---METADATA---
VENDOR: NaturalIntelligence
PRODUCT: fast-xml-parser
AFFECTED_VERSIONS: >= 5.9.3, < 5.10.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The fast-xml-parser library is vulnerable to XML Entity Expansion, which could allow an attacker to cause a denial of service via specially crafted XML input.

Executive Summary:
A high-severity XML entity expansion vulnerability in the fast-xml-parser library poses a significant risk of denial-of-service attacks.

Vulnerability Details

CVE-ID: CVE-2026-73569

Affected Software: NaturalIntelligence fast-xml-parser

Affected Versions: >= 5.9.3, < 5.10.1

Vulnerability: This vulnerability, classified as CWE-776, involves the improper restriction of recursive entity references in DTDs. It allows an unauthenticated attacker to supply malicious XML payloads to the parser, leading to excessive resource consumption.

Business Impact

Successful exploitation results in service unavailability, as the parser consumes excessive memory or CPU cycles while processing the recursive entities. With a CVSS score of 8.7, the impact on availability is critical for applications relying on this library for data processing. This could lead to significant operational disruptions for dependent services.

Remediation Plan

Immediate Action: Update the npm package fast-xml-parser to version 5.10.1 or later to implement the necessary security patches.

Proactive Monitoring: Monitor application logs for unusual XML processing patterns or sudden spikes in memory usage that may indicate attempts to trigger entity expansion.

Compensating Controls: If immediate patching is not feasible, implement strict XML schema validation to reject documents containing DTDs or external entity references before they reach the parser.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to facilitate automated denial-of-service attacks against internet-facing services.

Analyst Recommendation

Given the high CVSS score and the ease of exploitation, teams should prioritize upgrading to version 5.10.1. Failure to address this vulnerability leaves critical data processing pipelines exposed to potential service outages.

---METADATA---
VENDOR: fatedier
PRODUCT: frp
AFFECTED_VERSIONS: >= 0.53.0, < 0.70.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The frp reverse proxy is vulnerable to a denial of service attack via integer overflow and improper array index validation.

Executive Summary:
An integer overflow vulnerability in the fatedier frp reverse proxy allows remote, unauthenticated attackers to cause a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2026-73564

Affected Software: fatedier frp

Affected Versions: 0.53.0 through 0.70.0

Vulnerability: This issue stems from improper validation of array indices (CWE-129) and integer overflows (CWE-190), which can lead to application crashes when processing malformed network traffic. This vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation results in the crashing of the frp service, leading to service disruption for any traffic relying on the proxy. Given the CVSS score of 8.7, the impact on availability is significant for organizations that depend on frp for connectivity. Downtime caused by this vulnerability could result in operational delays and potential loss of business continuity.

Remediation Plan

Immediate Action: Update the frp deployment to version 0.70.1 or later.

Proactive Monitoring: Review system logs for frequent service restarts or unexpected crashes related to the frp process.

Compensating Controls: Deploy a Web Application Firewall or network filter to drop malformed packets that might trigger the integer overflow condition.

Exploitation Status

Public Exploit Available: No confirmed public exploit (no weaponized module or curated PoC confirmed in available data).

Analyst Notes: As of August 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently susceptible to remote triggering via specially crafted network packets.

Analyst Recommendation

The presence of a proof-of-concept makes this vulnerability an urgent priority. Administrators should apply the 0.70.1 update immediately to ensure service stability and prevent potential denial of service attacks.

---METADATA---
VENDOR: WPManageNinja
PRODUCT: Ninja Tables Pro
AFFECTED_VERSIONS: 5.2.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ninja Tables Pro version 5.2.11 contained a malicious backdoor injected via a tampered plugin build, enabling unauthorized administrative access and persistent system compromise.

Executive Summary:
A critical supply chain compromise in WPManageNinja Ninja Tables Pro version 5.2.11 has introduced a backdoor allowing remote code execution and unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-73533

Affected Software: WPManageNinja Ninja Tables Pro

Affected Versions: 5.2.11

Vulnerability: This vulnerability involves the distribution of a tampered plugin build containing malicious PHP code. The code facilitates a backdoor REST API, creates a passwordless admin account, and drops persistent backdoors in the server file system that survive plugin uninstallation.

Business Impact

The backdoor allows attackers full administrative control over the affected WordPress site, leading to potential data theft, site defacement, and the deployment of further malware. Given the CVSS score of 9.8, this incident poses an extreme risk to the confidentiality, integrity, and availability of the affected web application.

Remediation Plan

Immediate Action: Update Ninja Tables Pro to the latest version immediately, and conduct a forensic scan of the server to purge any malicious files or unauthorized accounts created by the backdoor.

Proactive Monitoring: Regularly audit the WordPress user list for suspicious accounts and scan the server file system for unknown PHP files, particularly in the mu-plugins and uploads folders.

Compensating Controls: Use a WAF to monitor and block unauthorized requests to the WordPress REST API and ensure that file integrity monitoring is active on the server.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This is a severe supply chain incident where the vendor's distribution mechanism was leveraged to deliver malicious code to end users.

Analyst Recommendation

The severity of this issue cannot be overstated. Administrators must treat this as a total system compromise if the affected version was installed. Immediate patching is mandatory, followed by a thorough investigation of the server environment to ensure all traces of the backdoor have been eradicated, as simple updates may not remove the persistence mechanisms installed by the malicious code.

---METADATA---
VENDOR: WPManageNinja
PRODUCT: Fluent Forms Pro
AFFECTED_VERSIONS: 6.2.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fluent Forms Pro version 6.2.7 contained a malicious backdoor injected via a tampered plugin build, allowing unauthorized administrative access and persistent system compromise.

Executive Summary:
A critical supply chain compromise in WPManageNinja Fluent Forms Pro version 6.2.7 has introduced a backdoor allowing remote code execution and unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-73532

Affected Software: WPManageNinja Fluent Forms Pro

Affected Versions: 6.2.7

Vulnerability: This is an embedded malicious code vulnerability where a tampered plugin build was distributed. The malicious code establishes a backdoor REST API endpoint, creates a passwordless administrator account, and installs persistent PHP files in the server environment.

Business Impact

The presence of a backdoor provides attackers with persistent, high-level access to the WordPress environment. This risk includes unauthorized data exfiltration, total site takeover, and the potential for the server to be used as a staging point for broader attacks. With a CVSS score of 9.8, this compromise represents a catastrophic failure of the software supply chain.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately, and perform a comprehensive security audit of the WordPress installation to identify and remove any unauthorized administrator accounts or persistent malicious files.

Proactive Monitoring: Monitor the WordPress user database for unauthorized administrator accounts and check the mu-plugins and uploads directories for suspicious PHP files that may have been dropped by the backdoor.

Compensating Controls: Ensure the site is behind a robust WAF and restrict access to the REST API endpoints if they are not strictly required for site functionality.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this vulnerability, being a direct injection of malicious code into a distributed build, indicates a high degree of intent and potential for widespread impact.

Analyst Recommendation

This is an extremely severe incident requiring immediate attention. Organizations using version 6.2.7 of Fluent Forms Pro must not only update the plugin but also verify the integrity of the entire WordPress instance, as the backdoor is designed to maintain persistence even after the plugin is removed.

---METADATA---
VENDOR: COVESA
PRODUCT: Open1722
AFFECTED_VERSIONS: 0 through 0.9.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
COVESA Open1722 contains a numeric truncation error in the ACF CAN listener, which may lead to unauthorized stack memory disclosure.

Executive Summary:
A numeric truncation vulnerability in COVESA Open1722 versions 0 through 0.9.2 creates a risk of sensitive stack memory disclosure to unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-73523

Affected Software: COVESA Open1722

Affected Versions: 0 through 0.9.2

Vulnerability: This vulnerability is a numeric truncation error (CWE-197) in the ACF CAN listener. It allows an unauthenticated, remote attacker to trigger conditions that disclose internal stack memory contents.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant security risk. Unauthorized disclosure of stack memory can lead to the exposure of cryptographic keys, session tokens, or other sensitive data, potentially facilitating further attacks against the host system.

Remediation Plan

Immediate Action: Check the official COVESA Open1722 repository for patched releases and update the software to the latest version.

Proactive Monitoring: Review system and application logs for unusual memory access patterns or unauthorized attempts to probe the CAN listener interface.

Compensating Controls: Utilize host-based intrusion detection systems to monitor for anomalous memory access or unexpected crashes within the Open1722 process space.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation in the wild.

Analyst Recommendation

The risk of memory disclosure necessitates prompt action. Users of the COVESA Open1722 software should verify their current version and update to a version that addresses the numeric truncation flaw to maintain data confidentiality.

---METADATA---
VENDOR: COVESA
PRODUCT: Open1722
AFFECTED_VERSIONS: 0 through 0.9.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
COVESA Open1722 is susceptible to a stack-based buffer overflow that could allow for unauthorized code execution or system instability.

Executive Summary:
A stack-based buffer overflow in COVESA Open1722 presents a high-severity risk that could be leveraged by remote attackers to impact system integrity.

Vulnerability Details

CVE-ID: CVE-2026-73522

Affected Software: COVESA Open1722

Affected Versions: 0 through 0.9.2

Vulnerability: This is a stack-based buffer overflow vulnerability, identified as CWE-121, occurring during the processing of AVTP to CAN data. The vulnerability is remotely triggerable by an unauthenticated attacker.

Business Impact

A successful exploit could result in an attacker gaining control over the process flow or causing significant system instability. With a CVSS score of 7.5, this vulnerability represents a high risk to the availability and integrity of systems relying on the Open1722 implementation.

Remediation Plan

Immediate Action: Maintain vigilance for security patches from the COVESA project and apply updates to the Open1722 implementation immediately.

Proactive Monitoring: Monitor for anomalous spikes in memory usage or unexpected segmentation faults in services utilizing the Open1722 library.

Compensating Controls: Deploy strict packet inspection on the network interface to identify and drop malformed AVTP frames before they reach the vulnerable parser.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Stack-based buffer overflows in network-facing components are historically high-value targets for attackers seeking remote code execution.

Analyst Recommendation

Due to the severity of stack-based buffer overflows, it is critical that organizations using COVESA Open1722 monitor for vendor-supplied patches. Until a fix is applied, prioritize network-level restrictions to prevent untrusted traffic from reaching the parsing logic.

---METADATA---
VENDOR: wolfsoftwaresystemsltd
PRODUCT: WolfStack
AFFECTED_VERSIONS: 0 up to (excluding) 25.9.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WolfStack contains a hard-coded authentication secret, allowing unauthenticated remote attackers to bypass authentication and execute arbitrary commands as root inside containers.

Executive Summary:
A critical hard-coded credential vulnerability in WolfStack allows unauthenticated attackers to achieve full administrative control and remote code execution on the host.

Vulnerability Details

CVE-ID: CVE-2026-73519

Affected Software: wolfsoftwaresystemsltd WolfStack

Affected Versions: 0 up to (excluding) 25.9.2

Vulnerability: The application utilizes a hard-coded secret for cluster authentication, which is exposed in the source code. This flaw allows unauthenticated attackers to bypass all authentication gates and interact with the management API to execute commands on host containers.

Business Impact

The presence of a hard-coded administrative secret renders the entire deployment insecure by default. With a CVSS score of 9.8, this vulnerability poses an extreme risk, as it permits full unauthorized access to containerized workloads, potentially leading to complete data exfiltration, service disruption, and total compromise of the host infrastructure.

Remediation Plan

Immediate Action: Upgrade to WolfStack version 25.9.2 or later immediately to remove the hard-coded credential and implement secure authentication mechanisms.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /api/containers/ management endpoint, specifically those containing the X-WolfStack-Secret header.

Compensating Controls: Restrict access to the WolfStack management port at the network layer using firewalls or VPNs to ensure only authorized administrative endpoints can reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the static nature of the hard-coded secret, which provides a trivial path for attackers to gain full system access.

Analyst Recommendation

This is a critical vulnerability that requires urgent patching. Given the simplicity of the attack vector, organizations running WolfStack must prioritize updating to version 25.9.2 to eliminate the exposure caused by the hard-coded secret.

---METADATA---
VENDOR: PostGIS
PRODUCT: address_standardizer
AFFECTED_VERSIONS: 0 up to (excluding) 423570b0dbf6cd9f6fc36de28a636e7b6e9aa8aa
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The PostGIS address_standardizer extension contains an out-of-bounds write vulnerability that can be triggered during address standardization processes.

Executive Summary:
An out-of-bounds write vulnerability in the PostGIS address_standardizer extension poses a critical risk to database integrity and system stability.

Vulnerability Details

CVE-ID: CVE-2026-73514

Affected Software: PostGIS address_standardizer

Affected Versions: 0 up to (excluding) 423570b0dbf6cd9f6fc36de28a636e7b6e9aa8aa

Vulnerability: The extension is susceptible to an out-of-bounds write (CWE-787) when processing inputs. An authenticated attacker can trigger this memory corruption, leading to potential arbitrary code execution or service crashes.

Business Impact

With a CVSS score of 8.8, this memory corruption issue allows for significant technical impact, including total system compromise. If exploited, an attacker could disrupt database availability or gain unauthorized control over the underlying server hosting the PostgreSQL instance, leading to catastrophic data loss or exfiltration.

Remediation Plan

Immediate Action: Apply the vendor-provided patch by updating the address_standardizer extension to the commit version 423570b0dbf6cd9f6fc36de28a636e7b6e9aa8aa or newer.

Proactive Monitoring: Monitor PostgreSQL logs for segmentation faults or unexpected process terminations associated with the extension.

Compensating Controls: Restrict database access permissions to minimize the number of users capable of executing extension-specific functions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Memory corruption bugs of this nature are frequently targeted for weaponization.

Analyst Recommendation

Given the existence of a proof-of-concept, the risk of exploitation is elevated. Organizations utilizing the PostGIS address_standardizer extension should prioritize patching the library to ensure the stability and security of their database environments.

---METADATA---
VENDOR: etcd-io
PRODUCT: etcd
AFFECTED_VERSIONS: < 3.5.33, >= 3.6.0, < 3.6.14, >= 3.7.0-alpha.0, < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The etcd distributed key-value store is vulnerable to a resource exhaustion attack due to improper limitation of resource allocation.

Executive Summary:
A resource allocation vulnerability in etcd allows unauthenticated remote attackers to trigger a denial-of-service condition by exhausting system resources.

Vulnerability Details

CVE-ID: CVE-2026-73500

Affected Software: etcd-io etcd

Affected Versions: < 3.5.33, >= 3.6.0, < 3.6.14, >= 3.7.0-alpha.0, < 3.7.1

Vulnerability: The application lacks sufficient limits or throttling for resource allocation (CWE-770), which can be leveraged by an unauthenticated attacker to cause a denial-of-service (DoS) by crashing the service.

Business Impact

Successful exploitation results in the unavailability of the etcd service, which is a critical component for many distributed systems and container orchestration platforms. With a CVSS score of 8.7, this vulnerability poses a severe risk to service continuity, potentially causing significant downtime for dependent applications.

Remediation Plan

Immediate Action: Update etcd to version 3.5.33, 3.6.14, or 3.7.1, depending on the current branch in use.

Proactive Monitoring: Monitor system resource usage (CPU and memory) and etcd service health metrics to detect potential resource exhaustion attempts.

Compensating Controls: Deploy rate-limiting at the network or load balancer level to restrict the volume of requests sent to the etcd cluster.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable as it does not require authentication to initiate the resource-intensive requests.

Analyst Recommendation

Given that etcd is a foundational component for many systems, this patch should be applied with high urgency. Administrators should verify their current version and upgrade to the corresponding patched release to ensure system resilience against denial-of-service attacks.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: 0 up to (excluding) 3.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Flowise is susceptible to a sandbox escape vulnerability via improper input validation in specific pandas methods, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
An authenticated sandbox escape vulnerability in Flowise before version 3.1.3 poses a critical risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-73484

Affected Software: FlowiseAI Flowise

Affected Versions: 0 up to (excluding) 3.1.3

Vulnerability: This vulnerability, identified as CWE-184, involves an incomplete list of disallowed inputs that allows a logged-in user to bypass sandbox restrictions when utilizing certain pandas methods. By providing malicious input, an authenticated attacker can achieve arbitrary code execution on the underlying host.

Business Impact

Successful exploitation of this vulnerability allows an attacker to break out of the application sandbox and execute commands with the privileges of the Flowise process. Given the CVSS score of 8.6, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the production environment.

Remediation Plan

Immediate Action: Upgrade all instances of Flowise to version 3.1.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Inspect server logs for unusual pandas-related activity or unexpected system calls originating from the Flowise service account.

Compensating Controls: Restrict access to the Flowise interface to trusted users only and implement network segmentation to limit the impact of a potential container breakout.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for escaping restricted execution environments.

Analyst Recommendation

The severity of this flaw necessitates immediate remediation. Administrators should prioritize upgrading to version 3.1.3 to close the sandbox escape vector, as the availability of proof-of-concept material increases the likelihood of opportunistic exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome on Windows
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Accessibility component of Google Chrome on Windows could allow for arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Google Chrome’s Accessibility component on Windows presents a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7344

Affected Software: Google Chrome on Windows

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a use-after-free error in the Accessibility feature of Chrome. An unauthenticated attacker can trigger this flaw by enticing a user to visit a malicious website.

Business Impact

With a CVSS score of 8.8, this flaw represents a high risk to Windows-based enterprise workstations. If exploited, an attacker could gain control over the browser process, potentially leading to privilege escalation or further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update Google Chrome on all Windows workstations to version 147 or later immediately.

Proactive Monitoring: Monitor system logs for unexpected application crashes or unauthorized process executions originating from the Chrome browser.

Compensating Controls: Use Group Policy to enforce browser updates and limit the execution of high-risk browser extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the widespread use of Chrome on Windows, this vulnerability should be treated with high urgency. IT administrators must ensure that all Windows clients are updated to the latest version to protect against potential exploitation.

---METADATA---
VENDOR: vulnerability-lookup
PRODUCT: vulnerability-lookup
AFFECTED_VERSIONS: 0 through 5.5.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Vulnerability-Lookup is susceptible to an authentication bypass via a capture-replay attack during the account activation and password recovery processes.

Executive Summary:
An authentication bypass vulnerability in the Vulnerability-Lookup software allows attackers to intercept and replay tokens to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-73431

Affected Software: vulnerability-lookup vulnerability-lookup

Affected Versions: 0 through 5.5.1

Vulnerability: The software fails to properly secure its account recovery and activation mechanisms against capture-replay attacks (CWE-294), allowing an authenticated attacker to potentially assume control of other user sessions.

Business Impact

This vulnerability enables unauthorized access to user accounts, which could lead to the exposure of sensitive platform data or administrative account takeover. With a CVSS score of 8.8, this flaw represents a significant risk to the overall security posture and trust of the application.

Remediation Plan

Immediate Action: Review the vendor repository for the latest security patches. If a specific patch version is not yet released, implement temporary restrictions on the password recovery and account activation features.

Proactive Monitoring: Monitor authentication logs for anomalous patterns, specifically multiple successful password resets or account activations occurring from unusual IP addresses.

Compensating Controls: Enforce multi-factor authentication (MFA) for all users to mitigate the impact of compromised account credentials.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a specific sequence of actions to capture traffic, making it a targeted attack vector.

Analyst Recommendation

Security teams must prioritize monitoring for any signs of unauthorized account modifications. It is critical to apply the vendor-provided patch as soon as it becomes available to prevent potential session hijacking and identity theft.

---METADATA---
VENDOR: Google
PRODUCT: Chrome on Android
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the WebView component of Google Chrome on Android may allow for remote code execution.

Executive Summary:
A high-severity use-after-free vulnerability in Chrome on Android's WebView component exposes mobile devices to potential remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-7342

Affected Software: Google Chrome on Android

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a use-after-free error in the WebView component. It allows an unauthenticated attacker to cause memory corruption via a specially crafted webpage on an Android device.

Business Impact

The CVSS score of 8.8 underscores the gravity of this vulnerability for mobile device security. Successful exploitation could lead to unauthorized access to enterprise data stored on mobile devices, potentially compromising the integrity of corporate mobile device management (MDM) environments.

Remediation Plan

Immediate Action: Update the Google Chrome application on all Android devices to version 147 or higher through the Google Play Store.

Proactive Monitoring: Monitor mobile device management (MDM) consoles for devices running outdated versions of Chrome.

Compensating Controls: Enforce strict mobile security policies and restrict the use of non-essential third-party applications that utilize WebView.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mobile devices are an increasingly common attack vector. Security teams must ensure that Chrome on Android is updated immediately to the latest version to prevent potential exploitation of the WebView component.

---METADATA---
VENDOR: jupyterlab
PRODUCT: jupyterlab
AFFECTED_VERSIONS: >= 3.3.0, < 4.5.10; >= 4.6.0, < 4.6.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JupyterLab is vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input and output encoding, allowing attackers to execute arbitrary scripts in a user's browser session.

Executive Summary:
A high-severity Cross-site Scripting vulnerability in JupyterLab allows unauthenticated attackers to execute malicious scripts within a user's browser session.

Vulnerability Details

CVE-ID: CVE-2026-73417

Affected Software: jupyterlab jupyterlab

Affected Versions: >= 3.3.0, < 4.5.10; >= 4.6.0, < 4.6.2

Vulnerability: This vulnerability involves improper neutralization of input during web page generation (CWE-79) and improper encoding or escaping of output (CWE-116). The attack vector is network-based and does not require authentication, though it does require user interaction.

Business Impact

Successful exploitation can lead to unauthorized access to sensitive user data, session hijacking, or the execution of malicious actions on behalf of the authenticated user. Given the CVSS score of 8.6, this flaw poses a significant risk to the integrity and confidentiality of research or data environments managed within JupyterLab.

Remediation Plan

Immediate Action: Update the jupyterlab package to version 4.5.10 or 4.6.2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review web server and application logs for suspicious activity, specifically looking for unusual script injections or unexpected redirects.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded and executed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for cross-site scripting in an environment often used to handle sensitive data.

Analyst Recommendation

Due to the high CVSS score and the nature of XSS vulnerabilities, organizations should treat this as a priority update. Administrators must verify their current version and apply the appropriate patch to ensure the environment is protected against potential script injection attacks.

---METADATA---
VENDOR: ericcornelissen
PRODUCT: shescape
AFFECTED_VERSIONS: >= 2.1.11, < 2.1.14, >= 3.0.0, < 3.0.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The shescape JavaScript library is vulnerable to uncontrolled resource consumption, which can lead to a denial of service.

Executive Summary:
A high severity vulnerability in the shescape library allows an unauthenticated attacker to cause a denial of service via resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-73413

Affected Software: ericcornelissen shescape

Affected Versions: >= 2.1.11, < 2.1.14, >= 3.0.0, < 3.0.1

Vulnerability: This vulnerability involves uncontrolled resource consumption and inefficient algorithmic complexity (CWE-400, CWE-407). It can be triggered by an unauthenticated attacker, potentially leading to application instability or service failure.

Business Impact

Successful exploitation results in a denial of service, which can render applications relying on the shescape library unavailable. With a CVSS score of 8.7, this represents a significant risk to business continuity, especially for services that require high availability.

Remediation Plan

Immediate Action: Update the shescape package to version 2.1.14 or 3.0.1 immediately.

Proactive Monitoring: Monitor server CPU and memory usage patterns for spikes that correlate with unusual input processing.

Compensating Controls: Implement rate limiting and input validation at the application layer to mitigate the impact of malicious payloads before they reach the library.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by providing crafted input that triggers inefficient processing logic.

Analyst Recommendation

Given the high CVSS score and the potential for service disruption, administrators should prioritize updating the shescape library. Patching is the only effective way to resolve the underlying algorithmic inefficiency.

---METADATA---
VENDOR: Budibase
PRODUCT: budibase
AFFECTED_VERSIONS: < 3.40.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is affected by a combination of Time-of-check Time-of-use (TOCTOU) race conditions and Server-Side Request Forgery (SSRF) vulnerabilities.

Executive Summary:
Budibase versions prior to 3.40.0 are vulnerable to race conditions and SSRF, which could allow an authenticated attacker to bypass security controls or perform unauthorized requests.

Vulnerability Details

CVE-ID: CVE-2026-73410

Affected Software: Budibase budibase

Affected Versions: < 3.40.0

Vulnerability: This vulnerability involves a TOCTOU race condition and SSRF flaws that allow an authenticated user to perform unauthorized actions or interact with internal systems. The attack requires low privileges and can lead to significant security bypasses.

Business Impact

The identified vulnerabilities pose a high risk to organizational data and infrastructure. An attacker could potentially leverage SSRF to scan or interact with internal network resources that are otherwise inaccessible from the public internet. Given the CVSS score of 8.5, this issue is critical, as it allows for total technical impact, including data exfiltration or internal service disruption.

Remediation Plan

Immediate Action: Upgrade to Budibase version 3.40.0 or later to apply the necessary security patches.

Proactive Monitoring: Inspect server logs for unusual outbound connection patterns or unexpected internal API access logs that deviate from established baselines.

Compensating Controls: Ensure that the Budibase instance is deployed within a segmented network environment with strict egress filtering to limit the reach of potential SSRF attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of TOCTOU and SSRF, which can be chained to bypass network isolation.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest patched version. Administrators should prioritize this deployment to prevent potential exploitation of the platform's internal network access capabilities.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the WebRTC component of Google Chrome could allow an unauthenticated attacker to trigger memory corruption.

Executive Summary:
A critical use-after-free vulnerability in Google Chrome's WebRTC component could lead to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-7341

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free memory management error in the WebRTC engine. An unauthenticated attacker can exploit this by enticing a user to navigate to a malicious website.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a high threat to business operations. Exploitation can lead to unauthorized code execution, enabling attackers to bypass security controls and access sensitive information stored on the host system.

Remediation Plan

Immediate Action: Update all installations of Google Chrome to version 147 or later as soon as the patch is available.

Proactive Monitoring: Review web proxy logs and browser activity logs for indicators of malicious redirects or unusual traffic patterns.

Compensating Controls: Deploy Web Application Firewalls (WAF) or secure web gateways to filter out known malicious payloads targeting browser vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser-based vulnerabilities that allow for remote code execution are critical priorities. Organizations should ensure that the latest stable channel release of Chrome is enforced across the enterprise to mitigate this high-severity risk.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability in the WebRTC component of Google Chrome could allow an attacker to crash the application or execute arbitrary code.

Executive Summary:
A heap buffer overflow in Google Chrome’s WebRTC implementation creates a high-risk vector for remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7339

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a heap buffer overflow within the WebRTC module. This flaw requires no authentication and can be exploited by an attacker through a malicious web page.

Business Impact

This heap buffer overflow carries a CVSS score of 8.8, indicating a severe risk to corporate environments. Successful exploitation allows for memory corruption, which typically leads to arbitrary code execution, potentially resulting in full system compromise for the affected user.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Google to transition to Chrome version 147 or higher.

Proactive Monitoring: Monitor for anomalous spikes in browser memory usage or frequent unexpected application terminations.

Compensating Controls: Ensure that endpoint protection systems are configured to block execution from suspicious web-based sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Memory corruption vulnerabilities in core browser components like WebRTC are frequent targets for threat actors. It is essential that security teams verify that all instances of Chrome are updated to the patched version to prevent potential exploitation.

---METADATA---
VENDOR: Joomla
PRODUCT: Joomla! CMS
AFFECTED_VERSIONS: 1.0.0-5.4.6, 6.0.0-6.1.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Joomla! CMS and Framework Filesystem are vulnerable to unrestricted file uploads, potentially allowing attackers to upload SHTML files.

Executive Summary:
A high-severity vulnerability in Joomla! CMS allows authenticated attackers with administrative privileges to upload dangerous SHTML files, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73373

Affected Software: Joomla! CMS and Framework Filesystem

Affected Versions: 1.0.0-5.4.6, 6.0.0-6.1.2 (CMS); 1.0.0-3.3.0, 4.0.0-4.2.0 (Framework)

Vulnerability: This is an unrestricted file upload vulnerability (CWE-434). The vulnerability requires high privileges (PR:H) to execute, meaning an attacker must have administrative access to the platform to exploit this flaw.

Business Impact

Successful exploitation allows an attacker to upload malicious SHTML files, which can lead to remote code execution and total system compromise. Given the CVSS score of 8.9, the impact on confidentiality, integrity, and availability is critical, potentially resulting in unauthorized data access and complete service disruption.

Remediation Plan

Immediate Action: Review the official Joomla security center for available patches and apply them to all affected CMS and Framework instances immediately.

Proactive Monitoring: Audit web server directories for unauthorized SHTML files and monitor administrative logs for suspicious file upload activity.

Compensating Controls: Implement strict file type validation at the Web Application Firewall (WAF) level to block uploads of executable or server-side script files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-level administrative access significantly limits the attack surface for this issue.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of the Joomla environment. Organizations should prioritize patching as soon as the vendor releases the necessary updates to prevent potential administrative abuse and lateral movement within the hosting infrastructure.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists within the WebRTC component of Google Chrome, potentially allowing for arbitrary code execution.

Executive Summary:
A critical use-after-free vulnerability in Google Chrome's WebRTC component poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7336

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a use-after-free flaw located in the WebRTC engine. It can be triggered by an unauthenticated remote attacker via a specially crafted web page.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to unauthorized system access or data exfiltration. With a CVSS score of 8.8, this flaw represents a high-severity risk that could compromise the integrity and confidentiality of user workstations.

Remediation Plan

Immediate Action: Update Google Chrome to version 147 or later immediately to resolve the vulnerable WebRTC component.

Proactive Monitoring: Review endpoint security logs for unusual browser process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Utilize browser-based security policies or enterprise-grade endpoint protection software to restrict malicious script execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the prevalence of Chrome in enterprise environments, organizations must prioritize patching. Administrators should deploy the latest Chrome update across all managed endpoints to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the media component of Google Chrome allows for potential arbitrary code execution.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome’s media component allows for potential memory corruption and arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-7335

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This use-after-free vulnerability occurs within the media handling logic of the browser, which can be triggered by processing specifically crafted media files.

Business Impact

The CVSS score of 8.8 reflects the high risk associated with memory corruption vulnerabilities in widely used browsers. Exploitation can allow attackers to execute arbitrary code with the privileges of the browser process, leading to system-wide compromise.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Google for the Chrome browser.

Proactive Monitoring: Monitor for browser instability or unusual process behavior when rendering media content.

Compensating Controls: Use the browser in a restricted environment or with enhanced sandboxing features to limit the impact of potential exploitation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users should prioritize updating their browsers immediately to mitigate this vulnerability. Given the ubiquity of media processing in web content, this flaw represents a significant attack vector that must be closed.

---METADATA---
VENDOR: AresIT
PRODUCT: WP Compress
AFFECTED_VERSIONS: Versions prior to 7.20.01
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability exists in the WP Compress WordPress plugin due to improper control of code generation, allowing attackers to execute arbitrary commands.

Executive Summary:
The WP Compress plugin for WordPress contains a critical unauthenticated remote code execution vulnerability that allows attackers to fully compromise the affected system.

Vulnerability Details

CVE-ID: CVE-2026-73343

Affected Software: AresIT WP Compress

Affected Versions: Versions prior to 7.20.01

Vulnerability: This vulnerability is a code injection flaw (CWE-94) residing within the WP Compress plugin. It allows an unauthenticated remote attacker to bypass security controls and execute arbitrary code on the underlying server.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation and the underlying server environment. Given the critical CVSS score of 10.0, this risk includes complete data exfiltration, unauthorized access to sensitive information, and total system disruption. The potential for reputational damage and the loss of data integrity necessitates an immediate response to prevent exploitation.

Remediation Plan

Immediate Action: Update the WP Compress plugin to version 7.20.01 or later immediately.

Proactive Monitoring: Monitor server access logs for unusual HTTP requests or suspicious outbound traffic originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block common code injection attempts targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dangerous because it allows unauthenticated attackers to execute code with the privileges of the web server.

Analyst Recommendation

The severity of this flaw is absolute, as it permits unauthenticated remote code execution. Security teams must prioritize patching this plugin immediately. If an immediate update is not feasible, administrators should consider deactivating the plugin until it can be updated to a secure version to prevent potential compromise.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Views component of Google Chrome on Mac allows for potential arbitrary code execution.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome on Mac allows for potential memory corruption and arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-7334

Affected Software: Google Chrome on Mac

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free vulnerability within the Views UI component, which can be triggered when the browser incorrectly handles memory operations.

Business Impact

Rated at 8.8 on the CVSS scale, this vulnerability poses a significant risk as it can be exploited by web content to compromise the underlying system. Successful exploitation could lead to unauthorized code execution, data theft, or browser instability.

Remediation Plan

Immediate Action: Update Google Chrome on all affected Mac devices to the latest available version.

Proactive Monitoring: Monitor for unexpected browser crashes or unusual memory usage patterns that could indicate exploitation attempts.

Compensating Controls: Ensure that browser security features like site isolation are fully enabled and avoid browsing untrusted websites until the update is applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

As this is a browser-based vulnerability, all users should update their Chrome installations immediately. High-severity memory corruption bugs are frequent targets for browser-based attacks.

---METADATA---
VENDOR: owen2345
PRODUCT: CamaleonCMS
AFFECTED_VERSIONS: 0 through 2.9.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin allows authenticated attackers to inject arbitrary HTML via the before_html field.

Executive Summary:
A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin enables authenticated attackers to inject malicious scripts, leading to potential account takeover.

Vulnerability Details

CVE-ID: CVE-2026-73332

Affected Software: owen2345 CamaleonCMS

Affected Versions: 0 through 2.9.1

Vulnerability: The cama_contact_form plugin fails to sanitize user input in the before_html field, allowing a low-privileged authenticated attacker to perform stored cross-site scripting (XSS) attacks.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a significant risk to user session security and data integrity. An attacker can execute malicious scripts in the context of other users, including administrators, which may result in unauthorized data access or complete compromise of the CMS administrative interface.

Remediation Plan

Immediate Action: Review vendor security advisories for a patch, and if unavailable, disable the cama_contact_form plugin until a fix is released.

Proactive Monitoring: Audit logs for suspicious activity within the contact form edit endpoint and monitor for anomalous HTML content within the application database.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block malicious script injection patterns directed at the contact form management endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of server-side input validation.

Analyst Recommendation

Security teams should immediately assess their exposure and consider disabling the vulnerable plugin. Until an official patch is published, restrict access to the contact form configuration to trusted administrative users only.

---METADATA---
VENDOR: owen2345
PRODUCT: CamaleonCMS
AFFECTED_VERSIONS: 0 through 2.9.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
CamaleonCMS contains a stored cross-site scripting vulnerability in the post title parameter, allowing authenticated users to execute arbitrary JavaScript in an administrator's browser.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in CamaleonCMS allows low-privileged users to compromise administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-73329

Affected Software: owen2345 CamaleonCMS

Affected Versions: 0 through 2.9.1

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered by injecting unsanitized HTML into the post title field during draft creation. It requires the attacker to have low-level authenticated access to the system.

Business Impact

An attacker can hijack administrative sessions, leading to full site compromise, unauthorized data access, or the creation of malicious administrative users. The CVSS score of 8.7 reflects the high risk of privilege escalation and persistent code execution within the administrative context.

Remediation Plan

Immediate Action: Restrict access to administrative and content creation interfaces until a vendor-supplied patch is applied.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to content, particularly from low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS payloads directed at the post title input fields.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable once an attacker has authenticated access to the CMS.

Analyst Recommendation

Security teams should enforce strict input validation for all user-controllable fields. Organizations using CamaleonCMS should monitor vendor release channels for a security update and apply it immediately upon availability.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: < 3.39.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is vulnerable to improper privilege management and authorization flaws, allowing authenticated users to perform unauthorized actions within the low-code platform.

Executive Summary:
A high-severity authorization vulnerability in Budibase allows authenticated attackers to bypass security controls and potentially gain unauthorized access to platform resources.

Vulnerability Details

CVE-ID: CVE-2026-73305

Affected Software: Budibase

Affected Versions: < 3.39.24

Vulnerability: This vulnerability involves improper privilege management and missing or incorrect authorization checks (CWE-269, CWE-862, CWE-863). An authenticated attacker can exploit these flaws to perform actions beyond their intended permission level.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data access, modification of business applications, or full compromise of the platform environment. Given the CVSS score of 8.8, this represents a significant risk to organizational integrity and data confidentiality, as low-code platforms often serve as central hubs for internal workflows and sensitive business logic.

Remediation Plan

Immediate Action: Update all Budibase instances to version 3.39.24 or later to apply the necessary authorization patches.

Proactive Monitoring: Review system access logs for unusual administrative actions or account privilege escalation patterns.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or VPN.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the authorization logic within the server-side components of the application.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Budibase platform to version 3.39.24 to resolve the underlying authorization defects and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Microsoft
PRODUCT: Prompty
AFFECTED_VERSIONS: < 0.1.5, >= 2.0.0-alpha.1, < 2.0.0-beta.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Microsoft Prompty is vulnerable to code injection due to improper template evaluation, allowing unauthenticated attackers to execute arbitrary JavaScript in the host Node.js process.

Executive Summary:
A critical code injection vulnerability in Microsoft Prompty allows unauthenticated remote attackers to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73299

Affected Software: Microsoft Prompty

Affected Versions: < 0.1.5, >= 2.0.0-alpha.1, < 2.0.0-beta.5

Vulnerability: The vulnerability stems from improper neutralization of template engine elements within the Nunjucks renderer, which permits unrestricted JavaScript member access. An unauthenticated attacker can supply a malicious template body to traverse object prototypes and execute code within the host Node.js environment.

Business Impact

Successful exploitation grants an attacker full control over the host Node.js process, potentially leading to unauthorized data access, system compromise, or lateral movement within the network. Given the CVSS score of 10.0, this represents a critical risk to infrastructure integrity and confidentiality, as the attack requires no authentication and can be performed remotely.

Remediation Plan

Immediate Action: Update the npm package @prompty/core to version 0.1.5 or 2.0.0-beta.5 immediately.

Proactive Monitoring: Review application logs for unusual template inputs or unexpected process execution patterns originating from Prompty services.

Compensating Controls: Implement strict input validation for all .prompty files and ensure the Node.js process runs with the least privilege necessary to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bypass standard template sandboxing.

Analyst Recommendation

This vulnerability poses a maximum-severity risk to any environment utilizing the Prompty library. Organizations must prioritize applying the provided updates immediately to prevent potential remote code execution, as the lack of authentication requirements makes this an ideal target for automated exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Container-Migration-Solution-Accelerator
AFFECTED_VERSIONS: <= 2.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass in the Microsoft Container Migration Solution Accelerator allows authenticated users to manipulate keys, potentially leading to unauthorized system access or data modification.

Executive Summary:
A vulnerability in the Microsoft Container Migration Solution Accelerator permits an authenticated attacker to perform unauthorized actions by bypassing authorization checks, posing a significant risk to migration integrity.

Vulnerability Details

CVE-ID: CVE-2026-73298

Affected Software: Microsoft Container Migration Solution Accelerator

Affected Versions: <= 2.1.2

Vulnerability: This vulnerability, identified as CWE-639 (Authorization Bypass Through User-Controlled Key), allows an authenticated user with low privileges to manipulate identifiers to access resources they are not authorized to view or modify.

Business Impact

Successful exploitation of this flaw could allow an attacker to hijack migration processes, leading to the compromise of sensitive container configurations or credentials during the transition to Azure Kubernetes Service. With a CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of migrated cloud infrastructure.

Remediation Plan

Immediate Action: Upgrade to a version beyond 2.1.2 as soon as the vendor patch is applied.

Proactive Monitoring: Audit access logs for unusual patterns in API calls that involve resource keys or unexpected shifts in administrative activity.

Compensating Controls: Implement strict access control lists (ACLs) and use a Web Application Firewall (WAF) to filter requests containing suspicious or malformed identifier parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total technical impact on the migration environment.

Analyst Recommendation

Given the high severity score and the critical nature of migration tools, organizations should prioritize updating the Container Migration Solution Accelerator. Ensure that all users with access to the migration interface are strictly vetted and that logs are reviewed for any signs of unauthorized object access.

---METADATA---
VENDOR: semaphoreui
PRODUCT: semaphore
AFFECTED_VERSIONS: < 2.18.17, >= 2.19.0-alpha3, < 2.19.5-beta2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Semaphore UI is vulnerable to OS command injection via improper handling of git_url parameters in the API, allowing authenticated project managers or owners to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in Semaphore UI allows authenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-73294

Affected Software: semaphoreui semaphore

Affected Versions: < 2.18.17, >= 2.19.0-alpha3, < 2.19.5-beta2

Vulnerability: The application fails to properly sanitize the git_url input when interacting with the underlying Git client. This allows an authenticated user with Project Manager or Owner privileges to inject malicious arguments, resulting in remote code execution on the server.

Business Impact

Successful exploitation grants an attacker full control over the Semaphore server process. Given the 9.9 CVSS score, this represents a critical risk of complete system compromise, potential lateral movement into the DevOps environment, and unauthorized access to sensitive CI/CD secrets.

Remediation Plan

Immediate Action: Update Semaphore UI to version 2.18.17 or 2.19.5-beta2 immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual POST requests to the /api/project/{id}/repositories endpoint and monitor for suspicious child processes spawned by the semaphore service.

Compensating Controls: Restrict access to the Semaphore UI interface to trusted internal networks and implement strict role-based access control to limit the number of users with administrative project permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct nature of the command injection flaw.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity and confidentiality of the entire DevOps pipeline. Administrators must prioritize patching the Semaphore instance to the specified fixed versions to prevent potential full-system compromise by malicious actors.

---METADATA---
VENDOR: semaphoreui
PRODUCT: semaphore
AFFECTED_VERSIONS: < 2.18.19, >= 2.19.0-alpha3, < 2.19.5-beta5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Semaphore UI contains a privilege management vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An improper privilege management vulnerability in Semaphore UI permits authenticated attackers to escalate their permissions and potentially gain full control of the DevOps environment.

Vulnerability Details

CVE-ID: CVE-2026-73293

Affected Software: semaphoreui semaphore

Affected Versions: < 2.18.19, >= 2.19.0-alpha3, < 2.19.5-beta5

Vulnerability: This vulnerability (CWE-269) arises from improper privilege management, allowing a lower-privileged authenticated user to perform actions beyond their assigned scope.

Business Impact

The CVSS score of 8.8 highlights the critical risk to DevOps workflows. An attacker with standard access could manipulate deployment pipelines, access secrets, or modify infrastructure configurations, leading to a complete compromise of the development and production lifecycle.

Remediation Plan

Immediate Action: Update to version 2.18.19 or 2.19.5-beta5, depending on the current branch, to patch the privilege management logic.

Proactive Monitoring: Review audit logs for unexpected configuration changes or administrative actions performed by non-administrative user accounts.

Compensating Controls: Implement the principle of least privilege by strictly limiting the number of users with access to the Semaphore UI and isolating the management interface from public networks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

The existence of a proof-of-concept increases the urgency of this remediation. Organizations should immediately verify their version and apply the provided security updates to prevent unauthorized privilege escalation within their DevOps infrastructure.

---METADATA---
VENDOR: Progress Software
PRODUCT: MarkLogic Server
AFFECTED_VERSIONS: 11.0.0 up to 11.3.6, 12.0.0 up to 12.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Progress MarkLogic Server contains an improper privilege management vulnerability in its query interfaces allowing authenticated users with low-privileged roles to escalate to administrator.

Executive Summary:
A critical privilege escalation vulnerability in Progress MarkLogic Server allows low-privileged authenticated users to gain administrative control over the system.

Vulnerability Details

CVE-ID: CVE-2026-7329

Affected Software: Progress Software MarkLogic Server

Affected Versions: 11.0.0 up to (excluding) 11.3.6, 12.0.0 up to (excluding) 12.0.3

Vulnerability: This is an improper privilege management flaw (CWE-269) within the SQL, SPARQL, and Optic REST query interfaces. An attacker who has already authenticated as a low-privileged REST user can exploit this to perform unauthorized administrative actions and access sensitive data.

Business Impact

Successful exploitation allows an attacker to bypass security controls and gain full administrative access to the database server. Given the CVSS score of 9.9, this represents a critical risk of total system compromise, unauthorized data exfiltration, and potential disruption of business-critical operations.

Remediation Plan

Immediate Action: Upgrade to MarkLogic Server version 11.3.6, 12.0.3, or later as specified in the vendor security advisory.

Proactive Monitoring: Audit database access logs for unusual administrative activities or queries originating from accounts that typically do not perform such operations.

Compensating Controls: Restrict access to the REST query interfaces to authorized IP addresses via network-level controls or a Web Application Firewall to mitigate unauthorized access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high CVSS score is driven by the potential for full system compromise once the initial authentication threshold is met.

Analyst Recommendation

This vulnerability presents a severe risk to data integrity and system confidentiality. Organizations utilizing Progress MarkLogic Server should prioritize patching to the identified secure versions immediately to eliminate the privilege escalation path.

---METADATA---
VENDOR: rustfs
PRODUCT: rustfs
AFFECTED_VERSIONS: < 1.0.0-beta.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
RustFS contains an improper privilege management vulnerability that could allow an authenticated attacker to perform unauthorized actions.

Executive Summary:
A privilege management flaw in the RustFS distributed object storage system enables authenticated users to escalate privileges, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73284

Affected Software: rustfs rustfs

Affected Versions: < 1.0.0-beta.11

Vulnerability: The application suffers from improper privilege management (CWE-269), which permits an attacker with low privileges to perform unauthorized actions within the distributed storage environment.

Business Impact

Successful exploitation allows an attacker to bypass intended access controls, potentially resulting in the unauthorized modification, deletion, or exfiltration of sensitive stored data. With a CVSS score of 8.8, this high severity vulnerability poses a significant risk to data integrity and confidentiality for organizations relying on RustFS for critical storage operations.

Remediation Plan

Immediate Action: Update all instances of RustFS to version 1.0.0-beta.11 or later to resolve the privilege management flaw.

Proactive Monitoring: Review audit logs for unusual administrative activity or unauthorized access attempts from low-privileged user accounts.

Compensating Controls: Implement strict network segmentation and ensure that only authorized services have access to the RustFS API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to grant unauthorized administrative capabilities to standard users.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, organizations should prioritize patching their RustFS deployments. Failure to update the software exposes the entire distributed storage infrastructure to potential unauthorized control and data manipulation.

---METADATA---
VENDOR: Progress
PRODUCT: MarkLogic Server
AFFECTED_VERSIONS: 11.0.0 up to 11.3.6, 12.0.0 up to 12.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in the REST API document processing pipeline of MarkLogic Server allows authenticated users to escalate privileges.

Executive Summary:
MarkLogic Server contains an improper privilege management vulnerability that allows an authenticated user to perform unauthorized actions within the document processing pipeline.

Vulnerability Details

CVE-ID: CVE-2026-7327

Affected Software: Progress MarkLogic Server

Affected Versions: 11.0.0 up to 11.3.6, and 12.0.0 up to 12.0.3

Vulnerability: This is an improper privilege management vulnerability (CWE-269) within the REST API document processing pipeline. It requires the attacker to have high privileges (authenticated) to successfully exploit the flaw.

Business Impact

Successful exploitation allows an authenticated user to perform actions beyond their authorized scope, potentially leading to unauthorized data access or modification within the document processing pipeline. Given the CVSS score of 8.1, this represents a significant threat to data integrity and confidentiality, especially in environments where strict role-based access control is required.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Progress Software Corporation to upgrade to a non-vulnerable version (11.3.6 or 12.0.3 or higher).

Proactive Monitoring: Review access logs and audit trails for unauthorized attempts to access or modify documents via the REST API, particularly by users with restricted roles.

Compensating Controls: Limit access to the REST API endpoints to known, trusted IP addresses and enforce the principle of least privilege for all user accounts interacting with the database.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the vulnerability is not considered automatable.

Analyst Recommendation

While this vulnerability requires prior authentication, the potential for privilege escalation within a database environment remains a high-risk scenario. Organizations should prioritize updating their MarkLogic instances to the specified patched versions to ensure robust access control and maintain the security posture of their data.

---METADATA---
VENDOR: prowler-cloud
PRODUCT: prowler
AFFECTED_VERSIONS: < 5.36.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Prowler is vulnerable to OS command injection via the Kubernetes provider connection test, allowing authenticated users to execute arbitrary commands on the worker.

Executive Summary:
An OS command injection vulnerability in Prowler versions prior to 5.36.0 allows authenticated users to execute arbitrary commands, creating a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73263

Affected Software: prowler-cloud prowler

Affected Versions: < 5.36.0

Vulnerability: The vulnerability exists in the Kubernetes provider connection test, where attacker-supplied kubeconfig content containing legacy authentication providers is processed through a subprocess call without adequate neutralization. This requires authenticated access to the API to trigger the injection.

Business Impact

Successful exploitation allows an authenticated user to achieve command execution on the system running the Prowler worker, which could lead to full control of the underlying infrastructure. With a CVSS score of 9.9, the impact on the security of the cloud environment managed by Prowler is catastrophic, as it allows attackers to escalate privileges and move laterally within the cloud management plane.

Remediation Plan

Immediate Action: Update Prowler to version 5.36.0 or later to patch the command injection flaw in the Kubernetes provider connection logic.

Proactive Monitoring: Monitor API access logs for anomalous requests to the connection test endpoints and audit shell execution logs for unexpected processes spawned by the Prowler service.

Compensating Controls: Restrict access to the Prowler API to only authorized and trusted personnel to minimize the risk of exploitation by malicious insiders or compromised user accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any authenticated user with access to the API, necessitating prompt patching to mitigate the risk of internal or credential-based attacks.

Analyst Recommendation

Immediate update to version 5.36.0 is required for all Prowler deployments. Because this vulnerability allows for OS command injection, it represents a significant threat to the security of the infrastructure being managed by the Prowler platform, and the patch should be applied without delay.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: < 3.15.186
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the electerm terminal client allows authenticated users to execute arbitrary code due to improper control of dynamically managed code resources.

Executive Summary:
An authenticated remote code execution vulnerability in electerm poses a severe risk to host systems, potentially granting attackers full control over the application environment.

Vulnerability Details

CVE-ID: CVE-2026-73226

Affected Software: electerm electerm

Affected Versions: < 3.15.186

Vulnerability: The application suffers from improper control of dynamically managed code resources (CWE-913). This flaw allows an authenticated attacker to manipulate code execution, which can be leveraged to achieve remote code execution within the context of the application.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the electerm application. Given the CVSS score of 8.8, this represents a high risk to business operations, as it could lead to total compromise of the host machine, unauthorized access to stored credentials, and lateral movement within the network.

Remediation Plan

Immediate Action: Update electerm to version 3.15.186 or later immediately to incorporate the upstream fix.

Proactive Monitoring: Review application logs for suspicious shell commands or unexpected child processes initiated by the electerm binary.

Compensating Controls: Restrict access to the application to only trusted users and ensure the software is running in a segmented environment with limited network permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to hold valid, albeit low-level, user credentials to initiate the exploitation process.

Analyst Recommendation

This high-severity vulnerability requires immediate attention due to the potential for full system compromise. Administrators must prioritize updating all instances of electerm to the patched version 3.15.186 to eliminate the risk of remote code execution.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: < 3.15.120
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the electerm client allows attackers to execute arbitrary OS commands through improper neutralization of special elements.

Executive Summary:
An OS command injection vulnerability in the electerm client, rated at 8.8, allows an attacker to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73224

Affected Software: electerm electerm

Affected Versions: < 3.15.120

Vulnerability: The vulnerability is an OS command injection flaw arising from the improper handling of input. It is remotely exploitable and requires user interaction, but does not require authentication to trigger.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the electerm client. This could lead to a full compromise of the local machine, including the theft of SSH keys, stored credentials, and lateral movement within the network, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the electerm client to version 3.15.120 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor for unexpected child processes being spawned by the electerm application or unusual outbound network connections originating from the host.

Compensating Controls: Restrict the execution environment of the client by utilizing containerization or sandboxing, and ensure the host operating system is hardened against unauthorized command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, command injection flaws of this nature are frequently targeted by attackers once disclosed.

Analyst Recommendation

All users of the electerm client must upgrade to version 3.15.120 immediately to mitigate the risk of remote command execution. Given the potential for full system compromise, this update should be treated as a high-priority maintenance task for all workstations and servers running the affected software.