---METADATA---
VENDOR: BookingPress
PRODUCT: BookingPress Appointment Booking Pro
AFFECTED_VERSIONS: 0 up to (excluding) 5.7.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The BookingPress Appointment Booking Pro WordPress plugin is vulnerable to improper authentication, allowing unauthenticated attackers to potentially bypass security controls.

Executive Summary:
An authentication bypass vulnerability in BookingPress Appointment Booking Pro exposes WordPress sites to unauthorized access and potential data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-9830

Affected Software: BookingPress BookingPress Appointment Booking Pro

Affected Versions: 0 up to (excluding) 5.7.3

Vulnerability: This vulnerability involves improper authentication (CWE-287), which allows an unauthenticated attacker to interact with the plugin's functionality without valid credentials. The CVSS vector confirms that no user interaction or high privileges are required to exploit this flaw.

Business Impact

The ability for an unauthenticated attacker to bypass authentication mechanisms could lead to unauthorized access to booking data, sensitive customer information, and potential modification of appointment records. With a CVSS score of 8.2, this vulnerability represents a high risk to both system integrity and customer privacy.

Remediation Plan

Immediate Action: Update the BookingPress Appointment Booking Pro plugin to version 5.7.3 or later immediately.

Proactive Monitoring: Review audit logs for unexpected account access or unauthorized modifications to appointment data.

Compensating Controls: Implement strict access control lists at the network level and utilize a WAF to filter malicious traffic attempting to interact with plugin-specific endpoints.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists in a GitHub repository (ChPratik/CVE-2026-9830).

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public proof-of-concept significantly lowers the barrier for potential attackers.

Analyst Recommendation

Due to the existence of a public proof-of-concept and the high severity of this authentication flaw, administrators must ensure the plugin is updated to version 5.7.3 or later without delay. Failure to patch may result in unauthorized access to sensitive appointment management systems.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mattermost contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in Mattermost allows authenticated attackers to perform unauthorized actions, potentially leading to full system impact.

Vulnerability Details

CVE-ID: CVE-2026-9816

Affected Software: Mattermost

Affected Versions: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) that occurs when a low-privileged authenticated user can bypass intended access controls. The flaw permits unauthorized operations that should be restricted to administrative or higher-level roles.

Business Impact

Successful exploitation allows an authenticated user to perform actions outside their assigned permissions, which could lead to the compromise of confidential communications or unauthorized modification of system data. With a CVSS score of 8.3, the risk of privilege escalation and data integrity loss is substantial for enterprise collaboration environments.

Remediation Plan

Immediate Action: Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, or 11.8.4 or higher to resolve the authorization logic errors.

Proactive Monitoring: Monitor audit logs for suspicious administrative actions performed by standard user accounts or unexpected changes to channel and team permissions.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users with high-level privileges until the environment is patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive due to the potential for unauthorized administrative actions.

Analyst Recommendation

Organizations utilizing Mattermost must prioritize these updates to maintain the integrity of their collaboration platforms. Applying the vendor-provided patches is the only reliable method to remediate this authorization bypass.

---METADATA---
VENDOR: Unknown
PRODUCT: AI Copilot (WordPress Plugin)
AFFECTED_VERSIONS: 0 up to (excluding) 1.5.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The AI Copilot WordPress plugin fails to bind OAuth tokens to specific users, allowing unauthenticated attackers to impersonate administrators and execute privileged tools.

Executive Summary:
An authentication and privilege management flaw in the AI Copilot WordPress plugin allows unauthenticated attackers to gain administrative access and execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-9810

Affected Software: AI Copilot WordPress Plugin

Affected Versions: 0 up to 1.5.4

Vulnerability: This vulnerability involves improper privilege management (CWE-269) where the plugin accepts any valid OAuth token as an administrative session. An unauthenticated attacker can complete the public OAuth flow to escalate privileges to the administrator level.

Business Impact

Successful exploitation allows an attacker to create new administrative users, escalate privileges, and execute arbitrary MCP tools. This could result in complete site takeover, data theft, and the installation of malicious payloads, presenting an extreme risk to the WordPress environment.

Remediation Plan

Immediate Action: Update the AI Copilot plugin to version 1.5.4 or higher immediately.

Proactive Monitoring: Audit WordPress user accounts for unauthorized additions or changes to roles and review logs for suspicious administrative actions.

Compensating Controls: Disable the AI Copilot plugin entirely until the update can be applied to prevent potential exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require prior authentication.

Analyst Recommendation

Plugin vulnerabilities of this nature are frequent targets for automated exploitation. Administrators must update the AI Copilot plugin to version 1.5.4 immediately to remediate the risk of account takeovers and privilege escalation.

---METADATA---
VENDOR: Red Hat
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Red Hat Keycloak Policy Enforcer allows for improper access control, potentially bypassing security constraints during authentication processes.

Executive Summary:
A high-severity flaw in the Red Hat Keycloak Policy Enforcer could allow attackers to bypass critical access control mechanisms, leading to unauthorized resource access.

Vulnerability Details

CVE-ID: CVE-2026-9800

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Policy Enforcer component, which fails to correctly validate user permissions. The issue typically requires the attacker to be authenticated, potentially allowing them to escalate privileges or access resources outside their authorized scope.

Business Impact

Successful exploitation allows for unauthorized access to sensitive identity and access management (IAM) functions, which may lead to total system compromise and data breach. The CVSS score of 8.1 underscores the critical nature of this vulnerability, as it directly undermines the centralized security posture of the affected organization.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the latest version provided by the vendor to remediate the policy enforcement logic.

Proactive Monitoring: Audit Keycloak logs for unusual policy evaluation results or unauthorized attempts to access restricted administrative functions.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and utilize Web Application Firewalls to inspect traffic for patterns indicative of policy bypass attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on Keycloak for authentication and authorization must treat this update with extreme urgency. Failure to patch the Policy Enforcer could result in a catastrophic failure of identity security across the enterprise.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the NVBULogDaemon component of Quest NetVault Backup enables remote attackers to execute arbitrary system commands.

Executive Summary:
A remote command injection vulnerability in the Quest NetVault Backup NVBULogDaemon component enables attackers to execute unauthorized commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-9787

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists within the NVBULogDaemon, which fails to properly validate input before passing it to the system shell. This allows an unauthenticated attacker to inject and execute arbitrary commands, leading to full system compromise.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the host server. A compromise of the backup server could lead to the exposure of sensitive backup data, manipulation of recovery points, or the deployment of secondary payloads within the internal network.

Remediation Plan

Immediate Action: Identify and patch all instances of NetVault Backup according to the manufacturer’s forthcoming security guidance.

Proactive Monitoring: Inspect system process logs for irregular command executions or the spawning of unexpected shells from the NVBULogDaemon process.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to block unauthorized child processes launched by backup services and limit service account privileges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to perform remote command injection makes this a high-priority risk for all environments utilizing Quest NetVault Backup. IT teams should ensure that all backup infrastructure is isolated from public-facing networks and apply vendor patches immediately upon release to remediate the underlying command injection vector.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote attackers to potentially execute arbitrary code.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup could allow an unauthenticated attacker to achieve remote code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-9786

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the NVBUDashboard component, where improper sanitization of database inputs permits SQL injection. Successful exploitation allows an attacker to bypass security constraints and execute arbitrary code with the privileges of the service.

Business Impact

The high CVSS score of 8.8 reflects the potential for full system compromise, including unauthorized data access, modification, or complete service disruption. As backup infrastructure is a primary target for ransomware actors, this vulnerability presents a significant risk to data integrity and organizational business continuity.

Remediation Plan

Immediate Action: Review the official Quest security advisory and apply the necessary patches or configuration changes to the NVBUDashboard component immediately.

Proactive Monitoring: Monitor database access logs for anomalous query structures and unexpected administrative activity originating from the dashboard interface.

Compensating Controls: Restrict network access to the NetVault Backup dashboard to trusted management subnets and deploy a Web Application Firewall (WAF) to filter malicious SQL syntax.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this remote code execution vulnerability, administrators must prioritize the assessment of their NetVault Backup deployments. Until a patch can be verified and applied, strict network segmentation is required to prevent unauthorized access to the vulnerable dashboard interface.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is susceptible to a SQL injection vulnerability within the NVBULibrarySlot component, which could allow an attacker to perform remote code execution.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBULibrarySlot component enables remote code execution, posing a severe threat to the security and integrity of the system.

Vulnerability Details

CVE-ID: CVE-2026-9785

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to sanitize input within the NVBULibrarySlot function, enabling an unauthenticated attacker to inject malicious SQL queries that facilitate remote code execution on the server.

Business Impact

The exploitation of this vulnerability could result in total system compromise, allowing an attacker to manipulate backup sets or gain persistent access to the network. The CVSS score of 8.8 reflects the high risk, necessitating immediate attention to prevent unauthorized access to sensitive data and critical infrastructure components.

Remediation Plan

Immediate Action: Ensure all Quest NetVault Backup installations are updated to the latest secure version provided by the vendor.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for unauthorized shell commands or suspicious processes spawned by the NetVault server service.

Compensating Controls: Implement strict network segmentation to minimize the attack surface of the backup server, ensuring it is not accessible from untrusted or public networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability allows for remote code execution, it represents a critical security risk that must be addressed promptly. Organizations should verify their current version status and prepare to deploy the necessary patches immediately to safeguard their backup environment from potential exploitation.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup contains a SQL injection vulnerability in the NVBULibraryPort component, which may enable remote code execution by an attacker.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBULibraryPort component permits remote code execution, creating a significant risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-9784

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the NVBULibraryPort component, where improper input validation allows an unauthenticated attacker to inject malicious SQL commands, potentially resulting in remote code execution.

Business Impact

Successful exploitation allows an adversary to bypass security controls, leading to potential data exfiltration or complete system takeover. The CVSS score of 8.8 underscores the high severity, indicating that this vulnerability could lead to widespread disruption of backup operations and compromise of the enterprise backup environment.

Remediation Plan

Immediate Action: Monitor vendor communication channels and apply the official security patch as soon as it becomes available for your specific environment.

Proactive Monitoring: Inspect database logs for anomalous input strings or unauthorized access attempts directed at the library port configuration interfaces.

Compensating Controls: Restrict network access to the NetVault management console using strict firewall rules to ensure only trusted administrative segments can reach the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency, as backup infrastructure is a high-value target for attackers. Immediate application of vendor-provided patches is essential to prevent potential exploitation and secure the backup environment against unauthorized command execution.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is vulnerable to a SQL injection flaw within the NVBURemovableMedia component, potentially allowing for remote code execution.

Executive Summary:
A critical SQL injection vulnerability in the Quest NetVault Backup NVBURemovableMedia component poses a severe risk of remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-9783

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly sanitize user-supplied input within the NVBURemovableMedia function, leading to a SQL injection vulnerability that can be leveraged by an unauthenticated attacker to achieve remote code execution.

Business Impact

The ability to execute arbitrary code on a backup server carries catastrophic business risk, including the potential for unauthorized access to sensitive backup data, credentials, and the underlying infrastructure. With a CVSS score of 8.8, this high-severity flaw threatens the confidentiality, integrity, and availability of critical enterprise data assets.

Remediation Plan

Immediate Action: Identify and patch all instances of Quest NetVault Backup according to the vendor's forthcoming security guidance.

Proactive Monitoring: Review system and application logs for unusual database queries or unexpected process execution patterns originating from the NetVault service account.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter and block suspicious SQL injection patterns targeting the NetVault management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant threat to organizational security. Administrators should prioritize the identification of affected NetVault instances and apply the necessary patches immediately upon release to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDeviceDrive component of Quest NetVault Backup facilitates remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBUDeviceDrive component poses a severe risk of remote code execution and unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-9782

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the NVBUDeviceDrive component and stems from insufficient SQL input validation, which can be exploited to achieve remote code execution. Attackers may target this vulnerability to execute arbitrary commands by injecting malicious SQL queries into the device drive management functions.

Business Impact

Exploitation of this vulnerability could lead to the total compromise of backup integrity, potentially allowing attackers to disable security controls or exfiltrate backed-up data. The CVSS score of 8.8 underscores the high risk to organizational operations, as a compromised backup server can serve as a pivot point for broader network attacks.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches for NetVault Backup as soon as they become available to address the underlying SQL injection flaw.

Proactive Monitoring: Perform regular audits of system logs and monitor for irregular database activity or unauthorized attempts to access device drive configuration settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing common SQL injection payloads and ensure management interfaces are protected by multi-factor authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant threat to organizational security. Security teams must prioritize patching and verify that all NetVault Backup instances are running the latest software versions provided by the vendor to mitigate this high-severity risk effectively.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBURASDevice component of Quest NetVault Backup enables remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBURASDevice component poses a severe risk of remote code execution and potential unauthorized system takeover.

Vulnerability Details

CVE-ID: CVE-2026-9781

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the NVBURASDevice component, involving improper SQL input sanitization that permits an attacker to inject and execute arbitrary code. The vulnerability likely requires interaction with the device management interface, which may require authenticated access depending on the network configuration.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the backup infrastructure, threatening the confidentiality and availability of sensitive corporate data. With a CVSS score of 8.8, the vulnerability is classified as high severity, reflecting the significant impact on enterprise security posture should the backup environment be compromised.

Remediation Plan

Immediate Action: Consult the official Quest security advisory to obtain and apply the required patches for the NetVault Backup suite.

Proactive Monitoring: Monitor for suspicious activity, specifically focusing on database-related errors or unexpected modifications to the NVBURASDevice configurations.

Compensating Controls: Implement strict network segmentation to ensure that the management interfaces of NetVault Backup are not exposed to untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from IT security teams. Organizations should treat this as a high-priority update to ensure the integrity of their backup operations and prevent exploitation by malicious actors who could leverage this flaw to gain deeper access into the environment.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup contains a cross-site scripting (XSS) vulnerability in the addclient3 function that permits authentication bypass.

Executive Summary:
A critical authentication bypass flaw in Quest NetVault Backup via the addclient3 function exposes administrative interfaces to unauthorized script execution.

Vulnerability Details

CVE-ID: CVE-2026-9780

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an XSS flaw within the addclient3 function, which fails to adequately sanitize user input, leading to an authentication bypass. This allows an attacker to manipulate client registration processes and gain unauthorized access to the backup management console.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a substantial threat to internal security controls. Exploitation could allow an attacker to gain administrative control over the backup environment, potentially leading to unauthorized modification of configurations or complete loss of data availability.

Remediation Plan

Immediate Action: Update the Quest NetVault Backup environment to the latest version released by the vendor to resolve the addclient3 vulnerability.

Proactive Monitoring: Monitor network traffic and application logs for unusual activity associated with client management functions.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block malicious requests containing script-based payloads directed at the addclient3 endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue necessitates urgent attention from IT security teams. Applying the vendor's patch is the only definitive way to remediate this authentication bypass; regular verification of patch compliance across all backup nodes is highly recommended.

---METADATA---
VENDOR: Unraid
PRODUCT: Unraid Web Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Unraid Web Server is vulnerable to remote code execution via command injection in the ToggleState function.

Executive Summary:
A critical command injection vulnerability in the Unraid Web Server allows unauthenticated remote attackers to execute arbitrary code on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-9773

Affected Software: Unraid Web Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists due to improper sanitization of user-supplied input within the ToggleState command function, enabling command injection. An unauthenticated attacker can leverage this flaw to execute system-level commands remotely.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code poses a severe risk to data integrity, confidentiality, and system availability. With a CVSS score of 8.8, this vulnerability could lead to a complete system compromise, unauthorized access to stored data, and potential lateral movement within the network, resulting in significant operational disruption and reputational damage.

Remediation Plan

Immediate Action: Apply all available security patches provided by Unraid immediately, prioritizing internet-facing instances.

Proactive Monitoring: Review web server access logs for anomalous request patterns or suspicious command strings directed at the ToggleState endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block common command injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for remote code execution, this vulnerability represents a significant threat to the environment. Administrators should verify their current version status against vendor bulletins and apply updates immediately. If patching is not immediately feasible, restrict access to the web interface to trusted management networks.

---METADATA---
VENDOR: Unraid
PRODUCT: Unraid Web Server
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A file upload command injection vulnerability in the Unraid web server allows remote attackers to execute arbitrary commands by uploading malicious files.

Executive Summary:
An unauthenticated remote code execution vulnerability exists in the Unraid web server, stemming from improper validation of file uploads.

Vulnerability Details

CVE-ID: CVE-2026-9772

Affected Software: Unraid Web Server

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability occurs due to insufficient validation of file types and names during the upload process. An attacker can upload a crafted file to the web server that, when processed, executes arbitrary commands on the underlying host operating system.

Business Impact

The CVSS score of 8.8 highlights the critical nature of this flaw, as it allows for trivial remote code execution. Successful exploitation could lead to total control over the Unraid host, resulting in the theft of stored data, permanent system damage, or the use of the device as a pivot point for lateral movement.

Remediation Plan

Immediate Action: Apply the vendor-provided patch or update to the latest stable version of Unraid as soon as it becomes available.

Proactive Monitoring: Review web server access and error logs for suspicious file upload activity, particularly involving files with non-standard extensions or those uploaded to unexpected directories.

Compensating Controls: Disable the web management interface if accessible from non-trusted networks and implement restrictive ingress rules at the network perimeter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to the ease with which an attacker can execute code via file uploads. Organizations and users must restrict access to the Unraid management interface immediately and apply the necessary software updates as soon as they are released to mitigate the risk of remote system compromise.

---METADATA---
VENDOR: zephyrproject
PRODUCT: zephyr
AFFECTED_VERSIONS: 4.0.0 up to (excluding) 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A memory safety vulnerability in the Zephyr RTOS flash_copy system call allows local attackers to achieve unauthorized memory access.

Executive Summary:
A critical memory safety vulnerability in the Zephyr RTOS flash_copy system call could allow a local attacker to achieve elevated privileges or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9771

Affected Software: zephyrproject zephyr

Affected Versions: 4.0.0 up to (excluding) 4.4.2

Vulnerability: The vulnerability exists within the implementation of the flash_copy system call, specifically in the verification logic handled by z_vrfy_flash_copy. This flaw allows a local, authenticated user to bypass intended memory protections.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to embedded systems running the Zephyr RTOS. Unauthorized access to flash memory can result in complete system compromise, firmware tampering, or the exposure of sensitive data stored on the device.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to include the necessary security fixes for the flash_copy system call.

Proactive Monitoring: Implement strict access control lists for local system users and monitor for unauthorized attempts to access low-level system calls or memory-mapped flash regions.

Compensating Controls: If an update cannot be applied immediately, restrict access to the device to only trusted local users and disable unnecessary system calls if the hardware configuration permits.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which limits the immediate threat from remote attackers.

Analyst Recommendation

Given the critical nature of memory safety flaws in an RTOS, immediate patching is essential to prevent potential full-system compromise. Development teams should prioritize upgrading the Zephyr kernel version to 4.4.2 to ensure the integrity of the flash subsystem.

---METADATA---
VENDOR: TP-Link
PRODUCT: Kasa EC71 v4 and EC70 v4
AFFECTED_VERSIONS: 0 up to (excluding) 2.4.0 Build 20260520 rel.4191
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Kasa EC71 and EC70 v4 firmware versions store a static cryptographic private key on a read-only filesystem, which is shared across all devices.

Executive Summary:
The presence of a hard-coded, static cryptographic key across TP-Link Kasa devices introduces a critical risk of interception and unauthorized access to device communications.

Vulnerability Details

CVE-ID: CVE-2026-9770

Affected Software: TP-Link Kasa EC71 v4 and EC70 v4

Affected Versions: All versions prior to 2.4.0 Build 20260520 rel.4191

Vulnerability: This vulnerability (CWE-321) involves the use of hard-coded cryptographic keys, which enables an attacker with adjacent network access to potentially decrypt communications or impersonate legitimate devices.

Business Impact

The use of a shared static key undermines the security of the entire device fleet. A successful exploit could lead to the complete compromise of device confidentiality and integrity, effectively nullifying the encryption intended to protect user traffic and device management commands.

Remediation Plan

Immediate Action: Update the firmware of all Kasa EC71 and EC70 v4 devices to version 2.4.0 Build 20260520 rel.4191 or later, as provided by the TP-Link support portal.

Proactive Monitoring: Monitor the local network for unusual authentication requests or attempts to intercept traffic originating from smart home devices.

Compensating Controls: Isolate smart home devices onto a dedicated VLAN to limit the scope of potential lateral movement or interception attempts from compromised devices on the primary network.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Hard-coded keys represent a systemic flaw in product design, making them inherently exploitable once the key is extracted.

Analyst Recommendation

Due to the nature of hard-coded credentials, this vulnerability poses a significant risk to the privacy and security of the affected hardware. Users should ensure the firmware update is applied immediately to rotate or replace the insecure cryptographic material.

---METADATA---
VENDOR: Grafana
PRODUCT: Grafana IRM
AFFECTED_VERSIONS: 1.0.0 through 1.164.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Grafana IRM allows authenticated users to perform unauthorized actions, potentially impacting system integrity and availability.

Executive Summary:
Grafana IRM versions 1.0.0 through 1.164.0 are affected by a high-severity vulnerability that permits authenticated users to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9765

Affected Software: Grafana Grafana IRM

Affected Versions: 1.0.0 through 1.164.0

Vulnerability: This vulnerability involves an improper authorization flaw, which allows an authenticated attacker with low privileges to perform unauthorized modifications or disrupt service availability within the platform.

Business Impact

The exploitation of this vulnerability could lead to significant unauthorized changes to incident response configurations or service disruptions, directly impacting operational continuity. With a CVSS score of 7.1, the risk is categorized as High because it allows an attacker to manipulate core system functions despite requiring authenticated access. Failure to address this flaw may result in the corruption of critical incident data or unauthorized access to sensitive workflow parameters.

Remediation Plan

Immediate Action: Update Grafana IRM to the latest vendor-supplied patch version as detailed in the official security advisory.

Proactive Monitoring: Review audit logs for suspicious activity involving user-initiated configuration changes or unexpected spikes in service resource consumption.

Compensating Controls: Implement strict access control lists and principle of least privilege policies to limit the potential impact of an authenticated user session being compromised.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization issue that requires the attacker to have established a valid user session within the environment.

Analyst Recommendation

Given the potential for unauthorized system modifications, administrators should prioritize applying the security updates provided by Grafana. Ensure that all users maintain strong, unique credentials to mitigate the risk of account compromise, which is a prerequisite for exploiting this vulnerability.

---METADATA---
VENDOR: IBM
PRODUCT: Db2
AFFECTED_VERSIONS: 11.5.0 through 11.5.9, 12.1.0 through 12.1.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM Db2 is susceptible to a code injection vulnerability that could allow an authenticated local user to execute unauthorized code.

Executive Summary:
A code injection vulnerability in IBM Db2 versions 11.5 and 12.1 enables authenticated local users to potentially execute arbitrary code on the database server.

Vulnerability Details

CVE-ID: CVE-2026-9762

Affected Software: IBM Db2

Affected Versions: 11.5.0 through 11.5.9, 12.1.0 through 12.1.4

Vulnerability: The vulnerability is identified as CWE-94, which involves the improper control of code generation. It requires the attacker to have local access and low privileges to execute the injection successfully.

Business Impact

A successful code injection attack allows an authenticated local user to gain elevated control over the database environment. This could result in unauthorized data modification, exfiltration, or complete system takeover, justifying the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Download and apply the appropriate interim fix or special build (e.g., Special Build #87098 or later for V11.5.9) from IBM Fix Central.

Proactive Monitoring: Audit database user permissions and monitor for unauthorized execution of administrative or system-level commands.

Compensating Controls: Enforce the principle of least privilege for all database users and ensure local system access is strictly controlled to prevent unauthorized login attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, this vulnerability is not considered automatable, which lowers the immediate risk of wide-scale automated exploitation.

Analyst Recommendation

While the exploit requires local access, the potential for code injection remains a significant security risk for database administrators. Administrators should apply the recommended interim fixes or special builds as soon as possible to mitigate this risk.

---METADATA---
VENDOR: HAYAJO
PRODUCT: Mojolicious::Plugin::Web::Auth::OAuth2
AFFECTED_VERSIONS: Through 0.17
---END_METADATA---

Description Summary:
The HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 Perl module uses a predictable state parameter, enabling CSRF-based session hijacking.

Executive Summary:
A critical flaw in the HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 module allows unauthenticated attackers to perform session hijacking via predictable OAuth2 state parameters.

Vulnerability Details

CVE-ID: CVE-2026-9733

Affected Software: HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2

Affected Versions: Through 0.17

Vulnerability: This vulnerability stems from the use of a predictable SHA-1 hash for the OAuth2 state parameter, which relies on low-entropy sources like epoch time and Perl's rand function. This allows an unauthenticated attacker to bypass CSRF protections and hijack user sessions.

Business Impact

The ability to hijack user sessions poses a significant risk to data integrity and confidentiality. Successful exploitation could allow unauthorized actors to impersonate legitimate users, leading to unauthorized data access or administrative control over affected applications. Given the CVSS score of 9.1, this vulnerability represents a critical threat to the security posture of any service utilizing this plugin.

Remediation Plan

Immediate Action: Update the Mojolicious::Plugin::Web::Auth::OAuth2 module to the latest patched version provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous patterns in OAuth2 callback requests or suspicious authentication flow initiation.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that alternative CSRF mitigation strategies are in place while the update is being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2 module must prioritize this update immediately. Because the vulnerability facilitates full session hijacking, the risk to application security is severe, and failure to patch leaves users highly susceptible to unauthorized account takeover.

---METADATA---
VENDOR: printcart
PRODUCT: Printcart Web to Print Product Designer for WooCommerce
AFFECTED_VERSIONS: Up to and including 2.5.2
---END_METADATA---

Description Summary:
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via improper path validation and nonce exposure.

Executive Summary:
A critical arbitrary file deletion vulnerability in the Printcart WordPress plugin allows unauthenticated attackers to execute unauthorized file operations, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9725

Affected Software: printcart Printcart Web to Print Product Designer for WooCommerce

Affected Versions: Up to and including 2.5.2

Vulnerability: The plugin fails to perform adequate path validation on the 'nbd_item_key' parameter and fails to properly secure the nonce required for the nbd_save_customer_design action, allowing unauthenticated attackers to delete arbitrary files.

Business Impact

This vulnerability is rated 9.1 (Critical) as it facilitates arbitrary file deletion, which can be chained to achieve Remote Code Execution (RCE). The impact includes complete site compromise, data loss, and potential total loss of control over the WordPress server environment, posing a severe threat to business continuity.

Remediation Plan

Immediate Action: Update the Printcart Web to Print Product Designer for WooCommerce plugin to the latest version immediately.

Proactive Monitoring: Monitor server filesystem integrity and review web server logs for suspicious POST requests targeting the plugin's AJAX endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing directory traversal sequences or unauthorized attempts to access sensitive plugin functions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous because it allows unauthenticated attackers to perform destructive actions on the server. Site administrators must update the plugin immediately to the latest patched version to prevent potential RCE and complete site takeover.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: PowerLogic P7
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in Schneider PowerLogic P7 devices that allows authenticated users to execute arbitrary commands with elevated privileges.

Executive Summary:
A high-severity OS command injection vulnerability in Schneider PowerLogic P7 devices allows privileged attackers to execute unauthorized commands, threatening system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9717

Affected Software: Schneider Electric PowerLogic P7

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is an OS command injection vulnerability (CWE-78) triggered when a privileged authenticated user interacts with a network-exposed service. The flaw allows the injection of malicious system commands that execute with elevated permissions.

Business Impact

The CVSS score of 8.6 reflects the critical impact of command injection on industrial control systems. Unauthorized execution of system commands can lead to full device compromise, loss of confidentiality regarding operational data, and potential disruption of power management functions, posing significant operational and safety risks.

Remediation Plan

Immediate Action: Update the affected PowerLogic P7 firmware to the latest version provided by Schneider Electric to neutralize the command injection vector.

Proactive Monitoring: Monitor device audit logs for unusual command execution patterns or unexpected system-level configuration changes.

Compensating Controls: Enforce strict access control policies to ensure only minimal, necessary privileges are assigned to service accounts, reducing the impact of a compromised account.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires authenticated access, the ability to escalate commands to the system level necessitates a high-priority response. IT and OT security teams must ensure that firmware updates are tested and deployed rapidly to maintain the integrity of the PowerLogic environment.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: PowerLogic™ P7
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A NULL pointer dereference vulnerability in Schneider PowerLogic™ P7 devices can lead to a denial-of-service condition when processing malformed network requests.

Executive Summary:
A critical NULL pointer dereference vulnerability in Schneider PowerLogic™ P7 devices can be triggered by malformed network packets, resulting in a denial-of-service condition for device management.

Vulnerability Details

CVE-ID: CVE-2026-9716

Affected Software: Schneider Electric PowerLogic™ P7

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability, identified as CWE-476, occurs when the device encounters malformed requests over exposed network interfaces. The resulting NULL pointer dereference causes the device's HMI and configuration functionality to crash, effectively rendering the device unmanageable.

Business Impact

The inability to access the HMI or configuration functionality of industrial power management hardware can lead to significant operational disruption and loss of visibility into critical infrastructure. With a CVSS score of 8.7, this vulnerability presents a high risk to operational continuity, especially in environments where remote management is essential for uptime.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update to all affected PowerLogic™ P7 units immediately.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual patterns directed toward the device's management interfaces to detect potential exploitation attempts.

Compensating Controls: Isolate critical power management devices on dedicated, firewalled network segments to prevent unauthorized or malformed traffic from reaching the device interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of PowerLogic™ devices in industrial settings, patching this vulnerability is essential to prevent potential denial-of-service attacks. If immediate patching is not possible, ensure that network segmentation is strictly enforced to minimize the attack surface of the management interfaces.

---METADATA---
VENDOR: EventON
PRODUCT: EventON (Pro) - WordPress Virtual Event Calendar Plugin
AFFECTED_VERSIONS: Up to and including 5.0.11
---END_METADATA---

Description Summary:
The EventON WordPress plugin is vulnerable to unauthenticated SQL injection via the search parameter due to insufficient input escaping and lack of parameterized queries.

Executive Summary:
A critical SQL injection vulnerability in the EventON plugin allows unauthenticated attackers to extract sensitive database information, posing a severe risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-9711

Affected Software: EventON EventON (Pro)

Affected Versions: Up to and including 5.0.11

Vulnerability: The vulnerability exists due to improper handling of the WordPress 'search' parameter. Unauthenticated attackers can inject malicious SQL commands into existing queries if the "Enable additional search queries" setting is active, allowing for unauthorized data extraction.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk of data breach. Successful exploitation allows unauthorized access to the underlying database, potentially exposing sensitive customer data, administrative credentials, or proprietary information, leading to severe regulatory and financial consequences.

Remediation Plan

Immediate Action: Update the EventON plugin to the latest version immediately to resolve the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for anomalous patterns or injection-style characters (e.g., ', --, UNION) associated with the search function.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter malicious search queries before they reach the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and requires immediate attention to prevent unauthorized access to sensitive database contents. Organizations utilizing EventON must apply the latest vendor update as soon as possible to mitigate the risk of data exfiltration.

---METADATA---
VENDOR: joe007
PRODUCT: Eventer
AFFECTED_VERSIONS: 0 through 4.4.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Eventer WordPress plugin stores password reset keys in plaintext, allowing unauthenticated attackers to hijack user accounts.

Executive Summary:
A critical authentication bypass vulnerability in the Eventer WordPress plugin allows unauthenticated attackers to hijack any user account, including administrators.

Vulnerability Details

CVE-ID: CVE-2026-9701

Affected Software: joe007 Eventer

Affected Versions: 0 through 4.4.2

Vulnerability: The plugin insecurely stores plaintext password reset keys in the eventer_verification_code meta field. Unauthenticated attackers can leverage this, potentially in conjunction with other vulnerabilities like SQL injection, to retrieve these keys and reset passwords for arbitrary accounts.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating maximum severity. Successful exploitation allows for complete account takeover, granting attackers administrative access to the WordPress instance. This leads to full site control, unauthorized data access, and the potential to inject malicious content into the site.

Remediation Plan

Immediate Action: Update the Eventer plugin to the latest version immediately to ensure secure handling of password reset keys.

Proactive Monitoring: Monitor user metadata tables for suspicious entries in the eventer_verification_code field and audit successful password reset events.

Compensating Controls: Ensure the site is protected by a WAF and disable the password reset functionality if the plugin cannot be updated immediately.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Account takeover vulnerabilities are high-priority risks that must be addressed immediately. Administrators should update the Eventer plugin to the latest version, verify that no unauthorized accounts have been created or modified, and force a password reset for all administrative users.

---METADATA---
VENDOR: DBI (Perl)
PRODUCT: DBI
AFFECTED_VERSIONS: DBI versions before 1.648
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Perl DBI module occurs when error messages are written to a fixed-size 200-byte buffer without length validation.

Executive Summary:
A critical buffer overflow vulnerability in the Perl DBI module allows an attacker to execute arbitrary code by manipulating error messages in affected applications.

Vulnerability Details

CVE-ID: CVE-2026-9698

Affected Software: DBI (Perl)

Affected Versions: DBI versions before 1.648

Vulnerability: The vulnerability stems from the use of a limited 200-byte buffer for storing error messages when RaiseError, PrintError, or HandleError are enabled. If an attacker can influence the error text, they can trigger a buffer overflow, potentially leading to arbitrary code execution.

Business Impact

The CVSS score of 9.8 highlights the severity of this issue, as it enables remote code execution in applications utilizing the DBI interface. Successful exploitation could lead to full application compromise, data theft, or unauthorized database access, threatening the confidentiality and integrity of critical business information.

Remediation Plan

Immediate Action: Upgrade the Perl DBI module to version 1.648 or later to ensure proper buffer size management.

Proactive Monitoring: Monitor database-connected applications for unusual error patterns and investigate any application crashes that coincide with user-supplied input.

Compensating Controls: Implement robust input sanitization for all user-provided data that could potentially trigger database errors, preventing the input from reaching the vulnerable DBI logging mechanisms.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical for any Perl-based application that interacts with databases via DBI. Developers and system administrators must prioritize upgrading to version 1.648 to resolve this buffer overflow risk and prevent potential remote code execution attacks.

---METADATA---
VENDOR: Dassault Systèmes
PRODUCT: DELMIA Apriso
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authentication vulnerability in Dassault Systèmes DELMIA Apriso (2020-2026) allows remote, unauthenticated attackers to gain privileged access to the server.

Executive Summary:
An improper authentication flaw in Dassault Systèmes DELMIA Apriso allows unauthenticated remote attackers to obtain unauthorized administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-9695

Affected Software: Dassault Systèmes DELMIA Apriso

Affected Versions: Release 2020 Golden through 2026 SP1 (see specific service pack ranges in metadata)

Vulnerability: This is an Improper Authentication (CWE-287) vulnerability. It allows an unauthenticated remote attacker to bypass security controls and gain privileged access to the application server.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to business operations. An attacker gaining privileged access can manipulate production workflows, steal sensitive manufacturing data, or disrupt critical industrial processes, leading to severe financial and operational consequences.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches immediately by updating to the latest service pack for your specific DELMIA Apriso release.

Proactive Monitoring: Review application access logs for anomalous login patterns, especially those originating from unexpected IP addresses or occurring outside of business hours.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict access control lists to block traffic to unauthorized administrative endpoints until the patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and presents a significant risk of full system takeover. Organizations utilizing DELMIA Apriso must prioritize these updates immediately to prevent unauthorized access to their production environments.

---METADATA---
VENDOR: Integration for ActiveCampaign
PRODUCT: Contact Form 7, WPForms, Elementor, Ninja Forms Integration
AFFECTED_VERSIONS: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
---END_METADATA---

Description Summary:
An unauthenticated PHP Object Injection vulnerability (CWE-502) affects the Integration for ActiveCampaign and various form plugins, potentially allowing remote code execution.

Executive Summary:
A critical deserialization vulnerability in the Integration for ActiveCampaign plugin allows unauthenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-9691

Affected Software: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

Affected Versions: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

Vulnerability: The vulnerability is rooted in the insecure deserialization of untrusted data. An unauthenticated attacker can exploit this by sending a crafted payload to the affected plugin, bypassing security controls to execute malicious code.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation allows an attacker to gain unauthorized control over the web server, which could lead to sensitive data exfiltration, modification of site content, or the installation of persistent backdoors.

Remediation Plan

Immediate Action: Upgrade the affected plugin to the latest version immediately to patch the insecure deserialization logic.

Proactive Monitoring: Review application and server access logs for anomalous traffic or unexpected execution patterns that deviate from normal plugin behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common PHP object injection patterns and block malicious HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk of remote code execution. Organizations utilizing these integration plugins must prioritize patching, as unauthenticated RCE vulnerabilities are frequently targeted by automated exploit campaigns.

---METADATA---
VENDOR: WordPress
PRODUCT: Recover Exit For WooCommerce Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The "Recover Exit For WooCommerce" WordPress plugin is vulnerable to Local File Inclusion (LFI), which could allow attackers to access sensitive server files.

Executive Summary:
A Local File Inclusion vulnerability in the Recover Exit For WooCommerce plugin for WordPress exposes the host server to potential information disclosure and unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-9662

Affected Software: WordPress Recover Exit For WooCommerce Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Local File Inclusion (LFI), allowing an attacker to include files on the server that should not be accessible. This vulnerability typically allows an unauthenticated attacker to read sensitive configuration files or perform path traversal.

Business Impact

An LFI vulnerability is critical as it can lead to the exposure of configuration files (e.g., wp-config.php), database credentials, or system information. Given the CVSS score of 8.1, the risk of total site compromise is high, necessitating immediate action to secure the WordPress installation.

Remediation Plan

Immediate Action: Update the "Recover Exit For WooCommerce" plugin to the latest available version or remove the plugin if it is not strictly required.

Proactive Monitoring: Review WordPress access logs for path traversal patterns (e.g., ../../) and unexpected file access attempts.

Compensating Controls: Utilize a security plugin or WAF with LFI protection rules to block malicious input patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin-based vulnerabilities are a common attack vector for WordPress sites. Administrators must update the affected plugin immediately or disable it to prevent attackers from leveraging this LFI flaw to gain unauthorized access to the underlying server.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1756-EN2, 1756-EN3, 1756-ENBT
AFFECTED_VERSIONS: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A denial-of-service vulnerability in Rockwell Automation communication modules arises from improper validation of CIP Implicit Connection packets, allowing unauthenticated remote disruption.

Executive Summary:
A critical denial-of-service vulnerability in Rockwell Automation communication modules poses a significant risk to industrial control systems by allowing unauthenticated remote service disruption.

Vulnerability Details

CVE-ID: CVE-2026-9653

Affected Software: Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules

Affected Versions: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006

Vulnerability: This is a denial-of-service vulnerability caused by improper validation of CIP Implicit Connection packets (CWE-354). The vulnerability is exploitable by an unauthenticated remote attacker with network access to the target modules.

Business Impact

The exploitation of this vulnerability can lead to a complete loss of availability for the affected communication modules. In industrial environments, such an outage can halt critical operations, cause unplanned downtime, and potentially lead to significant safety or financial consequences. With a CVSS score of 8.7, this flaw is categorized as High severity, reflecting the ease of remote exploitation and the potential for severe operational impact.

Remediation Plan

Immediate Action: Review the official Rockwell Automation security advisory (SD1780) to identify specific firmware updates or configuration changes required for your hardware revisions. Apply all recommended vendor security updates as soon as they are made available for your specific environment.

Proactive Monitoring: Monitor industrial network traffic for anomalous CIP packet patterns or unexpected spikes in traffic directed at communication modules. Implement logging on network infrastructure to identify unauthorized attempts to communicate with control system hardware.

Compensating Controls: Restrict network access to industrial communication modules by implementing strict VLAN segmentation and firewall rules that allow only authorized traffic. Utilize an Industrial Intrusion Detection System to identify and alert on malformed CIP packets or abnormal traffic volumes.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of future exploitation attempts once technical details become more widely understood.

Analyst Recommendation

Given the High severity of this vulnerability and its direct impact on industrial availability, organizations should prioritize the identification of affected hardware within their control networks. It is imperative to apply vendor-supplied patches as soon as they become available and to maintain strict network isolation for all vulnerable communication modules to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Schneider Electric
PRODUCT: EasyLogic T150
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An insufficiently protected credentials vulnerability in Schneider Electric EasyLogic T150 allows unauthenticated access to sensitive system information.

Executive Summary:
A severe credential protection flaw in the Schneider Electric EasyLogic T150 controller allows unauthenticated attackers to gain unauthorized access to sensitive firmware or system files.

Vulnerability Details

CVE-ID: CVE-2026-9650

Affected Software: Schneider Electric EasyLogic T150

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability (CWE-522) involves the storage of credentials in an insufficiently protected manner within the device firmware. An unauthenticated attacker can exploit this to extract sensitive authentication data, gaining unauthorized access to the controller.

Business Impact

The ability for an unauthenticated attacker to extract credentials from an industrial controller poses a severe risk to operational technology (OT) environments. With a CVSS score of 8.7, this vulnerability could lead to total system compromise, unauthorized configuration changes, or the disruption of critical industrial processes, posing significant safety and operational risks.

Remediation Plan

Immediate Action: Update the firmware of all affected EasyLogic T150 controllers to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts to the controller interface and review system logs for signs of credential harvesting.

Compensating Controls: Isolate the controllers on a restricted management network with strict access control lists (ACLs) to prevent unauthorized network access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of industrial control systems, this vulnerability requires immediate attention. Organizations must identify all deployed EasyLogic T150 units and apply the vendor-provided firmware update as a matter of urgency to prevent potential remote exploitation and unauthorized access to industrial operations.

---METADATA---
VENDOR: ScadaBR
PRODUCT: ScadaBR
AFFECTED_VERSIONS: 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ScadaBR contains a vulnerability where authenticated users can execute arbitrary JavaScript on the server, resulting in remote code execution with root privileges.

Executive Summary:
A critical OS command injection vulnerability in ScadaBR allows authenticated attackers to execute arbitrary code and gain root-level access.

Vulnerability Details

CVE-ID: CVE-2026-9645

Affected Software: ScadaBR

Affected Versions: 1.2.0

Vulnerability: The application contains exposed methods that fail to neutralize malicious input, leading to OS command injection (CWE-78). An authenticated user can leverage this to execute JavaScript, which is subsequently interpreted as system commands running with root privileges.

Business Impact

Rated at 9.9 (Critical), this vulnerability allows for complete system compromise. Since the injected commands execute with root-level privileges, an attacker can gain total control over the server, exfiltrate sensitive process data, or sabotage industrial control systems managed by the ScadaBR platform.

Remediation Plan

Immediate Action: Apply the latest security patch or update to the version recommended by the ScadaBR vendor.

Proactive Monitoring: Review system logs for unauthorized script execution or unexpected processes spawned by the ScadaBR application service.

Compensating Controls: Restrict access to the ScadaBR interface to trusted users only and implement strict network segmentation to limit the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely severe vulnerability that grants root access to the underlying system. Immediate patching is mandatory; until patches can be applied, ensure that access to the ScadaBR interface is strictly controlled and monitored to prevent exploitation by malicious actors.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: DIAView
AFFECTED_VERSIONS: Delta Electronics DIAView V4.4
---END_METADATA---

Description Summary:
A mitigation bypass vulnerability in Delta Electronics DIAView V4.4 allows unauthenticated remote attackers to access configured databases.

Executive Summary:
An unauthenticated remote database access vulnerability in Delta Electronics DIAView poses a critical risk of data compromise due to a failed previous security patch.

Vulnerability Details

CVE-ID: CVE-2026-9642

Affected Software: Delta Electronics DIAView

Affected Versions: Delta Electronics DIAView V4.4

Vulnerability: This issue is a mitigation bypass of CVE-2025-62582. An unauthenticated remote attacker can leverage this flaw to gain unauthorized access to databases within a DIAView project.

Business Impact

Successful exploitation allows an unauthenticated attacker to bypass existing security controls and access sensitive database information. With a CVSS score of 9.8, this vulnerability represents a critical threat to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or manipulation of industrial project data.

Remediation Plan

Immediate Action: Review and re-apply security patches for DIAView and ensure the bypass for unauthenticated remote database access is fully addressed.

Proactive Monitoring: Audit system access logs for anomalous database connection attempts and monitor network traffic for unauthorized access patterns.

Compensating Controls: Restrict network access to database servers to trusted IP addresses only and ensure robust network segmentation is in place.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 26, 2026, there is public information indicating that an exploit is available. Given that this is a bypass of a previously known vulnerability, the urgency for remediation is extremely high.

Analyst Recommendation

Organizations utilizing Delta Electronics DIAView V4.4 must prioritize applying the latest security patches to remediate this bypass. Failure to address this vulnerability leaves critical database infrastructure exposed to unauthenticated remote attackers.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical flaw has been found in the UTT HiPER 1250GW router that may allow for unauthorized system exploitation.

Executive Summary:
A critical security flaw in UTT HiPER 1250GW routers necessitates an immediate firmware update to prevent potential network compromise.

Vulnerability Details

CVE-ID: CVE-2026-9632

Affected Software: UTT HiPER 1250GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw involves a weakness in the device's operational security. It is likely that this could lead to unauthorized access or control over the router, facilitating further attacks on the internal network.

Business Impact

The vulnerability carries a high impact on network confidentiality and integrity. If exploited, an attacker could gain a persistent foothold within the network, leading to significant reputational and operational damage. The 8.8 CVSS score reflects this high risk.

Remediation Plan

Immediate Action: Update all UTT HiPER 1250GW devices to the latest available firmware provided by the vendor.

Proactive Monitoring: Review system logs for signs of unauthorized access or unexpected changes to device settings.

Compensating Controls: Isolate the router's management interface from the internet and monitor internal traffic for suspicious activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must prioritize this update as part of their standard security maintenance. As gateway devices are critical, ensuring they are patched is essential to maintain a secure and resilient network infrastructure.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical vulnerability has been detected in the UTT HiPER 1250GW router, posing a risk of unauthorized exploitation.

Executive Summary:
A high-severity vulnerability in the UTT HiPER 1250GW router requires immediate firmware updates to secure network perimeters.

Vulnerability Details

CVE-ID: CVE-2026-9631

Affected Software: UTT HiPER 1250GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The detected vulnerability affects the device's firmware and could potentially be utilized by remote attackers to gain unauthorized access. Further analysis suggests a significant risk to the security boundary enforced by the device.

Business Impact

The compromise of a HiPER 1250GW router allows an attacker to control the flow of data into and out of the corporate network. This could lead to data exfiltration or the injection of malicious content, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the firmware on all UTT HiPER 1250GW units to the latest version immediately.

Proactive Monitoring: Monitor for unusual outbound traffic patterns or unauthorized access attempts to the router's management interface.

Compensating Controls: Limit access to the management UI to a specific, trusted management subnet to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the role of the UTT HiPER 1250GW as a network gateway, immediate remediation is mandatory. Security teams should ensure all units are running the most recent firmware to mitigate this high-severity risk.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1200GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in the UTT HiPER 1200GW router, potentially leading to unauthorized system compromise.

Executive Summary:
A critical security weakness in UTT HiPER 1200GW routers poses a high risk to network integrity and requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-9628

Affected Software: UTT HiPER 1200GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability represents a identified weakness in the device's security architecture. It is highly likely that this flaw, similar to other vulnerabilities in this product line, could be exploited to bypass security controls.

Business Impact

Exploitation of this gateway device could lead to complete network visibility by an attacker, including data interception and unauthorized internal access. The 8.8 CVSS score underscores the high-risk nature of this vulnerability for any business using this model.

Remediation Plan

Immediate Action: Apply the latest firmware patches provided by UTT to all affected HiPER 1200GW units.

Proactive Monitoring: Inspect device logs for suspicious login attempts or unexpected configuration changes.

Compensating Controls: Implement an external firewall to protect the router's management interface if an immediate firmware update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must verify the firmware version of all UTT HiPER 1200GW units and apply updates as a matter of urgency. Maintaining updated firmware on network infrastructure is essential to preventing remote exploits.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1200GW
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the UTT HiPER 1200GW router, potentially allowing for unauthorized system access.

Executive Summary:
A critical security vulnerability in the UTT HiPER 1200GW requires immediate attention to protect against unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-9627

Affected Software: UTT HiPER 1200GW

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to a security weakness in the device firmware. While specific technical details are pending, such flaws in network edge devices often involve authentication bypass or command injection.

Business Impact

Compromise of a network gateway like the HiPER 1200GW can allow attackers to intercept traffic, redirect users, or gain a foothold in the internal network. The 8.8 CVSS score indicates a high risk to the overall network security posture.

Remediation Plan

Immediate Action: Update the firmware on all UTT HiPER 1200GW devices to the latest patched version.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or anomalous traffic patterns originating from the management interface.

Compensating Controls: Disable remote management features on the WAN interface and restrict management access to a dedicated, secure internal management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators should prioritize updating these gateway devices immediately. As edge devices are the first line of defense, keeping them updated is critical to prevent wider network breaches.

---METADATA---
VENDOR: Ivanti
PRODUCT: Neurons for ITSM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM allows authenticated attackers to escalate privileges to administrative levels.

Executive Summary:
An improper access control vulnerability in Ivanti Neurons for ITSM enables authenticated attackers to gain administrative access, posing a critical threat to organizational security.

Vulnerability Details

CVE-ID: CVE-2026-9614

Affected Software: Ivanti Neurons for ITSM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an access control flaw that allows a remote, authenticated attacker to bypass standard permissions and gain administrative control over the ITSM platform.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. An attacker gaining administrative access to an ITSM platform can compromise sensitive organizational data, modify system configurations, and potentially pivot into other internal systems, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Ivanti for the Neurons for ITSM platform immediately.

Proactive Monitoring: Review administrative audit logs for unauthorized user activity or suspicious privilege elevation events.

Compensating Controls: Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts and restrict access to the management console to trusted internal IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete platform compromise, organizations using Ivanti Neurons for ITSM must prioritize this update. Ensure that all patches are tested and deployed rapidly to mitigate the risk of unauthorized administrative access.

---METADATA---
VENDOR: SEPPmail
PRODUCT: SEPPmail Secure Email Gateway & SEPPmail Cloud
AFFECTED_VERSIONS: Before 15.0.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SEPPmail Secure Email Gateway improperly uses the GET method for sensitive operations, leading to the potential exposure of session tokens within logs or browser history.

Executive Summary:
A security flaw in SEPPmail Secure Email Gateway and Cloud allows for the potential exposure of sensitive session tokens through insecure GET request usage.

Vulnerability Details

CVE-ID: CVE-2026-9592

Affected Software: SEPPmail Secure Email Gateway & SEPPmail Cloud

Affected Versions: Before 15.0.4.2

Vulnerability: The software exhibits a CWE-598 vulnerability where sensitive query strings containing session information are transmitted via GET requests. An unauthenticated attacker positioned on the local network could potentially intercept these tokens to facilitate session hijacking.

Business Impact

The exposure of session tokens allows attackers to impersonate legitimate users, potentially leading to unauthorized access to encrypted email communications and internal administrative functions. While the CVSS score is 7.5, the risk is elevated in environments where sensitive email privacy is a primary business requirement.

Remediation Plan

Immediate Action: Upgrade to SEPPmail version 15.0.4.2 or later, which addresses the login redirect behavior to prevent token disclosure.

Proactive Monitoring: Monitor network traffic and server logs for abnormal session handling or unexpected GET requests containing sensitive parameters.

Compensating Controls: Ensure that the gateway is deployed within a secure, isolated management network to restrict the physical or network access required for interception.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires an attacker to be present on the adjacent network to successfully intercept the sensitive traffic.

Analyst Recommendation

Administrators must prioritize the update to version 15.0.4.2 to ensure session tokens are not inadvertently leaked. Failure to patch this issue could lead to significant breaches of confidentiality within secure communication channels.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in Sangoma Switchvox SMB Edition allows authenticated users to inject malicious scripts into the web interface.

Executive Summary:
A stored cross-site scripting vulnerability in Sangoma Switchvox SMB Edition allows authenticated attackers to execute malicious scripts, potentially compromising administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-9588

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: The application is susceptible to stored cross-site scripting (CWE-79) due to improper neutralization of user-supplied input. This vulnerability can be exploited by an authenticated attacker who provides malicious input that is subsequently stored and executed in the browser of another user, such as an administrator.

Business Impact

Successful exploitation may allow an attacker to hijack user sessions, perform unauthorized actions on behalf of other users, or steal sensitive session cookies. Given the CVSS score of 7.0, this vulnerability presents a significant risk to the security of the management console, potentially leading to full administrative compromise if an administrator interacts with the malicious payload.

Remediation Plan

Immediate Action: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later as specified in the vendor release notes.

Proactive Monitoring: Monitor the application for unexpected script execution or unusual entries within fields that accept user input, as these may indicate attempted XSS injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common XSS payloads directed at the Switchvox web interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows for persistent malicious code execution within the context of the application.

Analyst Recommendation

Due to the persistent nature of stored XSS, this vulnerability poses an ongoing threat to all users of the Switchvox web interface. Organizations must prioritize upgrading to version 8.4.0.2 to ensure that input sanitization is correctly implemented and to secure the management environment against potential session-based attacks.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Sangoma Switchvox SMB Edition contains an authenticated local file inclusion vulnerability that allows attackers to access sensitive files on the server.

Executive Summary:
Sangoma Switchvox SMB Edition is vulnerable to authenticated local file inclusion, which may allow an attacker to read unauthorized files on the target system.

Vulnerability Details

CVE-ID: CVE-2026-9587

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: This is a local file inclusion vulnerability (CWE-73) that requires the attacker to have authenticated access to the system. Once authenticated, an attacker can manipulate file paths to gain access to files they should not be able to read.

Business Impact

The ability to perform local file inclusion can lead to the exposure of sensitive system configuration files, database credentials, or internal application data. With a CVSS score of 7.1, this vulnerability poses a high risk to the confidentiality of the environment, particularly for administrators or users with access to the management interface.

Remediation Plan

Immediate Action: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later to address the file inclusion flaw.

Proactive Monitoring: Monitor system logs for suspicious file access requests or authentication events originating from unusual accounts or IP addresses.

Compensating Controls: Restrict access to the management interface of the Switchvox appliance to trusted internal networks or VPNs to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which limits the potential threat actors to those who have already compromised or possess legitimate user credentials.

Analyst Recommendation

Administrators must prioritize updating their Switchvox SMB Edition instances to version 8.4.0.2. While the vulnerability requires authentication, the potential for sensitive data exposure makes patching essential to maintain the security posture of the telecommunications infrastructure.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition that allows remote attackers to execute arbitrary database commands via the /pa endpoint.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition allows remote attackers to execute arbitrary database operations and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9586

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: This is an improper neutralization of special elements used in an SQL command (CWE-89). The /pa endpoint fails to sanitize user-controlled input, allowing an unauthenticated attacker to inject malicious SQL statements directly into PostgreSQL queries.

Business Impact

Successful exploitation poses a severe threat to the integrity and confidentiality of the backend database. Given the CVSS score of 9.3, this flaw enables a remote attacker to bypass authentication, access sensitive information, or potentially gain full system control, leading to significant service disruption and data loss.

Remediation Plan

Immediate Action: Update Sangoma Switchvox SMB Edition to version 8.4.0.2 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious requests to the /pa endpoint, particularly those containing SQL syntax or unusual XML structures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests to the /pa endpoint containing unexpected SQL keywords or characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication and the potential for direct database interaction.

Analyst Recommendation

This vulnerability is highly critical due to the lack of authentication required for exploitation. Administrators must prioritize updating affected Switchvox instances to the latest version to prevent potential remote code execution and unauthorized data access.

---METADATA---
VENDOR: Sangoma
PRODUCT: Switchvox SMB Edition
AFFECTED_VERSIONS: 8.3 (104997) up to (excluding) 8.4.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8, allowing for unauthorized script execution.

Executive Summary:
An unauthenticated reflected cross-site scripting vulnerability in Sangoma Switchvox SMB Edition exposes users to potential session theft and unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-9585

Affected Software: Sangoma Switchvox SMB Edition

Affected Versions: 8.3 (104997) up to (excluding) 8.4.0.2

Vulnerability: This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) where input is not properly neutralized during web page generation. An unauthenticated attacker can trick a user into executing malicious scripts within their browser session.

Business Impact

Reflected XSS can be used to hijack user sessions, capture sensitive data, or perform actions on behalf of the user within the Switchvox interface. With a CVSS score of 8.6, this vulnerability poses a high risk to organizational security, particularly if administrative users are targeted, potentially leading to full control over the PBX system.

Remediation Plan

Immediate Action: Update Sangoma Switchvox SMB Edition to version 8.4.0.2 or later as specified in the vendor release notes.

Proactive Monitoring: Review access logs for suspicious URL patterns containing embedded script tags or anomalous redirect activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious payloads from incoming HTTP requests and enforce strong Content Security Policy (CSP) headers.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. XSS vulnerabilities are commonly used in phishing campaigns, so user awareness should be considered alongside technical patching.

Analyst Recommendation

The update to version 8.4.0.2 should be applied immediately to mitigate the risk of reflected XSS attacks. Administrators should ensure that the patch is verified against the vendor release notes to confirm the vulnerability has been addressed in their specific environment.

---METADATA---
VENDOR: Eclipse Foundation
PRODUCT: Eclipse Kura
AFFECTED_VERSIONS: 5.0.0 through 5.6.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Eclipse Kura versions 5.0.0 through 5.6.1 contain vulnerabilities related to the reliance on untrusted inputs and insufficient verification of data authenticity.

Executive Summary:
Multiple security flaws in Eclipse Kura allow for the potential manipulation of security decisions due to the processing of unverified or untrusted input data.

Vulnerability Details

CVE-ID: CVE-2026-9561

Affected Software: Eclipse Foundation Eclipse Kura

Affected Versions: 5.0.0 through 5.6.1

Vulnerability: The software fails to properly verify the authenticity of data (CWE-345) and relies on untrusted inputs for critical security decisions (CWE-807). These issues, categorized under CWE-348, allow an unauthenticated attacker to influence the system's internal logic.

Business Impact

Successful exploitation could result in unauthorized configuration changes or the bypassing of security controls, potentially leading to a complete compromise of the affected IoT gateway or edge device. With a CVSS score of 8.8, this vulnerability represents a severe threat to operational environments where Eclipse Kura is deployed for device management.

Remediation Plan

Immediate Action: Update Eclipse Kura to the latest supported version as specified by the Eclipse Foundation security advisory.

Proactive Monitoring: Audit device logs for unauthorized or unexpected configuration changes and monitor network traffic for anomalous communication originating from the Kura interface.

Compensating Controls: Restrict network access to the Eclipse Kura management interface to trusted administrative subnets only, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the underlying CWEs suggests that exploitation may require specific knowledge of the Kura environment.

Analyst Recommendation

Due to the high CVSS score, organizations must prioritize patching their Eclipse Kura deployments. Failure to address these verification flaws leaves critical edge infrastructure susceptible to remote manipulation.

---METADATA---
VENDOR: Mautic
PRODUCT: Mautic
AFFECTED_VERSIONS: Mautic 7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A path traversal flaw in Mautic 7's campaign import feature allows authenticated users to write arbitrary PHP files, leading to Remote Code Execution (RCE) on the underlying server.

Executive Summary:
A critical path traversal vulnerability in Mautic 7 allows authenticated users with specific privileges to achieve Remote Code Execution by overwriting sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-9559

Affected Software: Mautic Mautic

Affected Versions: Mautic 7

Vulnerability: This is a path traversal vulnerability residing in the campaign import ZIP extraction logic. An authenticated user possessing 'campaign:imports:create' privileges can bypass directory restrictions to write arbitrary files to the filesystem.

Business Impact

The vulnerability carries a CVSS score of 9.9, reflecting its extreme severity. Successful exploitation grants an attacker full Remote Code Execution capabilities, potentially leading to total system compromise, unauthorized data access, and complete loss of control over the Mautic application environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of Mautic 7 as soon as the vendor-supplied patch becomes available.

Proactive Monitoring: Review access logs for suspicious file upload activity and monitor for unexpected PHP file creation within the application's temporary and core directories.

Compensating Controls: Implement strict file system permissions for the web server user and utilize a Web Application Firewall (WAF) to inspect uploaded ZIP archives for path traversal patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of achieving RCE, the potential for exploitation is extremely high once proof-of-concept code is developed.

Analyst Recommendation

Given the critical CVSS score of 9.9, this vulnerability poses an immediate and severe threat to organizational infrastructure. Administrators must restrict 'campaign:imports:create' privileges to trusted users only and prioritize patching the Mautic instance immediately upon the release of the security update.

---METADATA---
VENDOR: Mautic
PRODUCT: Mautic
AFFECTED_VERSIONS: Mautic up to 4.4.19/5.2.10/6.0.8/7.1.1
---END_METADATA---

Description Summary:
A Server-Side Template Injection (SSTI) vulnerability in the Mautic theme engine allows authenticated users with theme upload permissions to execute arbitrary code on the server.

Executive Summary:
An SSTI vulnerability in Mautic permits authenticated attackers to execute arbitrary code or access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-9558

Affected Software: Mautic

Affected Versions: Mautic up to 4.4.19/5.2.10/6.0.8/7.1.1

Vulnerability: The Mautic theme engine renders Twig templates without a sandbox or strict function restrictions. Authenticated users with theme creation or upload capabilities can inject malicious code into templates, leading to Remote Code Execution (RCE) or unauthorized file access.

Business Impact

The vulnerability carries a CVSS score of 9.9, reflecting the extreme risk of RCE. While it requires authenticated access, the ability to compromise the host server via theme manipulation poses a severe threat to the integrity and confidentiality of the Mautic platform and associated marketing data.

Remediation Plan

Immediate Action: Update to Mautic version 4.4.20, 5.2.11, 6.0.9, or 7.1.2 as appropriate for your branch.

Proactive Monitoring: Audit user permissions regarding theme uploads and monitor server logs for unusual template-related activity or unauthorized system file access.

Compensating Controls: Restrict theme upload permissions to only highly trusted administrative users and implement file integrity monitoring on the theme directory.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users should apply the specified patches immediately. Due to the high risk of RCE, administrators should also review the current list of users with theme management permissions to minimize the attack surface.

---METADATA---
VENDOR: curl
PRODUCT: curl
AFFECTED_VERSIONS: curl 8.11.0 to and including 8.20.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in libcurl's HTTP/3 implementation allows for potential information leakage when an attacker replaces a legitimate server with an impostor during a cached SSL session.

Executive Summary:
An unauthenticated attacker can exploit a flaw in curl 8.11.0 through 8.20.0 to perform unauthorized data transmission before certificate verification failure occurs.

Vulnerability Details

CVE-ID: CVE-2026-9545

Affected Software: curl

Affected Versions: curl 8.11.0 to and including 8.20.0

Vulnerability: This HTTP/3-specific vulnerability occurs when libcurl attempts a second transfer to a site that has been replaced by an impostor. The client may prematurely send request bytes on a new connection before the certificate verification failure is enforced, potentially leaking sensitive information.

Business Impact

The CVSS score of 7.5 (High) highlights the risk of sensitive data exposure. In scenarios where an attacker can intercept traffic, this vulnerability allows for the leakage of request data to an unauthorized party, potentially leading to the compromise of sensitive credentials or private business information.

Remediation Plan

Immediate Action: Update to curl version 8.21.0 or later to resolve the certificate verification timing issue.

Proactive Monitoring: Monitor for unusual network latency or connection errors during HTTP/3 handshakes which may indicate an attempt to exploit connection caching.

Compensating Controls: If patching is delayed, consider disabling HTTP/3 support (QUIC) in the affected application until the update can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the update to version 8.21.0 to mitigate the risk of information leakage during HTTP/3 transfers. Given the complexity of the exploit, ensuring that all client libraries are fully patched is the most reliable defense.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: Totolink N300RH 6.1c.1353_B20190305
---END_METADATA---

Description Summary:
The Totolink N300RH web management interface contains an OS command injection vulnerability in the setPasswordCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink N300RH web management interface allows remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-9543

Affected Software: Totolink N300RH

Affected Versions: Totolink N300RH 6.1c.1353_B20190305

Vulnerability: The setPasswordCfg function within /cgi-bin/cstecgi.cgi improperly sanitizes the admpass argument, allowing a remote attacker to inject and execute arbitrary OS commands.

Business Impact

This vulnerability provides an attacker with full control over the affected router. With a CVSS score of 9.8, this could lead to the interception of network traffic, redirection of DNS, or the device being utilized as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version provided by Totolink.

Proactive Monitoring: Monitor the device for unusual configuration changes and audit network traffic originating from the router for signs of compromise.

Compensating Controls: Disable remote access to the Web Management Interface and ensure the device is not accessible from the public internet.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 26, 2026, the exploit has been disclosed publicly. Given the availability of the exploit, the risk of active exploitation is significant.

Analyst Recommendation

Owners of Totolink N300RH devices should update their firmware immediately. If no firmware update is available for a specific version, the device should be taken offline or have its management interface restricted from external access to prevent exploitation.

---METADATA---
VENDOR: GIGABYTE
PRODUCT: MBStorage
AFFECTED_VERSIONS: 0 through 26.02.10.01
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper access control vulnerability in the MBStorage DRAM lighting module of Gigabyte Control Center allows local attackers to exploit exposed IOCTLs.

Executive Summary:
A high-severity improper access control vulnerability in the GIGABYTE MBStorage module could allow a local attacker to achieve unauthorized system-level actions.

Vulnerability Details

CVE-ID: CVE-2026-9492

Affected Software: GIGABYTE MBStorage

Affected Versions: 0 through 26.02.10.01

Vulnerability: The vulnerability involves insufficient access control (CWE-782) for exposed IOCTLs within the MBStorage DRAM lighting control module, allowing a locally authenticated user to interact with the driver in an unauthorized manner.

Business Impact

The CVSS score of 7.8 reflects the potential for a local attacker to compromise the host system's security. Unauthorized access to system-level controls via the driver could result in full system compromise, data loss, or persistent malware installation.

Remediation Plan

Immediate Action: Update the MBStorage component within the Gigabyte Control Center to version 26.06.03.01 or later.

Proactive Monitoring: Review system logs for suspicious IOCTL-related activity or unauthorized modifications to system lighting configurations.

Compensating Controls: Restrict non-administrator user access to the Gigabyte Control Center software where possible to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

This vulnerability presents a clear risk to local host security. Users and system administrators should verify their version of the MBStorage module and apply the update to version 26.06.03.01 immediately to close the access control gap.