---METADATA---
VENDOR: Iqonic Design
PRODUCT: KiviCare (kivicare-clinic-management-system)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The KiviCare clinic management system plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive data from the site's database.

Executive Summary:
The KiviCare clinic management system plugin for WordPress is affected by a high-severity Blind SQL Injection vulnerability that risks the exposure of sensitive medical and administrative data.

Vulnerability Details

CVE-ID: CVE-2026-25022

Affected Software: Iqonic Design KiviCare (kivicare-clinic-management-system)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') within the KiviCare plugin. An attacker can use Blind SQL Injection techniques to query the database indirectly, potentially leading to the extraction of sensitive information without requiring direct output from the application.

Business Impact

The impact is extremely high, especially for medical clinics, as it could lead to the theft of patient records, protected health information (PHI), and administrative credentials. A breach of this nature could result in massive fines under HIPAA or GDPR. The CVSS score of 8.5 reflects the critical danger to data confidentiality.

Remediation Plan

Immediate Action: Apply the latest security patches from Iqonic Design for the KiviCare plugin immediately to remediate the SQL injection flaw.

Proactive Monitoring: Enable database query logging and monitor for unusual, repetitive queries that are characteristic of Blind SQL Injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection enabled to filter and block malicious database queries at the network edge.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, SQL injection remains one of the most common and damaging attack vectors for web applications.

Analyst Recommendation

Given the 8.5 CVSS score and the sensitive nature of clinic management data, this vulnerability requires immediate attention. Administrators must update the KiviCare plugin to the latest version and perform a thorough security audit of their database to ensure no unauthorized access has occurred.

---METADATA---
VENDOR: BestWebSoft
PRODUCT: Gallery by BestWebSoft
AFFECTED_VERSIONS: 0 through 4.7.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL injection via the gallery_order{post_id} parameter, allowing authenticated users with high privileges to manipulate database queries.

Executive Summary:
The Gallery by BestWebSoft plugin for WordPress contains a SQL injection vulnerability that allows high-privileged users to compromise the database and potentially execute unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-2497

Affected Software: BestWebSoft Gallery by BestWebSoft

Affected Versions: 0 through 4.7.9

Vulnerability: This is an SQL injection vulnerability (CWE-89) triggered by improper input sanitization of the gallery_order{post_id} parameter. The vulnerability requires the attacker to have high-level administrative privileges (authenticated) to trigger the malicious query.

Business Impact

A successful SQL injection attack can lead to unauthorized data extraction, modification, or deletion within the WordPress database. Given the CVSS score of 7.2, this vulnerability represents a significant risk to the integrity of the website and its associated data. Compromise of the database could lead to further unauthorized access or total site takeover.

Remediation Plan

Immediate Action: Update the Gallery by BestWebSoft plugin to version 4.8.0 or later immediately to patch the injection vector.

Proactive Monitoring: Monitor database query logs for suspicious or malformed SQL statements originating from administrative sessions.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the gallery plugin parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for administrative privileges naturally limits the attack surface, but it remains a critical risk for internal security.

Analyst Recommendation

Administrators must verify the plugin version and apply the update to 4.8.0. If an immediate update is not feasible, restrict administrative access to the plugin settings to trusted users only.

---METADATA---
VENDOR: magepeopleteam
PRODUCT: WpEvently (mage-eventpress)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WpEvently (mage-eventpress) WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted data, potentially leading to remote code execution.

Executive Summary:
The magepeopleteam WpEvently plugin for WordPress is vulnerable to a critical deserialization flaw that could allow an attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-24954

Affected Software: magepeopleteam WpEvently (mage-eventpress)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Deserialization of Untrusted Data issue within the WpEvently plugin. By providing specially crafted input to a vulnerable parameter, an attacker can trigger PHP Object Injection, potentially leading to arbitrary code execution or unauthorized file manipulation on the host server.

Business Impact

A successful exploit could result in a complete takeover of the WordPress site, allowing attackers to steal user data, deface the website, or use the server as a jumping-off point for further attacks. The CVSS score of 8.8 reflects the high severity and the relative ease with which an attacker could cause significant operational damage.

Remediation Plan

Immediate Action: Update the WpEvently (mage-eventpress) plugin to the latest version immediately to patch the insecure deserialization point.

Proactive Monitoring: Scan WordPress logs for suspicious PHP error messages or unusual activity in the plugin's directories that might indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically designed to block PHP Object Injection and common WordPress exploit patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Deserialization flaws are highly sought after by attackers because they often lead directly to remote code execution (RCE).

Analyst Recommendation

Due to the high CVSS score of 8.8 and the risk of site takeover, this vulnerability must be addressed immediately. Administrators should prioritize updating the WpEvently plugin and consider a broader audit of their WordPress environment for similar deserialization vulnerabilities.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Prior to version 8.0.0
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the OpenEMR Patient REST API allows authenticated users to execute arbitrary queries and access protected health information.

Executive Summary:
A critical SQL injection vulnerability in OpenEMR allows authenticated users to bypass security controls and access sensitive patient data, leading to a major breach of PHI.

Vulnerability Details

CVE-ID: CVE-2026-24908

Affected Software: OpenEMR OpenEMR

Affected Versions: Prior to version 8.0.0

Vulnerability: The vulnerability exists in the Patient REST API endpoint due to the lack of proper validation on the _sort parameter. An authenticated attacker with API access can inject malicious SQL commands into the ORDER BY clause, enabling unauthorized database interaction.

Business Impact

The impact of this flaw is severe, potentially resulting in the full exposure of Protected Health Information (PHI) and a violation of HIPAA regulations. Beyond data theft, attackers could compromise administrative credentials or manipulate medical records, leading to significant legal, financial, and reputational damage. The CVSS score of 9.9 underscores the critical nature of this injection flaw.

Remediation Plan

Immediate Action: Administrators must upgrade OpenEMR installations to version 8.0.0 or higher to eliminate the vulnerable code path in the REST API.

Proactive Monitoring: Review database logs for anomalous queries containing SQL keywords in the ORDER BY clauses and monitor API traffic for suspicious sorting requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to intercept and block malicious payloads targeting the REST API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. Given that OpenEMR is widely used in healthcare, the incentive for exploitation by threat actors is high.

Analyst Recommendation

Protecting patient data is a primary requirement for healthcare providers. Organizations using OpenEMR must prioritize this update immediately to prevent unauthorized access to sensitive medical databases and ensure regulatory compliance.

Executive Summary:
A high-severity vulnerability has been identified in the TrustTunnel VPN protocol affecting multiple products from the vendor "prior". This flaw, a Server-Side Request Forgery (SSRF), could allow a remote attacker to bypass network security restrictions and force the VPN server to make unauthorized requests to internal network resources, potentially leading to data exposure and further network compromise.

Vulnerability Details

CVE-ID: CVE-2026-24902

Affected Software: prior Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a Server-Side Request Forgery (SSRF) combined with a private network restriction bypass within the TrustTunnel VPN protocol. An unauthenticated remote attacker can craft a malicious request to the vulnerable VPN server. The server fails to properly validate this input, causing it to initiate a new connection to an arbitrary destination on the internal network, effectively acting as a proxy for the attacker. This allows the attacker to scan internal networks, access internal services, and potentially exfiltrate sensitive data from systems that were presumed to be protected from external access.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.1. Successful exploitation could have a significant negative impact on the organization. An attacker could gain unauthorized access to sensitive internal systems, such as databases, file servers, and internal applications, bypassing perimeter defenses. This could lead to the exfiltration of confidential corporate data, intellectual property theft, service disruption, and lateral movement within the corporate network. The resulting consequences include potential data breaches, financial loss, reputational damage, and non-compliance with regulatory requirements.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected products immediately. After patching, it is crucial to review access logs for the VPN server and connected internal systems for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for signs of exploitation. This includes scrutinizing VPN server logs for unusual or malformed connection requests. Monitor network traffic for unexpected outbound connections from the VPN server to internal IP addresses and ports. Internal application logs should also be reviewed for anomalous requests originating from the VPN server's IP address.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Apply strict firewall rules to limit the VPN server's ability to initiate connections to other systems on the internal network. Enforce an "allow-list" model, only permitting access to explicitly required resources.
• Deploy an Intrusion Prevention System (IPS) or Web Application Firewall (WAF) to inspect traffic to the VPN server for known SSRF attack patterns.
• Enhance network segmentation to isolate the VPN server from critical internal assets, preventing lateral movement in case of a compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 31, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, SSRF vulnerabilities are well-understood by attackers, and it is highly likely that exploits will be developed. Organizations should assume that threat actors will begin scanning for and attempting to exploit this flaw.

Analyst Recommendation

Given the high severity (CVSS 7.1) and the critical function of VPN servers as gateways to internal networks, this vulnerability poses a significant risk. The analyst strongly recommends that organizations prioritize the immediate application of vendor-supplied patches to all affected systems. While this CVE is not currently listed on the CISA KEV list, its potential for granting initial access to a network makes it an attractive target for attackers. The remediation and monitoring steps outlined in this report should be implemented without delay to prevent unauthorized access and protect sensitive internal resources.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR (MedEx Module)
AFFECTED_VERSIONS: Prior to 8.0.0
---END_METADATA---

Description Summary:
An unauthenticated token disclosure in OpenEMR's MedEx callback endpoint leaks API tokens, leading to PHI exfiltration and HIPAA violations.

Executive Summary:
OpenEMR contains a critical vulnerability where an unauthenticated attacker can steal MedEx API tokens, resulting in the exposure of sensitive patient health information.

Vulnerability Details

CVE-ID: CVE-2026-24898

Affected Software: OpenEMR

Affected Versions: Prior to 8.0.0

Vulnerability: The MedEx callback endpoint explicitly bypasses authentication ($ignoreAuth = true). By providing a callback_key via POST, an unauthenticated visitor triggers a login process that returns the full JSON response, including sensitive MedEx API tokens.

Business Impact

This vulnerability carries a CVSS score of 10. The exposure of API tokens allows for complete third-party service compromise, unauthorized actions on the MedEx platform, and the exfiltration of Protected Health Information (PHI). This constitutes a major security failure and a direct violation of HIPAA regulations.

Remediation Plan

Immediate Action: Upgrade OpenEMR to version 8.0.0 immediately. Following the upgrade, revoke and rotate all MedEx API tokens to ensure any previously leaked tokens are invalidated.

Proactive Monitoring: Review access logs for the MedEx callback endpoint for unauthorized POST requests and monitor MedEx platform logs for suspicious activity.

Compensating Controls: Implement IP whitelisting for the MedEx callback endpoint so that only legitimate MedEx servers can communicate with the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. Given the sensitivity of the data involved, this vulnerability is a prime target for attackers seeking medical records.

Analyst Recommendation

This is a critical security flaw with severe legal and financial implications. We strongly urge immediate patching and token rotation to protect patient data and maintain regulatory compliance.

Executive Summary:
A critical vulnerability has been identified in the Erugo self-hosted file-sharing platform, allowing a low-privileged authenticated user to gain full control of the server. An attacker can exploit this flaw by uploading a malicious file to a web-accessible location, leading to remote code execution. This complete system compromise poses a severe risk of data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-24897

Affected Software: Erugo is a Multiple Products

Affected Versions: Versions up to and including 0.2.14

Vulnerability: The vulnerability exists due to insufficient path validation in the file-sharing creation feature. An authenticated attacker with low-level privileges can specify a crafted file path, such as one using path traversal sequences (../), when creating a new share. This allows them to bypass directory restrictions and designate a share location anywhere on the filesystem where the application has write permissions, including the public web root directory. By subsequently uploading a web shell or other executable script to this share, the attacker can place malicious code in a publicly accessible location and execute it by simply visiting the corresponding URL, resulting in full remote code execution on the server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10. Successful exploitation results in a complete compromise of the server hosting the Erugo platform. This could lead to the theft or destruction of all stored data, installation of ransomware, or the use of the compromised server to launch further attacks against the internal network. The potential business impact includes significant data breach costs, regulatory fines, operational downtime, and severe reputational damage. Since the only prerequisite for an attacker is a low-privileged account, the risk of exploitation is high in any environment where user registration is open or multiple users have access.

Remediation Plan

Immediate Action: Immediately upgrade all instances of Erugo to version 0.2.15 or later, which contains the fix for this vulnerability. After patching, review server access logs and application logs for any signs of suspicious activity, such as unusual file creation requests or access to unexpected files in the web root.

Proactive Monitoring: Implement enhanced monitoring of the Erugo application and underlying server. Specifically, monitor application logs for share creation events containing path traversal sequences (../). Use file integrity monitoring (FIM) to alert on any new files, especially those with executable extensions (.php, .sh, .jsp, etc.), being written to the web root directory outside of normal deployment processes.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with rules to detect and block path traversal attacks.
• Strictly enforce file system permissions to prevent the web server's user account from writing to the web root or other sensitive directories.
• If business functionality allows, temporarily disable file upload capabilities for all non-administrative users.
• Audit all existing user accounts and remove any that are unnecessary or have excessive privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Jan 28, 2026), there are no publicly available exploits or reports of active exploitation in the wild. However, given the critical impact and the relative simplicity of the attack vector, proof-of-concept (PoC) exploits are expected to be developed and published quickly. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the critical severity (CVSS 10.0) and the potential for a low-privileged user to achieve complete system compromise, this vulnerability requires immediate attention. All organizations using affected versions of Erugo must prioritize applying the update to version 0.2.15 or later. The low barrier to exploitation makes this an attractive target for attackers, and organizations should assume it will be actively targeted in the near future.

---METADATA---
VENDOR: Arch (Node.js Library)
PRODUCT: Compressing
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the 'Compressing' Node.js library could allow for arbitrary file manipulation during the compression or decompression process.

Executive Summary:
The 'Compressing' library for Node.js contains a high-severity vulnerability that could allow attackers to perform unauthorized file writes on the host system.

Vulnerability Details

CVE-ID: CVE-2026-24884

Affected Software: Compressing (Node.js library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability likely involves a "Zip Slip" or path traversal flaw within the compression/uncompression functions. An attacker providing a malicious archive could potentially write files to arbitrary locations on the server, often without authentication if the library processes user-uploaded files.

Business Impact

A CVSS score of 8.4 reflects the high risk of Remote Code Execution (RCE) or system takeover. By overwriting critical system files or application code, an attacker can gain persistent access to the server, leading to data theft and significant operational impact.

Remediation Plan

Immediate Action: Developers should update the 'Compressing' dependency in their package.json to the latest secure version and redeploy affected applications.

Proactive Monitoring: Audit application code to ensure that all file paths extracted from archives are validated and sanitized before being written to the disk.

Compensating Controls: Run Node.js applications in a restricted environment (e.g., containers with read-only file systems where possible) to limit the impact of unauthorized file writes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Library vulnerabilities are particularly dangerous as they can affect a wide range of downstream applications.

Analyst Recommendation

We strongly recommend that development teams audit their Node.js projects for the 'Compressing' library and update it immediately. Failure to patch this library could leave servers vulnerable to full system compromise via malicious file uploads.

---METADATA---
VENDOR: themrdemonized
PRODUCT: xray-monolith
AFFECTED_VERSIONS: 0 up to (excluding) 2025.12.30
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion vulnerability in themrdemonized xray-monolith allows unauthenticated remote attackers to potentially access or manipulate system resources.

Executive Summary:
A critical type confusion vulnerability in xray-monolith (before 2025.12.30) poses a high risk of unauthorized data access or integrity compromise to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-24874

Affected Software: themrdemonized xray-monolith

Affected Versions: 0 up to (excluding) 2025.12.30

Vulnerability: This is a Type Confusion vulnerability (CWE-843) occurring within the application. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is exploitable by an unauthenticated remote attacker without requiring user interaction.

Business Impact

The vulnerability carries a CVSS score of 9.1, reflecting its high potential for severe impact. Successful exploitation could lead to unauthorized access to sensitive data or modification of critical system information, potentially resulting in significant operational disruption and data breach consequences.

Remediation Plan

Immediate Action: Upgrade to version 2025.12.30 or later to apply the necessary security fixes provided by the vendor.

Proactive Monitoring: Monitor system logs for unusual traffic patterns or errors that might indicate an attempt to exploit memory-related vulnerabilities.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets to identify and block malformed requests that may attempt to trigger type confusion.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for remote, unauthenticated code execution or data manipulation.

Analyst Recommendation

Given the critical CVSS severity and the low complexity required for exploitation, organizations using xray-monolith should prioritize patching immediately. Ensure that the updated version is deployed across all affected environments to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: ProjectSkyfire
PRODUCT: SkyFire_548
AFFECTED_VERSIONS: 0 up to (excluding) 5.4.8-stable5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper pointer arithmetic vulnerability in ProjectSkyfire SkyFire_548 allows unauthenticated remote attackers to cause system crashes or potentially execute arbitrary code.

Executive Summary:
A critical improper pointer arithmetic vulnerability in SkyFire_548 (before 5.4.8-stable5) allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-24872

Affected Software: ProjectSkyfire SkyFire_548

Affected Versions: 0 up to (excluding) 5.4.8-stable5

Vulnerability: The vulnerability involves improper pointer arithmetic, which can lead to memory corruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms that this is exploitable by an unauthenticated remote attacker.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk to infrastructure. Exploitation could lead to a total compromise of the affected system, including unauthorized data access and the potential for full system control, severely impacting business continuity.

Remediation Plan

Immediate Action: Update to version 5.4.8-stable5 or newer immediately to resolve the identified memory management flaw.

Proactive Monitoring: Review system and application logs for segmentation faults, abnormal crashes, or unexpected memory usage patterns.

Compensating Controls: Utilize memory protection mechanisms and restrict network access to the affected software to only trusted IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly susceptible to exploitation if exposed to the network.

Analyst Recommendation

Due to the critical severity and the lack of authentication required to exploit this flaw, this patch should be considered a high-priority emergency deployment. Organizations must update their SkyFire_548 installations immediately to prevent potential system-wide compromise.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiAnalyzer
AFFECTED_VERSIONS: FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiManager 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiNAC-F 7.6.3-7.6.5; FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in various Fortinet products allows attackers to log into devices registered to other accounts if FortiCloud SSO is enabled.

Executive Summary:
Multiple Fortinet products are affected by a critical authentication bypass vulnerability that permits unauthorized account access via FortiCloud SSO.

Vulnerability Details

CVE-ID: CVE-2026-24858

Affected Software: Fortinet FortiAnalyzer (and other listed Fortinet products)

Affected Versions: See "Affected Versions" in metadata for full scope of impacted firmware across FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy, and FortiWeb.

Vulnerability: This is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. It allows an attacker who possesses a legitimate FortiCloud account and a registered device to authenticate to other devices registered to different accounts, provided FortiCloud SSO is enabled.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of unauthorized access to sensitive network management infrastructure. Exploitation could allow attackers to gain control over security appliances, access logs, or modify firewall policies, leading to severe data breaches or complete network compromise.

Remediation Plan

Immediate Action: Update all affected Fortinet devices to the latest patched firmware versions as specified in the official Fortinet security advisory.

Proactive Monitoring: Review access logs for suspicious login patterns originating from unexpected FortiCloud accounts and monitor for unauthorized changes to administrative settings.

Compensating Controls: If patching is delayed, consider disabling FortiCloud SSO authentication as a temporary measure to block the attack vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of January 27, 2026, this vulnerability is listed in the CISA KEV catalog. While there is no public exploit code, the inclusion in the KEV catalog indicates that the vulnerability is being actively exploited in the wild.

Analyst Recommendation

This vulnerability poses a severe threat to organizational security due to the potential for cross-account unauthorized access. Organizations should treat this as a high-priority update and ensure all affected Fortinet infrastructure is updated immediately to mitigate the risk of compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple ChurchCRM products, a widely used open-source church management system. This flaw, tracked as CVE-2026-24854, could allow a remote, unauthenticated attacker to compromise the application, potentially leading to a complete loss of data confidentiality, integrity, and availability. Immediate patching is required to prevent unauthorized access to sensitive member information and financial data.

Vulnerability Details

CVE-ID: CVE-2026-24854

Affected Software: ChurchCRM Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an unauthenticated SQL injection flaw within the application's public-facing API endpoints. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL queries to a vulnerable endpoint. Successful exploitation allows the attacker to bypass authentication, execute arbitrary code on the database server, and potentially gain full administrative control over the underlying server operating system.

Business Impact

This vulnerability presents a significant risk to the organization, classified as High severity with a CVSS score of 8.8. Successful exploitation could lead to the complete compromise of the ChurchCRM system. The potential consequences include unauthorized access to and exfiltration of sensitive Personally Identifiable Information (PII) of church members, disclosure of confidential financial and donation records, and reputational damage. An attacker could also deface the application or use the compromised server as a pivot point for further attacks against the internal network.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. System administrators should prioritize the deployment of these patches across all affected ChurchCRM instances. Following the update, it is crucial to review web server and application access logs for any signs of exploitation attempts that may have occurred prior to patching.

Proactive Monitoring: Implement enhanced monitoring on the systems running ChurchCRM. Security teams should look for suspicious activity in web server logs, such as unusual URL requests containing SQL keywords (e.g., UNION, SELECT, SLEEP). Monitor for unexpected outbound network connections from the server and any unauthorized changes to files within the web application's directory.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attacks.
• Restrict access to the ChurchCRM application and its administrative interfaces to trusted IP addresses only.
• Ensure the database user account used by the application adheres to the principle of least privilege and cannot execute system-level commands.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of February 1, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, given the high severity and relative ease of exploitation for this type of flaw, it is highly probable that threat actors will develop and begin using exploits in the near future.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the critical nature of the data managed by ChurchCRM, this vulnerability requires immediate attention. Organizations must prioritize applying the vendor-supplied patches to all affected systems without delay. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime candidate for future inclusion and a high-value target for attackers. If patching is delayed, the compensating controls listed above should be implemented as an urgent temporary measure.

---METADATA---
VENDOR: Caido
PRODUCT: Caido
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Caido web security auditing toolkit is affected by a high-severity vulnerability that could compromise the security of the auditing environment.

Executive Summary:
Caido, a professional web auditing toolkit, contains a high-severity vulnerability that could allow for unauthorized access or compromise of sensitive security testing data.

Vulnerability Details

CVE-ID: CVE-2026-24853

Affected Software: Caido

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Caido auditing toolkit. Given Caido's function as a proxy and analysis tool for web traffic, a high-severity flaw (CVSS 8.1) in this software could potentially allow an attacker to intercept or manipulate the security professional's auditing session.

Business Impact

A compromise of a security professional's toolkit is a critical event. An attacker could potentially gain access to the sensitive vulnerabilities, session tokens, and request data captured during a security audit. This not only compromises the integrity of the audit itself but could also lead to the exposure of the client systems being tested, resulting in significant legal and reputational liabilities.

Remediation Plan

Immediate Action: Users should update their Caido installation to the latest version immediately to secure their auditing environment.

Proactive Monitoring: Monitor the local workstation and network for any anomalous traffic that suggests the toolkit is being remotely controlled or data is being exfiltrated.

Compensating Controls: Run security auditing tools within isolated virtual machines or containers to prevent a compromise of the tool from affecting the host operating system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 14, 2026, there is no public information indicating active exploitation of this vulnerability. Security tools are frequently targeted by sophisticated actors to gain insight into what vulnerabilities are being discovered by defenders.

Analyst Recommendation

Security practitioners must ensure their own tools are secure before testing others. We recommend that all Caido users apply the latest updates immediately. Because this tool handles highly sensitive data, the CVSS score of 8.1 reflects a substantial risk to the confidentiality of audit findings.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Versions prior to 7.0.4
---END_METADATA---

Description Summary:
An arbitrary file read vulnerability in OpenEMR allows any authenticated user to access sensitive files on the server filesystem via the EtherFax component.

Executive Summary:
Any authenticated user in OpenEMR can read sensitive server files, potentially exposing credentials, configuration data, and patient information.

Vulnerability Details

CVE-ID: CVE-2026-24849

Affected Software: OpenEMR

Affected Versions: Versions prior to 7.0.4

Vulnerability: The disposeDocument() method in EtherFaxActions.php fails to properly validate file paths. This allows any authenticated user, regardless of their privilege level, to perform path traversal and read arbitrary files from the server.

Business Impact

The exposure of sensitive files can lead to a total breach of patient confidentiality (HIPAA violation) and provide attackers with the credentials needed for further lateral movement or full system compromise. The CVSS score of 9.9 reflects the high impact on data integrity and confidentiality.

Remediation Plan

Immediate Action: Update OpenEMR to version 7.0.4 immediately to patch the insecure file handling logic in the EtherFax component.

Proactive Monitoring: Audit application logs for unusual calls to EtherFaxActions.php and check for attempts to access system files like /etc/passwd or configuration files.

Compensating Controls: Restrict filesystem permissions for the web server user to ensure it cannot access sensitive system directories outside of the application root.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, active exploitation has not been reported. However, because any low-privileged user can exploit this, the internal threat risk is significantly elevated.

Analyst Recommendation

Healthcare organizations must prioritize this update due to the sensitive nature of the data handled by OpenEMR. Applying the patch to version 7.0.4 is the only effective way to prevent unauthorized file access by authenticated users.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A second high-severity vulnerability has been identified in the Melange apk package builder's declarative pipeline system.

Executive Summary:
Melange is affected by a high-severity vulnerability that poses a risk to the security and integrity of package build pipelines.

Vulnerability Details

CVE-ID: CVE-2026-24844

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Similar to other recent flaws in the product, this vulnerability involves the processing of declarative pipelines. An attacker could exploit this flaw to perform unauthorized actions within the build environment, potentially impacting the final apk output.

Business Impact

With a CVSS score of 7.9, this vulnerability represents a significant threat to the software supply chain. An attacker could potentially introduce malicious code or backdoors into packages, leading to a loss of trust and potential compromise of downstream users.

Remediation Plan

Immediate Action: Apply the latest security updates to the Melange toolset immediately to protect build pipelines.

Proactive Monitoring: Implement integrity checks for all generated apk packages and monitor build environments for unauthorized process execution.

Compensating Controls: Restrict access to pipeline configuration files and utilize signed commits for all changes to the build infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the repeated identification of flaws in pipeline processing highlights a critical area of risk for Melange users.

Analyst Recommendation

The urgency for remediation is high due to the potential for supply chain contamination. Organizations should update Melange immediately and review their build security posture to ensure defense-in-depth.

---METADATA---
VENDOR: Chainguard
PRODUCT: Melange
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw in Melange, a tool for building apk packages using declarative pipelines, could allow for unauthorized actions during the build process.

Executive Summary:
The Melange package builder is vulnerable to a high-severity flaw that could allow attackers to compromise the integrity of the apk package build pipeline.

Vulnerability Details

CVE-ID: CVE-2026-24843

Affected Software: Melange

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the declarative pipeline processing in Melange. An attacker with the ability to influence pipeline definitions could potentially execute unauthorized commands or manipulate the resulting apk packages during the build phase.

Business Impact

A compromise of the build pipeline is a critical supply chain risk. With a CVSS score of 8.2, this vulnerability could allow for the injection of malicious code into software packages before they are distributed, leading to widespread downstream compromise of users and systems.

Remediation Plan

Immediate Action: Update Melange to the latest version to ensure that pipeline processing logic is properly secured against exploitation.

Proactive Monitoring: Audit build logs for any anomalous activities or unauthorized changes to the declarative pipeline configurations.

Compensating Controls: Implement strict code review processes for all pipeline definitions and ensure the build environment is isolated from sensitive internal networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Supply chain tools like Melange are increasingly targeted by sophisticated actors to facilitate large-scale attacks.

Analyst Recommendation

Security teams should prioritize updating their build infrastructure. Ensuring the integrity of the software supply chain is paramount, and applying this patch is a critical step in preventing malicious package injection.

Executive Summary:
A critical command injection vulnerability has been identified in the Dokploy PaaS, affecting versions prior to 0.26.6. This flaw allows an authenticated attacker to execute arbitrary commands on the underlying server, potentially leading to a complete system compromise, data theft, and service disruption. Due to the high severity (CVSS 9.9), immediate patching is required to prevent a full takeover of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-24841

Affected Software: Dokploy is a Multiple Products

Affected Versions: All versions prior to 0.26.6

Vulnerability: The vulnerability is a command injection flaw within the /docker-container-terminal WebSocket endpoint. The endpoint accepts containerId and activeWay parameters which are insecurely passed to a shell command on the host server without proper sanitization or validation. An authenticated attacker can manipulate these parameters to inject and execute arbitrary shell commands with the privileges of the Dokploy service, leading to remote code execution (RCE) on the host.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9. Successful exploitation would result in a complete compromise of the server hosting Dokploy, granting the attacker full control. The potential business impact includes theft or modification of sensitive data, deployment of ransomware, complete disruption of all applications managed by Dokploy, and the ability for an attacker to use the compromised server as a pivot point to attack other systems within the internal network. This represents a total loss of confidentiality, integrity, and availability for the affected system and its hosted services.

Remediation Plan

Immediate Action: Immediately upgrade all Dokploy instances to version 0.26.6 or later, which contains the fix for this vulnerability. After patching, review system and application logs for any signs of compromise or suspicious activity preceding the update.

Proactive Monitoring:

• Monitor WebSocket connection logs for unusual or malformed requests to the /docker-container-terminal endpoint.
• Implement host-based monitoring to detect anomalous process execution, especially unexpected shell commands spawned by the Dokploy user/service.
• Analyze outbound network traffic from the Dokploy server for connections to unknown or malicious destinations.
• Review Dokploy access logs for unauthorized or suspicious authentication events.

Compensating Controls: If patching cannot be performed immediately, implement the following controls:

• Restrict network access to the Dokploy management interface and API endpoints to trusted IP addresses using a firewall.
• Deploy a Web Application Firewall (WAF) with rules specifically designed to inspect and block malicious WebSocket payloads targeting command injection.
• Enforce the principle of least privilege for all user accounts with access to Dokploy, and ensure multi-factor authentication is enabled.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jan 28, 2026, there are no widespread reports of active exploitation in the wild. However, command injection vulnerabilities of this nature are trivial to exploit once discovered. It is highly probable that functional proof-of-concept (PoC) exploit code will become publicly available shortly, significantly increasing the risk. The only mitigating factor is the requirement for the attacker to be authenticated.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the risk of complete system compromise, it is imperative that organizations treat this vulnerability with the highest priority. The provided remediation to upgrade to version 0.26.6 or later should be applied immediately across all affected systems. Although this vulnerability is not currently listed on the CISA KEV list, its severity makes it a prime candidate for future inclusion. Do not delay patching.

Executive Summary:
A critical vulnerability exists in multiple DNN products that allows an attacker to inject malicious scripts into module titles. When a user views a page with a compromised module, this script can execute in their browser, potentially leading to account takeover, data theft, or website defacement. Organizations are urged to apply the available security updates immediately to mitigate this high-risk threat.

Vulnerability Details

CVE-ID: CVE-2026-24838

Affected Software: DNN Multiple Products

Affected Versions: All versions prior to 9.13.10 and 10.2.0

Vulnerability: The vulnerability is a stored Cross-Site Scripting (XSS) flaw within the module title field. Because this field improperly sanitizes rich text input, an authenticated attacker with permissions to edit module titles can inject malicious HTML and JavaScript code. When any user, including administrators, views the page containing the malicious module title, the injected script executes within the context of their browser session, compromising that session.

Business Impact

With a critical severity rating and a CVSS score of 9.1, this vulnerability poses a significant threat to the organization. Successful exploitation could lead to the theft of sensitive user data, session cookies, and administrative credentials, enabling complete account and site takeover. Further consequences include website defacement, redirection of users to malicious phishing sites, and the deployment of malware, resulting in severe reputational damage, loss of customer trust, and potential regulatory non-compliance.

Remediation Plan

Immediate Action: The primary remediation is to upgrade affected systems. Administrators must update their DNN instances to version 9.13.10, 10.2.0, or a later patched version immediately. Refer to the official DNN security advisory for specific patch instructions and details.

Proactive Monitoring: Security teams should actively monitor web application and server logs for attempts to inject script tags (<script>, <iframe>, onerror) into POST requests associated with module title updates. Review existing module titles across the site for any suspicious code. Implement alerts for unusual client-side script execution or unexpected outbound network traffic from user browsers interacting with the site.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads.
• Restrict permissions for editing module titles to a minimal number of highly trusted administrators.
• Implement a strong Content Security Policy (CSP) to prevent the execution of untrusted inline scripts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jan 28, 2026, there is no known public exploit code or active exploitation of this vulnerability in the wild. However, XSS vulnerabilities in widely used platforms like DNN are often targeted by threat actors shortly after disclosure. The simplicity of exploiting this type of flaw increases the likelihood that proof-of-concept exploits will be developed and published by security researchers.

Analyst Recommendation

Given the critical CVSS score of 9.1, this vulnerability requires immediate attention. We strongly recommend that all organizations using affected DNN products prioritize the deployment of the security patches to versions 9.13.10 or 10.2.0. Although this CVE is not currently on the CISA KEV list, its high severity and potential for complete system compromise present an unacceptable risk. If patching is delayed, the compensating controls outlined above should be implemented as an urgent temporary measure.

Executive Summary:
A high-severity vulnerability has been identified in the DNN (DotNetNuke) web content management system, which operates within the Microsoft ecosystem. This flaw allows a remote, authenticated attacker with low-level privileges to read sensitive files from the underlying server. Successful exploitation could lead to the exposure of confidential data, including configuration details and credentials, potentially enabling further unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-24837

Affected Software: DNN (DotNetNuke)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a path traversal flaw within a component of the DNN platform responsible for file management. The application fails to properly sanitize user-supplied input that specifies a file path. An authenticated attacker can exploit this by crafting a malicious request containing "dot-dot-slash" (../) sequences to navigate outside of the intended web root directory, allowing them to read arbitrary files on the server's file system to which the web server process has access.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. The primary business impact is a breach of confidentiality. Exploitation could allow an attacker to exfiltrate sensitive information, such as the web.config file containing database connection strings and other application secrets, source code, or internal documents stored on the server. This exposure could lead to a full compromise of the application and its data, regulatory penalties for data breaches, and significant reputational damage.

Remediation Plan

Immediate Action: Apply the security updates released by the vendor immediately to all affected DNN instances. Following the update, security teams should monitor for any potential exploitation attempts that may have occurred prior to patching by carefully reviewing web server access logs for suspicious requests.

Proactive Monitoring: Monitor web server logs (e.g., IIS logs) for GET or POST requests containing path traversal sequences like ../, ..\\, or their URL-encoded equivalents (%2e%2e%2f). Implement alerts for any attempts to access critical system files (e.g., web.config, boot.ini, /etc/passwd) via the web application. Utilize a Web Application Firewall (WAF) to detect and block malicious requests matching path traversal signatures.

Compensating Controls: If patching cannot be performed immediately, implement a WAF with strict rules to block path traversal patterns. Additionally, enforce the principle of least privilege by ensuring the web server's service account has the minimum necessary file system permissions, restricting its access to directories outside of the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 28, 2026, there are no known public proof-of-concept exploits or active attacks leveraging this vulnerability. However, given the low complexity of path traversal attacks, it is highly likely that exploit code will be developed and released publicly in the near future. Threat actors are expected to begin scanning for vulnerable systems shortly.

Analyst Recommendation

Given the high severity score (CVSS 7.6) and the low complexity required for exploitation, this vulnerability poses a significant risk to the organization. We strongly recommend prioritizing the immediate patching of all internet-facing DNN applications. Although this CVE is not currently listed on the CISA KEV catalog, its characteristics make it an attractive target for attackers. Where immediate patching is not feasible, the compensating controls outlined above should be implemented as a matter of urgency to mitigate the risk of a data breach.