interfaces using firewalls and ensure the devices are not exposed directly to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of crafting a stable exploit for embedded systems may delay widespread use, but the risk remains critical.

Analyst Recommendation

Given the critical role these devices play in industrial environments, immediate firmware patching is mandatory. Organizations should verify their current firmware versions and schedule maintenance windows to update all affected HMS Networks hardware to prevent potential remote takeover.

---METADATA---
VENDOR: HMS Networks
PRODUCT: Ewon Flexy and Cosy+
AFFECTED_VERSIONS: Ewon Flexy < 15.0s4, Cosy+ 22.xx < 22.1s6, Cosy+ 23.xx < 23.0s3
---END_METADATA---

Description Summary:
HMS Networks Ewon Flexy and Cosy+ devices suffer from weak entropy in authentication cookies, enabling attackers to brute-force encryption parameters and recover user passwords.

Executive Summary:
Weak cryptographic entropy in HMS Networks gateways allows attackers with a captured session cookie to crack user passwords, leading to unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-25818

Affected Software: HMS Networks Ewon Flexy and Cosy+

Affected Versions: Ewon Flexy < 15.0s4, Cosy+ 22.xx < 22.1s6, Cosy+ 23.xx < 23.0s3

Vulnerability: The firmware utilizes insufficient entropy when generating authentication cookies. An attacker who successfully intercepts or steals a valid session cookie can perform an offline brute-force attack against the encryption parameters to reverse-engineer and identify the plaintext user password.

Business Impact

The compromise of administrative passwords on industrial gateways grants attackers full control over the device and the traffic it manages. With a CVSS score of 9.1, this vulnerability represents a high risk to the confidentiality of credentials. Once a password is recovered, the attacker can maintain persistent access and potentially manipulate industrial processes.

Remediation Plan

Immediate Action: Update device firmware to the latest versions (15.0s4, 22.1s6, or 23.0s3) to implement stronger entropy for session management.

Proactive Monitoring: Monitor for multiple failed login attempts or unusual administrative activity that might indicate the use of compromised credentials.

Compensating Controls: Enforce the use of HTTPS for all management sessions to prevent cookie interception and implement multi-factor authentication where supported.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, the use of weak cryptography is a common target for sophisticated attackers seeking long-term access.

Analyst Recommendation

The recovery of plaintext passwords through session analysis is a critical security failure. Administrators must update HMS Networks firmware immediately. After updating, it is strongly recommended that all administrative passwords be changed, as they may have been previously compromised without detection.

---METADATA---
VENDOR: 3DP-MANAGER
PRODUCT: 3DP-MANAGER
AFFECTED_VERSIONS: 2.0.1 and prior
---END_METADATA---

Description Summary:
3DP-MANAGER automatically creates an administrative account with default credentials (admin/admin) upon initialization. Attackers can use these credentials to gain full control over VPN and system settings.

Executive Summary:
The use of hardcoded default administrative credentials in 3DP-MANAGER allows unauthenticated attackers to gain full control over the application and its VPN management features.

Vulnerability Details

CVE-ID: CVE-2026-25803

Affected Software: 3DP-MANAGER

Affected Versions: 2.0.1 and prior

Vulnerability: Upon initial setup, the application creates an account with the well-known credentials "admin/admin". Any unauthenticated attacker with network access to the login interface can use these credentials to gain full administrative privileges.

Business Impact

A CVSS score of 9.8 reflects the high impact of this flaw. An attacker gaining administrative access can manage VPN tunnels, modify system settings, and potentially intercept or redirect network traffic, leading to a complete breach of the organization's secure communications.

Remediation Plan

Immediate Action: Change the default "admin" password immediately. Plan to update to version 2.0.2 as soon as it is released to address the underlying initialization flaw.

Proactive Monitoring: Check system logs for successful logins using the "admin" account from unexpected IP addresses and review all VPN configuration changes for unauthorized modifications.

Compensating Controls: Implement multi-factor authentication (MFA) if supported, or restrict access to the 3DP-MANAGER login page to a specific administrative management network.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, active exploitation has not been reported, but the use of default credentials is one of the most common vectors for automated attacks.

Analyst Recommendation

The presence of default credentials on an internet-facing management tool is a critical security failure. Administrators must change the default password immediately and update the software to version 2.0.2 upon release to secure the deployment.

---METADATA---
VENDOR: New API
PRODUCT: New API LLM Gateway
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the New API large language model (LLM) gateway and AI asset management system could allow for unauthorized access or manipulation of AI resources.

Executive Summary:
The New API LLM gateway is subject to a high-severity vulnerability that could compromise artificial intelligence asset management and gateway integrity.

Vulnerability Details

CVE-ID: CVE-2026-25802

Affected Software: New API LLM Gateway

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the New API system, a gateway designed for managing LLM and AI assets. While the specific vulnerability type is not detailed, the high CVSS score suggests a critical failure in access control or input handling within the API management layer.

Business Impact

A successful exploit could lead to the unauthorized use of expensive AI model credits, leakage of sensitive training data, or the redirection of LLM traffic to malicious endpoints. With a CVSS score of 7.6, the severity is classified as High, reflecting a significant risk to the confidentiality and integrity of an organization’s AI infrastructure and associated data assets.

Remediation Plan

Immediate Action: Administrators should apply the latest security updates provided by the New API project maintainers immediately to secure the gateway.

Proactive Monitoring: Implement rigorous logging of API requests and monitor for unusual spikes in LLM token usage or unauthorized IP addresses accessing the management console.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming traffic to the gateway and restrict access to the management interface using IP allowlisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a centralized AI gateway, the potential for exploitation is high once details emerge.

Analyst Recommendation

The high CVSS score and the critical role that LLM gateways play in modern infrastructure necessitate immediate action. Organizations utilizing New API must prioritize the application of vendor-provided patches. Failure to remediate this flaw could result in significant financial loss through resource theft or the exposure of proprietary AI workflows.

---METADATA---
VENDOR: WP Maps
PRODUCT: WP Maps – Store Locator
AFFECTED_VERSIONS: Up to and including 4.x
---END_METADATA---

Description Summary:
The WP Maps WordPress plugin is vulnerable to time-based SQL Injection via the ‘orderby’ parameter, allowing attackers to extract sensitive database information.

Executive Summary:
A high-severity SQL Injection vulnerability in the WP Maps plugin for WordPress allows attackers to extract sensitive information from the site's database.

Vulnerability Details

CVE-ID: CVE-2026-2580

Affected Software: WP Maps WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters

Affected Versions: All versions up to, and including, 4.x

Vulnerability: The plugin is vulnerable to time-based SQL Injection through the orderby parameter. This occurs because the plugin fails to properly sanitize user-supplied input before using it in a database query, allowing a remote attacker to infer data by observing the time the server takes to respond.

Business Impact

An attacker can use this vulnerability to extract sensitive information from the WordPress database, including user credentials, configuration details, and customer information. This leads to a loss of confidentiality and can serve as a stepping stone for a full site takeover. The CVSS score of 7.5 reflects this significant risk.

Remediation Plan

Immediate Action: Update the WP Maps plugin to the latest version immediately to resolve the SQL injection flaw.

Proactive Monitoring: Review database logs for unusual time-delay queries and monitor for unauthorized access to administrative accounts.

Compensating Controls: Enable a Web Application Firewall (WAF) with SQL injection protection rules to mitigate exploitation attempts while waiting for a patch window.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most common and effective attack vectors for compromising web applications.

Analyst Recommendation

Applying the vendor's patch is the only effective way to remediate this vulnerability. Organizations should prioritize this update to protect their database integrity and prevent sensitive data leakage.