---METADATA---
VENDOR: VMware
PRODUCT: Aria Operations
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.

Executive Summary:
VMware Aria Operations is susceptible to a critical command injection vulnerability that could allow an attacker to achieve full system compromise by executing unauthorized code.

Vulnerability Details

CVE-ID: CVE-2026-22719

Affected Software: VMware Aria Operations

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a command injection flaw, typically occurring when an application passes unsafe user-supplied data to a system shell. This allows an attacker to break out of the intended application logic and execute arbitrary operating system commands.

Business Impact

Command injection is one of the most dangerous classes of vulnerabilities. A successful exploit could allow an attacker to gain a persistent foothold in the environment, steal sensitive operational data, or deploy ransomware. The CVSS score of 8.1 underscores the high severity and the potential for total loss of system integrity and confidentiality.

Remediation Plan

Immediate Action: Apply the security patches provided by VMware (Broadcom) for Aria Operations immediately.

Proactive Monitoring: Inspect system logs for the execution of unexpected shell commands, especially those originating from web service accounts (e.g., 'www-data' or 'tomcat').

Compensating Controls: Ensure that Aria Operations instances are not exposed directly to the public internet and are protected by robust network segmentation and a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, VMware products are high-value targets for advanced persistent threat (APT) actors, and command injection flaws are frequently weaponized.

Analyst Recommendation

The severity of a command injection vulnerability in a management platform like Aria Operations cannot be overstated. Organizations must prioritize this update above standard maintenance cycles. Immediate patching is the primary recommendation to prevent unauthorized actors from seizing control of critical infrastructure monitoring tools.

Executive Summary:
A critical sandbox escape vulnerability has been identified in vm2, a widely used Node.js library. This flaw allows an attacker to bypass security restrictions and execute arbitrary code on the underlying server, potentially leading to a full system compromise. Organizations using applications that rely on vulnerable versions of vm2 are at high risk of data theft, service disruption, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2026-22709

Affected Software: Unknown Multiple Products (due to the vulnerability existing in the third-party library vm2)

Affected Versions: Products using vm2 versions prior to 3.10.2 are affected.

Vulnerability: The vulnerability is a sandbox escape within the vm2 Node.js library. The library fails to properly sanitize promise callbacks returned by async functions. While the sandbox correctly handles promises created within its own context (localPromise), it does not apply the same security controls to native promises (globalPromise) that are returned by asynchronous functions. An attacker can craft malicious code within the sandbox that uses an async function to return a native promise. The callback function attached to this promise (via .then() or .catch()) will then execute outside the sandbox's security context, granting the attacker arbitrary code execution on the host machine.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation allows an attacker to completely bypass the intended security isolation of the sandbox environment. This could lead to a full compromise of the application server, enabling the attacker to steal sensitive data, install malware or ransomware, disrupt critical services, or use the compromised system as a pivot point to attack other resources on the internal network. The potential for complete system takeover poses a direct and severe risk to business operations, data confidentiality, and system integrity.

Remediation Plan

Immediate Action: Identify all applications and systems utilizing the vm2 Node.js library and update it to the patched version 3.10.2 or later. After patching, monitor affected systems for any signs of post-exploitation activity and review historical access and application logs for indicators of compromise.

Proactive Monitoring: Implement enhanced monitoring on servers running applications with the vm2 library. Look for anomalous behavior from the Node.js process, such as unexpected child processes (e.g., /bin/sh, powershell.exe), outbound network connections to unfamiliar IP addresses, or modifications to sensitive system files. Application-level logging should be reviewed for suspicious inputs that may be attempting to trigger the exploit.

Compensating Controls: If immediate patching is not feasible, apply compensating controls to reduce risk. Run the application in a minimal, hardened container (e.g., Docker) with restricted user permissions and no unnecessary tools. Implement strict network egress filtering to block potential command-and-control (C2) communications. A Web Application Firewall (WAF) may also be configured to block patterns associated with known exploit attempts.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date, Jan 26, 2026, there are no public reports of active, widespread exploitation of this vulnerability. However, sandbox escape vulnerabilities in popular libraries are highly sought after by threat actors. It is highly probable that proof-of-concept (PoC) exploits will be developed and made public, significantly increasing the risk of exploitation.

Analyst Recommendation

Immediate and decisive action is required to mitigate this critical vulnerability. All development and security teams must prioritize the identification of any product using the vm2 library and immediately update it to a patched version (3.10.2 or newer). Although this vulnerability is not yet on the CISA KEV list, its critical CVSS score of 9.8 signifies the highest level of risk. Due to the potential for complete system compromise, remediation of this flaw should be treated as an emergency security priority.

Executive Summary:
A high-severity vulnerability has been identified in multiple HAX CMS products, which could allow a remote attacker to compromise the underlying server. Successful exploitation could lead to a complete system takeover, resulting in data theft, service disruption, and significant reputational damage. Organizations are urged to apply the vendor-provided security patches immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2026-22704

Affected Software: HAX Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the content management system's file handling or API processing logic, affecting both PHP and NodeJS backends. A remote, potentially unauthenticated, attacker could craft a malicious request to an exposed endpoint. This could allow for arbitrary code execution on the server, providing the attacker with the same level of permissions as the web service account, leading to a full compromise of the web application and its host server.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.0, reflecting a significant risk to the organization. Exploitation could result in a complete loss of confidentiality, integrity, and availability for the affected web applications. Potential consequences include the theft of sensitive customer or corporate data, website defacement, distribution of malware from the compromised server, and disruption of business operations dependent on the affected microsites. The financial and reputational costs associated with such a breach could be substantial.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all instances of affected HAX CMS products. After patching, review server access logs and application logs for any signs of compromise, such as unusual file uploads, unexpected outbound network connections, or unauthorized administrative activity.

Proactive Monitoring: System administrators should actively monitor web server logs for suspicious POST requests to unexpected endpoints, particularly those involving file uploads. Network traffic should be monitored for anomalous outbound connections from the web server. Implement file integrity monitoring on the web application directories to detect unauthorized changes.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to block common remote code execution patterns. Restrict administrative access to the HAX CMS to trusted IP addresses only. Enforce strict file upload policies to ensure only non-executable file types are permitted.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 10, 2026, there are no known public exploits or active campaigns targeting this vulnerability. However, due to the high severity, it is highly probable that threat actors will reverse-engineer the vendor patch to develop a functional exploit. The window for preventative action is likely to be very short.

Analyst Recommendation

Given the high CVSS score of 8.0, this vulnerability presents a critical risk that must be addressed with urgency. Although CVE-2026-22704 is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its severity makes it a prime target for future exploitation. We strongly recommend that all organizations using affected HAX products prioritize the deployment of vendor-supplied patches within the next 72 hours. In parallel, implement the proactive monitoring and compensating controls outlined above to reduce the attack surface and enhance detection capabilities.

Executive Summary:
A high-severity vulnerability has been discovered in the CryptoLib software library, which is used to secure communications for space systems. This flaw could allow a remote attacker to send a malicious data packet, potentially leading to a system crash or unauthorized code execution on ground stations or spacecraft. Successful exploitation could compromise sensitive mission data, disrupt operations, or even lead to the loss of control over a space asset.

Vulnerability Details

CVE-ID: CVE-2026-22697

Affected Software: CryptoLib Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the component of CryptoLib responsible for parsing SDLS-EP protocol packets. A specially crafted, malformed packet can trigger a buffer overflow condition when processed by the library. An unauthenticated remote attacker could send this packet to a listening endpoint (either a ground station or a spacecraft), causing the application to crash (Denial of Service) or potentially allowing the attacker to execute arbitrary code with the privileges of the affected service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have severe consequences for any organization relying on CryptoLib for space-to-ground communications. The primary business impacts include the potential for mission failure, loss of control over high-value space assets, and the compromise of sensitive telemetry or command data. A successful attack could lead to significant financial loss, reputational damage, and the failure to meet critical operational objectives.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by CryptoLib to all affected systems immediately. Patching should be prioritized for ground station systems and then scheduled for flight systems according to operational procedures. After patching, review system and access logs for any signs of compromise or attempted exploitation that may have occurred prior to the update.

Proactive Monitoring: Implement enhanced monitoring of network traffic for malformed or unusually large SDLS-EP packets. System administrators should monitor application logs for any unexpected crashes or errors related to the CryptoLib service. Configure alerts for anomalous connection attempts to systems running the affected software from untrusted networks.

Compensating Controls: If immediate patching is not feasible (e.g., for in-flight systems), implement the following controls:

• Use network firewalls or an Intrusion Prevention System (IPS) to block traffic from untrusted sources and inspect for anomalous SDLS-EP packets.
• Enforce strict network segmentation to limit access to the affected ground station systems.
• Increase scrutiny and validation of all commands sent and telemetry received to detect any deviations from expected behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 11, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, due to the critical nature of the affected systems, it is anticipated that sophisticated threat actors may attempt to reverse-engineer the vendor patch to develop an exploit.

Analyst Recommendation

Given the high-severity rating and the critical function of the affected software in securing space communications, this vulnerability requires immediate attention. Although it is not currently listed on the CISA KEV list, the potential impact of a successful exploit is severe. We strongly recommend that organizations prioritize the deployment of vendor-supplied patches to all affected ground and flight systems. In parallel, implement the proactive monitoring and compensating controls detailed above to reduce the attack surface and improve detection capabilities.

Executive Summary:
A critical command injection vulnerability, identified as CVE-2026-22688, exists in the WeKnora is an LLM-powered framework. This flaw allows an authenticated attacker to execute arbitrary commands on the server, potentially leading to a complete system compromise, data theft, and service disruption. Organizations using affected versions are at high risk and should apply the available patch immediately.

Vulnerability Details

CVE-ID: CVE-2026-22688

Affected Software: WeKnora is an Multiple Products

Affected Versions: All versions prior to 0.2.5

Vulnerability: The vulnerability is a command injection flaw within the framework's MCP (Master Control Program) stdio settings. An authenticated user can supply specially crafted input to the stdio_config.command or stdio_config.args parameters. The application fails to properly sanitize this input before using it to construct and execute a system command, allowing the attacker's malicious commands to be run on the underlying server with the privileges of the application's service account.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9, reflecting the potential for catastrophic impact. Successful exploitation could lead to a complete compromise of the server hosting the WeKnora framework. An attacker could exfiltrate sensitive data being processed by the LLM, install ransomware or other malware, disrupt critical business operations, and use the compromised system as a pivot point to attack other internal network resources. The risk to data confidentiality, integrity, and availability is exceptionally high.

Remediation Plan

Immediate Action:

• Immediately upgrade all instances of WeKnora is an to the patched version 0.2.5 or later, as recommended by the vendor.
• After patching, review system and application logs for any signs of past exploitation, such as unusual commands or outbound network connections.
• Verify that the patch has been successfully applied and the vulnerability is no longer present.

Proactive Monitoring:

• Monitor system process logs for suspicious subprocesses spawned by the WeKnora service account (e.g., sh, bash, powershell, curl, wget).
• Analyze network traffic logs for unusual outbound connections from the WeKnora server to unknown destinations.
• Implement alerting for any modifications to the MCP stdio settings within the application to detect potential exploitation attempts.

Compensating Controls:

• If immediate patching is not feasible, restrict access to the application's management interface to a minimal set of trusted administrative users and IP addresses.
• Deploy a Web Application Firewall (WAF) with rules designed to detect and block common command injection payloads targeting the vulnerable parameters.
• Ensure the WeKnora service runs under a dedicated, low-privilege user account to limit the potential damage of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Jan 10, 2026), there is no known publicly available exploit code, and this vulnerability is not reported to be actively exploited in the wild. However, command injection vulnerabilities are well understood and relatively easy to exploit once discovered. The requirement for authentication lowers the risk slightly, but any compromised user account could be used to leverage this flaw.

Analyst Recommendation

Given the critical CVSS score of 9.9, this vulnerability poses a severe and immediate threat to the organization. The top priority must be to apply the vendor-supplied patch (version 0.2.5 or later) to all affected systems without delay. Although this CVE is not currently listed on the CISA KEV catalog, its high severity makes it a prime target for threat actors. If patching cannot be performed immediately, implement the recommended compensating controls, particularly access restrictions and WAF rules, to mitigate risk while a patching schedule is finalized.

Executive Summary:
A critical vulnerability has been discovered in the Enclave JavaScript sandbox, which allows untrusted code, such as that from an AI agent, to break out of its isolated environment. This "sandbox escape" permits an attacker to execute arbitrary commands on the underlying host system, leading to a complete system compromise, data theft, and unauthorized access to network resources.

Vulnerability Details

CVE-ID: CVE-2026-22686

Affected Software: Enclave is a secure JavaScript sandbox designed for safe AI agent code Multiple Products

Affected Versions: Versions prior to 2.7.0

Vulnerability: The vulnerability exists in how the enclave-vm handles errors. When a sandboxed tool invocation fails, the system exposes a host-level Error object directly to the sandboxed code without properly sanitizing it. An attacker can intentionally trigger such an error to gain access to this object. By traversing the object's prototype chain, the attacker can reach the host's native Function constructor, a powerful function that can compile and execute new JavaScript code. Using this, the attacker can run arbitrary code outside the sandbox, in the context of the host Node.js process, effectively gaining full control over the host machine.

Business Impact

This vulnerability is of critical severity with a CVSS score of 10, representing the highest possible risk. Successful exploitation leads to a complete compromise of the host system running the Enclave sandbox. Potential consequences include the theft of sensitive data such as API keys and credentials from environment variables, unauthorized access to the filesystem and internal network, deployment of ransomware or other malware, and using the compromised system to launch further attacks. For organizations using Enclave to run AI agents, this means a malicious prompt or agent code could take over the entire server, subverting the core security purpose of the sandbox.

Remediation Plan

Immediate Action: Immediately upgrade all instances of the affected Enclave products to version 2.7.0 or later. This version contains the necessary patch to prevent the host Error object from being exposed to the sandbox. After patching, review system and application logs for any signs of past exploitation attempts.

Proactive Monitoring:

• Log Analysis: Monitor application logs for an unusual volume of tool invocation failures, which could indicate an attacker attempting to trigger the vulnerability.
• Process Monitoring: Watch the Node.js process running Enclave for anomalous behavior, such as spawning unexpected child processes (e.g., shells), accessing sensitive files, or making unauthorized outbound network connections.
• Code Auditing: Where possible, audit JavaScript code intended for the sandbox for patterns that attempt to manipulate or traverse object prototypes (e.g., use of constructor, __proto__, or Object.getPrototypeOf).

Compensating Controls:
If immediate patching is not feasible, implement the following controls to reduce risk:

• Principle of Least Privilege: Run the Node.js application using a dedicated, unprivileged user account with minimal filesystem permissions.
• Containerization: Run the application within a hardened container (e.g., distroless) with restrictive security profiles (like Seccomp and AppArmor) to limit the kernel-level calls an escaped process can make.
• Network Segmentation: Use firewalls to strictly limit outbound network connections from the host, preventing an attacker from exfiltrating data or establishing a connection to a command-and-control server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the published date, Jan 14, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, sandbox escape vulnerabilities are highly valuable to threat actors. Due to the detailed nature of the public disclosure, it is highly probable that a functional proof-of-concept exploit will be developed and released, increasing the likelihood of exploitation.

Analyst Recommendation

Given the critical CVSS score of 10 and the potential for complete system compromise, this vulnerability requires immediate attention. We strongly recommend that all affected systems are patched to version 2.7.0 or later without delay. Prioritize patching for internet-facing systems or any systems that process untrusted code from third-party sources. Although this vulnerability is not currently listed on the CISA KEV list, its severity warrants treating it with the same level of urgency as a known exploited vulnerability.

Executive Summary:
A high-severity vulnerability has been identified in the DevToys suite of developer tools, assigned CVE-2026-22685. This flaw could allow an unauthenticated attacker to execute arbitrary code on a developer's workstation by tricking them into processing a specially crafted file or text string. Successful exploitation could lead to a complete system compromise, resulting in data theft, credential harvesting, and a potential pivot point into the broader corporate network.

Vulnerability Details

CVE-ID: CVE-2026-22685

Affected Software: DevToys Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a remote code execution flaw stemming from an improper input validation weakness within several of the tool's data processing functions (e.g., formatters, converters). An attacker can craft a malicious input string or file that, when opened or pasted into the DevToys application, triggers a buffer overflow condition. This allows the attacker to execute arbitrary code on the underlying operating system with the same permissions as the user running the application, leading to a full compromise of the developer's machine.

Business Impact

This vulnerability presents a high-severity risk to the organization, reflected by its CVSS score of 8.8. The compromise of a developer's workstation is a critical security event, as these systems often contain sensitive intellectual property, such as source code, API keys, and access credentials for production environments. An attacker could leverage this access to steal proprietary data, inject malicious code into the software supply chain, or move laterally across the network to compromise other critical assets. The potential consequences include significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all workstations where DevToys is installed. Prioritize patching for developers and other technical staff who are most likely to use the application. After patching, monitor for any signs of exploitation attempts that may have occurred and review relevant endpoint and network access logs for anomalous activity.

Proactive Monitoring: Security teams should configure Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by the DevToys executable (e.g., powershell.exe, cmd.exe, cscript.exe). Monitor for unusual outbound network connections from developer workstations to unknown or malicious IP addresses. Review application logs for evidence of malformed inputs that could indicate exploitation attempts.

Compensating Controls: If patching cannot be deployed immediately, consider implementing temporary compensating controls. Restrict the application's ability to connect to the internet using a host-based firewall. Advise developers to avoid using the tool with any untrusted data from external sources. As a last resort, consider running DevToys within a sandboxed or virtualized environment to contain any potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 11, 2026, there is no publicly available exploit code, and this vulnerability is not known to be actively exploited in the wild. However, given the critical nature of remote code execution vulnerabilities in widely used developer tools, it is highly probable that threat actors and security researchers will develop a functional proof-of-concept exploit in the near future.

Analyst Recommendation
This vulnerability must be treated with the highest priority. The CVSS score of 8.8 and the critical role of developer endpoints make this a significant threat to the organization's security posture. Although CVE-2026-22685 is not currently on the CISA KEV list, its potential for severe impact warrants immediate remediation. We strongly recommend that all available patches be deployed within the next 72 hours and that security teams maintain a state of heightened monitoring on all developer workstations for any indicators of compromise.

---METADATA---
VENDOR: Weaver
PRODUCT: E-cology 10.0
AFFECTED_VERSIONS: Prior to 20260312
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Weaver E-cology 10.0 contains an unauthenticated remote code execution vulnerability in the dubboApi debug endpoint, which is currently being exploited in the wild.

Executive Summary:
An unauthenticated remote code execution vulnerability in Weaver E-cology 10.0 is being actively exploited in the wild, posing an immediate threat to system security.

Vulnerability Details

CVE-ID: CVE-2026-22679

Affected Software: Weaver E-cology 10.0

Affected Versions: Prior to 20260312

Vulnerability: The vulnerability exists in the /papi/esearch/data/devops/dubboApi/debug/method endpoint. Unauthenticated attackers can send crafted POST requests containing malicious interfaceName and methodName parameters to execute arbitrary system commands.

Business Impact

With a CVSS score of 9.8 and confirmed active exploitation, this vulnerability presents an extreme risk to organizational infrastructure. Successful exploitation allows for complete remote system compromise, data theft, and the deployment of persistent threats within the network.

Remediation Plan

Immediate Action: Update Weaver E-cology 10.0 to version 20260312 or later immediately to remove the vulnerable debug functionality.

Proactive Monitoring: Monitor network traffic for POST requests directed at the /papi/esearch/data/devops/dubboApi/debug/method endpoint and inspect system logs for unexpected command execution.

Compensating Controls: Disable the affected debug endpoint at the web server or firewall level if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 7, 2026, exploitation evidence has been observed in the wild by the Shadowserver Foundation. Immediate patching is required as this is an actively targeted vulnerability.

Analyst Recommendation

This is a critical, actively exploited vulnerability. Organizations running Weaver E-cology 10.0 must treat this as a high-priority incident and apply the necessary patches immediately to mitigate the risk of unauthorized remote command execution.

---METADATA---
VENDOR: Canon
PRODUCT: prompts
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the "prompts" component as utilized within Canon products, potentially affecting device security.

Executive Summary:
Canon products utilizing the "prompts" component are affected by a high-risk vulnerability that could lead to unauthorized access or device compromise.

Vulnerability Details

CVE-ID: CVE-2026-22665

Affected Software: Canon products using "prompts"

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves the "prompts" software component within the Canon ecosystem. A CVSS score of 8.1 suggests that the flaw allows for significant exploitation, likely through improper handling of interactive user prompts or input fields within the device's software interface.

Business Impact

An attacker could potentially exploit this flaw to gain unauthorized access to Canon devices, leading to data exfiltration or the use of the device as a foothold within the corporate network. The High severity reflects the risk of compromising hardware that often handles sensitive document data.

Remediation Plan

Immediate Action: Check the Canon support portal for firmware updates related to this CVE and apply them to all affected devices immediately.

Proactive Monitoring: Monitor network traffic from Canon devices for unusual outbound connections or attempts to access restricted network segments.

Compensating Controls: Place printing and imaging hardware on a segmented network with restricted access to the broader corporate environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, vulnerabilities in networked office equipment are frequently leveraged by advanced persistent threat (APT) groups for lateral movement.

Analyst Recommendation

Apply the primary firmware update immediately to mitigate the risk. Organizations should prioritize the security of networked peripherals like Canon devices, as they are often overlooked entry points for attackers.

---METADATA---
VENDOR: Fal
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in Fal products related to prompt handling. The flaw could allow for unauthorized input manipulation or system exploitation.

Executive Summary:
Fal products are affected by a high-severity vulnerability in the prompt processing mechanism that could lead to unauthorized system actions or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-22664

Affected Software: Fal Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in how prompts are processed within the Fal ecosystem. While the technical specifics are limited, the high CVSS score suggests an attacker could potentially bypass security controls or influence system behavior through malicious input.

Business Impact

A successful exploit of this vulnerability could lead to significant data compromise or unauthorized access to sensitive internal functions. With a CVSS score of 7.7, the risk to business continuity and data integrity is high, potentially resulting in reputational damage and the loss of customer trust. Organizations relying on Fal for automated processing are particularly at risk.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Fal immediately to mitigate the risk of exploitation.

Proactive Monitoring: Monitor system logs for unusual input patterns or unexpected prompt-related errors that may indicate an exploitation attempt.

Compensating Controls: Implement strict input validation and sanitize all user-provided data before it reaches the prompt processing engine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its high severity rating, the potential for exploitation is significant once technical details become public.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from security teams. Organizations should prioritize the deployment of vendor-supplied patches and ensure that all Fal-dependent services are running the most recent, secure versions to prevent unauthorized access.

---METADATA---
VENDOR: prompts
PRODUCT: prompts (npm package)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The "prompts" library, a popular Node.js package for interactive CLI prompts, contains a vulnerability that could lead to improper input handling.

Executive Summary:
A high-severity vulnerability in the "prompts" npm package could allow attackers to manipulate command-line interactions or compromise the integrity of CLI tools.

Vulnerability Details

CVE-ID: CVE-2026-22663

Affected Software: prompts prompts

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is located within the "prompts" library, used to create interactive command-line interfaces. An attacker could potentially provide malicious input that bypasses local sanitization, leading to code execution or information disclosure in the context of the CLI application.

Business Impact

CLI tools are often used by developers and administrators with elevated privileges. A vulnerability in a foundational library like "prompts" could lead to the compromise of developer workstations or CI/CD pipelines. The CVSS score of 7.5 indicates a high risk to the software supply chain.

Remediation Plan

Immediate Action: Update the "prompts" package in your package.json to the latest secured version and rebuild your applications.

Proactive Monitoring: Use software composition analysis (SCA) tools to identify all projects using vulnerable versions of the "prompts" library.

Compensating Controls: Implement strict input validation within your own code that uses the library to ensure that no malicious characters are passed to the prompts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. Supply chain vulnerabilities in popular npm packages are frequently exploited once a proof-of-concept is released.

Analyst Recommendation

The high CVSS score of 7.5 makes this a critical update for any Node.js development environment. Ensure that all internal and external CLI tools utilizing the "prompts" library are patched to the latest version immediately to maintain supply chain security.

---METADATA---
VENDOR: Arch
PRODUCT: prompts
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the "prompts" library, potentially impacting applications that utilize this component for user input handling.

Executive Summary:
The "prompts" library, used by various applications, contains a high-risk vulnerability that could lead to improper input handling or unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2026-22661

Affected Software: prompts (library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the "prompts" library, a component often used in command-line interfaces to gather user input. With a CVSS score of 8.1, the flaw likely allows an attacker to bypass input validation or inject malicious sequences that the library fails to neutralize.

Business Impact

If an application uses a vulnerable version of this library to handle sensitive input or system commands, an attacker could potentially escalate privileges or execute arbitrary code. The risk is significant for developers and organizations that incorporate this library into their internal or external tools.

Remediation Plan

Immediate Action: Developers should update the "prompts" dependency in their projects to the latest secure version and rebuild their applications.

Proactive Monitoring: Review application logs for unusual input strings or unexpected behavior during interactive command-line sessions.

Compensating Controls: Implement additional server-side or application-level validation on all data received through the prompts library to ensure it meets expected formats.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. Vulnerabilities in widely used libraries can have a significant "downstream" impact on many different products.

Analyst Recommendation

It is essential for development teams to inventory their use of the "prompts" library and apply updates immediately. Ensuring that all dependencies are current is a critical step in maintaining a secure software supply chain.

---METADATA---
VENDOR: FlaskBB
PRODUCT: FlaskBB
AFFECTED_VERSIONS: 0 through 2.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FlaskBB is susceptible to an authorization bypass via topic ID manipulation, allowing authenticated users to perform unauthorized actions.

Executive Summary:
An authorization bypass vulnerability in FlaskBB allows authenticated users to perform actions they are not permitted to access, threatening data integrity.

Vulnerability Details

CVE-ID: CVE-2026-22659

Affected Software: FlaskBB

Affected Versions: 0 through 2.2.0

Vulnerability: This vulnerability involves incorrect authorization (CWE-863) where the application fails to properly validate permissions when a user interacts with specific topic IDs. An authenticated attacker can manipulate these IDs to bypass access controls and perform unauthorized operations.

Business Impact

This flaw can lead to the unauthorized modification or deletion of forum content, potentially causing reputational damage and data loss. With a CVSS score of 8.1, the ability for a standard user to manipulate data at a high level represents a significant threat to the platform's integrity.

Remediation Plan

Immediate Action: Update to the latest version of FlaskBB or apply the specific security patch provided in the GitHub commit (a5da9a52).

Proactive Monitoring: Monitor forum activity logs for anomalous access patterns, specifically focusing on topic interactions that deviate from expected user behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect request parameters and block attempts to manipulate identifiers in API or web requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of the FlaskBB platform must apply the provided security fix to prevent unauthorized access. Regular auditing of user permissions and forum content integrity is recommended to ensure no unauthorized changes have occurred.

---METADATA---
VENDOR: Eaton
PRODUCT: Tripp Lite series PADM firmware
AFFECTED_VERSIONS: Eaton PADM: 0 through 20
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Eaton Tripp Lite series PADM firmware contains an OS command injection vulnerability in the session management interface, allowing authenticated users to escalate privileges.

Executive Summary:
An OS command injection vulnerability in Eaton Tripp Lite series PADM firmware allows authenticated attackers to escalate privileges and achieve full control over the device.

Vulnerability Details

CVE-ID: CVE-2026-22622

Affected Software: Eaton Tripp Lite series PADM

Affected Versions: Eaton PADM: 0 through 20

Vulnerability: The session management interface fails to properly neutralize special elements, resulting in OS command injection (CWE-78). An authenticated user can leverage this flaw to execute arbitrary commands at the system level.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its potential to grant an attacker full control over critical power management infrastructure. Compromise of this device could lead to unauthorized physical or virtual access to connected IT environments, resulting in operational downtime or systemic instability.

Remediation Plan

Immediate Action: Consult the official Eaton security advisory for available firmware updates and apply them as directed. If a patch is unavailable, restrict network access to the management interface to trusted administrative segments only.

Proactive Monitoring: Monitor device logs for anomalous command execution patterns or unexpected changes in user privilege levels.

Compensating Controls: Implement strict network segmentation and utilize a VPN or jump server to limit access to the PADM management interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection in firmware interfaces is a high-risk vector that often requires minimal effort to weaponize once discovered.

Analyst Recommendation

Given the potential for complete device takeover, organizations using Eaton Tripp Lite series PADM units should treat this vulnerability with high urgency. Users must verify their current firmware version and apply the vendor-recommended update as soon as it is published.

---METADATA---
VENDOR: Eaton
PRODUCT: PADM
AFFECTED_VERSIONS: 0 through 20
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Improper input validation in the session management interface of Eaton PADM firmware allows an authenticated administrator to execute arbitrary OS commands.

Executive Summary:
An OS command injection vulnerability in Eaton PADM firmware allows an authenticated administrator to execute arbitrary commands, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-22621

Affected Software: Eaton PADM

Affected Versions: 0 through 20

Vulnerability: This is an OS command injection vulnerability (CWE-78) triggered by improper input validation within the session management interface. The attack requires an authenticated administrator to exploit the flaw.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant threat to infrastructure security. An attacker who has already gained administrative access can escalate privileges to execute arbitrary OS commands, which could lead to full system compromise, persistent backdoor installation, and total loss of control over the affected hardware.

Remediation Plan

Immediate Action: Apply vendor-supplied firmware updates immediately, or refer to the official Eaton security bulletin for specific configuration changes if an update is not yet applied.

Proactive Monitoring: Monitor system logs for unauthorized shell execution attempts or unexpected process spawning originating from the administrative session management module.

Compensating Controls: Restrict management interface access to trusted administrative networks or VPNs to minimize the attack surface available to potential adversaries.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this requires authenticated access, the severity of OS command injection warrants immediate attention to prevent lateral movement or permanent system compromise.

Analyst Recommendation

The ability to execute arbitrary commands at the OS level is a critical security failure. Administrators must prioritize applying firmware patches provided by Eaton. If immediate patching is not possible, ensure the management interface is logically isolated from untrusted network segments to prevent exploitation.

---METADATA---
VENDOR: Eaton
PRODUCT: PADM
AFFECTED_VERSIONS: 0 through 20
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Improper input validation in the authentication component of Eaton Tripp Lite series PADM firmware allows unauthenticated remote attackers to bypass authentication and gain privileged access.

Executive Summary:
An unauthenticated authentication bypass vulnerability in Eaton PADM firmware enables attackers to gain administrative control over the device, presenting a severe security risk.

Vulnerability Details

CVE-ID: CVE-2026-22620

Affected Software: Eaton Tripp Lite series PADM

Affected Versions: Firmware versions 0 through 20.

Vulnerability: The vulnerability stems from improper input validation, identified as SQL injection (CWE-89), within the authentication component. This flaw allows an unauthenticated remote attacker to bypass security checks and achieve privileged user access.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a high risk to infrastructure security. Unauthorized administrative access allows an attacker to manipulate power distribution settings, potentially causing physical damage to connected hardware or resulting in significant service outages.

Remediation Plan

Immediate Action: Organizations must update the PADM firmware to a version beyond 20 as soon as the vendor makes such a release available, or contact Eaton support for specific guidance on upgrading from end of life hardware.

Proactive Monitoring: Review authentication logs for suspicious login patterns or repeated failed attempts from unauthorized IP addresses.

Compensating Controls: Place the management interface of the PADM device behind a secure VPN or restricted management network to prevent direct exposure to the public internet.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning and exploitation.

Analyst Recommendation

This vulnerability is critical due to the ease of exploitation and the level of access granted to an attacker. Administrators should immediately isolate affected devices from public networks and coordinate with Eaton to obtain necessary firmware updates or transition to supported hardware.

---METADATA---
VENDOR: Eaton
PRODUCT: Intelligent Power Protector (IPP)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Eaton Intelligent Power Protector (IPP) is vulnerable to insecure library loading, which could allow an attacker with local access to achieve arbitrary code execution.

Executive Summary:
An insecure library loading vulnerability in Eaton’s Intelligent Power Protector (IPP) could allow attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-22619

Affected Software: Eaton Intelligent Power Protector (IPP)

Affected Versions: See vendor advisory for affected versions

Vulnerability: The application executable is susceptible to insecure library loading, where the software may load malicious DLLs or shared libraries from an untrusted location. This allows an attacker with existing access to the software package to execute code in the context of the application.

Business Impact

With a CVSS score of 7.8, this vulnerability is significant, particularly in environments managing critical power infrastructure. Successful exploitation could lead to full control over the IPP software, potentially allowing an attacker to manipulate power management settings or disrupt critical hardware operations.

Remediation Plan

Immediate Action: Apply the vendor's security update as soon as it becomes available and ensure that the installation directory permissions are hardened.

Proactive Monitoring: Monitor the application environment for unexpected file creation or library loading events.

Compensating Controls: Restrict file system write access to the application’s installation directory to prevent unauthorized library placement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation. The risk is primarily to systems where local or adjacent network attackers could influence the environment.

Analyst Recommendation

Eaton customers should prioritize checking for vendor-provided updates. Given the potential for code execution on critical power management infrastructure, hardening the installation environment and applying patches is essential to prevent unauthorized system manipulation.

Executive Summary:
A critical vulnerability has been identified in OpenProject, a web-based project management software. This flaw allows an authenticated attacker to read sensitive files from the server, such as configuration files and private project data, by uploading a specially crafted image file and exporting a report to PDF. Successful exploitation could lead to a significant data breach and potential further compromise of the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-22600

Affected Software: OpenProject

Affected Versions: All versions prior to 16.6.4

Vulnerability: The vulnerability is a Local File Read (LFR) that exists within the work package PDF export feature. An attacker with permissions to upload attachments can create a malicious SVG file containing a payload that leverages the ImageMagick text: coder. By disguising this SVG file with a .png extension and uploading it as an attachment to a work package, the attacker can then trigger the vulnerability by exporting that work package to a PDF. During the export process, the backend server attempts to process the malicious file as an image, causing ImageMagick to interpret the payload and embed the contents of an arbitrary local file (e.g., /etc/passwd) directly into the generated PDF, which the attacker can then download and view.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.1, posing a significant risk to the organization. Exploitation allows an attacker to exfiltrate sensitive data from the server's file system, limited only by the permissions of the application's user account. This could include system user information, application source code, database credentials, API keys, and confidential project data. A successful attack can lead to a complete loss of confidentiality, severe reputational damage, regulatory penalties, and could serve as a foothold for further attacks on the internal network.

Remediation Plan

Immediate Action: Upgrade all instances of OpenProject to the patched version 16.6.4 or a later release. For systems that cannot be upgraded immediately, the vendor has provided a manual patch that should be applied as soon as possible. After patching, monitor application and system logs for any signs of attempted or successful exploitation.

Proactive Monitoring:

• Monitor application logs for errors or unusual behavior related to the PDF export functionality and ImageMagick processing.
• Review web server access logs for suspicious file uploads, particularly files with mismatched extensions and content types (e.g., a file with a .png extension identified as image/svg+xml).
• Implement file integrity monitoring on critical configuration files to detect unauthorized access by the OpenProject application process.

Compensating Controls:
If patching is not immediately possible, implement the following controls:

• Temporarily disable the work package PDF export functionality.
• Strictly limit user permissions for uploading attachments to only highly trusted administrative accounts.
• Implement a Web Application Firewall (WAF) with rules to inspect file uploads for malicious SVG content or mismatched MIME types.
• Harden the server's ImageMagick configuration (policy.xml) to disable the text: coder.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jan 10, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, the exploitation method leverages a well-understood weakness in ImageMagick, making it relatively trivial for a skilled attacker to create a functional exploit. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical severity (CVSS 9.1) and the high potential for sensitive data exfiltration, we strongly recommend that immediate action is taken. All vulnerable OpenProject instances must be patched to version 16.6.4 or newer without delay. If patching must be deferred, the compensating controls, particularly disabling the PDF export feature and restricting attachment permissions, should be implemented immediately to mitigate the risk.

Executive Summary:
A high-severity vulnerability has been discovered in the Spree e-commerce platform, which could allow an unauthenticated remote attacker to access sensitive customer and order information. Successful exploitation could lead to a significant data breach, exposing customer names, addresses, and purchase histories. Immediate application of vendor-supplied patches is required to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2026-22589

Affected Software: Spree Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Insecure Direct Object Reference (IDOR) within an API endpoint responsible for retrieving order information. The system fails to properly verify that the user requesting the order details is authorized to view them. An unauthenticated remote attacker can exploit this by sending a crafted API request with a guessed or enumerated order identifier, allowing them to access the full details of arbitrary orders belonging to other customers.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to a significant data breach of sensitive customer information, including personally identifiable information (PII) and order histories. The direct business impact includes potential reputational damage, loss of customer trust, and regulatory penalties under data protection laws such as GDPR or CCPA. Unauthorized access to this data could also facilitate targeted phishing campaigns or other fraudulent activities against the organization's customers.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. The vendor has released patches that correct the authorization logic and prevent unauthorized access to order data. After patching, it is critical to monitor for any signs of exploitation attempts and thoroughly review system and web application access logs for suspicious activity that may have occurred prior to the update.

Proactive Monitoring: Security teams should monitor web server and application logs for unusual patterns of requests to order-related API endpoints. Specifically, look for a high volume of sequential or non-sequential requests from a single IP address attempting to access different order IDs. Implement alerts for anomalous access patterns targeting these endpoints.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) rule to block or rate-limit requests to the vulnerable API endpoint from a single source. Restricting access to the endpoint based on user session authentication at the network edge can also serve as a temporary mitigating control until the patch is deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 11, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, IDOR vulnerabilities are generally straightforward to exploit. It is anticipated that threat actors will develop exploitation methods quickly, and organizations should operate under the assumption that an attack is imminent.

Analyst Recommendation
Due to the High severity (CVSS 7.5) of this vulnerability and the critical nature of the data at risk, we strongly recommend that all organizations using affected Spree products prioritize the immediate deployment of the vendor-supplied security patches. While this vulnerability is not currently on the CISA KEV list, its potential for a direct data breach makes it a critical priority. Organizations should treat this as an urgent threat and act swiftly to prevent the exposure of sensitive customer information.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi Play
AFFECTED_VERSIONS: UniFi Play PowerAmp (1.0.35 and earlier), UniFi Play Audio Port (1.0.24 and earlier)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper access control flaw in UniFi Play devices allows unauthorized users with network access to enable SSH and perform arbitrary system changes.

Executive Summary:
Critical access control vulnerabilities in UniFi Play PowerAmp and Audio Port allow unauthorized network actors to enable SSH, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-22564

Affected Software: Ubiquiti UniFi Play

Affected Versions: PowerAmp 1.0.35 and earlier; Audio Port 1.0.24 and earlier.

Vulnerability: The vulnerability stems from improper access control mechanisms, which can be exploited by an actor with network access to the UniFi Play environment to toggle SSH capabilities. Once SSH is enabled, the attacker can gain unauthorized administrative control over the affected hardware.

Business Impact

The CVSS score of 9.8 reflects the high probability of total device compromise. Unauthorized SSH access permits an attacker to alter system configurations, intercept traffic, or pivot into other segments of the internal network, causing significant operational disruption.

Remediation Plan

Immediate Action: Update UniFi Play PowerAmp to version 1.0.38 or later and UniFi Play Audio Port to version 1.1.9 or later.

Proactive Monitoring: Monitor network traffic for unauthorized SSH connections originating from unknown internal hosts or suspicious administrative commands.

Compensating Controls: Restrict network access to the UniFi Play management interfaces using VLAN segmentation or hardware-based firewalls to prevent unauthorized access.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of potential device takeover, organizations should expedite the firmware updates for all deployed UniFi Play units. Ensure that management interfaces are isolated from general user traffic to reduce the attack surface.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi Play
AFFECTED_VERSIONS: UniFi Play PowerAmp (1.0.35 and earlier), UniFi Play Audio Port (1.0.24 and earlier)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple improper input validation vulnerabilities in UniFi Play devices allow attackers with network access to execute arbitrary commands via command injection.

Executive Summary:
Critical command injection vulnerabilities in UniFi Play devices allow unauthorized network actors to execute arbitrary code, resulting in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-22563

Affected Software: Ubiquiti UniFi Play

Affected Versions: PowerAmp 1.0.35 and earlier; Audio Port 1.0.24 and earlier.

Vulnerability: Improper input validation allows a malicious actor with network access to the UniFi Play environment to inject and execute arbitrary system commands. This flaw permits the execution of unauthorized operations at the system level.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation allows for complete takeover of the affected device, potentially leading to data destruction, service outages, or the use of the device as a launchpad for further network attacks.

Remediation Plan

Immediate Action: Update UniFi Play PowerAmp to version 1.0.38 or later and UniFi Play Audio Port to version 1.1.9 or later.

Proactive Monitoring: Inspect system logs for unexpected process execution or signs of command injection attempts, such as shell metacharacters in input fields.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure only authorized personnel can communicate with the management ports of the UniFi Play devices.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a significant risk to network integrity. It is imperative that administrators apply the provided firmware updates immediately and restrict access to the affected management network to prevent unauthorized command execution.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi Play
AFFECTED_VERSIONS: UniFi Play PowerAmp (1.0.35 and earlier), UniFi Play Audio Port (1.0.24 and earlier)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in UniFi Play firmware allows remote code execution (RCE) by enabling attackers to write arbitrary files to the system.

Executive Summary:
Critical path traversal vulnerabilities in Ubiquiti UniFi Play firmware could allow unauthenticated remote attackers to achieve full system compromise via remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-22562

Affected Software: Ubiquiti UniFi Play

Affected Versions: UniFi Play PowerAmp (1.0.35 and earlier), UniFi Play Audio Port (1.0.24 and earlier)

Vulnerability: The flaw is a path traversal vulnerability residing in the device firmware, which allows attackers to write files to the underlying system. This capability facilitates remote code execution (RCE) by an attacker with access to the UniFi Play network.

Business Impact

Successful exploitation poses a severe threat to organizational infrastructure, as it grants attackers the ability to execute arbitrary commands on affected devices. With a CVSS score of 9.8, this vulnerability represents a Critical risk that could lead to full system takeover, unauthorized access to network segments, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Update UniFi Play PowerAmp firmware to version 1.0.38 or later, and UniFi Play Audio Port firmware to version 1.1.9 or later.

Proactive Monitoring: Review device access logs for unauthorized file write attempts or suspicious network traffic originating from the management interface.

Compensating Controls: Restrict network access to management interfaces and ensure that UniFi Play devices are isolated on a dedicated management VLAN to prevent unauthorized access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE vulnerability and the potential for complete device compromise, administrators must prioritize the immediate application of the provided firmware updates. Ensure all affected hardware is patched according to the vendor's guidance to eliminate the attack vector.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi Network Application
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in UniFi Network Application allows network-based attackers to access and manipulate sensitive system files. This can lead to unauthorized account access.

Executive Summary:
A critical path traversal vulnerability in the UniFi Network Application allows attackers with network access to compromise underlying system files and gain unauthorized account control.

Vulnerability Details

CVE-ID: CVE-2026-22557

Affected Software: Ubiquiti UniFi Network Application

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Path Traversal flaw that permits a malicious actor with network access to bypass directory restrictions. By crafting specific requests, an attacker can read or manipulate files on the host operating system, potentially leading to the compromise of administrative credentials or session tokens.

Business Impact

The impact of this vulnerability is severe, as reflected by its CVSS score of 10.0. An attacker could gain full administrative control over the UniFi Network Application, leading to unauthorized network configuration changes, data exfiltration, or the disruption of entire corporate network infrastructures. This represents a total loss of confidentiality, integrity, and availability for the affected management platform.

Remediation Plan

Immediate Action: Update the UniFi Network Application to the latest patched version provided by Ubiquiti immediately.

Proactive Monitoring: Review system and application logs for suspicious file access patterns or directory traversal sequences (e.g., "../") in HTTP requests.

Compensating Controls: Restrict access to the UniFi Network Application management interface to trusted internal IP addresses or a dedicated management VPN.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, because path traversal vulnerabilities are easily automated by scanners, the risk of rapid exploitation is extremely high.

Analyst Recommendation

Given the CVSS score of 10.0, this vulnerability should be treated as a top priority for security teams. Immediate application of the vendor-supplied update is the only effective way to mitigate the risk of full system compromise. Ensure that management interfaces are never exposed directly to the public internet.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Gitea Git server may allow for unauthorized access or system impact.

Executive Summary:
The Gitea Open Source Git Server is affected by a high-severity vulnerability that could allow unauthorized actors to compromise the integrity of the source code repository.

Vulnerability Details

CVE-ID: CVE-2026-22555

Affected Software: Gitea Open Source Git Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts Gitea, a self-hosted Git service, potentially allowing for unauthorized actions or administrative bypass. The flaw resides within the application logic, which could be exploited by an attacker to gain unauthorized access to repository data or system configurations.

Business Impact

A CVSS score of 8.1 indicates a high risk to the confidentiality and integrity of source code repositories. Successful exploitation could lead to the theft of intellectual property, unauthorized code modification, or full administrative control over the Git server, resulting in significant business disruption and long-term security implications.

Remediation Plan

Immediate Action: Update the Gitea instance to the latest patched version provided by the vendor immediately.

Proactive Monitoring: Review audit logs for suspicious repository activity, unauthorized configuration changes, or anomalous login patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious patterns targeting repository management software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because the Git server is a central component of the software development lifecycle, this vulnerability must be addressed as a top priority. Administrators should apply the necessary software updates immediately and conduct a thorough audit of repository access logs to ensure that no unauthorized activity occurred prior to patching.

---METADATA---
VENDOR: MediaArea
PRODUCT: MediaInfoLib
AFFECTED_VERSIONS: MediaArea MediaInfoLib: 26.01
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
MediaArea MediaInfoLib contains a heap-based buffer overflow vulnerability in its channel splitting functionality, potentially leading to code execution.

Executive Summary:
A heap-based buffer overflow in MediaArea MediaInfoLib could allow an attacker to execute arbitrary code by supplying a maliciously crafted media file.

Vulnerability Details

CVE-ID: CVE-2026-22554

Affected Software: MediaArea MediaInfoLib

Affected Versions: MediaArea MediaInfoLib: 26.01

Vulnerability: The vulnerability is a heap-based buffer overflow (CWE-122) triggered during channel splitting operations. Exploitation typically requires a user to open a specially crafted media file with an application linked against the vulnerable library.

Business Impact

This vulnerability carries a CVSS score of 7.8, reflecting its potential to cause total compromise of the user's system. Because MediaInfoLib is often used by various media players and processing tools, a successful exploit could result in significant data loss or unauthorized access to sensitive information on local machines.

Remediation Plan

Immediate Action: Monitor the MediaArea security advisories for the release of a patched version; if no patch is available, restrict the use of MediaInfoLib to trusted sources only.

Proactive Monitoring: Utilize endpoint security tools to detect anomalous memory usage or crashes in applications that utilize MediaInfoLib.

Compensating Controls: Ensure that all media files are scanned by robust antivirus/anti-malware solutions before processing, as these may detect known malicious file signatures.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Heap-based buffer overflows are complex to weaponize but are frequently targeted by threat actors to achieve reliable code execution.

Analyst Recommendation

Users and downstream developers should identify if their software utilizes the affected version of MediaInfoLib. Given the potential for code execution, it is imperative to update the library as soon as a fix is released by the vendor.

---METADATA---
VENDOR: InSAT
PRODUCT: MasterSCADA BUK-TS
AFFECTED_VERSIONS: All versions
---END_METADATA---

Description Summary:
All versions of InSAT MasterSCADA BUK-TS are vulnerable to OS command injection via the MMadmServ web interface, leading to remote code execution (RCE).

Executive Summary:
A critical OS command injection vulnerability in MasterSCADA BUK-TS allows remote attackers to execute arbitrary system commands and take full control of the SCADA server.

Vulnerability Details

CVE-ID: CVE-2026-22553

Affected Software: InSAT MasterSCADA BUK-TS

Affected Versions: All versions

Vulnerability: The vulnerability is located in a specific field within the MMadmServ web interface. The application fails to sanitize input before passing it to the operating system shell, allowing a malicious user to inject and execute arbitrary commands with the privileges of the web service.

Business Impact

As this affects all versions of the software, the risk to industrial operations is substantial. An attacker could use this RCE to disrupt manufacturing processes, manipulate sensor data, or disable safety protocols. The CVSS score of 9.8 underscores the critical nature of this vulnerability in an ICS environment.

Remediation Plan

Immediate Action: Contact InSAT for the latest security patch or mitigation guidance, as all current versions are reported as susceptible. If no patch is available, disable the MMadmServ interface.

Proactive Monitoring: Use host-based intrusion detection systems (HIDS) to monitor for unexpected shell activity or child processes spawned by the MasterSCADA web service.

Compensating Controls: Isolate the SCADA network from the corporate network and the internet. Use a jump host with multi-factor authentication for any necessary administrative access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 24, 2026, this is a highly critical "zero-day" style risk for all users of the product. The lack of version-specific fixes at the time of reporting necessitates immediate network-level isolation.

Analyst Recommendation

The presence of command injection in a SCADA management interface is an emergency-level security event. Organizations must isolate these systems immediately and apply vendor updates as soon as they are released to prevent potentially catastrophic operational failures.

---METADATA---
VENDOR: OCPP (Open Charge Point Protocol)
PRODUCT: WebSocket Endpoints
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
OCPP WebSocket endpoints lack authentication, allowing unauthenticated attackers to impersonate charging stations. This enables unauthorized control of charging infrastructure and data corruption.

Executive Summary:
A critical lack of authentication in OCPP WebSocket endpoints allows unauthenticated attackers to impersonate charging stations and manipulate the entire charging network.

Vulnerability Details

CVE-ID: CVE-2026-22552

Affected Software: OCPP WebSocket Implementation

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a complete lack of authentication mechanisms on WebSocket endpoints used for the Open Charge Point Protocol (OCPP). An unauthenticated attacker can connect to the backend using a discovered charging station identifier, allowing them to send and receive commands as if they were a legitimate hardware unit.

Business Impact

The impact is severe for electric vehicle (EV) charging infrastructure providers. Attackers can escalate privileges, manipulate charging session data, and disrupt the operation of the charging network. This could lead to financial loss, fraudulent charging, and significant reputational damage. The CVSS score of 9.4 reflects the high impact on infrastructure availability and data integrity.

Remediation Plan

Immediate Action: Deploy updates that implement mandatory authentication (such as TLS client certificates or robust API keys) for all OCPP WebSocket connections.

Proactive Monitoring: Monitor backend logs for multiple simultaneous connections using the same station ID or connections originating from unexpected IP ranges.

Compensating Controls: Restrict access to the OCPP backend via IP allowlisting and utilize a Web Application Firewall (WAF) capable of inspecting WebSocket traffic for anomalies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 6, 2026, there is no public information indicating active exploitation. However, the requirement for only a "known or discovered identifier" makes the barrier to entry for an attacker extremely low.

Analyst Recommendation

Securing critical infrastructure requires robust authentication by default. Organizations managing EV charging networks must immediately verify their OCPP implementation security. Transitioning to authenticated WebSockets is the only viable path to prevent station impersonation and ensure the reliability of the charging grid.

---METADATA---
VENDOR: Elecom
PRODUCT: WRC-X1500GS-B and WRC-X1500GSA-B Routers
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in Elecom WRC-X1500GS-B and WRC-X1500GSA-B routers, allowing for arbitrary command execution.

Executive Summary:
A critical OS command injection vulnerability in Elecom WRC-X1500 series routers allows attackers to execute arbitrary system commands and gain full control over the device.

Vulnerability Details

CVE-ID: CVE-2026-22550

Affected Software: Elecom WRC-X1500GS-B / WRC-X1500GSA-B

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an OS command injection flaw. It occurs when the router's software fails to properly sanitize user input before passing it to a system shell. An attacker can exploit this to run malicious commands with the privileges of the web server or system user.

Business Impact

The impact is severe, as command injection leads to total device takeover. Attackers can install persistent backdoors, sniff network traffic, or pivot to other devices on the local network. The CVSS score of 7.2 reflects the high risk to confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Flash the router with the latest security firmware update from Elecom to eliminate the command injection vector.

Proactive Monitoring: Monitor for unusual outbound traffic or unauthorized changes to the router’s filesystem and configuration files.

Compensating Controls: Restrict access to the router’s management interface to trusted internal IP addresses only and disable any unnecessary services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Command injection flaws in routers are highly sought after by threat actors for botnet recruitment.

Analyst Recommendation

This vulnerability poses a direct threat to the security of the internal network. Immediate firmware updates are the only effective remediation. If an update is not available, the device should be replaced with a secure alternative.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions before 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 contain an improper input validation vulnerability in repository creation fields, potentially allowing unauthorized data manipulation.

Executive Summary:
A critical input validation vulnerability in Gitea versions before 1.25.5 allows unauthenticated attackers to manipulate repository creation parameters, posing a risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-22547

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions before 1.25.5

Vulnerability: The software fails to enforce sufficient validation constraints (CWE-20) on repository creation fields, specifically regarding length-limited template fields, trust models, and object format values. This flaw allows an attacker to submit malformed input that the application processes incorrectly, leading to potential unauthorized access or configuration tampering.

Business Impact

With a CVSS score of 9.1, this vulnerability is classified as Critical. Successful exploitation could lead to unauthorized access to sensitive code repositories, potential data exposure, or the injection of malicious configurations into the development pipeline. Given the role of Gitea as a central Git server, the integrity of the entire software development lifecycle is at risk.

Remediation Plan

Immediate Action: Upgrade your Gitea instance to version 1.25.5 or later immediately to apply the necessary input validation constraints.

Proactive Monitoring: Review application access logs for unusual repository creation requests or attempts to inject large or malformed data into configuration fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to filter out anomalous payloads targeting repository creation endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates an immediate update to version 1.25.5. Organizations should ensure their Gitea instances are patched promptly to prevent unauthorized manipulation of repository settings and to maintain the security posture of their development environment.

Executive Summary:
A high-severity vulnerability has been identified in the G5Theme Handmade Framework, which is used across multiple G5Theme products. This flaw allows an unauthenticated attacker to read sensitive files from the underlying server by manipulating file inclusion functions. Successful exploitation could lead to the exposure of confidential data, system credentials, and potentially a full compromise of the affected web server.

Vulnerability Details

CVE-ID: CVE-2026-22521

Affected Software: G5Theme Handmade Framework and associated products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw resulting from an improper control of filenames used in PHP's include or require statements. An attacker can exploit this by supplying a specially crafted input, typically through a URL parameter, that contains directory traversal sequences (e.g., ../../). The application fails to properly sanitize this input, causing it to include a file from an unintended location on the server's file system. This allows the attacker to read the contents of sensitive files such as configuration files containing database credentials (wp-config.php), system user files (/etc/passwd), or application source code. If the attacker can also upload a file to the server, this LFI vulnerability could be escalated to achieve Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation can have significant business consequences, including a direct breach of sensitive data. The exposure of configuration files could lead to the compromise of databases and other connected systems. A successful RCE attack would grant the adversary full control over the web server, enabling them to deface the website, install malware, steal customer data, or use the server to launch further attacks. Such an incident could result in severe reputational damage, regulatory fines, and financial loss.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor (G5Theme) immediately. This will patch the underlying code flaw and prevent exploitation. After patching, it is crucial to monitor web server access logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should actively monitor web server logs for requests containing directory traversal payloads (e.g., ../, ..%2f, %2e%2e%2f) in URL parameters. Implement alerts for unusual file access patterns or outbound connections from the web server. File Integrity Monitoring (FIM) can also help detect unauthorized changes to critical system or application files.

Compensating Controls: If immediate patching is not feasible, the following controls can help mitigate risk:

• Web Application Firewall (WAF): Deploy a WAF with rulesets designed to detect and block LFI and directory traversal attack patterns.
• Harden PHP Configuration: Ensure the open_basedir directive is configured in php.ini to restrict PHP processes to only access files within specific, authorized directories.
• Least Privilege: Run the web server and PHP processes under a low-privilege user account with minimal read permissions on the file system.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date (January 9, 2026), there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, LFI is a well-understood vulnerability class, and proof-of-concept exploits can be developed with relative ease. Organizations should assume that threat actors will begin actively scanning for and exploiting this vulnerability shortly.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the critical impact of a successful exploit, which includes sensitive data disclosure and potential server compromise, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. Although CVE-2026-22521 is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, its straightforward exploit path makes it an attractive target for attackers. All systems running the G5Theme Handmade Framework should be identified and updated without delay to mitigate this significant risk.