---METADATA---
VENDOR: iccDEV
PRODUCT: iccDEV libraries and tools
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the iccDEV libraries and tools for ICC color management could lead to unauthorized system manipulation or data compromise.

Executive Summary:
The iccDEV color management libraries are affected by a high-severity vulnerability that could allow for unauthorized actions or data exposure in applications using these tools.

Vulnerability Details

CVE-ID: CVE-2026-25634

Affected Software: iccDEV libraries and tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides within the iccDEV libraries, which are used for processing ICC color management profiles. A CVSS score of 7.8 suggests that the flaw could be exploited through a specially crafted ICC profile, potentially leading to a buffer overflow or other memory corruption issues.

Business Impact

Exploitation could allow an attacker to execute arbitrary code or cause a denial of service in any application that uses the vulnerable iccDEV libraries. The CVSS score of 7.8 reflects a high-severity risk to system stability and security. Organizations in the digital imaging, printing, and design industries are particularly at risk.

Remediation Plan

Immediate Action: Update all applications and systems that use the iccDEV libraries to the latest version. Developers should recompile their software with the patched version of the library.

Proactive Monitoring: Monitor systems for unexpected crashes or anomalous behavior when processing image or color profile files.

Compensating Controls: Use sandboxing or containerization to isolate applications that process external ICC profiles, limiting the potential impact of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. Vulnerabilities in image and color processing libraries are a common vector for remote code execution.

Analyst Recommendation

Immediate patching of these libraries is crucial for maintaining the security of applications that handle color management. Given the potential for remote code execution, this should be treated as a high-priority update. Ensure that all third-party software using these libraries is also identified and updated.

---METADATA---
VENDOR: EPyT-Flow
PRODUCT: EPyT-Flow
AFFECTED_VERSIONS: Prior to 0.16.1
---END_METADATA---

Description Summary:
EPyT-Flow’s REST API custom deserializer allows dynamic instantiation of attacker-specified classes. This leads to OS command execution via dangerous classes like subprocess.Popen.

Executive Summary:
EPyT-Flow is vulnerable to unauthenticated remote code execution (RCE) through a flawed JSON deserialization process that permits arbitrary OS command execution.

Vulnerability Details

CVE-ID: CVE-2026-25632

Affected Software: EPyT-Flow

Affected Versions: Prior to 0.16.1

Vulnerability: The custom deserializer my_load_from_json processes attacker-controlled JSON bodies. By providing a specific "type" field, an unauthenticated attacker can force the application to import and instantiate dangerous Python classes, such as subprocess.Popen, with arbitrary arguments.

Business Impact

With a CVSS score of 10.0, this vulnerability allows for complete system takeover. Attackers can execute arbitrary OS commands, potentially leading to the compromise of critical infrastructure data related to water distribution networks and lateral movement into internal systems.

Remediation Plan

Immediate Action: Update EPyT-Flow to version 0.16.1 immediately to replace the insecure deserialization logic with a safe alternative.

Proactive Monitoring: Review REST API logs for JSON requests containing "type" fields that reference unexpected or dangerous Python modules and classes.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming JSON payloads for suspicious keywords like "subprocess", "os", or "Popen".

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. However, the ability to trigger RCE via standard REST API calls makes this an extremely attractive target for attackers.

Analyst Recommendation

This is a critical RCE vulnerability that requires immediate attention. Organizations using EPyT-Flow for hydraulic modeling must prioritize the update to version 0.16.1 to prevent unauthorized access to sensitive infrastructure controls.

---METADATA---
VENDOR: Blesta
PRODUCT: Blesta
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in Blesta 3 could allow for unauthorized access or administrative compromise within the billing and management platform.

Executive Summary:
Blesta 3 is affected by a high-severity vulnerability that could allow attackers to compromise the billing platform, leading to potential financial data exposure.

Vulnerability Details

CVE-ID: CVE-2026-25615

Affected Software: Blesta Blesta

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the core components of Blesta 3. Given the CVSS score of 7.2, the flaw likely involves an authentication bypass or an elevation of privilege that allows an attacker to perform unauthorized administrative actions.

Business Impact

Blesta is a critical billing and client management tool; a compromise here could lead to the theft of customer PII, financial records, and service credentials. The business impact includes severe reputational damage, regulatory fines due to data breaches, and the potential for attackers to manipulate billing cycles or client accounts.

Remediation Plan

Immediate Action: Upgrade Blesta to the most recent secure version provided by the vendor to close the identified security gap.

Proactive Monitoring: Review administrative audit logs for any unauthorized logins or changes to system configurations and billing settings.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts and restrict access to the Blesta management interface to trusted IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Because Blesta handles sensitive financial data, the urgency for patching is elevated despite the lack of a public exploit.

Analyst Recommendation

It is critical to apply the primary remediation update immediately. Because this software manages financial transactions and sensitive client data, the 7.2 CVSS score represents a significant risk that must be addressed to maintain compliance and data security.

---METADATA---
VENDOR: Blesta
PRODUCT: Blesta
AFFECTED_VERSIONS: Version 3
---END_METADATA---

Description Summary:
A security vulnerability has been identified in version 3 of the Blesta billing and management platform. The flaw affects the core application logic used for managing client accounts and financial data.

Executive Summary:
A high-severity vulnerability in Blesta 3 could allow an attacker to compromise sensitive billing information or gain unauthorized access to the management platform.

Vulnerability Details

CVE-ID: CVE-2026-25614

Affected Software: Blesta Blesta

Affected Versions: Version 3

Vulnerability: This vulnerability affects Blesta 3, a platform used primarily for automated billing and client management. While specific details are limited, the CVSS score suggests a significant flaw that could be exploited by an unauthenticated attacker to bypass security controls or access sensitive data within the application database.

Business Impact

Blesta handles critical business functions, including payment processing and customer PII. A CVSS score of 7.5 indicates a High severity risk where an exploit could lead to financial fraud, theft of sensitive customer data, and severe reputational damage to service providers relying on the platform.

Remediation Plan

Immediate Action: Administrators should immediately update their Blesta installations to the latest version to patch the vulnerability in the version 3 branch.

Proactive Monitoring: Audit application logs for unusual administrative activity, failed login attempts, or unauthorized changes to billing configurations and client accounts.

Compensating Controls: Ensure the Blesta installation is hardened following the vendor's security best practices, including the use of strong multi-factor authentication (MFA) for all administrative users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Because Blesta is a billing platform, it is a high-priority target for attackers interested in financial gain or data theft.

Analyst Recommendation

The High severity of this vulnerability necessitates immediate patching. Organizations using Blesta 3 must prioritize this update to protect their financial operations and maintain the trust of their client base.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw personal AI assistant
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the OpenClaw personal AI assistant could allow attackers to gain unauthorized access to personal data or system functions.

Executive Summary:
The OpenClaw personal AI assistant is vulnerable to a high-severity exploit that could lead to the exposure of sensitive personal information and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-25593

Affected Software: OpenClaw

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the OpenClaw AI assistant, a platform that likely handles significant amounts of personal and sensitive data. With a CVSS score of 8.4, the flaw could involve a breakdown in authentication or a vulnerability that allows for the execution of unauthorized commands within the AI's environment.

Business Impact

A successful exploit could result in the leakage of sensitive user data and the potential for an attacker to manipulate the AI's behavior or access the underlying host system. The CVSS score of 8.4 indicates a high level of risk, particularly concerning data privacy and system integrity. This could lead to significant privacy violations and loss of user confidence in the AI platform.

Remediation Plan

Immediate Action: Apply the latest security updates for OpenClaw immediately. Ensure that the application and all its dependencies are updated to their most secure versions.

Proactive Monitoring: Monitor for unusual patterns in AI interactions or unauthorized access to the data repositories used by OpenClaw.

Compensating Controls: Implement strong encryption for all data at rest and in transit, and use strict access controls to limit the AI assistant's permissions on the host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. As AI assistants become more integrated into daily life, they are becoming increasingly attractive targets for cyberattacks.

Analyst Recommendation

Users and organizations using OpenClaw should prioritize this update to protect sensitive information. The high severity of this vulnerability highlights the need for robust security in AI applications. Continuous monitoring and a proactive approach to patching are essential for mitigating the risks associated with this and future vulnerabilities.

---METADATA---
VENDOR: Microsoft
PRODUCT: Semantic Kernel .NET SDK
AFFECTED_VERSIONS: Versions prior to 1.70.0
---END_METADATA---

Description Summary:
Microsoft Semantic Kernel .NET SDK contains an arbitrary file write flaw in the SessionsPythonPlugin. Attackers can exploit DownloadFileAsync or UploadFileAsync to write files to restricted paths.

Executive Summary:
A critical arbitrary file write vulnerability in Microsoft Semantic Kernel .NET SDK could allow attackers to overwrite sensitive system files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-25592

Affected Software: Microsoft Semantic Kernel .NET SDK

Affected Versions: Prior to 1.70.0

Vulnerability: This vulnerability exists within the SessionsPythonPlugin component of the SDK. An attacker can manipulate the localFilePath argument in the DownloadFileAsync or UploadFileAsync functions to perform arbitrary file writes, likely without requiring high-level authentication depending on the implementation's exposure.

Business Impact

A successful exploit allows an attacker to overwrite critical application files or configuration data, leading to a complete compromise of the host system. Given the CVSS score of 9.9, this represents a near-maximum risk to data integrity and system availability, potentially facilitating persistent access within AI-orchestrated environments.

Remediation Plan

Immediate Action: Administrators must update Microsoft.SemanticKernel.Core to version 1.70.0 or later immediately to patch the vulnerable plugin logic.

Proactive Monitoring: Implement logging for all file system interactions initiated by the Semantic Kernel and review arguments passed to the SessionsPythonPlugin for suspicious path traversal patterns.

Compensating Controls: As a temporary measure, developers can implement a Function Invocation Filter to validate and allow-list localFilePath arguments before they reach the vulnerable functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its 9.9 CVSS rating, the potential for rapid exploit development is extremely high.

Analyst Recommendation

The severity of this arbitrary file write flaw necessitates immediate remediation. Organizations utilizing the Semantic Kernel .NET SDK for AI agent orchestration should prioritize the update to version 1.70.0 to prevent total system compromise.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
A flaw in SandboxJS allows attackers to escape the sandbox by overwriting Map.prototype.has. Since Map is included in SAFE_PROTOTYPES, its prototype is accessible for malicious modification.

Executive Summary:
An unauthenticated attacker can escape the SandboxJS environment by exploiting insecure access to the Map prototype, leading to full host system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25587

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: Because the Map object is categorized under SAFE_PROTOTYPES, its prototype is exposed within the sandbox. An unauthenticated attacker can overwrite Map.prototype.has to bypass internal logic and escape the restricted execution environment.

Business Impact

Successful exploitation results in an escape to the host environment, allowing for arbitrary code execution. The CVSS score of 10.0 indicates that this vulnerability poses a maximum threat to the organization, as it allows for complete unauthorized control over the application server.

Remediation Plan

Immediate Action: Update SandboxJS to version 0.8.29 immediately to secure the SAFE_PROTOTYPES definitions and prevent prototype overwriting.

Proactive Monitoring: Review and log all modifications to global object prototypes within the sandboxed environment to detect early signs of escape attempts.

Compensating Controls: Utilize runtime monitoring tools that can detect and block unauthorized system calls or suspicious process spawning from the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. The vulnerability is highly critical as it leverages a trusted component (Map) to break isolation.

Analyst Recommendation

The reliance on a trusted prototype for sandbox escape makes this a high-priority fix. Organizations must apply the 0.8.29 update immediately to ensure that sandboxed code cannot interfere with the host's execution flow.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
SandboxJS allows sandbox escape via shadowing of the hasOwnProperty method. This disables prototype whitelist enforcement, enabling host Object.prototype pollution and persistent cross-sandbox impact.

Executive Summary:
SandboxJS is vulnerable to a critical escape and prototype pollution flaw that allows unauthenticated attackers to gain persistent control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-25586

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: By shadowing hasOwnProperty on a sandboxed object, an unauthenticated attacker can disable security checks in the property-access path. This grants direct access to blocked properties like proto, leading to host-level Object.prototype pollution.

Business Impact

The ability to pollute the host's Object.prototype allows for persistent attacks that can affect all subsequent sandboxes and the main application logic. The CVSS score of 10.0 reflects the total loss of confidentiality, integrity, and availability once the sandbox is escaped.

Remediation Plan

Immediate Action: Immediately upgrade SandboxJS to version 0.8.29 to patch the property-access validation logic.

Proactive Monitoring: Audit sandboxed scripts for attempts to redefine core JavaScript methods or access sensitive prototype properties.

Compensating Controls: Employ strict Content Security Policies (CSP) and minimize the permissions of the environment hosting the JavaScript engine to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is highly critical due to the persistent nature of prototype pollution.

Analyst Recommendation

This vulnerability represents a fundamental failure of the sandbox's isolation mechanisms. We recommend an immediate transition to version 0.8.29 to mitigate the risk of host-level compromise and persistent cross-session attacks.

---METADATA---
VENDOR: International Color Consortium
PRODUCT: iccDEV
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical flaw in the iccDEV libraries and tools allows for potential exploitation during the manipulation and application of ICC color management profiles.

Executive Summary:
The iccDEV color management toolkit is susceptible to a high-severity vulnerability that could be exploited when processing maliciously crafted ICC profiles.

Vulnerability Details

CVE-ID: CVE-2026-25585

Affected Software: International Color Consortium iccDEV

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core libraries of iccDEV used for interacting with ICC color profiles. An attacker could potentially achieve code execution or system instability by forcing the library to process a malformed profile, likely requiring no authentication beyond the delivery of the file.

Business Impact

Successful exploitation could lead to unauthorized access to systems that handle digital imagery or printing workflows. The CVSS score of 7.8 reflects a high severity, indicating that the flaw could result in significant data integrity issues or the compromise of systems within specialized design and production environments.

Remediation Plan

Immediate Action: Update the iccDEV libraries and tools to the latest version provided by the vendor to address flaws in the ICC profile parser.

Proactive Monitoring: Monitor system logs for crashes or unexpected behavior in applications that utilize the iccDEV libraries for color management.

Compensating Controls: Use network-level filtering to block the transmission of ICC profiles from untrusted sources and employ sandboxing for applications that process external media files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in media parsing libraries are frequently targeted for initial access.

Analyst Recommendation

IT administrators should identify all internal tools and applications that rely on the iccDEV toolkit and apply the necessary patches immediately. Ensuring that these libraries are up to date is essential for maintaining the security of the broader media processing infrastructure.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the iccDEV color management libraries could allow an attacker to execute arbitrary code by processing a specially crafted ICC profile.

Executive Summary:
The iccDEV libraries are affected by a high-severity vulnerability that enables arbitrary code execution through the manipulation of ICC color management profiles.

Vulnerability Details

CVE-ID: CVE-2026-25584

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the iccDEV libraries' handling of ICC color management profiles. An unauthenticated attacker can exploit this by delivering a malicious profile to an application, triggering an internal error that allows for memory corruption and subsequent code execution.

Business Impact

The compromise of a core library used for image processing can lead to the widespread exposure of corporate assets. If exploited, this could result in the loss of sensitive data, unauthorized system access, and significant operational disruption. The CVSS score of 7.8 highlights the High severity and the urgent need for remediation to protect the software supply chain.

Remediation Plan

Immediate Action: Update all iccDEV libraries and tools to the latest version immediately to patch the profile parsing logic.

Proactive Monitoring: Monitor for unusual application behavior when processing images and review security logs for signs of memory corruption exploits.

Compensating Controls: Employ application whitelisting and use modern operating systems with advanced memory protections to mitigate the impact of potential exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as long as vulnerable versions of the library are in use across various software ecosystems.

Analyst Recommendation

The primary recommendation is to apply the vendor's patch without delay. Security administrators should conduct a thorough audit of their software inventory to identify and update any third-party applications that utilize the iccDEV libraries.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The iccDEV color management libraries contain a high-severity vulnerability that could be triggered by malformed ICC profiles, leading to system instability or code execution.

Executive Summary:
The iccDEV libraries are susceptible to a vulnerability when parsing ICC profiles, which could allow an attacker to execute arbitrary code on systems using the affected software.

Vulnerability Details

CVE-ID: CVE-2026-25583

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the iccDEV suite of tools during the interaction and manipulation of ICC color management profiles. By crafting a malicious profile, an attacker can exploit an unauthenticated parsing flaw to corrupt memory and potentially take control of the host application.

Business Impact

The risk is substantial for organizations that process large volumes of third-party media. A successful exploit could lead to unauthorized access, data theft, or the introduction of malware into the environment. With a CVSS score of 7.8, the High severity is justified by the potential for widespread impact across various software products that integrate these libraries.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the iccDEV project and update all dependent software.

Proactive Monitoring: Inspect system logs for segmentation faults or other errors in image-processing applications that might indicate exploitation attempts.

Compensating Controls: Implement file-scanning solutions that can detect and block malformed ICC profiles at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of ICC profile parsing makes it a frequent source of security vulnerabilities.

Analyst Recommendation

We recommend that all users of iccDEV-based tools prioritize this update. Maintaining the security of shared libraries is a critical component of a robust vulnerability management program.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The iccDEV color management libraries are vulnerable to a flaw during the processing of ICC profiles, which could lead to memory corruption or arbitrary code execution.

Executive Summary:
A vulnerability in the iccDEV libraries allows for potential code execution when processing malicious ICC color profiles, posing a risk to applications using these tools.

Vulnerability Details

CVE-ID: CVE-2026-25582

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: The iccDEV libraries, used for manipulating ICC color profiles, contain a vulnerability in how they handle profile data. An attacker can provide a malformed ICC profile to an application using these libraries, triggering a memory-related flaw that could allow for unauthorized code execution.

Business Impact

Because these libraries are often integrated into larger software suites (such as image editors or web browsers), the impact can be widespread. A successful exploit could lead to the compromise of any system processing a malicious image. The CVSS score of 7.8 reflects a High severity due to the potential for remote exploitation and the impact on system confidentiality and integrity.

Remediation Plan

Immediate Action: Developers using iccDEV libraries should update to the latest version and recompile their applications; end-users should apply updates for any software that utilizes these libraries.

Proactive Monitoring: Monitor for application crashes when handling image files and use memory protection features like ASLR and DEP.

Compensating Controls: Use sandboxing for image processing tasks and implement strict input validation for all ICC profiles before they are parsed by the library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Library-level vulnerabilities are significant as they represent a supply-chain risk to multiple downstream products.

Analyst Recommendation

Immediate patching is essential for both developers and end-users. Organizations should identify all software in their environment that relies on iccDEV for color management and ensure that these applications are updated to the latest patched versions.

---METADATA---
VENDOR: OpenBullet
PRODUCT: OpenBullet2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
OpenBullet2 contains a high-severity vulnerability that could expose users to unauthorized access or system manipulation.

Executive Summary:
A critical security vulnerability in OpenBullet2 necessitates immediate attention to prevent unauthorized access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25559

Affected Software: OpenBullet2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the OpenBullet2 application. While the specific entry point is not fully detailed, the high CVSS score suggests a significant flaw that may allow unauthorized access or remote command execution.

Business Impact

OpenBullet2 is often used in automated testing and configuration contexts, and its compromise could result in the exposure of sensitive credentials or the use of the platform for malicious automation. The CVSS score of 8.8 indicates a high risk of severe impact to the host environment.

Remediation Plan

Immediate Action: Update OpenBullet2 to the latest patched version provided by the vendor.

Proactive Monitoring: Review all configuration files and user access logs for signs of unauthorized modifications or suspicious activity.

Compensating Controls: Restrict access to the OpenBullet2 interface behind a VPN or IP-based access control list.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of OpenBullet2 should verify their current version and update immediately. Given the high CVSS score, the risk of exploitation is substantial; therefore, administrative vigilance and prompt patching are required to maintain a secure posture.

---METADATA---
VENDOR: OpenBullet2
PRODUCT: OpenBullet2
AFFECTED_VERSIONS: OpenBullet2 through version 0.3.2
---END_METADATA---

Description Summary:
OpenBullet2 contains an authentication bypass vulnerability in its API key middleware, allowing unauthenticated attackers to access the admin console by providing an empty API key.

Executive Summary:
An authentication bypass in OpenBullet2 allows unauthenticated remote attackers to gain full administrative control over the application by manipulating API header values.

Vulnerability Details

CVE-ID: CVE-2026-25555

Affected Software: OpenBullet2

Affected Versions: OpenBullet2 through version 0.3.2

Vulnerability: The vulnerability exists in the API key authentication middleware, which incorrectly compares a user-supplied empty X-Api-Key header against an empty default value. This allows unauthenticated users to gain administrative access to all API endpoints.

Business Impact

The CVSS score of 9.8 reflects the severity of an authentication bypass that grants administrative privileges. Exploitation allows attackers to take full control of the application, potentially leading to data exfiltration, service manipulation, and complete loss of system confidentiality and integrity.

Remediation Plan

Immediate Action: Update OpenBullet2 to a version greater than 0.3.2 immediately.

Proactive Monitoring: Audit API access logs for successful requests lacking valid X-Api-Key headers or identifying attempts to access administrative endpoints.

Compensating Controls: Restrict access to the API and administrative console to known, trusted IP ranges via firewall rules until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides an trivial path to administrative access and must be addressed immediately. Organizations should update their installations and verify that no unauthorized API keys or administrative sessions have been established.

---METADATA---
VENDOR: Seagull Software
PRODUCT: BarTender
AFFECTED_VERSIONS: BarTender 2010, 2016 (<= R9), and 2019 (<= R10)
---END_METADATA---

Description Summary:
Seagull Software BarTender contains an unauthenticated remote code execution vulnerability in its .NET Remoting service, allowing attackers to execute code as NT AUTHORITY\SYSTEM.

Executive Summary:
A critical remote code execution vulnerability in the BarTender .NET Remoting service allows unauthenticated attackers to gain system-level control over the host server.

Vulnerability Details

CVE-ID: CVE-2026-25550

Affected Software: Seagull Software BarTender

Affected Versions: BarTender 2010, 2016 (<= R9), and 2019 (<= R10)

Vulnerability: The vulnerability exists in the .NET Remoting service exposed on TCP port 7375. Due to unsafe configuration of the TypeFilterLevel to "Full," an unauthenticated remote attacker can exploit object unmarshalling to execute arbitrary code, manipulate files, or coerce NTLMv2 authentication.

Business Impact

With a CVSS score of 9.8, this flaw represents a total compromise of the host server. Because the service runs as NT AUTHORITY\SYSTEM, attackers gain the highest level of system privileges, enabling them to install persistent backdoors, steal sensitive credentials, and move laterally across the entire organization's network.

Remediation Plan

Immediate Action: Update BarTender to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor TCP port 7375 for unexpected traffic and review system logs for suspicious process creation or unauthorized file access.

Compensating Controls: Use firewall rules to restrict access to TCP port 7375 to only authorized internal machines, preventing external or unauthorized network segments from reaching the service.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely high-risk vulnerability that requires immediate attention. All affected BarTender installations should be updated, and network access to the Remoting service should be strictly limited until the patch is applied.

---METADATA---
VENDOR: InvoicePlane
PRODUCT: InvoicePlane
AFFECTED_VERSIONS: <= 1.7.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
InvoicePlane versions 1.7.0 and earlier contain a critical RCE vulnerability via a chained Local File Inclusion and log poisoning attack, requiring administrative authentication.

Executive Summary:
A critical Remote Code Execution vulnerability in InvoicePlane allows an authenticated administrator to execute system commands through log poisoning and file inclusion.

Vulnerability Details

CVE-ID: CVE-2026-25548

Affected Software: InvoicePlane

Affected Versions: <= 1.7.0

Vulnerability: The application is vulnerable to a chained attack where an authenticated administrator manipulates the public_invoice_template setting to include poisoned log files, resulting in arbitrary code execution.

Business Impact

This vulnerability allows a malicious administrator to execute arbitrary commands on the host server, leading to a complete compromise of the application environment. The CVSS score of 9.1 reflects the high severity of achieving remote code execution, which could result in data theft or total system destruction.

Remediation Plan

Immediate Action: Upgrade to InvoicePlane version 1.7.1 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for attempts to inject PHP code or unusual requests directed at the public_invoice_template functionality.

Compensating Controls: Restrict administrative access to trusted personnel and ensure the web server user has limited write permissions to sensitive directories to prevent successful log poisoning.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a critical security risk to the integrity of the InvoicePlane platform. Organizations should verify their current deployment version and proceed with an immediate upgrade to 1.7.1 to neutralize the RCE vector.

---METADATA---
VENDOR: Godot
PRODUCT: MCP (Model Context Protocol) Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Godot MCP server, used for interacting with the Godot game engine, contains a vulnerability that could lead to unauthorized interactions or system compromise.

Executive Summary:
The Godot MCP server is affected by a high-severity vulnerability that could allow an attacker to interfere with game engine operations or execute unauthorized commands.

Vulnerability Details

CVE-ID: CVE-2026-25546

Affected Software: Godot MCP Server

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the Model Context Protocol (MCP) server designed for the Godot game engine. It allows for improper interaction handling, which could be exploited by an attacker to manipulate the engine's state or perform actions outside of the intended protocol constraints.

Business Impact

For organizations using Godot for development, this vulnerability could lead to the theft of source code, manipulation of game assets, or unauthorized access to the development environment. The CVSS score of 7.8 indicates a High severity, as it impacts the integrity and availability of the development pipeline. This could result in significant financial loss and damage to the developer's reputation.

Remediation Plan

Immediate Action: Update the Godot MCP server component to the latest secure version and review all server configurations.

Proactive Monitoring: Monitor MCP server logs for unusual connection patterns or malformed protocol requests.

Compensating Controls: Isolate the MCP server within a dedicated development network segment and use firewall rules to restrict access to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. As MCP is a relatively new protocol for engine interaction, it may be a target for researchers exploring development toolchains.

Analyst Recommendation

Developers should immediately update their Godot MCP server instances to mitigate the risk of unauthorized access. Ensuring that development tools are kept up-to-date is critical for maintaining the security of the software supply chain.

---METADATA---
VENDOR: Payload CMS
PRODUCT: Payload
AFFECTED_VERSIONS: Prior to 3.73.0
---END_METADATA---

Description Summary:
Payload CMS is vulnerable to blind SQL injection in JSON and richText field queries. Unauthenticated attackers can extract sensitive data and achieve full account takeover by embedding unescaped input into SQL.

Executive Summary:
An unauthenticated blind SQL injection vulnerability in Payload CMS allows attackers to steal sensitive data and take over administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-25544

Affected Software: Payload CMS

Affected Versions: Prior to 3.73.0

Vulnerability: User input provided during queries of JSON or richText fields is directly embedded into SQL statements without proper escaping. This allows an unauthenticated attacker to perform blind SQL injection to exfiltrate data such as emails and password reset tokens.

Business Impact

The ability to extract password reset tokens allows for full account takeover without the need for password cracking. With a CVSS score of 9.8, this vulnerability poses a critical risk to data confidentiality and can lead to the total compromise of the CMS and its hosted content.

Remediation Plan

Immediate Action: Update Payload CMS to version 3.73.0 or later immediately to ensure all database queries are properly parameterized.

Proactive Monitoring: Review database logs for unusual query patterns or a high frequency of boolean-based or time-based SQL syntax in JSON field filters.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules enabled to detect and block malicious query attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation. However, SQL injection in a headless CMS is a high-impact flaw that is often targeted by automated scanning tools.

Analyst Recommendation

The risk of unauthenticated account takeover makes this a critical priority. Administrators should apply the update to version 3.73.0 immediately to protect sensitive user data and maintain control over their content management system.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: Prior to version 3.5.5
---END_METADATA---

Description Summary:
SiYuan's /api/file/copyFile endpoint fails to validate the 'dest' parameter, allowing authenticated users to write files to arbitrary locations, potentially leading to Remote Code Execution (RCE).

Executive Summary:
An arbitrary file write vulnerability in SiYuan allows authenticated users to achieve Remote Code Execution by overwriting critical system files such as cron jobs or SSH keys.

Vulnerability Details

CVE-ID: CVE-2026-25539

Affected Software: SiYuan Personal Knowledge Management System

Affected Versions: Prior to version 3.5.5

Vulnerability: The vulnerability is located in the /api/file/copyFile endpoint, where the dest parameter lacks proper validation. This allows an authenticated attacker to perform a path traversal attack to write files into sensitive directories, such as shell configuration files or authorized_keys.

Business Impact

While the attack requires authentication, the impact is critical (CVSS 9.1) as it facilitates full system compromise. An attacker could gain persistent access to the server, leading to the total loss of data integrity and confidentiality. This could result in the exposure of private knowledge bases and lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update the SiYuan installation to version 3.5.5 or higher immediately to apply the necessary input validation patches.

Proactive Monitoring: Review system-level logs for unauthorized modifications to sensitive files like /etc/crontab, ~/.ssh/authorized_keys, and shell profiles.

Compensating Controls: Restrict access to the SiYuan API to trusted networks and implement the principle of least privilege for the user account running the SiYuan service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly reduces the risk compared to unauthenticated flaws, but the RCE potential remains a critical threat.

Analyst Recommendation

The ability to write to arbitrary filesystem locations is a high-risk condition. Organizations should enforce immediate updates to version 3.5.5 and audit the server for any signs of unauthorized persistence mechanisms.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Clouddriver / Orca
AFFECTED_VERSIONS: Versions prior to 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0
---END_METADATA---

Description Summary:
Spinnaker Clouddriver and Orca components suffer from a URL validation bypass due to improper handling of underscores in Java URL objects, leading to potential security control circumvention.

Executive Summary:
Spinnaker Clouddriver and Orca are vulnerable to a critical URL validation bypass that allows attackers to circumvent security sanitization using specially crafted URLs.

Vulnerability Details

CVE-ID: CVE-2026-25534

Affected Software: Spinnaker (Clouddriver and Orca)

Affected Versions: Versions prior to 2025.4.1, 2025.3.1, 2025.2.4, and 2026.0.0

Vulnerability: The vulnerability arises because Java URL objects do not correctly handle underscores during parsing, allowing attackers to bypass previous CVE fixes (CVE-2025-61916). This flaw affects both Clouddriver URL sanitation and Orca fromUrl expression handling.

Business Impact

A successful bypass of URL validation can lead to Server-Side Request Forgery (SSRF) or unauthorized data access within the cloud deployment pipeline. With a CVSS score of 9.1, this vulnerability represents a significant risk to the integrity of the CI/CD environment, potentially allowing attackers to interact with internal metadata services or protected resources.

Remediation Plan

Immediate Action: Update Spinnaker to versions 2025.4.1, 2025.3.1, 2025.2.4, or 2026.0.0 immediately to apply the necessary logic fixes for URL parsing.

Proactive Monitoring: Audit Spinnaker logs for suspicious URL patterns, particularly those containing underscores or targeting internal network ranges.

Compensating Controls: Organizations can temporarily disable the affected artifacts or restrict outbound network access from Spinnaker components to minimize the impact of a potential SSRF attack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 17, 2026, there is no public information indicating active exploitation of this vulnerability. This flaw is a direct bypass of a previous security fix, indicating a high likelihood that attackers will attempt to exploit this oversight.

Analyst Recommendation

It is critical to apply the latest Spinnaker patches immediately, as this vulnerability directly undermines the security controls of the cloud delivery platform. Ensure that all instances of Clouddriver and Orca are updated to the fixed versions to maintain pipeline security.

---METADATA---
VENDOR: HubSpot
PRODUCT: JinJava
AFFECTED_VERSIONS: Prior to versions 2.7.6 and 2.8.3
---END_METADATA---

Description Summary:
JinJava is vulnerable to arbitrary Java execution via a sandbox bypass in the ForTag component, allowing unauthorized class instantiation and file access. This issue is resolved in 2.7.6 and 2.8.3.

Executive Summary:
A critical sandbox bypass vulnerability in the HubSpot JinJava template engine allows unauthenticated attackers to execute arbitrary Java code and access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-25526

Affected Software: HubSpot JinJava

Affected Versions: Prior to versions 2.7.6 and 2.8.3

Vulnerability: This flaw exists within the ForTag component of the JinJava template engine. It allows an attacker to bypass built-in sandbox restrictions to instantiate arbitrary Java classes and perform unauthorized file system operations, effectively granting unauthenticated remote code execution capabilities.

Business Impact

A successful exploit could lead to a complete compromise of the host system, including the theft of sensitive data, intellectual property, and credentials. Given the CVSS score of 9.8, this vulnerability poses a critical risk to the confidentiality, integrity, and availability of any application utilizing affected JinJava versions. System downtime and significant reputational damage are highly likely if exploited.

Remediation Plan

Immediate Action: Administrators must immediately upgrade JinJava to version 2.7.6, 2.8.3, or later to eliminate the vulnerable ForTag logic.

Proactive Monitoring: Security teams should monitor application logs for unusual template rendering requests or unexpected Java class instantiation errors.

Compensating Controls: Implementing a strict Web Application Firewall (WAF) to filter malicious template injection patterns can provide temporary protection while updates are deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its critical CVSS score of 9.8, the potential for rapid exploit development is extremely high.

Analyst Recommendation

The severity of an unauthenticated sandbox bypass cannot be overstated. Organizations relying on JinJava for template rendering must prioritize this patch immediately to prevent full system takeover.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.29
---END_METADATA---

Description Summary:
SandboxJS is vulnerable to a sandbox escape via unwrapped function return values. Attackers can access the host's Function constructor to execute arbitrary code outside the restricted environment.

Executive Summary:
A critical sandbox escape vulnerability in SandboxJS allows unauthenticated attackers to bypass security restrictions and execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-25520

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.29

Vulnerability: The library fails to wrap function return values, allowing an unauthenticated attacker to use Object.values or Object.entries to retrieve the host's Function constructor. By leveraging Array.prototype.at, the attacker can invoke this constructor to escape the sandbox.

Business Impact

This vulnerability completely negates the security benefits of the sandbox, leading to host-level arbitrary code execution (ACE). With a CVSS score of 10.0, the impact is catastrophic, potentially resulting in full system takeover, data exfiltration, and lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Update SandboxJS to version 0.8.29 or higher to ensure all return values are properly wrapped and constructors are protected.

Proactive Monitoring: Monitor application logs for unusual patterns of prototype access or attempts to access the Function constructor from within sandboxed scripts.

Compensating Controls: Restrict the capabilities of the process running the sandbox using OS-level isolation (e.g., Docker containers or seccomp profiles) to limit the impact of a successful escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical details provided in the disclosure make the development of a functional exploit trivial.

Analyst Recommendation

Given the CVSS 10.0 rating, this is a maximum-severity issue. Organizations must update to version 0.8.29 immediately to restore the integrity of their sandboxing environment and prevent unauthorized host code execution.

---METADATA---
VENDOR: OpenSlides
PRODUCT: OpenSlides
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
OpenSlides, a web-based presentation and assembly system, is affected by a high-severity vulnerability that could impact the management of agendas and elections.

Executive Summary:
A high-severity vulnerability in OpenSlides could allow an attacker to compromise the integrity of assembly management, including motions and election results.

Vulnerability Details

CVE-ID: CVE-2026-25519

Affected Software: OpenSlides

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability in this web-based system could allow an attacker to interfere with the projected agenda, motions, or election processes. With a CVSS score of 8.1, the flaw likely involves unauthorized data modification or administrative access.

Business Impact

A successful exploit could undermine the democratic processes of an assembly by manipulating election data or agenda items. This poses a significant risk to the integrity of organizations that rely on OpenSlides for official decision-making and record-keeping.

Remediation Plan

Immediate Action: Update the OpenSlides installation to the latest version provided by the developers to patch the vulnerability.

Proactive Monitoring: Review application audit logs for unauthorized changes to election results or agenda configurations.

Compensating Controls: Use strong authentication mechanisms and ensure the web server is hardened against common web application attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The high score suggests that the impact on the integrity of the assembly process is substantial.

Analyst Recommendation

Given the potential impact on organizational governance, it is critical to apply the necessary updates immediately. Organizations should also perform a post-patch audit to ensure no unauthorized changes occurred prior to remediation.

---METADATA---
VENDOR: CI4MS
PRODUCT: CMS Skeleton
AFFECTED_VERSIONS: Prior to version 0.28.5.0
---END_METADATA---

Description Summary:
An authenticated user with file editor permissions in CI4MS can achieve Remote Code Execution (RCE) by uploading and executing arbitrary PHP code via insecure file endpoints.

Executive Summary:
CI4MS is vulnerable to a critical Remote Code Execution (RCE) flaw that allows authenticated users to execute arbitrary PHP code and gain full server control.

Vulnerability Details

CVE-ID: CVE-2026-25510

Affected Software: CI4MS CMS

Affected Versions: Prior to version 0.28.5.0

Vulnerability: The vulnerability exists in the file creation and save endpoints of the CMS. An authenticated attacker with "file editor" permissions can bypass restrictions to create or modify PHP files on the server, leading to code execution.

Business Impact

While this requires authentication, the CVSS score of 9.9 indicates that the impact is nearly total. Successful exploitation grants the attacker the ability to execute any command with the privileges of the web server, potentially leading to data exfiltration, installation of persistent backdoors, or lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update CI4MS to version 0.28.5.0 or later to implement proper security checks on file management operations.

Proactive Monitoring: Review file system changes in the web root for new or modified .php files and audit the activities of users with file editor privileges.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and disable the file editor functionality in production environments if it is not strictly necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. The requirement for authentication slightly reduces the risk compared to unauthenticated RCE, but the severity remains critical.

Analyst Recommendation

The primary recommendation is to apply the security patch immediately. Additionally, organizations should adopt the principle of least privilege, ensuring only highly trusted administrators have file-editing capabilities, and consider using file integrity monitoring (FIM) tools.

---METADATA---
VENDOR: Bambuddy
PRODUCT: Bambuddy
AFFECTED_VERSIONS: Prior to version 0.1.7
---END_METADATA---

Description Summary:
Bambuddy versions prior to 0.1.7 contain a hardcoded JWT secret key and lack authentication checks on many API routes, allowing unauthenticated access and system compromise.

Executive Summary:
Bambuddy is susceptible to complete unauthorized access and control due to a hardcoded cryptographic secret and a failure to enforce authentication on critical API routes.

Vulnerability Details

CVE-ID: CVE-2026-25505

Affected Software: Bambuddy (Bambu Lab 3D printer management)

Affected Versions: Prior to version 0.1.7

Vulnerability: The application utilizes a hardcoded secret key for signing JSON Web Tokens (JWT), which was exposed in the source code. Furthermore, numerous API routes fail to perform any authentication checks, allowing unauthenticated attackers to interact with the system as if they were administrators.

Business Impact

With a CVSS score of 9.8, the impact is critical. Attackers can gain full control over 3D printing workflows, potentially causing physical damage to hardware, stealing proprietary 3D designs, or using the self-hosted server as a pivot point into the local network.

Remediation Plan

Immediate Action: Update Bambuddy to version 0.1.7 or higher immediately to rotate the secret keys and enable mandatory authentication on all API routes.

Proactive Monitoring: Review access logs for requests to API routes that originated from unexpected IP addresses or showed signs of administrative actions without valid credentials.

Compensating Controls: Place the Bambuddy instance behind a reverse proxy that enforces its own authentication (e.g., Authelia or Basic Auth) until the application is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation. However, hardcoded secrets in open-source projects are trivial to exploit once identified.

Analyst Recommendation

The combination of hardcoded secrets and missing authentication is a severe security failure. Administrators must update to version 0.1.7 immediately to secure their printing infrastructure and intellectual property.

---METADATA---
VENDOR: iccDEV
PRODUCT: iccDEV
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the iccDEV libraries and tools, used for ICC color management profiles, could allow for remote exploitation.

Executive Summary:
The iccDEV color management libraries are affected by a high-severity vulnerability that could lead to system compromise when processing malicious ICC profiles.

Vulnerability Details

CVE-ID: CVE-2026-25502

Affected Software: iccDEV

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists in the libraries and tools used for interacting with ICC color management profiles. An attacker could potentially craft a malicious ICC profile that, when processed by a vulnerable application, triggers memory corruption or arbitrary code execution.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a risk to any system that utilizes iccDEV for image processing or color management. A successful exploit could result in the compromise of workstations or servers that handle untrusted media files.

Remediation Plan

Immediate Action: Update all applications and systems using the iccDEV libraries to the latest patched versions immediately.

Proactive Monitoring: Monitor for application crashes when processing image files or ICC profiles, as these may indicate exploitation attempts.

Compensating Controls: Use sandboxing for applications that process untrusted media and implement file-type filtering to restrict the processing of unnecessary color profiles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Vulnerabilities in image and color processing libraries are a common vector for initial access via malicious attachments.

Analyst Recommendation

It is critical to identify all software in the environment that relies on iccDEV and apply the necessary updates. Prioritize patching systems that process files from external or untrusted sources.

---METADATA---
VENDOR: EFM (iptime)
PRODUCT: A6004MX
AFFECTED_VERSIONS: 14.18.2
---END_METADATA---

Description Summary:
A critical unrestricted file upload vulnerability in the iptime A6004MX router allows remote attackers to execute arbitrary code via the commit_vpncli_file_upload function.

Executive Summary:
Remote attackers can achieve full system compromise and arbitrary code execution through an unrestricted file upload vulnerability in the iptime A6004MX router's management interface.

Vulnerability Details

CVE-ID: CVE-2026-2550

Affected Software: EFM iptime A6004MX

Affected Versions: 14.18.2

Vulnerability: The vulnerability exists within the commit_vpncli_file_upload function in /cgi/timepro.cgi. It allows an unauthenticated or remote attacker to upload arbitrary files to the system without restriction, leading to remote code execution (RCE).

Business Impact

The impact of this vulnerability is severe, as reflected in its CVSS score of 9.8. Successful exploitation allows an attacker to take complete control of the router, potentially intercepting all network traffic, pivoting to the internal network, or rendering the device inoperable. This poses a significant threat to organizational data security and business continuity.

Remediation Plan

Immediate Action: Update the iptime A6004MX firmware to the latest available version immediately to patch the vulnerable CGI function.

Proactive Monitoring: Monitor the router's file system and logs for any unexpected files in web-accessible directories or unusual administrative activity.

Compensating Controls: Restrict access to the router's management interface (/cgi/timepro.cgi) to trusted internal IP addresses only and disable remote management features over the WAN.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Feb 16, 2026, a public exploit for this vulnerability is available. The risk is elevated because the vendor reportedly failed to respond to the initial disclosure, increasing the likelihood of active exploitation in the wild.

Analyst Recommendation

Given the availability of a public exploit and the high CVSS score, this vulnerability must be remediated with the highest urgency. Administrators should assume that any internet-facing device running version 14.18.2 is currently at risk of compromise and should apply updates or restrictive access controls immediately.

---METADATA---
VENDOR: zhanghuanhao
PRODUCT: LibrarySystem
AFFECTED_VERSIONS: Up to and including version 1
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the zhanghuanhao LibrarySystem through version 1, potentially allowing for unauthorized system access.

Executive Summary:
The zhanghuanhao LibrarySystem is affected by a high-severity vulnerability that could lead to unauthorized access or data compromise within the management system.

Vulnerability Details

CVE-ID: CVE-2026-2549

Affected Software: zhanghuanhao LibrarySystem (图书馆管理系统)

Affected Versions: Up to 1

Vulnerability: The vulnerability affects the LibrarySystem management software. Although the specific CWE is not detailed, the CVSS score of 7.3 suggests a critical flaw, potentially involving improper access control or input validation that an unauthenticated or low-privileged attacker could exploit.

Business Impact

A successful exploit could result in the unauthorized disclosure of library user data, modification of system records, or potential downtime for the library services. The severity score of 7.3 indicates that this flaw could significantly impact the operational integrity of the affected institution.

Remediation Plan

Immediate Action: Discontinue use of version 1 or apply any available security patches from the developer, zhanghuanhao, immediately.

Proactive Monitoring: Review web server and application logs for unusual POST requests or SQL injection patterns targeting the LibrarySystem's administrative interfaces.

Compensating Controls: Place the application behind a Web Application Firewall (WAF) with rules configured to block common exploit payloads and restrict access to the management interface to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. The lack of detailed documentation for this product increases the risk of undiscovered flaws.

Analyst Recommendation

Given the high severity and the potential for unauthorized access, organizations using this software should prioritize remediation. If a patch is unavailable, consider migrating to a more modern and actively supported library management platform to ensure long-term security.

---METADATA---
VENDOR: ACPT
PRODUCT: ACPT (Pro) - Custom Post Types Plugin
AFFECTED_VERSIONS: from n/a through 2.0.47
---END_METADATA---

Description Summary:
An improper code injection vulnerability in the ACPT (Pro) plugin for WordPress allows unauthenticated remote attackers to execute arbitrary code.

Executive Summary:
A critical remote code execution vulnerability in the ACPT (Pro) WordPress plugin allows unauthenticated attackers to gain complete control over the host server.

Vulnerability Details

CVE-ID: CVE-2026-25470

Affected Software: ACPT ACPT (Pro) - Custom Post Types Plugin

Affected Versions: from n/a through 2.0.47

Vulnerability: This flaw (CWE-94) arises from improper control of code generation, which permits an unauthenticated remote attacker to inject and execute malicious PHP code within the WordPress environment. The vulnerability effectively bypasses all authentication mechanisms, granting full system access to an attacker.

Business Impact

Successful exploitation of this vulnerability results in a total compromise of the affected WordPress instance, leading to data exfiltration, unauthorized administrative access, and potential lateral movement into the hosting infrastructure. Given the CVSS score of 10.0, this represents the highest level of risk to operational integrity and data confidentiality.

Remediation Plan

Immediate Action: As of June 16, 2026, no official patch is available; administrators should immediately disable or uninstall the ACPT (Pro) plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious POST requests or attempts to access configuration files that deviate from standard user traffic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common code injection patterns and attempts to access sensitive plugin directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical severity of this vulnerability and the lack of an immediate patch, the risk of total system compromise is extreme. Organizations utilizing this plugin must prioritize its removal or isolation from the public-facing network until the vendor provides a remediation path.

---METADATA---
VENDOR: Shinetheme
PRODUCT: Traveler
AFFECTED_VERSIONS: n/a before 3.2.8.1
---END_METADATA---

Description Summary:
The Traveler theme/plugin by Shinetheme is vulnerable to PHP Object Injection via deserialization of untrusted data, potentially leading to remote code execution.

Executive Summary:
A critical PHP Object Injection vulnerability in the Shinetheme Traveler product allows attackers to execute arbitrary code by exploiting insecure data deserialization.

Vulnerability Details

CVE-ID: CVE-2026-25449

Affected Software: Shinetheme Traveler

Affected Versions: n/a before 3.2.8.1

Vulnerability: The software performs deserialization of untrusted data without adequate validation. An attacker can supply a specially crafted PHP serialized string to trigger Object Injection, which, when combined with available "POP chains" in the environment, can lead to arbitrary file deletion or remote code execution.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk. Successful exploitation can result in a total compromise of the WordPress site, including the theft of sensitive user information and the disruption of business operations. The impact is exacerbated if the site handles booking or financial transactions.

Remediation Plan

Immediate Action: Update the Shinetheme Traveler theme or plugin to version 3.2.8.1 or higher immediately.

Proactive Monitoring: Monitor web server logs for suspicious serialized data patterns in GET or POST parameters and check for unauthorized file changes.

Compensating Controls: Disable the use of unserialize() on user-controllable input and replace it with safer alternatives like json_decode(). A WAF can also be configured to block common PHP object injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. Deserialization flaws are highly technical but very potent, making them high-priority targets for sophisticated attackers.

Analyst Recommendation

The high CVSS score necessitates immediate action. Organizations using the Traveler theme must apply the patch to version 3.2.8.1 to prevent potential remote code execution and ensure the continued security of their web presence.

---METADATA---
VENDOR: Jonathan Daggerhart
PRODUCT: Widget Wrangler
AFFECTED_VERSIONS: From n/a through 2.3.9
---END_METADATA---

Description Summary:
Widget Wrangler is vulnerable to Code Injection due to improper control of code generation. This affects versions up to and including 2.3.9.

Executive Summary:
A critical code injection vulnerability in the Widget Wrangler WordPress plugin allows attackers to execute arbitrary code, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25447

Affected Software: Widget Wrangler (WordPress Plugin)

Affected Versions: From n/a through 2.3.9

Vulnerability: This is a Code Injection vulnerability in the widget-wrangler component. The application fails to properly control the generation of code, allowing an attacker to inject malicious logic that the server then executes.

Business Impact

An attacker can exploit this flaw to execute arbitrary commands, access the database, or modify site content. This level of access results in a complete compromise of the application's confidentiality and integrity. The CVSS score of 9.1 confirms the high severity and urgency of this issue.

Remediation Plan

Immediate Action: Update Widget Wrangler to the latest version (v2.4.0 or higher) immediately to patch the vulnerable code generation logic.

Proactive Monitoring: Monitor for unauthorized changes to widget configurations and review logs for suspicious PHP execution patterns.

Compensating Controls: Restrict access to the WordPress administrative dashboard and use a WAF to filter out common code injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. However, because widgets often process data on every page load, this vulnerability could be used to inject persistent malicious scripts (XSS) or server-side code.

Analyst Recommendation

Promptly applying the vendor's patch is the only effective way to mitigate this risk. Given the high CVSS score, we recommend that this update be treated as a priority to prevent unauthorized code execution and maintain the security of the WordPress platform.

---METADATA---
VENDOR: yued-fe
PRODUCT: LuLu UI
AFFECTED_VERSIONS: Up to 3
---END_METADATA---

Description Summary:
A security flaw in yued-fe LuLu UI versions up to 3 allows for potential remote exploitation of the user interface components.

Executive Summary:
A high-severity security flaw in the LuLu UI framework versions up to 3 poses a significant risk to applications utilizing this interface, potentially leading to unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-2544

Affected Software: yued-fe LuLu UI

Affected Versions: Up to version 3

Vulnerability: While specific technical details are limited, the flaw is identified as a significant security issue within the UI library components. Based on the CVSS score of 7.3, this likely involves a remote vector where an attacker can influence the UI behavior or gain unauthorized access.

Business Impact

A successful exploit could lead to cross-site scripting (XSS), data leakage, or unauthorized user sessions depending on how the UI framework is implemented. The CVSS score of 7.3 indicates a high severity, suggesting that the vulnerability could compromise the integrity of the web application and undermine user trust in the affected platform.

Remediation Plan

Immediate Action: Apply the latest security updates from the yued-fe repository or transition to a patched version of the LuLu UI library immediately.

Proactive Monitoring: Monitor web application logs for suspicious input patterns or anomalous behavior associated with UI component interactions and front-end requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common web-based attack vectors targeting front-end frameworks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 16, 2026, there is no public information indicating active exploitation of this vulnerability. Organizations should follow vendor advisories closely as more technical details become available.

Analyst Recommendation

The high severity of this flaw necessitates immediate attention from development teams using the LuLu UI library. It is recommended to prioritize the update of all front-end dependencies to their most secure versions to prevent potential exploitation of the user interface.

---METADATA---
VENDOR: Total VPN
PRODUCT: Total VPN
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in Total VPN that could allow an attacker to compromise the confidentiality or integrity of the VPN service.

Executive Summary:
Total VPN contains a significant security weakness that poses a high risk to user data privacy and the integrity of secure communication channels.

Vulnerability Details

CVE-ID: CVE-2026-2542

Affected Software: Total VPN Total VPN

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified weakness within the Total VPN application. Based on the software type, this flaw likely impacts the handling of secure tunnels or user authentication, potentially allowing an attacker to bypass security controls.

Business Impact

A successful exploit could lead to the interception of encrypted network traffic, unauthorized access to sensitive corporate data, or the compromise of the user's host system. The CVSS score of 7.0 (High) reflects the substantial risk to organizational privacy and the potential for significant reputational damage if user communications are exposed.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Total VPN immediately to mitigate the risk of exploitation.

Proactive Monitoring: Security teams should monitor for anomalous VPN connection patterns or unexpected spikes in encrypted traffic originating from unauthorized geographic locations.

Compensating Controls: Implement robust endpoint protection (EDR) and enforce multi-factor authentication (MFA) to provide layered defense if immediate patching is delayed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role VPNs play in perimeter security, the potential for targeted exploitation remains high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention from IT administrators. To ensure the continued protection of remote access communications, the primary remediation—updating the Total VPN client—must be performed across all affected endpoints without delay.