---METADATA---
VENDOR: davila7
PRODUCT: claude-code-templates
AFFECTED_VERSIONS: < 1.29.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The claude-code-templates CLI tool is vulnerable to OS command injection, missing authentication, and cross-site request forgery, potentially allowing unauthorized command execution.

Executive Summary:
A critical vulnerability in the davila7 claude-code-templates CLI tool allows unauthenticated attackers to execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-73222

Affected Software: davila7 claude-code-templates

Affected Versions: < 1.29.4

Vulnerability: This flaw encompasses OS command injection (CWE-78), missing authentication for critical functions (CWE-306), and cross-site request forgery (CWE-352). These vulnerabilities allow a remote attacker to execute arbitrary commands on the underlying host, as the application fails to properly neutralize special elements and lacks sufficient authentication controls.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk. A successful exploit could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the network. Because the tool is used for configuring and monitoring development workflows, its compromise directly threatens the integrity of the software development pipeline.

Remediation Plan

Immediate Action: Update the claude-code-templates CLI tool to version 1.29.4 or later immediately.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unusual CLI activity originating from the user account running the tool.

Compensating Controls: Restrict network access to the host running this tool using host-based firewalls to prevent unauthorized remote interaction until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of OS command injection and missing authentication makes this a high-value target for attackers seeking initial access to development environments.

Analyst Recommendation

Given the severity of potential OS command injection, immediate action is required. Organizations should prioritize updating all instances of claude-code-templates to version 1.29.4 to remediate the underlying flaws and prevent unauthorized system access.

---METADATA---
VENDOR: Chocobozzz
PRODUCT: PeerTube
AFFECTED_VERSIONS: < 8.1.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the PeerTube ActorFollowModel allows unauthenticated remote servers to execute arbitrary database queries and take over administrator accounts.

Executive Summary:
An unauthenticated SQL injection in PeerTube allows remote attackers to compromise administrative accounts and read or modify sensitive database tables.

Vulnerability Details

CVE-ID: CVE-2026-73211

Affected Software: Chocobozzz PeerTube

Affected Versions: < 8.1.6

Vulnerability: The flaw resides in the ActorFollowModel.updateScore() function, where attacker-controlled input is improperly interpolated into an SQL query. This allows unauthenticated actors to perform unauthorized database operations, including the theft of OAuth access tokens.

Business Impact

The potential for administrative account takeover via SQL injection makes this a critical vulnerability. With a CVSS score of 9.8, the impact includes total loss of control over the video platform, potential exfiltration of sensitive user data, and the ability to manipulate platform content or settings.

Remediation Plan

Immediate Action: Update PeerTube to version 8.1.6 or later to include the fix for the SQL injection vulnerability.

Proactive Monitoring: Audit database access logs for unauthorized queries or unusual activity related to the ActorFollowModel or OAuth token tables.

Compensating Controls: Implement strict network-level egress filtering for federated services and utilize a WAF to inspect incoming ActivityPub payloads for malicious SQL patterns.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by remote, unauthenticated federated servers.

Analyst Recommendation

This vulnerability poses an extreme risk to the security and integrity of PeerTube instances. Administrators are urged to apply the 8.1.6 update immediately to prevent unauthorized administrative access and protect platform data.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Firefox < 150, Thunderbird < 150, Firefox ESR < 140.10.1
---END_METADATA---

Description Summary:
A sandbox escape vulnerability in the WebRTC networking component allows attackers to bypass security boundaries.

Executive Summary:
A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird allows for potential system-level compromise by bypassing security sandboxing.

Vulnerability Details

CVE-ID: CVE-2026-7321

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: Firefox < 150, Thunderbird < 150, Firefox ESR < 140.10.1

Vulnerability: This vulnerability is caused by incorrect boundary conditions within the WebRTC networking component, allowing an unauthenticated attacker to escape the browser sandbox.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk to organizational security. Successful exploitation could allow an attacker to execute arbitrary code outside the browser's sandbox, leading to full system compromise, data exfiltration, and lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade all instances of Firefox, Thunderbird, and Firefox ESR to the versions specified in the vendor advisory immediately.

Proactive Monitoring: Monitor endpoint detection logs for abnormal process execution or unexpected network traffic originating from browser-related processes.

Compensating Controls: Ensure endpoint protection software is updated to detect and block malicious code execution patterns associated with browser-based exploits.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate patching across all workstation and server environments. Organizations should prioritize updating their browser installations to prevent potential remote code execution and sandbox breakout scenarios.

---METADATA---
VENDOR: MISP
PRODUCT: cti-transmute
AFFECTED_VERSIONS: 0 through 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The cti-transmute tool by MISP is vulnerable to Server-Side Request Forgery (SSRF) in its /fetch_misp_event and /misp_search_events endpoints.

Executive Summary:
A high-severity Server-Side Request Forgery (SSRF) vulnerability in cti-transmute allows unauthenticated attackers to potentially access internal resources and sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-73160

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: This SSRF vulnerability (CWE-918) exists within the /fetch_misp_event and /misp_search_events endpoints, allowing an unauthenticated attacker to force the application to make unauthorized requests to internal or external systems.

Business Impact

An attacker can exploit this vulnerability to perform reconnaissance on internal networks, bypass firewall protections, or interact with services that are not exposed to the public internet. Given the CVSS score of 8.7, this issue poses a significant risk of internal network compromise and unauthorized information disclosure.

Remediation Plan

Immediate Action: Review the official MISP repository for security updates, as a patch is required to restrict the allowed targets of the affected endpoints.

Proactive Monitoring: Monitor network logs for unusual outbound requests originating from the server hosting cti-transmute, specifically targeting internal IP ranges or sensitive metadata services.

Compensating Controls: Implement strict network egress filtering on the host running cti-transmute to prevent it from reaching internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent nature of SSRF makes this a high-value target for attackers looking to pivot into internal network segments.

Analyst Recommendation

Due to the high severity and the unauthenticated nature of this SSRF vulnerability, organizations should prioritize restricting network access to the affected service until a vendor-supplied patch is applied. Monitor the MISP project documentation for release updates to address this flaw.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: Progress Sitefinity version from 8.0.5700 to 13.3.7652
---END_METADATA---

Description Summary:
Progress Sitefinity versions 8.0.5700 through 13.3.7652 contain a vulnerability allowing remote authenticated attackers to obtain plain-text credentials for the Sitefinity Insight service.

Executive Summary:
A high-severity credential exposure vulnerability in Progress Sitefinity allows authenticated attackers to access sensitive credentials used for integration with the Sitefinity Insight service.

Vulnerability Details

CVE-ID: CVE-2026-7313

Affected Software: Progress Sitefinity

Affected Versions: Progress Sitefinity version from 8.0.5700 to 13.3.7652

Vulnerability: This is an "Insufficiently Protected Credentials" (CWE-522) vulnerability within web services. Exploitation requires a remote authenticated attacker with valid back-end authorization, non-default site configuration, and an active integration with the Sitefinity Insight service.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk of data compromise. By obtaining plain-text credentials for the Sitefinity Insight service, an attacker could gain unauthorized access to secondary systems, potentially leading to further data breaches or service manipulation.

Remediation Plan

Immediate Action: Update Progress Sitefinity to a patched version beyond 13.3.7652 immediately.

Proactive Monitoring: Monitor access logs for unusual administrative activity and audit all integrations configured with the Sitefinity Insight service.

Compensating Controls: Rotate all credentials associated with the Sitefinity Insight service after applying the patch to ensure any previously exposed secrets are invalidated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations running affected versions of Sitefinity should treat this as a high-priority update. Because the vulnerability involves credential exposure, simply patching is insufficient; administrators must also rotate credentials to ensure full remediation.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: 14.0.7700 to 14.4.8152, 15.0.8200 to 15.0.8234, 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, 15.4.8600 to 15.4.8630
---END_METADATA---

Description Summary:
Progress Sitefinity web services contain a vulnerability that allows unauthenticated remote attackers to retrieve plain-text credentials for the Sitefinity Insight service.

Executive Summary:
A critical credential disclosure vulnerability in Progress Sitefinity allows unauthenticated remote attackers to obtain sensitive plain-text credentials for integrated services.

Vulnerability Details

CVE-ID: CVE-2026-7312

Affected Software: Progress Sitefinity

Affected Versions: 14.0.7700 to 14.4.8152, 15.0.8200 to 15.0.8234, 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, 15.4.8600 to 15.4.8630

Vulnerability: The web services component fails to protect credentials, allowing an unauthenticated attacker to access plain-text credentials used for the Sitefinity Insight service, provided the installation has active integration and non-default configurations.

Business Impact

The exposure of plain-text credentials poses a significant risk of unauthorized access to the Sitefinity Insight service, potentially resulting in data exfiltration or manipulation of business analytics. Although the CVSS score is 10.0, the requirement for non-default site configurations acts as a limiting factor, though the impact remains severe for affected enterprise environments.

Remediation Plan

Immediate Action: Apply the vendor-provided patch corresponding to your specific version (e.g., 14.4.8152, 15.0.8234, etc.) immediately.

Proactive Monitoring: Review access logs for anomalous requests to web services and perform a credential rotation for all services integrated with Sitefinity Insight following the patch.

Compensating Controls: Ensure the Sitefinity instance is behind a robust WAF and restrict external access to web service endpoints that are not required for public operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the perfect CVSS score, this vulnerability demands immediate attention. Administrators must identify their current version and apply the specified patch to prevent the exposure of sensitive service credentials.

---METADATA---
VENDOR: TinyPNG
PRODUCT: JPEG, PNG & WebP image compression plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The TinyPNG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient input validation within the delete_converted_image_size function.

Executive Summary:
A critical arbitrary file deletion vulnerability in the TinyPNG WordPress plugin exposes the underlying server filesystem to unauthorized modification and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-7311

Affected Software: TinyPNG JPEG, PNG & WebP image compression plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize user-supplied input within the delete_converted_image_size function. This allows an authenticated attacker with sufficient privileges to delete arbitrary files on the web server.

Business Impact

The ability for an attacker to delete arbitrary files poses a severe risk to system integrity and availability. An attacker could remove critical configuration files, core WordPress files, or security-related logs, potentially leading to a complete denial-of-service or facilitating further system compromise. With a CVSS score of 8.1, this high-severity flaw requires immediate attention to prevent operational downtime.

Remediation Plan

Immediate Action: Update the TinyPNG plugin to the latest available version provided by the vendor to implement proper path validation.

Proactive Monitoring: Monitor server file system activity logs for unauthorized deletion attempts or access patterns targeting sensitive directories.

Compensating Controls: Implement file integrity monitoring (FIM) and ensure the web server service account operates with the principle of least privilege regarding filesystem permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates prompt remediation. Administrators should verify their current plugin version and apply updates immediately. If a patch is not yet available, consider disabling the plugin until a secure version is released to mitigate the risk of filesystem manipulation.

---METADATA---
VENDOR: Activepieces
PRODUCT: Activepieces
AFFECTED_VERSIONS: < 0.80.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Activepieces is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying operating system.

Executive Summary:
An OS Command Injection vulnerability in Activepieces allows authenticated users to execute arbitrary system commands, leading to full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-73081

Affected Software: Activepieces

Affected Versions: All versions prior to 0.80.0

Vulnerability: The software fails to properly neutralize special elements used in OS commands (CWE-78). An authenticated attacker can manipulate input parameters to execute arbitrary commands at the operating system level, effectively bypassing application-level restrictions.

Business Impact

The CVSS score of 8.7 highlights the critical nature of this vulnerability, as it allows for full system control by an authenticated user. This could lead to unauthorized access to sensitive workflow data, lateral movement within the network, or the installation of persistent malicious backdoors. The impact is elevated if the platform is integrated with highly privileged cloud services or internal infrastructure.

Remediation Plan

Immediate Action: Upgrade the Activepieces platform to version 0.80.0 or later as provided in the official release notes.

Proactive Monitoring: Inspect server logs for unusual process execution patterns or unauthorized attempts to access system-level binaries and configuration files.

Compensating Controls: Restrict access to the Activepieces administrative interface to trusted users only, and run the service with the least privilege necessary to minimize the potential impact of command execution.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in insecure input handling when interacting with the host OS.

Analyst Recommendation

Given the potential for complete system takeover, administrators should upgrade to version 0.80.0 immediately. Organizations should also review the access logs of the platform to ensure that no unauthorized users have utilized this vector to gain persistent access.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.2, 26.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in Red Hat build of Keycloak involves improper validation of syntactic correctness of input, which can lead to a denial-of-service condition.

Executive Summary:
A critical input validation vulnerability in the Red Hat build of Keycloak can be exploited by unauthenticated remote attackers to trigger a denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-7307

Affected Software: Red Hat build of Keycloak

Affected Versions: 26.2 and 26.4

Vulnerability: The vulnerability (CWE-1286) stems from improper validation of input syntax. An unauthenticated attacker can send specially crafted requests to the application, resulting in service disruption or exhaustion of resources.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to availability. Successful exploitation would result in a denial-of-service, rendering the authentication service unavailable and preventing legitimate users from accessing critical enterprise applications, which could lead to significant operational downtime.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the versions specified in the vendor errata (e.g., 26.2.16-1 or 26.4.12-1 and later) to resolve the underlying input validation error.

Proactive Monitoring: Review access logs for high-frequency or malformed request patterns that may indicate attempts to trigger a denial-of-service condition.

Compensating Controls: Deploy rate-limiting and request-filtering policies at the network perimeter or via an API gateway to mitigate the impact of malformed input attacks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly automatable, increasing the risk of opportunistic attacks.

Analyst Recommendation

Organizations utilizing the Red Hat build of Keycloak must apply the provided security updates as a matter of priority to restore service integrity. Ensure that all affected nodes in the cluster are patched to prevent potential service outages.

---METADATA---
VENDOR: Scriban
PRODUCT: Scriban
AFFECTED_VERSIONS: 3.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A denial of service vulnerability in Scriban allows remote, unauthenticated attackers to cause resource exhaustion via specifically crafted array multiplication operations.

Executive Summary:
Scriban versions 3.x are vulnerable to a denial of service attack that can be exploited by unauthenticated actors to crash the application.

Vulnerability Details

CVE-ID: CVE-2026-73062

Affected Software: Scriban Scriban

Affected Versions: 3.x

Vulnerability: This flaw relates to CWE-770: Allocation of Resources Without Limits or Throttling. An unauthenticated attacker can supply crafted array multiplication inputs that cause the application to consume excessive system memory or CPU cycles.

Business Impact

A successful exploit leads to a denial of service, causing system instability or complete application failure. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, which could lead to significant service outages for dependent business applications.

Remediation Plan

Immediate Action: Update the Scriban NuGet package to version 7.2.1 or later to resolve the underlying resource management flaw.

Proactive Monitoring: Analyze application logs for frequent crashes or latency spikes occurring during template processing tasks.

Compensating Controls: Deploy a Web Application Firewall to detect and block requests containing unusually large or complex array structures in template inputs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw is a standard resource exhaustion vector that is common in template engines lacking strict input limits.

Analyst Recommendation

All systems using the Scriban library must be updated to version 7.2.1 immediately to patch this vulnerability. Proactive patching is essential to prevent potential service disruption caused by malicious actors leveraging this resource exhaustion flaw.

---METADATA---
VENDOR: scriban
PRODUCT: scriban
AFFECTED_VERSIONS: 0 up to (excluding) 7.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Scriban template engine contains an access-modifier bypass vulnerability in TypedObjectAccessor, allowing unauthenticated attackers to perform unauthorized writes to CLR object properties.

Executive Summary:
A critical access-modifier bypass in the Scriban template engine allows unauthenticated remote attackers to modify protected object properties, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73061

Affected Software: scriban scriban

Affected Versions: 0 up to (excluding) 7.2.2

Vulnerability: The vulnerability exists in the TypedObjectAccessor component, where template code can write to CLR object properties without proper setter-visibility checks. This allows an unauthenticated attacker to manipulate private, internal, or init-only setters, effectively performing mass assignment on sensitive host objects.

Business Impact

Successful exploitation allows an attacker to permanently alter the state of live host objects after template rendering. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and system security, potentially enabling arbitrary code execution or privilege escalation within the application environment.

Remediation Plan

Immediate Action: Update the scriban package to version 7.2.2 or later via your package manager (e.g., NuGet).

Proactive Monitoring: Review application logs for unusual template rendering behavior or unexpected modifications to internal object states.

Compensating Controls: Implement strict input validation for templates and, where possible, utilize sandboxing configurations that restrict the scope of accessible object properties.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Organizations utilizing the Scriban template engine should prioritize upgrading to version 7.2.2 to close this access-modifier bypass. Failure to patch may allow remote attackers to gain unauthorized control over application logic and object data.

---METADATA---
VENDOR: Scriban
PRODUCT: Scriban
AFFECTED_VERSIONS: Versions 3.x
CONFIDENCE: medium
MISSING: none
---END_METADATA---

Description Summary:
Scriban is susceptible to a denial of service vulnerability caused by improper resource allocation during script range multiplication operations.

Executive Summary:
A vulnerability in the Scriban template engine allows unauthenticated remote attackers to trigger a denial of service condition through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-73060

Affected Software: Scriban Scriban

Affected Versions: 3.x

Vulnerability: This vulnerability is categorized under CWE-770: Allocation of Resources Without Limits or Throttling. It allows an unauthenticated attacker to exhaust system resources by submitting malicious script range multiplication inputs.

Business Impact

The successful exploitation of this vulnerability results in a denial of service, which can render applications utilizing the Scriban engine unresponsive or cause them to crash. Given the CVSS score of 7.5, this high severity flaw poses a significant operational risk to business continuity, particularly for web services relying on template rendering for user-facing content.

Remediation Plan

Immediate Action: Review the project dependencies and ensure the template engine is updated to a version that implements proper resource limits for script operations.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes associated with template parsing or rendering functions.

Compensating Controls: Implement input validation to restrict the size and complexity of template scripts submitted by users to prevent resource exhaustion attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable because the library fails to throttle resource-intensive operations during template execution.

Analyst Recommendation

Organizations utilizing the Scriban template engine should prioritize auditing their implementation to verify if they are using the affected version range. It is critical to apply updates or implement strict input validation to mitigate the risk of denial of service attacks.

---METADATA---
VENDOR: stoatchat
PRODUCT: stoatchat
AFFECTED_VERSIONS: All versions prior to 0.15.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The stoatchat application is vulnerable to a denial of service attack due to improper resource management during SVG rendering.

Executive Summary:
Stoatchat versions prior to 0.15.0 are affected by an uncontrolled resource consumption vulnerability during SVG rendering, which can lead to a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-73057

Affected Software: stoatchat

Affected Versions: All versions prior to 0.15.0

Vulnerability: This vulnerability, classified under CWE-400, stems from the application's failure to properly cap resources while rendering SVG files. An unauthenticated attacker can exploit this by submitting specifically crafted SVG content, causing the application to consume excessive system resources and crash.

Business Impact

The CVSS score of 7.5 indicates a high severity rating due to the potential for complete service disruption. A successful denial of service attack could render the chat platform unavailable to users, causing significant operational impact and loss of communication capabilities.

Remediation Plan

Immediate Action: Update the stoatchat software to version 0.15.0 or later to patch the resource consumption vulnerability.

Proactive Monitoring: Monitor server CPU and memory usage for spikes that may indicate attempts to exploit SVG rendering processes.

Compensating Controls: Implement input validation or sanitization layers to filter or block malicious SVG files before they reach the rendering engine.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable via network-based vectors, making it a critical threat to availability.

Analyst Recommendation

Availability is a core requirement for chat applications, and this vulnerability poses a direct threat to that goal. It is strongly recommended that all administrators apply the update to version 0.15.0 immediately to prevent potential service outages caused by malicious SVG payloads.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: < 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SiYuan kernel before 3.7.4 fails to restrict excessive authentication attempts, allowing unauthenticated attackers to brute-force API tokens and gain administrative access.

Executive Summary:
A critical authentication brute-force vulnerability in SiYuan kernel versions prior to 3.7.4 allows unauthenticated attackers to gain full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-73056

Affected Software: siyuan-note siyuan

Affected Versions: < 3.7.4

Vulnerability: The CheckAuth middleware fails to enforce rate limiting or CAPTCHA requirements on API token authentication. This allows an unauthenticated remote attacker to perform unlimited brute-force guesses against the API token, leading to full RoleAdministrator access.

Business Impact

With a CVSS score of 9.8, this flaw presents a critical risk, as it allows attackers to gain full control over the application. Administrative access grants the ability to perform arbitrary file operations and execute SQL queries, leading to potential data exfiltration or complete loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately to apply the necessary authentication rate limiting.

Proactive Monitoring: Review audit logs for high volumes of failed API authentication attempts or suspicious patterns originating from single IP addresses.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to rate-limit requests to API endpoints or block unauthorized IP addresses exhibiting rapid authentication failures.

Exploitation Status

Public Exploit Available: No (No confirmed weaponized exploit is documented in the provided data.)

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of built-in lockout mechanisms.

Analyst Recommendation

This vulnerability is highly critical due to the ease of brute-forcing API tokens. All deployments of SiYuan must be updated to version 3.7.4 or later as the primary mitigation. Ensure that API tokens are sufficiently long and complex to further reduce the risk of successful guessing.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability involving the websocket implementation, allowing unauthenticated remote access.

Executive Summary:
A high-severity authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to gain unauthorized access to the application via websocket communication.

Vulnerability Details

CVE-ID: CVE-2026-73054

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application suffers from improper authentication (CWE-287), specifically within its websocket handling, which permits unauthenticated attackers to interact with the system without valid credentials.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a critical failure in the application security model. Exploitation provides attackers with unauthorized access to system functions, creating a high risk of data exfiltration and administrative compromise.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later to resolve the websocket authentication bypass.

Proactive Monitoring: Review websocket traffic and connection logs for unusual patterns or connections originating from unauthorized or external sources.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and filter incoming websocket traffic for suspicious handshake patterns or unauthorized access attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw represents a fundamental breakdown in the application authentication logic.

Analyst Recommendation

The severity of this authentication bypass requires immediate attention. Security teams must ensure all instances of SiYuan are patched to version 3.7.4 to prevent potential unauthorized access and maintain the integrity of the application.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 are susceptible to cross-site scripting in the unicode2Emoji function, allowing arbitrary code execution in the renderer.

Executive Summary:
A critical cross-site scripting vulnerability in the SiYuan unicode2Emoji function permits attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73053

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability resulting from improper sanitization of codepoint branch output. By crafting specific document icons with hex-encoded markup, an authenticated attacker can execute arbitrary code within the renderer, which runs with Node integration enabled.

Business Impact

The vulnerability is rated as critical with a CVSS score of 9.0. It allows an attacker to bypass application-level controls to execute system-level commands, creating a direct path to full workstation or server compromise depending on where the application is deployed.

Remediation Plan

Immediate Action: Update to SiYuan version 3.7.4 or later, which includes necessary sanitization for the unicode2Emoji function.

Proactive Monitoring: Audit document icon metadata and look for abnormally long or hex-encoded strings that may indicate an attempt to trigger the vulnerable function.

Compensating Controls: Limit access to document creation or modification features for untrusted users until the software has been updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the application's configuration allowing Node.js integration in the renderer.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, immediate patching to version 3.7.4 is mandatory. Security teams should verify that all deployments are running the updated version to mitigate this risk.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary JavaScript by injecting malicious markup into attribute-view field names.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan can lead to arbitrary code execution when malicious attribute names are viewed by a user, particularly within the desktop client.

Vulnerability Details

CVE-ID: CVE-2026-73052

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to sanitize attribute-view field names, which are rendered via innerHTML in the sort menu. An authenticated attacker can rename a database field to include malicious scripts that execute in the context of the victim's session.

Business Impact

The impact is severe, as the vulnerability allows for arbitrary JavaScript execution. In the context of the SiYuan desktop client, where Node integration may be enabled, this vulnerability can escalate to full system command execution, threatening the integrity and confidentiality of the host environment.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later, which includes the necessary output encoding to prevent script injection.

Proactive Monitoring: Monitor for unusual modifications to database field names that contain HTML tags or script-related keywords.

Compensating Controls: Ensure that users are not granted unnecessary privileges to modify database structures and employ Content Security Policy (CSP) headers where applicable.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is elevated in desktop environments where improper neutralization of input can lead to local code execution.

Analyst Recommendation

While this vulnerability requires an authenticated user to initiate the injection, the potential for escalation to remote code execution in the desktop client is significant. Administrators should apply the update to version 3.7.4 as soon as possible to neutralize this stored XSS vector.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan before v3.7.4 contains a stored Cross-site Scripting vulnerability in the attribute-view select option color field, allowing arbitrary JavaScript execution.

Executive Summary:
A critical stored cross-site scripting flaw in SiYuan allows authenticated users to execute arbitrary JavaScript by injecting malicious payloads into select option color fields.

Vulnerability Details

CVE-ID: CVE-2026-73050

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to validate or escape the color field within attribute-view select options. This allows an attacker to inject event-handler attributes by including quotation marks in the input, which then execute when other users view the affected database records.

Business Impact

This vulnerability allows for the execution of arbitrary JavaScript in the context of other users' sessions, which can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. With a CVSS score of 9.0, this poses a high risk to the security of user data and the overall integrity of the collaborative environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Review application logs for suspicious entries in attribute-view select options or unusual client-side script execution.

Compensating Controls: Limit the ability of users to define custom colors or metadata in attribute-view fields until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of injecting malicious payloads into commonly used UI elements.

Analyst Recommendation

Given the critical severity of this cross-site scripting vulnerability, administrators should ensure all instances are updated to version 3.7.4 as soon as possible. Prompt patching is essential to prevent unauthorized code execution within the user base.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SiYuan CheckAuth middleware fails to enforce rate limiting or account lockout for HTTP Basic Authentication, allowing unauthenticated attackers to brute-force the workspace access code.

Executive Summary:
A critical authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to brute-force administrative access codes, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73046

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to restrict excessive authentication attempts within the CheckAuth middleware for the HTTP Basic Authentication branch. This flaw allows unauthenticated attackers to perform unlimited brute-force attempts to guess the workspace access code and gain administrative privileges.

Business Impact

Successful exploitation grants an attacker full RoleAdministrator access to the application kernel. This level of access poses a severe risk of unauthorized data modification, total loss of confidentiality, and potential disruption of business operations, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later to implement proper authentication rate limiting.

Proactive Monitoring: Review system access logs for high volumes of failed authentication attempts targeting the /api/* endpoints.

Compensating Controls: Implement network-level rate limiting or an IP-based blocklist via a Web Application Firewall to restrict automated brute-force traffic.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of constant-time string comparisons combined with the absence of account lockout mechanisms.

Analyst Recommendation

Given the ease of exploitation and the high level of access granted, this vulnerability presents an immediate risk to any exposed SiYuan instance. Organizations must prioritize updating to version 3.7.4 immediately to remediate the authentication bypass and prevent unauthorized administrative access.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.7.4 are vulnerable to a lack of proper restrictions on authentication attempts, potentially allowing attackers to conduct brute force attacks against the application.

Executive Summary:
A high-severity authentication vulnerability in SiYuan allows unauthenticated attackers to perform brute force attacks, risking unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-73045

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly restrict excessive authentication attempts (CWE-307), allowing unauthenticated remote attackers to bypass traditional rate limiting or lockout mechanisms.

Business Impact

This vulnerability carries a CVSS score of 7.5, reflecting a significant risk to confidentiality. Successful exploitation could lead to unauthorized access to sensitive user data or system configurations, potentially resulting in data breaches and loss of trust.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.4 or later to implement proper authentication attempt restrictions.

Proactive Monitoring: Monitor authentication logs for patterns of high-frequency login attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules configured to block excessive requests to authentication endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of built-in threshold management for authentication requests.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize updating to version 3.7.4 immediately. Securing the authentication gateway is critical to preventing account takeovers and protecting sensitive information stored within the SiYuan environment.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 are vulnerable to stored cross-site scripting via the setAttrViewColWidth API, which can lead to arbitrary code execution within the Electron renderer.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary code with Node integration enabled.

Vulnerability Details

CVE-ID: CVE-2026-73044

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where improper validation of table column width values permits malicious injection into style attributes. The vulnerability requires low privileges and user interaction, allowing an attacker to inject event handlers that trigger code execution in the Electron environment.

Business Impact

The exploitation of this vulnerability results in full system compromise, as the application runs with Node integration enabled. Given the CVSS score of 9.0, this represents a critical risk where an attacker can gain unauthorized control over the host system, leading to data exfiltration or total loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later to apply the necessary input validation and sanitization fixes.

Proactive Monitoring: Review application logs for unusual API calls to setAttrViewColWidth and monitor for unexpected process spawning from the SiYuan application.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if possible to restrict the execution of unauthorized scripts within the application interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of cross-site scripting and enabled Node.js integration within the renderer.

Analyst Recommendation

This vulnerability presents a severe risk to host system integrity. All administrators should prioritize updating to version 3.7.4 immediately to remediate this flaw and prevent potential remote code execution.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 contain a remote code execution vulnerability in the Template calculation operator, allowing execution of arbitrary code via injected malicious templates.

Executive Summary:
A critical remote code execution vulnerability in the SiYuan desktop client allows an attacker to execute arbitrary code when a malicious database is opened.

Vulnerability Details

CVE-ID: CVE-2026-73043

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to 3.7.4

Vulnerability: This is a cross-site scripting (CWE-79) and remote code execution vulnerability originating from the Template calculation operator. The operator fails to sanitize user-authored Go templates, which are rendered with Node integration enabled in the desktop client.

Business Impact

Successful exploitation allows an attacker to achieve code execution on the host machine running the SiYuan desktop client. This could lead to local data theft, lateral movement within the network, or complete control over the user's workstation, justifying the critical severity rating.

Remediation Plan

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.4 or later immediately.

Proactive Monitoring: Users should exercise caution when opening database files from untrusted sources and monitor for unexpected application behavior or unauthorized network connections.

Compensating Controls: Ensure the application is run with the least privilege necessary and utilize endpoint protection software to detect unauthorized child processes spawned by the SiYuan client.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of Aug 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of template rendering and enabled Node integration.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.7.4 to remediate this vulnerability. Given the ease with which local code execution can occur, users should avoid opening untrusted or shared SiYuan database files until the software has been patched.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan before v3.7.4 is vulnerable to stored Cross-site Scripting via improperly escaped database menu metadata, allowing execution of arbitrary code due to Electron's insecure configuration.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated users to achieve remote code execution through manipulated menu metadata.

Vulnerability Details

CVE-ID: CVE-2026-73042

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly escape database menu metadata during HTML interpolation. This flaw allows an authenticated user to inject malicious markup that executes arbitrary JavaScript, which, due to the application's use of Electron with insecure configuration, can escalate to full remote code execution.

Business Impact

The ability to execute arbitrary code with the privileges of the application provides an attacker with complete control over the user's local system. Given the CVSS score of 9.0, this represents a critical risk to confidentiality, integrity, and availability, as it allows for data exfiltration and total compromise of the host environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Monitor for unusual script execution or unexpected outbound network connections from the SiYuan application process.

Compensating Controls: Restrict permissions on database fields and views to trusted users only until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it bridges the gap between stored XSS and remote code execution in an Electron environment.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for remote code execution. Users are strongly advised to apply the version 3.7.4 update immediately to secure the application against potential exploitation.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 allow arbitrary code execution via malicious PDF annotations that trigger script execution in the PDF renderer with Node.js access.

Executive Summary:
A critical vulnerability in SiYuan PDF annotation handling allows authenticated attackers to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73041

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where the setFileAnnotation endpoint fails to sanitize markup injected into annotation fields. When a user opens a compromised PDF, the injected payload executes with full Node.js privileges, bypassing standard browser security boundaries.

Business Impact

With a CVSS score of 9.0, this vulnerability poses a high risk of total system takeover. Successful exploitation allows an attacker to execute arbitrary commands, potentially leading to the theft of sensitive user data, credential harvesting, or further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or newer to ensure that annotation fields are properly escaped and sanitized before being written to disk.

Proactive Monitoring: Monitor user activity logs for suspicious PDF file access or unexpected modifications to annotation data.

Compensating Controls: Restrict the ability of users to import or annotate untrusted PDF files from external sources until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it leverages the application's own file processing capabilities to trigger execution.

Analyst Recommendation

The risk of remote code execution via document processing is significant. Organizations must treat this as a high-priority update and deploy the patch to version 3.7.4 across all instances immediately.

---METADATA---
VENDOR: louislam
PRODUCT: dockge
AFFECTED_VERSIONS: 0 through 1.5.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dockge contains a path traversal vulnerability due to improper validation of stack names, which allows authenticated attackers to disclose arbitrary files and delete directories.

Executive Summary:
An authenticated path traversal vulnerability in louislam Dockge versions 1.5.0 and earlier allows attackers to perform unauthorized file operations and directory deletions.

Vulnerability Details

CVE-ID: CVE-2026-73040

Affected Software: louislam Dockge

Affected Versions: 0 through 1.5.0

Vulnerability: The application fails to properly validate stack names on the write path, leading to a path traversal vulnerability (CWE-22). This allows an authenticated user with low privileges to manipulate file paths, resulting in arbitrary file disclosure and directory deletion.

Business Impact

The ability to read arbitrary files and delete directories poses a severe risk to system integrity and confidentiality. An attacker could extract sensitive configuration files or environment variables, potentially leading to a full system compromise. With a CVSS score of 8.8, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Monitor the official repository for a patched version release and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious stack naming patterns or attempts to access restricted directory paths.

Compensating Controls: Implement strict network segmentation and ensure that the Dockge instance runs with the minimum necessary filesystem permissions to limit the impact of a successful traversal.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for arbitrary file interaction.

Analyst Recommendation

Given the high severity of this path traversal flaw, administrators should prioritize the deployment of security patches once released by the vendor. Until a fix is available, restrict access to the Dockge interface to trusted users only and enforce the principle of least privilege regarding the service account running the software.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when custom logit processing is enabled, due to unsafe Python object deserialization.

Executive Summary:
Unsafe deserialization in SGLangs allows unauthenticated attackers to execute arbitrary code remotely, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-7304

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: The application utilizes dill.loads() to deserialize Python objects without validation when the --enable-custom-logit-processor option is active, allowing an unauthenticated remote attacker to inject malicious payloads.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the ability for an attacker to achieve full remote code execution. This could lead to a complete compromise of the host system, theft of sensitive AI models, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Disable the --enable-custom-logit-processor option immediately if not strictly required, and update to the latest patched version.

Proactive Monitoring: Monitor server processes for unexpected child spawns or outbound connections originating from the runtime environment.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Network Intrusion Detection System (NIDS) to inspect and block malicious serialized object payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: eosphoros-ai
PRODUCT: DB-GPT
AFFECTED_VERSIONS: 0 through 0.8.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DB-GPT v0.8.1 is vulnerable to an unauthenticated path traversal attack that allows remote attackers to write arbitrary files to the server via the user_id HTTP header.

Executive Summary:
A critical unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to achieve remote code execution by writing arbitrary files to the server.

Vulnerability Details

CVE-ID: CVE-2026-73034

Affected Software: eosphoros-ai DB-GPT

Affected Versions: 0 through 0.8.1

Vulnerability: The application suffers from improper path validation (CWE-22) in the file-upload endpoint. An unauthenticated attacker can inject directory traversal sequences into the user_id HTTP header to escape the designated upload directory and overwrite sensitive system files.

Business Impact

The ability to write arbitrary files to the server, such as startup hooks or configuration files, results in full remote code execution. With a CVSS score of 9.8, this vulnerability allows total system compromise, leading to complete loss of confidentiality, integrity, and availability for the affected host.

Remediation Plan

Immediate Action: Apply the vendor-provided patch or update to the latest version identified in the project repository.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at file-upload endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences in headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical due to the lack of required authentication and the direct path to remote code execution.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Because it allows unauthenticated remote code execution, it should be treated as a top-priority remediation item. Ensure all public-facing instances are protected until updates are verified and applied.

---METADATA---
VENDOR: GramSearch
PRODUCT: telegram-search
AFFECTED_VERSIONS: 0 through 1.2.8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in GramSearch telegram-search allows remote attackers to execute arbitrary JavaScript by sending crafted messages containing unsanitized HTML.

Executive Summary:
A stored cross-site scripting vulnerability in GramSearch telegram-search could allow authenticated attackers to execute malicious scripts in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2026-73031

Affected Software: GramSearch telegram-search

Affected Versions: 0 through 1.2.8

Vulnerability: This vulnerability is a stored cross-site scripting flaw caused by improper neutralization of input in message handling. The vulnerability requires low privileges (authenticated) and user interaction to trigger the execution of arbitrary JavaScript.

Business Impact

The ability to execute arbitrary scripts in a victim's browser poses a significant risk to data confidentiality and session integrity. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information, justifying the high CVSS score of 8.7.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application logs for unusual message content or suspicious HTML tags being processed within Telegram group communications.

Compensating Controls: Implement or tune Content Security Policy (CSP) headers to restrict the execution of inline scripts and unauthorized external resources within the application interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of stored XSS, which can facilitate widespread impact across users of a shared group.

Analyst Recommendation

Given the high severity of this XSS vulnerability, administrators should prioritize the identification of affected instances. Until a formal patch is released, users should exercise extreme caution when interacting with message content from untrusted sources, and security teams should enforce strict CSP headers to mitigate potential script execution.

---METADATA---
VENDOR: frostming
PRODUCT: unearth
AFFECTED_VERSIONS: 0 through 0.18.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The unearth library is susceptible to a path traversal vulnerability via unnormalized paths and symlink escapes.

Executive Summary:
A path traversal vulnerability in the unearth library allows unauthenticated attackers to perform unauthorized file operations, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-73030

Affected Software: frostming unearth

Affected Versions: 0 through 0.18.2

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) that occurs when unnormalized paths are processed, allowing for symlink escapes by an unauthenticated attacker.

Business Impact

The CVSS score of 8.1 indicates a high-risk vulnerability that could allow attackers to read or write files outside of intended directories. This could lead to critical data compromise or system instability depending on the implementation of the library within the host application.

Remediation Plan

Immediate Action: Update the unearth library to the version containing the fix identified in commit 6c78164e7bfa28b8b3d6f247b87e560692e3c8ba.

Proactive Monitoring: Review application logs for unexpected file system access requests or directory traversal patterns.

Compensating Controls: Implement strict input validation and sanitization for all file paths processed by the library as a temporary measure.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ability to escape symlinks significantly increases the threat surface of this traversal vulnerability.

Analyst Recommendation

Developers and administrators should immediately update to the patched version of unearth to prevent potential exploitation. Given the nature of path traversal vulnerabilities, ensuring that user-supplied paths are strictly validated is essential to maintaining system security.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs runtime is vulnerable to an unauthenticated path traversal attack, allowing remote attackers to write arbitrary files to the server's filesystem.

Executive Summary:
Unauthenticated path traversal in the SGLangs runtime allows attackers to overwrite critical files, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7302

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: The application fails to validate filenames provided during upload, allowing the use of ../ sequences to traverse outside of intended directories and overwrite arbitrary system files.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an attacker to achieve code execution or denial of service by overwriting application binaries or configuration files. This represents a critical risk to the availability and integrity of the hosting server.

Remediation Plan

Immediate Action: Update to the latest version of SGLangs and implement strict path validation for file uploads.

Proactive Monitoring: Monitor filesystem integrity and alert on unauthorized write attempts to sensitive system directories.

Compensating Controls: Run the SGLangs service with the least privilege necessary, restricting its write access to specific, isolated directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs scheduler binds its ROUTER socket to 0.0.0.0 and performs unsafe pickle deserialization on incoming messages, enabling unauthenticated remote code execution.

Executive Summary:
A critical vulnerability in the SGLangs runtime scheduler allows unauthenticated attackers to execute arbitrary code by sending malicious packets to the exposed ROUTER socket.

Vulnerability Details

CVE-ID: CVE-2026-7301

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: By binding to all interfaces and using pickle.loads() on untrusted input, the scheduler creates an exploitable attack surface for any remote actor capable of reaching the socket.

Business Impact

The CVSS score of 9.8 underscores the severity of this remote code execution flaw. If the service is exposed to the internet, it provides an immediate vector for full system compromise, data theft, and persistent unauthorized access.

Remediation Plan

Immediate Action: Bind the ROUTER socket to 'localhost' (127.0.0.1) and update to the latest patched version.

Proactive Monitoring: Use network monitoring tools to ensure the ROUTER socket is not accessible from external, untrusted networks.

Compensating Controls: Place the service behind a restrictive firewall or VPN, ensuring it is not reachable from the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Edge (Chromium-based)
AFFECTED_VERSIONS: 1.0.0.0 up to (excluding) 151.0.4129.86
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code via a crafted network request.

Executive Summary:
A critical heap-based buffer overflow in Microsoft Edge could allow an unauthenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-72970

Affected Software: Microsoft Edge (Chromium-based)

Affected Versions: 1.0.0.0 up to (excluding) 151.0.4129.86

Vulnerability: This is a heap-based buffer overflow (CWE-122) occurring within the browser's memory management. The vulnerability permits an unauthenticated attacker to trigger a crash or execute arbitrary code, requiring only user interaction to process malicious content.

Business Impact

The CVSS score of 8.3 reflects a high severity risk that could lead to full system compromise. Successful exploitation allows unauthorized actors to execute code with the privileges of the victim, potentially leading to data exfiltration, lateral movement within the network, and complete loss of system integrity.

Remediation Plan

Immediate Action: Update Microsoft Edge (Chromium-based) to version 151.0.4129.86 or later immediately to resolve the overflow vulnerability.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution patterns or abnormal browser crashes that may indicate exploitation attempts.

Compensating Controls: Deploy browser-based security policies that restrict loading of untrusted content and utilize endpoint detection and response (EDR) solutions to identify anomalous child process spawning.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable due to the nature of heap overflows in browsers, there is no evidence of weaponized code currently in the wild.

Analyst Recommendation

Given the high severity and the potential for remote code execution, organizations must prioritize patching all instances of Microsoft Edge. Ensure that automated update channels are functioning correctly and verify that the browser version is updated to 151.0.4129.86 across all enterprise environments to mitigate this risk.

---METADATA---
VENDOR: seaweedfs
PRODUCT: seaweedfs
AFFECTED_VERSIONS: < 4.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SeaweedFS prior to 4.24 fails to enforce authentication on the gRPC IdentityAccessManagement service when the signing key is unset, allowing unauthorized administrative control.

Executive Summary:
A critical authentication bypass in seaweedfs allows unauthenticated attackers to gain administrative control over the storage system and mint arbitrary credentials.

Vulnerability Details

CVE-ID: CVE-2026-72920

Affected Software: seaweedfs seaweedfs

Affected Versions: < 4.24

Vulnerability: This is a missing authentication vulnerability (CWE-306) in the SeaweedIdentityAccessManagement gRPC service. When the jwt.filer_signing.key is not configured, the service fails to require authentication, permitting any network-adjacent attacker to perform administrative actions such as creating users and policies.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability. Successful exploitation allows an attacker to gain full S3 administrative control over the storage system, which can result in data exfiltration, deletion, or the modification of sensitive storage policies.

Remediation Plan

Immediate Action: Update SeaweedFS to version 4.24 or later, which mandates authentication for the affected gRPC service.

Proactive Monitoring: Audit gRPC service access logs for unauthorized connections or unexpected calls to IAM-related RPC functions.

Compensating Controls: Restrict network access to the SeaweedFS gRPC port using firewall rules to ensure that only authorized internal services can interact with the management interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally a configuration and authorization issue that exposes critical management functions to the network.

Analyst Recommendation

Immediate remediation is required for all exposed SeaweedFS instances. Administrators should prioritize upgrading to version 4.24 and verifying that the JWT signing key is correctly configured to prevent unauthorized access. Access to the gRPC port should be strictly limited to trusted networks to provide defense-in-depth.

---METADATA---
VENDOR: Mastodon
PRODUCT: Mastodon
AFFECTED_VERSIONS: >= 4.6.0-beta.1, < 4.6.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mastodon is vulnerable to an information exposure issue allowing unauthorized actors to access sensitive data due to a flaw in the application architecture.

Executive Summary:
A critical information exposure vulnerability in Mastodon allows unauthenticated remote attackers to access sensitive data, posing a significant risk to user privacy.

Vulnerability Details

CVE-ID: CVE-2026-72915

Affected Software: Mastodon Mastodon

Affected Versions: >= 4.6.0-beta.1, < 4.6.4

Vulnerability: This is an information exposure vulnerability (CWE-200) where the application fails to properly restrict access to sensitive data. The vulnerability is exploitable by unauthenticated remote attackers with no user interaction required.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive user information or internal server data. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality of the platform, potentially resulting in reputational damage and loss of user trust if exploited.

Remediation Plan

Immediate Action: Administrators must update Mastodon instances to version 4.6.4 or later immediately to resolve the underlying information exposure.

Proactive Monitoring: Review server access logs for unusual patterns or unexpected requests directed at sensitive API endpoints or data repositories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts or suspicious traffic patterns targeting Mastodon API endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated remote access vector.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Instance administrators should prioritize the deployment of the vendor-provided patch to version 4.6.4 to eliminate the risk of unauthorized data exposure.

---METADATA---
VENDOR: Mastodon
PRODUCT: Mastodon
AFFECTED_VERSIONS: < 4.4.21, >= 4.5.0-beta.1, < 4.5.14, >= 4.6.0-beta.1, < 4.6.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mastodon is susceptible to an asymmetric resource consumption vulnerability due to the lack of proper limits or throttling on incoming requests.

Executive Summary:
A resource consumption vulnerability in the Mastodon social network server allows unauthenticated attackers to cause a denial of service through amplification.

Vulnerability Details

CVE-ID: CVE-2026-72914

Affected Software: Mastodon Mastodon

Affected Versions: < 4.4.21, >= 4.5.0-beta.1, < 4.5.14, >= 4.6.0-beta.1, < 4.6.4

Vulnerability: This is a denial of service vulnerability involving asymmetric resource consumption (CWE-405) and lack of resource throttling (CWE-770). It allows an unauthenticated remote attacker to exhaust server resources by sending specifically crafted requests.

Business Impact

Successful exploitation can lead to significant service degradation or total system unavailability, impacting the availability of the Mastodon instance. Given the CVSS score of 7.5, this represents a high risk for administrators who must maintain uptime for their users, as the vulnerability can be leveraged to disrupt operations via network-based attacks.

Remediation Plan

Immediate Action: Update Mastodon instances to versions 4.4.21, 4.5.14, or 4.6.4, depending on the currently installed release branch.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes that do not correlate with legitimate user traffic, which may indicate an ongoing denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall or rate-limiting proxy in front of the Mastodon server to filter out malicious traffic patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of authentication required to trigger the resource exhaustion.

Analyst Recommendation

Administrators should apply the provided patches immediately to prevent potential denial of service attacks. Ensuring the software is updated to the latest secure version is critical for maintaining the stability and availability of the Mastodon platform.

---METADATA---
VENDOR: kovidgoyal
PRODUCT: kitty
AFFECTED_VERSIONS: < 0.48.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The kitty terminal emulator is susceptible to command injection, CRLF injection, and improper neutralization of escape sequences, which may lead to unauthorized code execution.

Executive Summary:
Multiple input neutralization vulnerabilities in the kitty terminal emulator could allow an attacker to execute arbitrary commands or manipulate terminal output.

Vulnerability Details

CVE-ID: CVE-2026-72913

Affected Software: kovidgoyal kitty

Affected Versions: Versions prior to 0.48.2

Vulnerability: The application suffers from command injection (CWE-77), CRLF injection (CWE-93), and improper control sequence neutralization (CWE-150). These flaws allow attackers to bypass intended security constraints through malicious input.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a significant risk to workstations and servers utilizing the kitty terminal. Successful exploitation could result in full system compromise, as an attacker could execute arbitrary commands with the privileges of the user running the terminal, potentially leading to data theft or lateral movement within the environment.

Remediation Plan

Immediate Action: Upgrade to kitty version 0.48.2 or later immediately to resolve the identified injection vulnerabilities.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected terminal behavior that may indicate an attempt to exploit terminal-based input flaws.

Compensating Controls: Avoid processing untrusted text streams or shell outputs through the terminal emulator until the software has been patched.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of multiple injection flaws makes this a high-priority update for any environment relying on terminal-based workflows.

Analyst Recommendation

The severity of command injection vulnerabilities in a terminal emulator necessitates an immediate upgrade to the patched version. Security teams should ensure all instances of kitty are updated to 0.48.2 to eliminate the risk of arbitrary code execution.

---METADATA---
VENDOR: frappe
PRODUCT: erpnext
AFFECTED_VERSIONS: < 15.118.0, >= 16.0.0, < 16.29.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ERPNext contains a template injection vulnerability that allows authenticated users to execute arbitrary server-side code by manipulating template parameters in processing functions.

Executive Summary:
An authenticated template injection vulnerability in ERPNext enables users with operational roles to execute arbitrary server-side code, resulting in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72911

Affected Software: frappe erpnext

Affected Versions: < 15.118.0, >= 16.0.0 < 16.29.0

Vulnerability: The application improperly neutralizes special elements in template engines (CWE-1336) within the process_statement_of_accounts module. An authenticated user can inject malicious expressions to execute code or access data, despite requiring prior authentication.

Business Impact

This vulnerability allows an attacker with legitimate system access to elevate their privileges and execute arbitrary code on the underlying host. The ability to read or modify data across the entire application, combined with the potential for remote code execution, presents a severe risk to organizational operations and data integrity.

Remediation Plan

Immediate Action: Update ERPNext to version 15.118.0, 16.29.0, or higher to ensure the template rendering logic is secured.

Proactive Monitoring: Monitor for anomalous server-side process execution or unexpected file system modifications originating from the ERPNext application account.

Compensating Controls: Restrict access to sensitive modules, such as account processing, to the minimum number of users required to perform business functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access slightly lowers the initial attack vector, but the impact of code execution remains critical.

Analyst Recommendation

Administrators should update their ERPNext instances immediately to prevent internal threats from escalating to full system compromise. Review user roles and permissions to ensure that access to template-related functions is strictly controlled until the patch is applied.

---METADATA---
VENDOR: firecrawl
PRODUCT: firecrawl
AFFECTED_VERSIONS: < 2.11.32
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An arbitrary file read and SSRF vulnerability in Firecrawl prior to 2.11.32 allows unauthenticated attackers to read local files via malicious JSON schemas during extraction.

Executive Summary:
A critical arbitrary file read and SSRF vulnerability in Firecrawl allows unauthenticated remote attackers to compromise internal server data and interact with internal network endpoints.

Vulnerability Details

CVE-ID: CVE-2026-72904

Affected Software: firecrawl firecrawl

Affected Versions: < 2.11.32

Vulnerability: The vulnerability stems from unsafe schema dereferencing in the extraction functionality, where user-supplied JSON schemas are processed with default resolver settings, allowing unauthorized access to local files and internal network resources.

Business Impact

Successful exploitation allows an attacker to read sensitive configuration files, credentials, or internal data stored on the host filesystem. With a CVSS score of 9.3, the risk of full system compromise or internal network scanning via SSRF is high, potentially leading to a broader breach of the hosting environment.

Remediation Plan

Immediate Action: Update firecrawl to version 2.11.32 or later immediately to resolve the unsafe schema dereferencing.

Proactive Monitoring: Monitor the application for unexpected outbound network connections from the extraction worker and review logs for suspicious schema submissions containing unexpected file paths or internal IP addresses.

Compensating Controls: Deploy a Web Application Firewall with rules designed to detect and block malicious JSON payloads, and ensure the extraction worker runs with the least privilege possible to limit filesystem access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex but presents a high risk due to the potential for unauthorized data access.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for unauthenticated remote exploitation, it should be treated with the highest urgency. Patching is the only reliable method to eliminate the underlying flaw in the schema processing logic.

---METADATA---
VENDOR: Eugeny
PRODUCT: tabby
AFFECTED_VERSIONS: < 1.0.235
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Tabby terminal emulator is vulnerable to a path traversal flaw, allowing an attacker to potentially access or manipulate unauthorized files.

Executive Summary:
A path traversal vulnerability in the Eugeny Tabby terminal emulator allows unauthenticated attackers to potentially impact system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-72903

Affected Software: Eugeny Tabby

Affected Versions: < 1.0.235

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) residing in the terminal emulator, which can be triggered by an unauthenticated attacker through user interaction.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a high risk to business operations. Exploitation could allow an attacker to bypass directory restrictions, leading to unauthorized file system access, which may result in system compromise or service disruption.

Remediation Plan

Immediate Action: Update the Tabby terminal emulator to version 1.0.235 or later to resolve the underlying path traversal issue.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected path traversal attempts originating from the terminal application.

Compensating Controls: Ensure that the application is running with the principle of least privilege to limit the scope of impact if a traversal attack is successful.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Path traversal flaws are inherently dangerous as they can lead to unauthorized data exposure or system manipulation.

Analyst Recommendation

Given the high severity score, organizations should prioritize updating all instances of Tabby to version 1.0.235 immediately. Failure to patch leaves the system exposed to potential file system traversal attacks that could compromise the integrity of the host environment.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 are vulnerable to OS command injection via the registry testing functions, allowing authenticated users to execute arbitrary commands on the host or remote server.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy versions prior to 0.29.13 allows attackers to execute arbitrary code on target servers, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72902

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) occurring because the application improperly interpolates user-controlled password fields into shell commands. Exploitation requires the attacker to have an authenticated session.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the Dokploy service. Given the CVSS score of 9.9, this vulnerability could lead to total system compromise, unauthorized data access, and the potential for lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Upgrade the Dokploy instance to version 0.29.13 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious shell commands or anomalous process execution originating from the Dokploy service account.

Compensating Controls: Ensure the Dokploy service runs with the least privilege necessary, and utilize network segmentation to limit the impact if the host is compromised.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it bridges the gap between application logic and system-level command execution.

Analyst Recommendation

The critical severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating to version 0.29.13 to prevent potential remote code execution and maintain the security posture of their deployment environments.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 are susceptible to OS command injection via the volume backup functionality, allowing authenticated low-privilege users to execute commands with root-level impact.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows low-privilege users to execute arbitrary code on the control-plane host with root-equivalent privileges.

Vulnerability Details

CVE-ID: CVE-2026-72901

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to quote the volumeName field when processing backup requests, allowing an attacker to inject shell commands. Because the service has access to the Docker socket, successful exploitation results in execution that is effectively host or root-equivalent.

Business Impact

This vulnerability is rated at 9.9 on the CVSS scale, signifying a critical risk to the host control plane. A successful exploit allows a low-privileged user to break out of the application's intended scope, achieving full system access and potentially compromising all other services running on the host server.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to ensure proper command argument handling.

Proactive Monitoring: Monitor the control-plane host for unauthorized process execution or unexpected modifications to the Docker environment.

Compensating Controls: Ensure that the Dokploy service runs with the minimum necessary privileges and, where possible, utilize kernel-level security modules like AppArmor or SELinux to restrict potential container escapes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly concerning because the interaction with the Docker socket provides an easy path to host-level command execution.

Analyst Recommendation

Given the extreme severity and the potential for total control-plane compromise, users must upgrade to version 0.29.13 or later immediately. Failure to patch leaves the host server exposed to trivial command injection attacks by any authenticated user.

---METADATA---
VENDOR: Metabase
PRODUCT: Metabase
AFFECTED_VERSIONS: x.58.0 up to (excluding) x.58.24, x.59.0 up to (excluding) x.59.21, x.60.0 up to (excluding) x.60.17, x.61.0 up to (excluding) x.61.11, x.62.0 up to (excluding) x.62.9, x.63.0 up to (excluding) x.63.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Metabase contains an SQL injection vulnerability allowing unauthenticated attackers to execute arbitrary SQL commands via manipulated field-filter parameters in shared dashboards.

Executive Summary:
A critical SQL injection vulnerability in Metabase allows unauthenticated remote attackers to compromise the underlying database, posing a severe risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-72899

Affected Software: Metabase Metabase

Affected Versions: x.58.0 to x.58.23, x.59.0 to x.59.20, x.60.0 to x.60.16, x.61.0 to x.61.10, x.62.0 to x.62.8, x.63.0 to x.63.4

Vulnerability: This is an SQL injection flaw (CWE-89) triggered by improper input validation of field-filter parameters in shared cards or dashboards. The vulnerability is exploitable by unauthenticated attackers, enabling unauthorized database interaction.

Business Impact

Successful exploitation allows an attacker to bypass application controls and execute arbitrary queries against the backend database. This can result in full data exfiltration, unauthorized modification of records, or complete system compromise, justifying the CVSS score of 10.0.

Remediation Plan

Immediate Action: Upgrade to the patched versions: x.58.24, x.59.21, x.60.17, x.61.11, or the latest available maintenance release for your specific branch.

Proactive Monitoring: Audit application logs for unusual query patterns or unexpected database errors originating from public-facing dashboard endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect traffic directed at dashboard filter parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its remote, unauthenticated nature and the potential for total impact.

Analyst Recommendation

Given the critical severity and the ease of exploitation, organizations must prioritize patching Metabase immediately. Ensure that all public-facing dashboards are reviewed and updated to the latest secure versions to prevent unauthorized access to sensitive business data.

---METADATA---
VENDOR: Metabase
PRODUCT: Metabase
AFFECTED_VERSIONS: x.58.0 up to x.58.24, x.59.0 up to x.59.21, x.60.0 up to x.60.17, x.61.0 up to x.61.11, x.62.0 up to x.62.9, x.63.0 up to x.63.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Metabase contains a critical SQL injection vulnerability in the password reset endpoint that allows unauthenticated remote attackers to gain full administrative control over the instance.

Executive Summary:
A critical SQL injection vulnerability in Metabase allows unauthenticated remote attackers to achieve full system compromise, necessitating an immediate update to patched versions.

Vulnerability Details

CVE-ID: CVE-2026-72898

Affected Software: Metabase Metabase

Affected Versions: x.58.0 up to x.58.24, x.59.0 up to x.59.21, x.60.0 up to x.60.17, x.61.0 up to x.61.11, x.62.0 up to x.62.9, x.63.0 up to x.63.5

Vulnerability: This is an SQL injection vulnerability (CWE-89) affecting the /reset_password endpoint, which fails to properly sanitize user input, allowing an unauthenticated attacker to execute arbitrary SQL commands.

Business Impact

The vulnerability carries a CVSS score of 10.0, indicating the highest possible severity. Successful exploitation allows an attacker to bypass authentication, access sensitive business data, and potentially take complete control of the underlying server infrastructure, leading to severe data breaches and operational disruption.

Remediation Plan

Immediate Action: Upgrade your Metabase instance to the fixed versions (x.58.24, x.59.21, x.60.17, x.61.11, or later) immediately.

Proactive Monitoring: Review application and database logs for anomalous requests directed at the /reset_password endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting password reset workflows.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the ease of exploitation and the high technical impact, the risk is significant regardless of current exploit availability.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of authentication required for exploitation, organizations must prioritize patching. Failure to update Metabase immediately exposes the entire data environment to unauthorized access and potential total system compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: >= 0.29.2, < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in Dokploy allows authenticated users to escalate privileges and execute arbitrary scripts as root on the host machine.

Executive Summary:
A critical authorization bypass in Dokploy enables authenticated users to escalate privileges and execute commands as root, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-72886

Affected Software: Dokploy dokploy

Affected Versions: >= 0.29.2, < 0.29.13

Vulnerability: The flaw exists within the schedule management API, where improper authorization checks allow an authenticated member to attach their application to a schedule and run scripts as root. This bypasses intended access controls for non-administrative users.

Business Impact

An attacker with minimal access can leverage this flaw to gain root-level control over the underlying server. This total compromise could result in the theft of sensitive data, modification of application environments, or persistent access to the infrastructure. The 9.9 CVSS score reflects the high impact of a root-level privilege escalation.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review audit logs for suspicious activity related to the schedule API and monitor for unexpected process execution with root privileges.

Compensating Controls: Implement strict access control lists for users within the Dokploy environment and limit user roles to the minimum necessary for their function.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once a user has authenticated, making internal threats a significant concern.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for root escalation. Organizations using Dokploy should perform an immediate update to version 0.29.13 and audit their user permissions to ensure no unauthorized activities have already occurred.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains an OS command injection vulnerability, allowing authenticated users with low privileges to execute arbitrary commands on the underlying host.

Executive Summary:
An OS command injection vulnerability in Dokploy allows authenticated attackers to gain unauthorized command execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72884

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability involves the improper neutralization of special elements used in an OS command (CWE-78). It requires the attacker to have low-level privileges to successfully inject and execute arbitrary commands.

Business Impact

Successful exploitation leads to full system compromise, as the attacker can execute arbitrary commands with the privileges of the Dokploy service. With a CVSS score of 8.7, this represents a significant risk of data exfiltration, service manipulation, and lateral movement within the environment.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to apply the necessary security fixes.

Proactive Monitoring: Review audit logs for suspicious process execution or unexpected shell activity initiated by the Dokploy user account.

Compensating Controls: Ensure the Dokploy process runs with the least privilege necessary and utilize containerization or sandboxing to limit the scope of potential command execution.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection remains a high-risk vector that should be remediated by updating the software immediately.

Analyst Recommendation

The severity of this command injection flaw necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential full-system compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is affected by a missing authorization vulnerability, which allows authenticated users to perform unauthorized actions within the platform.

Executive Summary:
A missing authorization vulnerability in Dokploy permits authenticated users to execute unauthorized operations, posing a high risk to the security of hosted applications.

Vulnerability Details

CVE-ID: CVE-2026-72883

Affected Software: Dokploy Dokploy

Affected Versions: < 0.29.13

Vulnerability: The software fails to properly enforce authorization checks, allowing an authenticated user to perform actions outside of their intended permissions scope.

Business Impact

With a CVSS score of 8.8, this flaw could allow an attacker to gain excessive privileges, potentially leading to unauthorized modification or deletion of deployments, data, and system configurations. This threatens the integrity of all services managed through the Dokploy platform.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Review application logs for unauthorized access attempts or suspicious configuration changes performed by lower-privileged user accounts.

Compensating Controls: Audit user permissions within the Dokploy dashboard to ensure that the principle of least privilege is strictly maintained.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The fix is readily available in the referenced commit history and release notes, making remediation straightforward for administrators.

Analyst Recommendation

Maintaining proper authorization is fundamental to the security of a platform as a service. It is highly recommended that all users upgrade to version 0.29.13 immediately to eliminate the risk of privilege escalation and unauthorized system management.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: <= 0.28.8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dokploy versions 0.28.8 and earlier are vulnerable to OS command injection via the filePath parameter, allowing authenticated users to execute arbitrary commands on remote servers.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows attackers to execute arbitrary code on remote managed servers, leading to remote host compromise.

Vulnerability Details

CVE-ID: CVE-2026-72882

Affected Software: Dokploy dokploy

Affected Versions: <= 0.28.8

Vulnerability: The application fails to properly sanitize the filePath parameter when configuring file mounts for services. An authenticated user can inject malicious shell metacharacters, resulting in OS command injection that executes with the privileges of the Dokploy service on the target host.

Business Impact

The ability to execute commands on remote managed servers via the web interface provides an attacker with a direct path to host-level exploitation. With a CVSS score of 9.9, this vulnerability severely undermines the security of the entire infrastructure managed by Dokploy. Unauthorized command execution can lead to complete system takeover and the compromise of all hosted data.

Remediation Plan

Immediate Action: Verify if a vendor-supplied patch is available for your specific deployment and apply it immediately; if no patch is currently available, restrict access to the file mount configuration interface.

Proactive Monitoring: Review SSH logs on managed servers for suspicious command execution patterns or unexpected connections from the Dokploy host.

Compensating Controls: Utilize a Web Application Firewall to block requests containing shell metacharacters in the filePath input field.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly critical due to the ease of achieving remote code execution.

Analyst Recommendation

This vulnerability is a high-risk entry point for remote code execution. Administrators should audit all service file mount configurations and restrict access to these settings until a verified patch can be applied.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 contain an arbitrary file write and deletion vulnerability due to improper input validation in the certificate management service.

Executive Summary:
A critical directory traversal vulnerability in Dokploy allows authenticated users with specific permissions to perform unauthorized file operations on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72880

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly sanitize the certificatePath parameter, which allows an authenticated user with certificate management permissions to escape the intended directory and execute arbitrary file writes or deletions.

Business Impact

Successful exploitation of this flaw allows a malicious actor to overwrite critical system files or delete essential data, potentially leading to a complete compromise of the host server. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to system integrity and availability, as it permits unauthorized administrative-level actions within the application environment.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Review audit logs for unusual file access patterns or unexpected attempts to modify files outside of the standard application directories.

Compensating Controls: Restrict access to the certificate management interface to the absolute minimum number of trusted users and employ file integrity monitoring on the host to detect unauthorized changes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct filesystem manipulation by an authenticated user.

Analyst Recommendation

This vulnerability presents a severe risk to the host environment due to the potential for arbitrary file manipulation. Organizations should prioritize patching to version 0.29.13 immediately to mitigate the risk of host compromise.