---METADATA---
VENDOR: Alist
PRODUCT: Alist
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Alist, a file list program powered by Gin and Solidjs, contains a high-severity vulnerability that could lead to unauthorized file access or system compromise.

Executive Summary:
The Alist file list program is affected by a high-severity vulnerability that poses a critical risk to data confidentiality and server security.

Vulnerability Details

CVE-ID: CVE-2026-25161

Affected Software: Alist Alist

Affected Versions: See vendor advisory

Vulnerability: Alist is a versatile file list program supporting multiple storage backends. The vulnerability likely exists in the way the application handles storage requests or authentication, potentially allowing an attacker to bypass security controls and access restricted files or execute unauthorized commands.

Business Impact

A successful exploit could result in the exposure of all data stored across the various backends connected to Alist (e.g., cloud storage, local disks). The CVSS score of 8.8 indicates a High severity (bordering on Critical), reflecting the potential for significant data breaches and loss of control over sensitive storage environments.

Remediation Plan

Immediate Action: Update Alist to the latest available version immediately. If a patch is not yet available, consider disabling the service if it is exposed to the public internet.

Proactive Monitoring: Review application logs for unauthorized access attempts or unusual file download activity from unknown IP addresses.

Compensating Controls: Restrict access to the Alist web interface using a VPN or IP allowlisting, and ensure that the underlying storage credentials have the least amount of privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, because Alist is often used to aggregate multiple cloud storage accounts, it is a high-value target for attackers looking for sensitive data.

Analyst Recommendation

The 8.8 CVSS score makes this the highest-priority vulnerability in this batch. Organizations and individuals using Alist must apply updates immediately and audit their storage permissions to ensure that a compromise of the application does not lead to a total data breach.

---METADATA---
VENDOR: Alist
PRODUCT: Alist
AFFECTED_VERSIONS: Prior to version 3.57.0
---END_METADATA---

Description Summary:
Alist versions prior to 3.57.0 disable TLS certificate verification by default, exposing all outgoing storage driver communications to Man-in-the-Middle (MitM) attacks and data theft.

Executive Summary:
A critical security misconfiguration in Alist disables TLS verification by default, allowing attackers to intercept, decrypt, and manipulate sensitive data via Man-in-the-Middle attacks.

Vulnerability Details

CVE-ID: CVE-2026-25160

Affected Software: Alist File List Program

Affected Versions: Prior to version 3.57.0

Vulnerability: The application is configured to bypass TLS certificate verification for all outgoing storage driver communications by default. This allows a network-adjacent or positioned attacker to perform a Man-in-the-Middle (MitM) attack, compromising the integrity and confidentiality of data without requiring authentication.

Business Impact

The impact is severe (CVSS 9.1), as it permits the complete decryption and manipulation of user data transmitted to various storage providers. This could lead to the theft of sensitive credentials, unauthorized access to cloud storage, and large-scale data breaches, resulting in significant regulatory and legal liabilities.

Remediation Plan

Immediate Action: Upgrade Alist to version 3.57.0 or later, which enables TLS certificate verification by default for all storage drivers.

Proactive Monitoring: Inspect network traffic for unusual certificates or intercepted connections and review Alist logs for storage connection errors.

Compensating Controls: Ensure that Alist is deployed within a secure, encrypted network segment and use VPNs or dedicated tunnels for storage traffic where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the default "insecure" state of the software makes it a high-value target for attackers in shared network environments.

Analyst Recommendation

Disabling TLS verification is a catastrophic failure of transport security. It is imperative that administrators update to version 3.57.0 immediately to restore the confidentiality and integrity of their data transfers.

---METADATA---
VENDOR: Unidocs
PRODUCT: ezPDF DRM Reader / ezPDF Reader
AFFECTED_VERSIONS: 2.x (See vendor advisory for specific versions)
---END_METADATA---

Description Summary:
A vulnerability has been identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2, which could allow for unauthorized code execution or data access.

Executive Summary:
A high-severity vulnerability in Unidocs ezPDF Reader products could allow an attacker to compromise the user's system through a specially crafted PDF document.

Vulnerability Details

CVE-ID: CVE-2026-2516

Affected Software: Unidocs ezPDF DRM Reader and ezPDF Reader

Affected Versions: Version 2 and potentially others; see vendor advisory for details.

Vulnerability: The vulnerability involves a flaw in how the ezPDF Reader handles specific document structures or DRM components. With a CVSS score of 7.0, it is likely that an attacker can achieve unauthorized actions by tricking a user into opening a malicious file.

Business Impact

Exploitation of this flaw could lead to the compromise of sensitive documents, unauthorized access to the host system, and the potential for malware installation. For organizations relying on these readers for DRM-protected content, this poses a significant risk to document confidentiality and endpoint security.

Remediation Plan

Immediate Action: Update all installations of ezPDF DRM Reader and ezPDF Reader to the latest patched version provided by Unidocs.

Proactive Monitoring: Monitor for unusual process activity originating from the PDF reader application and use endpoint detection and response (EDR) tools to identify malicious behavior.

Compensating Controls: Implement file-type filtering at the email gateway and advise users against opening PDF documents from untrusted or unknown sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 16, 2026, there is no public information indicating active exploitation. Document-based vulnerabilities remain a common vector for initial access in many cyberattacks.

Analyst Recommendation

The high severity of this vulnerability requires timely patching of all affected software. Administrators should ensure that the primary remediation is applied across all endpoints to mitigate the risk of a successful document-based attack.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The OpenClaw personal AI assistant contains a high-severity vulnerability that could allow for unauthorized access or system manipulation.

Executive Summary:
A significant security flaw in the OpenClaw AI assistant could permit attackers to compromise the privacy and integrity of the user's personal assistant environment.

Vulnerability Details

CVE-ID: CVE-2026-25157

Affected Software: OpenClaw

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability in OpenClaw, a personal AI assistant, likely involves improper input validation or an authentication bypass. Given the CVSS score of 7.7, an unauthenticated or low-privileged attacker could potentially gain unauthorized access to the assistant's data or control its functions.

Business Impact

The impact of this vulnerability is high, as personal AI assistants often have access to sensitive user data, including schedules, communications, and integrated third-party accounts. A compromise could lead to significant privacy breaches, data exfiltration, and unauthorized actions performed on behalf of the user, resulting in severe personal or organizational risk.

Remediation Plan

Immediate Action: Apply the latest security patches for the OpenClaw assistant and review the assistant's permissions and integrated accounts for any signs of tampering.

Proactive Monitoring: Review access logs for the OpenClaw service to identify any connections from unrecognized IP addresses or unusual command patterns.

Compensating Controls: Isolate the AI assistant within a dedicated network segment and limit its access to sensitive internal resources until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. AI assistants are increasingly targeted due to the wealth of information they process.

Analyst Recommendation

Users and administrators of OpenClaw should prioritize the application of this security update. Given the high CVSS score and the sensitive nature of AI assistant data, immediate remediation is required to prevent unauthorized access to personal and corporate information.

---METADATA---
VENDOR: Builder.io
PRODUCT: Qwik City
AFFECTED_VERSIONS: Prior to version 1.19.0
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in the Qwik City middleware's formToObj() function allows unauthenticated attackers to manipulate Object.prototype via crafted HTTP POST requests.

Executive Summary:
The Qwik City framework is vulnerable to a critical prototype pollution flaw that allows unauthenticated attackers to achieve privilege escalation, authentication bypass, or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-25150

Affected Software: Builder.io Qwik City

Affected Versions: Prior to version 1.19.0

Vulnerability: This vulnerability resides in the formToObj() function within the @builder.io/qwik-city middleware. It fails to sanitize sensitive property names like __proto__ during dot-notation processing, allowing unauthenticated attackers to inject malicious properties into the global Object prototype.

Business Impact

A successful exploit poses a severe threat to application integrity and availability. Attackers can bypass security controls to gain unauthorized administrative access or crash the application environment entirely. Given the CVSS score of 9.3, this flaw represents a critical risk to any organization utilizing affected versions of the Qwik framework for production web applications.

Remediation Plan

Immediate Action: Update the @builder.io/qwik-city package to version 1.19.0 or later immediately to eliminate the insecure processing logic.

Proactive Monitoring: Review application logs for unusual HTTP POST requests containing dot-notation keys or reserved keywords such as __proto__ and constructor.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common prototype pollution payloads in request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its location in a popular performance-focused framework, the potential for exploitation is high.

Analyst Recommendation

The severity of this prototype pollution vulnerability cannot be overstated, as it targets the foundation of the JavaScript runtime environment. IT administrators must prioritize the update to version 1.19.0. Failure to patch may result in complete application takeover or persistent denial of service.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
OpenEMR, an open-source medical practice management application, contains a security vulnerability that could lead to unauthorized access or data compromise.

Executive Summary:
A high-severity vulnerability in OpenEMR threatens the confidentiality and integrity of sensitive electronic health records and medical practice management data.

Vulnerability Details

CVE-ID: CVE-2026-25147

Affected Software: OpenEMR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the OpenEMR application framework, a platform used for managing electronic health records (EHR). Based on the available summary, the flaw likely involves improper input validation or access control, potentially allowing an attacker to interact with sensitive medical records.

Business Impact

The impact of a successful exploit is severe, potentially resulting in the exposure of Protected Health Information (PHI), which leads to significant legal liabilities and HIPAA compliance violations. The CVSS score of 7.1 justifies the High severity rating, as a breach could result in both reputational damage and the loss of critical patient data integrity.

Remediation Plan

Immediate Action: Update OpenEMR to the latest patched version immediately. Review the official OpenEMR security advisories for specific version-level instructions.

Proactive Monitoring: Review application access logs for unauthorized logins or unusual data export activities, especially focusing on administrative and patient record modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rulesets specifically designed to block common web exploits such as SQL injection or cross-site scripting (XSS) that may target EHR platforms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, because OpenEMR is a public-facing application handling high-value data, the potential for exploitation remains a significant concern.

Analyst Recommendation

Given the sensitivity of the data handled by OpenEMR, this vulnerability must be addressed with the highest priority. We recommend that healthcare IT administrators apply the vendor-provided security updates immediately to prevent unauthorized access to patient health information.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: 5.0.2 to before 8.0.0
---END_METADATA---

Description Summary:
OpenEMR leaks gateway_api_key secrets in plaintext to the client, enabling unauthorized financial transactions and account takeovers of payment gateways.

Executive Summary:
A critical information disclosure vulnerability in OpenEMR allows unauthenticated users to view sensitive payment gateway API keys, leading to potential financial fraud and data breaches.

Vulnerability Details

CVE-ID: CVE-2026-25146

Affected Software: OpenEMR

Affected Versions: 5.0.2 to before 8.0.0

Vulnerability: Two specific code paths in the application render the gateway_api_key secret value in plaintext to the client. This allows an unauthenticated attacker to capture these keys by simply accessing the affected application paths.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a significant financial and regulatory risk. Exposure of payment gateway keys can lead to unauthorized money movement, broad account takeovers, and the compromise of Protected Health Information (PHI), potentially resulting in severe HIPAA violations and reputational damage.

Remediation Plan

Immediate Action: Upgrade OpenEMR to version 8.0.0 immediately. After upgrading, rotate all payment gateway API keys, as they must be considered compromised.

Proactive Monitoring: Review web server logs for access to the vulnerable paths and monitor payment gateway logs for unauthorized or suspicious transactions.

Compensating Controls: Use a Web Application Firewall (WAF) to block access to sensitive configuration paths and implement strict egress filtering for payment processing traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. However, the plaintext nature of the leak makes exploitation highly likely if an attacker identifies the specific paths.

Analyst Recommendation

Updating the software is only the first step; because the keys were exposed in plaintext, they must be rotated immediately to prevent ongoing unauthorized access to financial services.

---METADATA---
VENDOR: Chainguard
PRODUCT: melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in melange affects how declarative pipelines build apk packages, posing a significant risk to supply chain integrity.

Executive Summary:
The melange build tool contains a high-severity vulnerability that could allow for the compromise of apk package builds within declarative pipelines.

Vulnerability Details

CVE-ID: CVE-2026-25143

Affected Software: Chainguard melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the declarative pipeline processing engine of melange. While the specific mechanism is not detailed, the CVSS score of 7.8 suggests a significant flaw that could be triggered by an authenticated user with pipeline configuration privileges or through malicious build definitions.

Business Impact

This flaw poses a direct threat to the software supply chain by potentially allowing the injection of malicious code into legitimate apk packages. With a CVSS score of 7.8, the impact is high, as compromised packages could be distributed to downstream users, leading to widespread system compromises and severe reputational damage to the organization providing the software.

Remediation Plan

Immediate Action: Update melange to the latest patched version and re-validate all packages built using declarative pipelines since the vulnerability's introduction.

Proactive Monitoring: Audit build logs and pipeline definitions for unauthorized changes or anomalous build behaviors that deviate from established patterns.

Compensating Controls: Implement strict access controls on build environments and require multi-factor authentication for any changes to declarative pipeline configurations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high for organizations relying on melange for automated package generation and distribution.

Analyst Recommendation

Given the critical role melange plays in the modern software supply chain, this vulnerability must be addressed with high urgency. Organizations should apply the vendor-provided updates immediately to ensure the continued integrity and security of their apk package distribution pipelines.

Executive Summary:
A critical vulnerability has been identified in the SandboxJS library, a tool designed to safely execute untrusted JavaScript code. This flaw allows an attacker to bypass the library's security restrictions and execute arbitrary code on the underlying server. Successful exploitation could lead to a complete system compromise, resulting in data theft, service disruption, or further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-25142

Affected Software: SandboxJS library

Affected Versions: Versions prior to 0.8.27

Vulnerability: The SandboxJS library fails to properly restrict access to the __lookupGetter__ JavaScript object method. An attacker can craft malicious JavaScript code that leverages this method to access and modify object prototypes. By manipulating the prototype chain, the attacker can gain access to powerful, unrestricted functions outside of the sandbox environment, such as the Function constructor, ultimately leading to a sandbox escape and remote code execution (RCE) on the host system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10. A successful exploit would grant an attacker the ability to execute commands on the server with the same privileges as the application running the SandboxJS library. This could lead to a complete loss of confidentiality, integrity, and availability of the affected system and its data. Potential consequences include theft of sensitive data, deployment of ransomware, manipulation of application data, or using the compromised server as a pivot point to attack other systems within the organization's network.

Remediation Plan

Immediate Action: All systems utilizing the SandboxJS library must be immediately updated to version 0.8.27 or later, which contains the fix for this vulnerability. After patching, review application and system logs for any signs of exploitation that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Security teams should look for suspicious patterns in logs, such as unexpected process creation by the application, unusual network connections, or logs of user-submitted JavaScript containing strings like __lookupGetter__, prototype, or constructor.

Compensating Controls: If immediate patching is not feasible, consider implementing the following compensating controls:

• Run the application utilizing SandboxJS within a heavily restricted, isolated environment (e.g., a minimal Docker container with no unnecessary privileges or network access).
• Implement a Web Application Firewall (WAF) with rules designed to detect and block malicious JavaScript patterns attempting to exploit this vulnerability.
• Enhance input validation to sanitize or reject any user-supplied code before it is passed to the SandboxJS library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 2, 2026, there are no known public exploits targeting this vulnerability. However, given the critical CVSS score of 10 and the public disclosure of the vulnerability's technical details, it is highly probable that proof-of-concept exploits will be developed and released by security researchers or malicious actors in the near future.

Analyst Recommendation

Due to the critical severity (CVSS 10) of this vulnerability and the high risk of complete system compromise, immediate remediation is strongly recommended. Organizations must prioritize applying the update to version 0.8.27 or later across all affected applications without delay. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for widespread exploitation, and it should be treated with the highest urgency.

---METADATA---
VENDOR: Chainguard
PRODUCT: apko
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Another high-severity vulnerability has been identified in the apko container build tool, impacting the security of OCI image generation.

Executive Summary:
A second high-severity vulnerability in apko further increases the risk of container image compromise during the automated build and publish phases.

Vulnerability Details

CVE-ID: CVE-2026-25140

Affected Software: Chainguard apko

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to CVE-2026-25121, this vulnerability in apko affects the OCI image build process. The CVSS score of 7.5 indicates a high-impact flaw, potentially allowing for the injection of unauthorized content or the modification of image metadata by an attacker with pipeline access.

Business Impact

The impact of this vulnerability is significant, as it could result in the deployment of compromised containers across the enterprise. This could lead to data exfiltration, service disruption, and the introduction of persistent backdoors within the production environment, significantly damaging the organization's security posture.

Remediation Plan

Immediate Action: Apply the latest security updates to apko and audit the integrity of all OCI images published during the period the vulnerability was present.

Proactive Monitoring: Monitor build pipeline logs for unauthorized package additions or changes to the image manifest during the build process.

Compensating Controls: Enforce strict role-based access control (RBAC) for the CI/CD environment and utilize automated security scanning for all generated container images.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Continuous monitoring of build tools is essential as they are high-value targets for attackers.

Analyst Recommendation

It is critical to apply the latest patches to apko to protect the software supply chain. Organizations must prioritize the security of their container build processes to prevent the introduction of vulnerabilities into their production cloud environments.

Executive Summary:
A critical vulnerability exists in the NixOS package for the Odoo ERP and CRM system. This flaw exposes the database management interface to the public internet without any password protection, allowing an unauthenticated attacker to download or delete the entire business database, including all sensitive customer data and files. This could lead to a catastrophic data breach and complete disruption of business operations.

Vulnerability Details

CVE-ID: CVE-2026-25137

Affected Software: The NixOS package for Odoo

Affected Versions: Versions from 21.11 to before 25.11 and 26.05

Vulnerability: The vulnerability is an authentication bypass caused by a configuration issue specific to how Odoo is packaged on NixOS. The Odoo database manager, a powerful tool intended for development, is publicly exposed. On other operating systems, this interface is protected by a master password; however, due to the immutable nature of NixOS, Odoo is unable to save the auto-generated or manually set master password. Consequently, every time the Odoo service restarts, the password is lost, leaving the database manager completely unprotected. An unauthenticated attacker can simply navigate to the /web/database endpoint and gain full administrative control over the Odoo databases, allowing them to download, delete, or create backups of all data.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.1. Successful exploitation would have a catastrophic impact on the business. An attacker could exfiltrate the entire database, leading to a massive data breach of sensitive information, including customer data, financial records, and proprietary business information. Furthermore, an attacker could delete the database, causing a complete and immediate loss of service and data, leading to severe operational disruption. The potential consequences include significant financial loss, severe reputational damage, loss of customer trust, and potential regulatory fines for data protection violations.

Remediation Plan

Immediate Action: Update The NixOs Odoo package is an open source ERP and CRM Multiple Products to the latest version. Specifically, organizations must upgrade to version 25.11, 26.05, or a later patched release that corrects the password persistence issue. After updating, administrators should verify that the database manager is no longer publicly accessible or is properly secured with a persistent master password.

Proactive Monitoring: Actively monitor web server access logs and Odoo application logs for any historical or current requests to the /web/database endpoint. System administrators should configure alerts for any access attempts to this path from untrusted IP addresses. Evidence of such requests should trigger an immediate incident response investigation to determine if a data breach has occurred.

Compensating Controls: If immediate patching is not feasible, implement a compensating control by using a reverse proxy or Web Application Firewall (WAF). Configure the device to explicitly block all external access to the /web/database URL path. Additionally, restrict network access to the Odoo instance via firewall rules, allowing connections only from trusted IP ranges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Feb 2, 2026, there are no known public exploit tools for this vulnerability. However, exploitation is trivial and does not require a specialized tool; an attacker only needs to know the URL of the vulnerable Odoo instance and navigate to the exposed database manager endpoint. Due to this simplicity, organizations should assume they are at high risk and investigate for signs of compromise immediately.

Analyst Recommendation

Given the critical CVSS score of 9.1 and the trivial nature of exploitation, this vulnerability poses a severe and immediate threat to any organization using an affected version of the NixOS Odoo package. We strongly recommend that organizations prioritize the immediate application of the security patches provided by the vendor. Although this CVE is not currently on the CISA KEV list, the high potential for a complete data breach and service disruption requires urgent attention. All affected systems should be patched and thoroughly audited for any signs of past compromise.

Executive Summary:
A critical vulnerability has been identified in the Cybersecurity AI (CAI) framework, which could allow a remote attacker to take full control of an affected system. The flaw stems from the insecure handling of user-supplied data, enabling the execution of arbitrary commands without any user interaction or approval. This vulnerability poses a significant risk of complete system compromise, data theft, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-25130

Affected Software: Cybersecurity AI Multiple Products

Affected Versions: Versions up to and including 0.5.10

Vulnerability: The vulnerability is a critical argument injection flaw within the function tools of the Cybersecurity AI framework. The application improperly passes user-controlled input directly to system shell commands using subprocess.Popen() with shell=True. An attacker can craft input that includes malicious shell command arguments. Specifically, the find_file() tool, which is pre-approved as a "safe" command and requires no human-in-the-loop approval, can be exploited by injecting arguments like -exec to execute arbitrary commands, leading to Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.6. Successful exploitation grants an attacker full control over the host system, equivalent to the user running the CAI framework. The potential consequences include theft of sensitive data, deployment of ransomware, disruption of critical business operations, and using the compromised system as a pivot point to attack other internal network resources. The reputational damage to an organization relying on a compromised AI security product is also a significant risk.

Remediation Plan

Immediate Action: Immediately apply the vendor-supplied patch by updating all instances of Cybersecurity AI products to the latest version which contains the fix (referenced in commit e22a1220f764e2d7cf9da6d6144926f53ca01cde). After patching, review system and application logs for any signs of past exploitation attempts.

Proactive Monitoring: Monitor for suspicious process execution chains. Specifically, look for child processes spawned by the CAI application, such as find executing unexpected commands (e.g., sh, bash, curl, wget). Scrutinize network traffic originating from servers running the CAI framework for unusual outbound connections. Review shell command history and system audit logs for commands that may indicate a compromise.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Run the Cybersecurity AI application in a minimal-privilege, sandboxed, or containerized environment to limit the impact of a potential compromise.
• Implement strict input validation and sanitization at a network level using a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) to block requests containing shell metacharacters and suspicious command arguments like -exec.
• Restrict outbound network access from the host running the application to prevent attackers from easily exfiltrating data or downloading further malware.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date of January 30, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the straightforward nature of the argument injection flaw, it is highly probable that proof-of-concept (PoC) exploits will be developed and made public quickly. Organizations should assume that threat actors will begin actively scanning for and exploiting this vulnerability in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.6 and the risk of unauthenticated Remote Code Execution, this vulnerability represents a severe and immediate threat to the organization. We strongly recommend that the vendor's patch be applied to all affected systems with the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, its severity makes it a prime candidate for future inclusion. All remediation and monitoring actions should be initiated immediately to prevent a potential system compromise.

---METADATA---
VENDOR: Chainguard
PRODUCT: apko
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in apko affects the building and publishing of OCI container images, potentially compromising container security.

Executive Summary:
The apko container build tool contains a high-severity flaw that could allow for the creation of compromised OCI images during the build process.

Vulnerability Details

CVE-ID: CVE-2026-25121

Affected Software: Chainguard apko

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability in apko involves a flaw in how OCI container images are constructed from apk packages. With a CVSS score of 7.5, the issue likely resides in the image assembly or package verification logic, which could be manipulated by an attacker with access to the build pipeline.

Business Impact

A successful exploit could lead to the distribution of malicious container images to production environments. This poses a major threat to the integrity of the containerized infrastructure and could lead to unauthorized access, data breaches, and a lack of trust in the organization's software delivery process.

Remediation Plan

Immediate Action: Update apko to the latest version and rebuild any container images that were generated using the vulnerable version of the tool.

Proactive Monitoring: Implement image signing and verification (e.g., using Sigstore/Cosign) to ensure that only authorized and untampered images are deployed.

Compensating Controls: Restrict access to the container build environment and use ephemeral build runners to minimize the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The security of container build tools is critical for maintaining a secure CI/CD pipeline.

Analyst Recommendation

Organizations using apko should update the tool immediately to mitigate the risk of supply chain attacks. Ensuring that container images are built using secure and patched tools is a fundamental requirement for modern cloud-native security.

---METADATA---
VENDOR: Soliton Systems
PRODUCT: FileZen
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.

Executive Summary:
Soliton FileZen contains a critical OS command injection vulnerability that could allow an attacker to achieve full system compromise and execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-25108

Affected Software: Soliton Systems FileZen

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an OS command injection flaw located within the FileZen appliance. While the specific authentication requirements are not explicitly detailed in the summary, this class of vulnerability typically allows an attacker to bypass intended command restrictions to execute system-level instructions.

Business Impact

A successful exploit of this OS command injection vulnerability could result in complete unauthorized access to the FileZen appliance. Given its role in file transfer, a compromise could lead to the theft of sensitive corporate data, lateral movement within the network, and total loss of system integrity. The CVSS score of 8.8 reflects a High severity, indicating that the impact on confidentiality, integrity, and availability is significant.

Remediation Plan

Immediate Action: Administrators should apply the latest security updates provided by Soliton Systems immediately to patch the command injection vector.

Proactive Monitoring: Monitor system logs for unusual shell activity or unexpected outbound connections originating from the FileZen appliance.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection patterns (e.g., semicolons, pipes, or backticks in web requests).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high, as command injection remains a primary target for automated exploitation scripts.

Analyst Recommendation

The high CVSS score of 8.8 necessitates an immediate response to prevent potential data breaches. Organizations using FileZen must prioritize this update above standard maintenance cycles. Failure to remediate this flaw leaves the appliance exposed to remote code execution, which could serve as an entry point for ransomware or advanced persistent threats.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, Cloud 5.0.4-5.0.5, PaaS 5.0.4-5.0.5
---END_METADATA---

Description Summary:
An OS command injection vulnerability in FortiSandbox allows unauthenticated attackers to execute unauthorized commands via specifically crafted HTTP requests.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSandbox allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-25089

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, 4.2 all versions, Cloud 5.0.4 through 5.0.5, and PaaS 5.0.4 through 5.0.5.

Vulnerability: This vulnerability arises from improper neutralization of special elements used in OS commands, permitting an unauthenticated attacker to inject and execute unauthorized commands via malicious HTTP requests.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe threat, as it allows complete administrative control over the security appliance without requiring prior authentication. A compromise of FortiSandbox—a critical security tool—could allow attackers to bypass security controls, exfiltrate sensitive data, or pivot into the internal network.

Remediation Plan

Immediate Action: Update to FortiSandbox 5.0.6, 4.4.9, or higher, depending on the specific product line, as detailed in the vendor advisory.

Proactive Monitoring: Monitor device logs for signs of suspicious HTTP requests or unexpected command execution attempts on the FortiSandbox appliance.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious HTTP input that could trigger command injection while the patching process is underway.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of the attack vector, this vulnerability is a high-priority target for threat actors. Administrators must apply the vendor-provided patches immediately to prevent unauthorized access and maintain the integrity of their security infrastructure.

---METADATA---
VENDOR: ZLAN
PRODUCT: ZLAN5143D
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The ZLAN5143D device is vulnerable to authentication bypass, allowing attackers to access internal URLs directly and gain unauthorized administrative access.

Executive Summary:
ZLAN5143D devices are susceptible to an authentication bypass that permits unauthenticated attackers to access sensitive internal management pages.

Vulnerability Details

CVE-ID: CVE-2026-25084

Affected Software: ZLAN ZLAN5143D (Serial to Ethernet Device)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The authentication mechanism for the ZLAN5143D can be bypassed by directly requesting internal URLs. This indicates a failure in the authorization logic, where the system does not verify the user's session before serving sensitive administrative content to unauthenticated users.

Business Impact

An attacker can gain unauthorized access to the device configuration, potentially leading to the interception of serial data or the redirection of network traffic. With a CVSS score of 9.8, the impact is critical, as it allows for complete device management without the need for valid credentials.

Remediation Plan

Immediate Action: Update the ZLAN5143D firmware to the latest version that implements proper session validation for all internal URLs.

Proactive Monitoring: Audit web server logs for direct access attempts to administrative URLs that bypass the standard login flow.

Compensating Controls: Isolate the ZLAN device on a dedicated management VLAN and restrict access to authorized workstations only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 11, 2026, there is no public information indicating active exploitation. Forced browsing/direct URL access is a common technique used by attackers to find such bypasses.

Analyst Recommendation

The bypass of authentication on industrial communication devices like the ZLAN5143D can have serious operational consequences. Immediate firmware updates are required. Ensure that these devices are never exposed directly to the internet, as they lack robust defensive layers.

---METADATA---
VENDOR: OpenList
PRODUCT: OpenList Frontend
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the OpenList Frontend UI component could lead to unauthorized access or manipulation of the OpenList application environment.

Executive Summary:
The OpenList Frontend is affected by a high-severity vulnerability that could allow attackers to bypass security controls or access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-25060

Affected Software: OpenList OpenList Frontend

Affected Versions: See vendor advisory for affected versions

Vulnerability: Similar to CVE-2026-25059, this vulnerability exists in the OpenList Frontend. It may involve improper session management or insecure direct object references (IDOR) that allow a user to access data or perform actions they are not authorized for.

Business Impact

The CVSS score of 8.1 indicates a High severity. If exploited, this could allow an attacker to view or modify data belonging to other users, leading to a significant breach of privacy and data integrity. For organizations relying on OpenList, this could result in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Update the OpenList Frontend to the latest version immediately to ensure all security patches are applied.

Proactive Monitoring: Audit application logs for unauthorized access attempts to specific API endpoints or unusual data retrieval patterns.

Compensating Controls: Implement robust server-side authorization checks to ensure that the frontend cannot request data that the user is not explicitly permitted to see.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Vulnerabilities in frontend UI components often expose underlying API weaknesses.

Analyst Recommendation

Immediate remediation is recommended to prevent unauthorized data access. Beyond patching, developers should conduct a thorough review of the application's authorization logic to ensure that all user requests are properly validated on the server side.

---METADATA---
VENDOR: OpenList
PRODUCT: OpenList Frontend
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the OpenList Frontend UI component could allow for unauthorized actions or data exposure within the OpenList application.

Executive Summary:
The OpenList Frontend contains a high-severity vulnerability that could allow attackers to compromise the user interface and interact with sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-25059

Affected Software: OpenList OpenList Frontend

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the UI component of OpenList. It likely involves a cross-site scripting (XSS) or similar frontend injection flaw that allows an attacker to execute malicious scripts in the context of the user's browser, potentially leading to session hijacking.

Business Impact

A CVSS score of 8.8 reflects the high risk associated with this frontend vulnerability. An attacker could steal session tokens, impersonate users, or modify the data displayed to the user. This could lead to unauthorized access to the OpenList platform, resulting in data breaches and a loss of system integrity.

Remediation Plan

Immediate Action: Apply the latest security updates for the OpenList Frontend to remediate the underlying code flaw.

Proactive Monitoring: Implement Content Security Policy (CSP) headers to mitigate the impact of script injection and monitor web server logs for suspicious request patterns.

Compensating Controls: Use a Web Application Firewall (WAF) to detect and block common frontend exploitation techniques like XSS or injection attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Frontend components are frequently targeted to gain access to user sessions.

Analyst Recommendation

It is essential to update the OpenList Frontend immediately to protect users from potential account takeover. Security teams should also review the application's security headers to provide additional layers of defense against similar vulnerabilities in the future.

---METADATA---
VENDOR: MarkUs
PRODUCT: MarkUs
AFFECTED_VERSIONS: Prior to 2.9.1
---END_METADATA---

Description Summary:
MarkUs versions before 2.9.1 allow instructors to perform path traversal via malicious zip file uploads, enabling arbitrary file writes to the server disk.

Executive Summary:
A critical path traversal vulnerability in MarkUs allows authenticated instructors to write arbitrary files to the server, potentially leading to a full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-25057

Affected Software: MarkUs (Assignment Submission and Grading Application)

Affected Versions: Prior to 2.9.1

Vulnerability: The application fails to validate entry names within uploaded ZIP files during assignment configuration. An authenticated instructor can use crafted filenames (e.g., using ../ sequences) to write files to any location on the server disk that the web application has permission to access.

Business Impact

With a CVSS score of 9.1, the impact is severe. An attacker could overwrite critical system files or upload a web shell to achieve Remote Code Execution (RCE). This could lead to the theft of student data, modification of grades, or complete loss of the grading platform's availability.

Remediation Plan

Immediate Action: Upgrade MarkUs to version 2.9.1 or higher immediately to enable proper path validation during ZIP extraction.

Proactive Monitoring: Inspect the web server's file system for unexpected files in directories outside of the intended "courses" upload path.

Compensating Controls: Run the web application with the least privilege possible to limit the directory scope an attacker could write to, and use file integrity monitoring (FIM) tools.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. However, path traversal via ZIP files is a well-known attack vector, making exploitation highly likely if patches are not applied.

Analyst Recommendation

The ability for a user to write arbitrary files to a server is a critical security failure. Administrators should update the MarkUs application immediately and verify that the file system permissions for the application user are strictly limited.

---METADATA---
VENDOR: Scille
PRODUCT: parsec-cloud
AFFECTED_VERSIONS: < 3.3.3-rc.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Scille parsec-cloud is susceptible to a path traversal vulnerability via Windows UNC share names, allowing authenticated users to potentially access unauthorized files.

Executive Summary:
A path traversal vulnerability in Scille parsec-cloud allows authenticated attackers to perform unauthorized file operations, posing a significant risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-25039

Affected Software: Scille parsec-cloud

Affected Versions: < 3.3.3-rc.0

Vulnerability: This is a path traversal vulnerability (CWE-40) involving the improper handling of UNC share names. The vulnerability is exploitable by an authenticated user with low privileges.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to read or modify sensitive files outside of the intended directory structure. Given the CVSS score of 8.8, this flaw represents a high risk to organizational data security, potentially leading to unauthorized access to confidential information or system compromise.

Remediation Plan

Immediate Action: Update the Scille parsec-cloud software to version 3.3.3-rc.0 or higher to resolve the path traversal flaw.

Proactive Monitoring: Review application access logs for unusual path patterns or attempts to access system files using UNC naming conventions.

Compensating Controls: Implement strict file system permissions and ensure that the application is running with the minimum necessary privileges to limit the impact of potential path traversal.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ability to bypass standard file access controls.

Analyst Recommendation

The high severity of this vulnerability necessitates an immediate update to the patched version. Administrators should prioritize deployment of the fix to prevent potential unauthorized access to sensitive file shares within the environment.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea 1.26.2 contains an improper authorization vulnerability that allows unauthenticated users to access labels belonging to private organizations.

Executive Summary:
A critical authorization bypass in Gitea 1.26.2 permits unauthenticated users to access sensitive labels of private organizations, posing a risk to information confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-25038

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea 1.26.2

Vulnerability: This is an improper authorization vulnerability (CWE-862) and an information exposure flaw (CWE-200) where the application fails to perform necessary capability checks. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation allows unauthorized parties to view sensitive metadata regarding private projects, which can lead to the exposure of internal organization structures and project naming conventions, potentially aiding in further targeted attacks against the organization.

Remediation Plan

Immediate Action: Upgrade Gitea to version v1.26.3 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Review web access logs for unusual patterns of requests directed at label-related endpoints, particularly those originating from unauthorized or external IP addresses.

Compensating Controls: Implement strict network access controls (ACLs) to restrict access to the Gitea instance to known, trusted IP ranges where possible to minimize exposure to external threats.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 3, 2026, public proof-of-concept exploit code exists for this vulnerability. Given the ease of exploitation, immediate patching is required.

Analyst Recommendation

The presence of a public exploit significantly elevates the risk of this vulnerability. Administrators must prioritize the upgrade to v1.26.3 to close this unauthorized access vector and prevent the leakage of sensitive organizational metadata.

---METADATA---
VENDOR: ThemeMove
PRODUCT: Unicamp
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The ThemeMove Unicamp theme for WordPress contains a Local File Inclusion (LFI) vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
ThemeMove Unicamp is vulnerable to Local File Inclusion (LFI), allowing an attacker to read sensitive files or potentially execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-25027

Affected Software: ThemeMove Unicamp

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a Local File Inclusion (LFI) vulnerability caused by improper control of filenames in PHP include or require statements. An attacker can manipulate input parameters to force the application to include local files, potentially leading to the disclosure of sensitive configuration files like wp-config.php.

Business Impact

Successful exploitation allows an attacker to access sensitive server-side files, which can contain database credentials or system configurations. With a CVSS score of 7.5, this vulnerability could escalate to full remote code execution (RCE) if the attacker can upload or find a way to execute a malicious file, resulting in a total system compromise.

Remediation Plan

Immediate Action: Update the ThemeMove Unicamp theme to the latest version immediately to patch the insecure PHP inclusion logic.

Proactive Monitoring: Scan web server logs for directory traversal patterns (e.g., ../../etc/passwd) in URL parameters.

Compensating Controls: Disable allow_url_include in the PHP configuration and use a WAF to filter out common LFI attack strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. LFI vulnerabilities in WordPress themes are frequently targeted by automated exploit kits.

Analyst Recommendation

The severity of LFI vulnerabilities cannot be overstated, as they often serve as the first step in a multi-stage attack. You must apply the theme update immediately to prevent unauthorized file access and potential server takeover.