---METADATA---
VENDOR: TeamT5
PRODUCT: ThreatSonar Anti-Ransomware
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
TeamT5 ThreatSonar Anti-Ransomware contains an arbitrary file deletion vulnerability.

Executive Summary:
An arbitrary file deletion vulnerability in TeamT5 ThreatSonar Anti-Ransomware allows attackers to delete critical system files, potentially leading to system instability.

Vulnerability Details

CVE-ID: CVE-2026-5966

Affected Software: TeamT5 ThreatSonar Anti-Ransomware

Affected Versions: See vendor advisory

Vulnerability: This vulnerability allows an attacker to delete arbitrary files on the system. Depending on the privileges of the application, this could lead to the deletion of critical system files, causing denial-of-service (DoS) conditions.

Business Impact

The ability to delete arbitrary files can disrupt business-critical services and lead to significant system downtime. With a CVSS score of 8.1, this flaw poses a high risk to the availability and reliability of the environments protected by the software.

Remediation Plan

Immediate Action: Update ThreatSonar Anti-Ransomware to the latest version released by TeamT5 to patch the file handling vulnerability.

Proactive Monitoring: Monitor system logs for unexpected file deletion activity or service failures that may indicate an ongoing exploitation attempt.

Compensating Controls: Ensure the application runs with the minimum necessary privileges and restrict access to the filesystem using operating system-level permissions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing TeamT5 ThreatSonar must prioritize this update to prevent potential service disruptions. Applying the vendor-provided patch is the only effective way to mitigate the risk of arbitrary file deletion.

---METADATA---
VENDOR: NewSoft
PRODUCT: NewSoftOA
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
NewSoftOA is susceptible to an unauthenticated OS command injection vulnerability, permitting remote attackers to execute arbitrary commands on the server.

Executive Summary:
An unauthenticated OS command injection vulnerability in NewSoftOA allows remote attackers to gain full control of the application server.

Vulnerability Details

CVE-ID: CVE-2026-5965

Affected Software: NewSoft NewSoftOA

Affected Versions: See vendor advisory

Vulnerability: This is an OS command injection flaw that does not require user authentication, allowing an attacker to inject and execute arbitrary commands directly on the server's operating system.

Business Impact

As an unauthenticated, critical-severity vulnerability (CVSS 9.8), this flaw allows for total system compromise. Consequences include unauthorized access to sensitive corporate data, lateral movement within the network, and potential full-scale system destruction or ransomware deployment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by NewSoft for the NewSoftOA platform immediately.

Proactive Monitoring: Monitor server logs for unexpected shell commands or suspicious network traffic patterns indicative of reconnaissance or exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns (e.g., shell meta-characters).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of authentication requirements makes this vulnerability exceptionally dangerous. It is imperative that all instances of NewSoftOA be updated immediately to prevent unauthorized remote access to the server environment.

---METADATA---
VENDOR: Digiwin
PRODUCT: EasyFlow .NET
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Digiwin EasyFlow .NET contains a SQL injection vulnerability allowing unauthenticated remote attackers to manipulate database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in Digiwin EasyFlow .NET poses a critical risk of complete database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-5964

Affected Software: Digiwin EasyFlow .NET

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands into the application. The flaw enables unauthorized parties to read, modify, or delete sensitive data stored within the backend database.

Business Impact

The exploitation of this vulnerability can result in the full compromise of the application's database, leading to unauthorized disclosure or destruction of sensitive corporate information. With a CVSS score of 9.8, this flaw represents a critical risk to business operations, data integrity, and compliance requirements.

Remediation Plan

Immediate Action: Update Digiwin EasyFlow .NET to the latest available version provided by the vendor to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database access logs for unusual patterns, such as unexpected query structures, unauthorized data export attempts, or large-scale record deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection signatures to detect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity and the unauthenticated nature of this vulnerability, immediate patching is required. Organizations should prioritize updating their Digiwin EasyFlow .NET instances to prevent potential data breaches and unauthorized system access.

---METADATA---
VENDOR: Digiwin
PRODUCT: EasyFlow .NET
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Digiwin EasyFlow .NET contains a SQL injection vulnerability allowing unauthenticated remote attackers to manipulate database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in Digiwin EasyFlow .NET poses a critical risk of complete database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-5963

Affected Software: Digiwin EasyFlow .NET

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands into the application. The flaw enables unauthorized parties to read, modify, or delete sensitive data stored within the backend database.

Business Impact

The exploitation of this vulnerability can result in the full compromise of the application's database, leading to unauthorized disclosure or destruction of sensitive corporate information. With a CVSS score of 9.8, this flaw represents a critical risk to business operations, data integrity, and compliance requirements.

Remediation Plan

Immediate Action: Update Digiwin EasyFlow .NET to the latest available version provided by the vendor to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database access logs for unusual patterns, such as unexpected query structures, unauthorized data export attempts, or large-scale record deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection signatures to detect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity and the unauthenticated nature of this vulnerability, immediate patching is required. Organizations should prioritize updating their Digiwin EasyFlow .NET instances to prevent potential data breaches and unauthorized system access.

---METADATA---
VENDOR: AIL Project
PRODUCT: AIL Framework
AFFECTED_VERSIONS: 0 through v6.9.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AIL Framework is susceptible to a path traversal vulnerability within its PDF object handling component, potentially allowing unauthorized file access.

Executive Summary:
A path traversal vulnerability in the AIL Framework allows authenticated attackers to potentially access sensitive files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59510

Affected Software: AIL Project AIL Framework

Affected Versions: 0 through v6.9.0

Vulnerability: The application fails to properly sanitize input during PDF object processing, which enables path traversal. This vulnerability requires a low-privileged authenticated user to trigger the flaw.

Business Impact

The ability to perform path traversal allows an attacker to read arbitrary files on the underlying server, which may lead to the exposure of sensitive configuration files, credentials, or proprietary data. With a CVSS score of 7.1, this is classified as a High severity issue. Failure to mitigate this risk could result in a full compromise of the application's data confidentiality and potential escalation of privileges within the host environment.

Remediation Plan

Immediate Action: Update the AIL Framework to a version beyond v6.9.0 once the vendor releases a patched version. In the interim, restrict access to the PDF processing functionality to trusted users only.

Proactive Monitoring: Review application access logs for unusual file path patterns or directory traversal sequences (e.g., ../) associated with PDF handling requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block path traversal patterns in incoming request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This path traversal vulnerability represents a significant security risk to the AIL Framework. Administrators should prioritize monitoring for anomalous activity and prepare to deploy the vendor-supplied patch as soon as it becomes available to ensure the integrity and confidentiality of the host system.

---METADATA---
VENDOR: cve-search
PRODUCT: cve-search
AFFECTED_VERSIONS: v4.0 through v6.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The cve-search application is vulnerable to improper input validation in its API, allowing unauthenticated remote attackers to read arbitrary MongoDB collections, including administrative credentials.

Executive Summary:
An unauthenticated input validation vulnerability in cve-search allows remote attackers to exfiltrate administrative credentials from the underlying MongoDB database.

Vulnerability Details

CVE-ID: CVE-2026-59509

Affected Software: cve-search

Affected Versions: v4.0 through v6.0.0

Vulnerability: This vulnerability is an Improper Input Validation (CWE-20) issue located in the POST /fetch_cve_data endpoint. By manipulating request parameters, an unauthenticated attacker can query arbitrary MongoDB collections, including those containing administrative user hashes.

Business Impact

Successful exploitation allows an attacker to extract user data and password hashes, which can then be cracked offline to gain full administrative control over the cve-search instance. With a CVSS score of 9.2, this represents a critical risk, especially if the instance is used to manage sensitive vulnerability management data or is integrated into other security workflows.

Remediation Plan

Immediate Action: Update the cve-search software to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Review access logs for the /fetch_cve_data endpoint, specifically looking for unusual regex patterns or attempts to access collections other than those intended for standard use.

Compensating Controls: Restrict network access to the cve-search instance using IP allowlisting or VPN requirements to prevent unauthorized access to the API endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of access to administrative hashes, this vulnerability must be patched immediately. Ensure that the update is applied and verify that the instance is not exposed to the public internet without proper authentication or network-level restrictions.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in ISC BIND 9 leads to a use-after-free vulnerability, potentially causing undefined behavior or service disruption.

Executive Summary:
A race condition vulnerability in ISC BIND 9 could lead to a use-after-free condition, posing a risk of service instability or potential remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-5947

Affected Software: ISC BIND 9

Affected Versions: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This vulnerability is caused by a race condition (CWE-362) that triggers a use-after-free (CWE-416) condition. The flaw can be triggered remotely by sending specific queries, making it a serious concern for DNS infrastructure.

Business Impact

The CVSS score of 7.5 reflects a High severity. As DNS is a foundational service, successful exploitation could lead to denial-of-service (DoS) conditions, potentially causing widespread network outages and service unavailability for the organization.

Remediation Plan

Immediate Action: Upgrade to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1 immediately.

Proactive Monitoring: Monitor BIND server logs for crashes or unexpected restarts, which may indicate attempted exploitation of the race condition.

Compensating Controls: Ensure that BIND instances are protected by access control lists (ACLs) to limit query sources and minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of DNS infrastructure, this patch should be prioritized in all production environments. Verify your current BIND version immediately and schedule an emergency maintenance window to apply the relevant security update.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple flaws in the BIND 9 named component allow for improper input validation and out-of-bounds reads when handling non-Internet DNS message classes.

Executive Summary:
A critical vulnerability in the ISC BIND 9 DNS server software allows for potential service disruption or crashes due to improper handling of specific DNS message classes.

Vulnerability Details

CVE-ID: CVE-2026-5946

Affected Software: ISC BIND 9

Affected Versions: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and associated Subscription Edition (S1) versions.

Vulnerability: This vulnerability involves improper input validation (CWE-20), out-of-bounds read (CWE-125), and reachable assertions (CWE-617) within named. It can be triggered by unauthenticated remote attackers sending specially crafted DNS queries containing non-standard classes like CHAOS, HESIOD, or meta-classes.

Business Impact

Successful exploitation of this flaw can lead to a denial-of-service (DoS) condition, crashing the DNS service and rendering name resolution unavailable for dependent infrastructure. Given the CVSS score of 7.5, this poses a significant risk to network availability and business continuity.

Remediation Plan

Immediate Action: Upgrade to the patched releases: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1.

Proactive Monitoring: Monitor named service logs for frequent restarts or crash reports coinciding with unusual DNS query traffic patterns.

Compensating Controls: Implement firewall rules to drop non-standard DNS query traffic if your environment does not require support for CHAOS or HESIOD classes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations running BIND 9 must prioritize patching to the versions listed above. Given the potential for automated exploitation, failure to address this flaw could lead to significant infrastructure outages.

---METADATA---
VENDOR: pnpm
PRODUCT: pnpm
AFFECTED_VERSIONS: < 10.34.4, >= 11.0.0, < 11.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
pnpm is affected by a path traversal vulnerability that may allow for unauthorized file system operations.

Executive Summary:
A high-severity path traversal vulnerability in the pnpm package manager could allow an attacker to manipulate files outside of intended directories, potentially leading to unauthorized system changes.

Vulnerability Details

CVE-ID: CVE-2026-59195

Affected Software: pnpm pnpm

Affected Versions: < 10.34.4, >= 11.0.0, < 11.8.0

Vulnerability: This vulnerability is categorized as a path traversal flaw (CWE-22). It allows an unauthenticated attacker to bypass directory restrictions, potentially resulting in unauthorized file integrity modifications.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to the software supply chain and CI/CD pipelines. Successful exploitation could allow attackers to overwrite critical files, inject malicious dependencies, or disrupt build processes, leading to widespread compromise of downstream systems and significant reputational damage.

Remediation Plan

Immediate Action: Update pnpm to version 10.34.4 or 11.8.0 or later immediately to resolve the directory traversal flaw.

Proactive Monitoring: Audit logs for unusual file system write operations or unexpected package installation paths during build processes.

Compensating Controls: Implement file system integrity monitoring and ensure that package manager processes run with the least privilege necessary to prevent broad system access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from development and DevOps teams. Ensure all development environments and build servers are patched to the recommended versions to prevent potential supply chain attacks.

---METADATA---
VENDOR: Apereo
PRODUCT: CAS
AFFECTED_VERSIONS: 7.3.0 before 8.0.0-RC6
---END_METADATA---

Description Summary:
A cryptographic flaw in Apereo CAS allows unauthenticated attackers to decrypt webflow conversation states by exploiting AES-GCM initialization vector reuse.

Executive Summary:
Apereo CAS contains a critical cryptographic vulnerability that allows unauthenticated attackers to recover plaintext conversation state, leading to potential identity and session compromise.

Vulnerability Details

CVE-ID: CVE-2026-59099

Affected Software: Apereo CAS

Affected Versions: 7.3.0 before 8.0.0-RC6

Vulnerability: The application utilizes a fixed all-zero initialization vector (IV) with AES-GCM encryption, resulting in keystream reuse. This allows unauthenticated remote attackers to perform known-plaintext analysis on collected webflow execution tokens.

Business Impact

The ability to decrypt conversation states poses a severe threat to authentication security, potentially exposing sensitive session information or facilitating session hijacking. With a CVSS score of 9.1, this represents a critical risk to any enterprise relying on Apereo CAS for centralized authentication and identity management.

Remediation Plan

Immediate Action: Upgrade to version 8.0.0-RC6 or later to implement secure, unique initialization vector generation for all cryptographic operations.

Proactive Monitoring: Monitor authentication logs and webflow traffic for patterns indicative of automated token collection or high-frequency requests from single sources.

Compensating Controls: While no direct WAF rule can fix the underlying cryptographic flaw, rate-limiting login attempts can slow down the token collection process required for this attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability undermines the fundamental security of the CAS identity provider. Organizations must treat this as a high-priority update to prevent the exposure of plaintext session data. Patching is the only effective way to resolve the underlying keystream reuse issue.

---METADATA---
VENDOR: LobeHub
PRODUCT: LobeChat
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability exists in LobeChat that could potentially lead to unauthorized access or data exposure.

Executive Summary:
LobeChat versions prior to 2 are vulnerable to a high-severity security flaw that could result in unauthorized access or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-59095

Affected Software: LobeHub LobeChat

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the LobeChat application framework, potentially allowing an attacker to bypass security controls or perform unauthorized actions. The specific entry point and authentication requirements depend on the underlying implementation flaw within the application logic.

Business Impact

The vulnerability carries a CVSS score of 7.7, indicating a high risk to organizational security. Successful exploitation could lead to the exposure of sensitive chat data, unauthorized usage of LLM resources, or potential compromise of the host environment, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade LobeChat to version 2 or the latest available release immediately to patch the underlying security flaw.

Proactive Monitoring: Review application access logs for irregular patterns and monitor for unauthorized session activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common injection and traversal patterns against the LobeChat interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The urgency of this vulnerability is high due to the potential for data exfiltration within the chat application. Administrators are strongly advised to update to version 2 or later immediately and verify that no unauthorized sessions persist following the update.

---METADATA---
VENDOR: Weaviate
PRODUCT: Weaviate
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability in Weaviate versions prior to 1 allows for potential unauthorized system interaction.

Executive Summary:
A high-severity vulnerability in the Weaviate vector database platform could allow an attacker to bypass security controls and compromise the underlying data infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-59093

Affected Software: Weaviate Weaviate

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core architecture of Weaviate prior to version 1. The exact authentication requirements remain subject to vendor clarification, but the high CVSS impact suggests significant risk to the application's security boundary.

Business Impact

Successful exploitation could lead to total unauthorized access to the vector database, resulting in the compromise of sensitive machine learning datasets and proprietary information. With a CVSS score of 8.8, this vulnerability represents an urgent threat to organizations relying on Weaviate for production AI/ML workloads.

Remediation Plan

Immediate Action: Upgrade all instances of Weaviate to the latest version immediately upon the release of security patches.

Proactive Monitoring: Review system and application access logs for anomalous API calls or unauthorized attempts to reach the database management interface.

Compensating Controls: Restrict network access to the Weaviate API via strict firewall rules and ensure that the instance is not exposed to the public internet without robust authentication layers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates an immediate review of all Weaviate deployments. Administrators must monitor vendor security channels for specific patch details and prepare for an accelerated deployment cycle to neutralize this threat.

---METADATA---
VENDOR: JuiceFS
PRODUCT: JuiceFS
AFFECTED_VERSIONS: JuiceFS through 1.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass in JuiceFS allows unauthenticated remote attackers to access sensitive debug endpoints and filesystem metadata.

Executive Summary:
JuiceFS versions through 1.3.1 are vulnerable to an authentication bypass that permits unauthenticated remote attackers to access sensitive system credentials and data.

Vulnerability Details

CVE-ID: CVE-2026-59092

Affected Software: JuiceFS JuiceFS

Affected Versions: JuiceFS through 1.3.1

Vulnerability: This is an authentication bypass vulnerability that permits unauthenticated remote attackers to access sensitive debug and metrics endpoints. By exploiting this, an attacker can retrieve process command lines containing database credentials and obtain full read/write access to filesystem metadata.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a critical security failure. Because it allows for the exfiltration of database credentials and grants full control over filesystem metadata, an attacker could compromise the entire storage backend, leading to total data loss, unauthorized data modification, or long-term persistence in the environment.

Remediation Plan

Immediate Action: Update JuiceFS to the version containing the fix (commit a46979c).

Proactive Monitoring: Inspect server logs for unauthorized access attempts to debug or metrics endpoints and monitor for any anomalous database connection requests.

Compensating Controls: Ensure that sensitive debug and metrics endpoints are not exposed to the public internet; implement network-level access control lists (ACLs) to restrict access to trusted management IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to the exposure of credentials and metadata. Organizations must prioritize patching to the corrected commit immediately. If an immediate update is not possible, ensure these endpoints are isolated from any untrusted network segments to prevent remote exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 147.0.7727.55
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Media component of Google Chrome allows remote attackers to execute arbitrary code via a crafted HTML page.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome's Media component enables remote code execution, posing a significant risk to end-user workstations.

Vulnerability Details

CVE-ID: CVE-2026-5883

Affected Software: Google Chrome

Affected Versions: prior to 147.0.7727.55

Vulnerability: The vulnerability is a use-after-free error occurring within the Media processing logic, which can be triggered by a remote attacker through a specially crafted HTML page to execute code within the browser sandbox.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on the host machine, potentially leading to malware installation, credential theft, or further lateral movement within the network. With a CVSS score of 8.8, this vulnerability is a high-priority risk for all endpoints utilizing the Chrome browser.

Remediation Plan

Immediate Action: Update Google Chrome to version 147.0.7727.55 or later across all managed devices.

Proactive Monitoring: Review endpoint security logs for unusual browser activity or attempts to load malicious media files.

Compensating Controls: Enforce browser security policies that restrict the execution of untrusted scripts and ensure all endpoints are running active EDR solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser-based vulnerabilities are common targets for attackers. Organizations should ensure that the automatic update mechanism for Google Chrome is functioning correctly or push the update to all endpoints immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Google
PRODUCT: Chrome for Mac
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Insufficient validation of untrusted input in the ANGLE graphics component of Google Chrome for Mac allows for potential code execution.

Executive Summary:
A vulnerability in Google Chrome for Mac's ANGLE component allows for potential remote code execution due to insufficient input validation.

Vulnerability Details

CVE-ID: CVE-2026-5879

Affected Software: Google Chrome for Mac

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is caused by insufficient validation of untrusted input within the ANGLE graphics layer. An unauthenticated attacker can trigger this flaw by enticing a user to visit a malicious site, leading to code execution.

Business Impact

Compromise of the browser on Mac systems can lead to unauthorized access to sensitive user data and local files. The CVSS score of 8.8 highlights the severity of this vulnerability for Mac-based corporate environments.

Remediation Plan

Immediate Action: Update Google Chrome on all Mac systems to version 147 or later.

Proactive Monitoring: Monitor for unusual graphics-related processes or browser crashes which could indicate exploitation.

Compensating Controls: Ensure macOS security settings are configured to minimize the impact of browser-based exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mac users are equally susceptible to browser-based attacks. Security teams should ensure that all Chrome installations on macOS are updated promptly to mitigate this high-severity risk.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows for potential arbitrary code execution.

Executive Summary:
A type confusion vulnerability in Google Chrome’s V8 engine presents a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5865

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a type confusion error within the V8 JavaScript engine. An unauthenticated attacker can exploit this by crafting a malicious website, causing the browser to execute arbitrary code.

Business Impact

Exploiting the V8 engine is a common technique used by threat actors to break out of browser sandboxes. With a CVSS score of 8.8, this vulnerability poses a high risk to the overall security posture of any organization relying on Google Chrome.

Remediation Plan

Immediate Action: Update Google Chrome to version 147 or higher to patch the V8 engine vulnerability.

Proactive Monitoring: Monitor for browser-related anomalies and ensure that endpoints are running updated anti-malware software.

Compensating Controls: Use a modern browser with robust sandboxing and disable unnecessary features or plugins that could increase the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

V8 engine flaws are consistently targeted by attackers. Organizations must ensure that Google Chrome is kept up to date across all workstations to protect against potential exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 147 could allow a remote attacker to trigger a crash or execute code.

Executive Summary:
A use-after-free vulnerability in the WebRTC component of Google Chrome may lead to system compromise if successfully exploited.

Vulnerability Details

CVE-ID: CVE-2026-5860

Affected Software: Google, Chrome

Affected Versions: See vendor advisory

Vulnerability: This is a use-after-free vulnerability within the WebRTC implementation. An attacker could exploit this by enticing a user to visit a malicious website, leading to potential code execution or application instability.

Business Impact

As a browser-based vulnerability, the impact is significant for all users within an organization. A CVSS score of 8.8 indicates high risk, as exploitation can result in the compromise of user sessions, data theft, or malware installation on endpoints.

Remediation Plan

Immediate Action: Update Google Chrome to version 147 or later immediately.

Proactive Monitoring: Monitor for browser-related security alerts and ensure that automatic update mechanisms are functioning across the fleet.

Compensating Controls: Use browser-based security policies to restrict the execution of untrusted scripts or plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser vulnerabilities are frequently targeted. Organizations must ensure that all endpoints are running the latest version of Google Chrome to mitigate the risk of drive-by attacks exploiting this use-after-free flaw.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setWiFiEasyCfg function, specifically through the merge argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5854

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability in the setWiFiEasyCfg function of the CGI handler, where the merge argument is not properly sanitized, allowing remote unauthenticated attackers to execute commands.

Business Impact

The severity of this flaw (CVSS 9.8) means an attacker can gain complete control over the device, leading to significant security risks including data theft, network interception, and further compromise of the local environment.

Remediation Plan

Immediate Action: Deploy the latest firmware update provided by Totolink to remediate the vulnerability.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or attempts to interact with the CGI handler.

Compensating Controls: Block external access to the device’s administrative CGI endpoints using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, significantly increasing the probability of exploitation.

Analyst Recommendation

Prompt firmware updates are critical for all Totolink A7100RU devices. Given the existence of public exploits, organizations should prioritize this remediation to maintain the security and integrity of their network infrastructure.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is vulnerable to remote OS command injection via the setIpv6LanCfg function, exploitable through the addrPrefixLen argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5853

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setIpv6LanCfg function within the CGI handler fails to sanitize user input for the addrPrefixLen parameter, leading to an OS command injection vulnerability accessible to unauthenticated remote attackers.

Business Impact

Successful exploitation results in full control of the device, enabling the attacker to manipulate network traffic and pivot into the internal network. The 9.8 CVSS score reflects the high severity of this remote, unauthenticated access vector.

Remediation Plan

Immediate Action: Update the affected device to the latest firmware version provided by the manufacturer.

Proactive Monitoring: Review system logs for suspicious activity and monitor for unexpected changes to IPv6 settings.

Compensating Controls: Restrict management access to the device to a dedicated, secure management VLAN or trusted local IP addresses.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, necessitating immediate attention to prevent exploitation.

Analyst Recommendation

Given the high-risk nature of this vulnerability and the availability of public exploits, immediate firmware updates are essential. Administrators should treat this as a high-priority remediation task for all deployed A7100RU units.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU allows remote OS command injection via the setIptvCfg function by manipulating the igmpVer argument in the CGI handler.

Executive Summary:
A critical OS command injection flaw in Totolink A7100RU routers permits remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-5852

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability occurs in the setIptvCfg function of the CGI handler. An unauthenticated remote attacker can supply a malicious payload in the igmpVer argument to trigger OS command injection.

Business Impact

The ability to execute arbitrary commands remotely on a network device leads to total compromise of the device's functionality. This could lead to redirection of traffic, man-in-the-middle attacks, and unauthorized access to protected internal resources, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update to address the vulnerability in the CGI handler.

Proactive Monitoring: Monitor for anomalous traffic patterns and unexpected system configuration changes within the router's logs.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent filtering to inspect and block malicious CGI requests directed at the router.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code exists, significantly increasing the risk of active exploitation.

Analyst Recommendation

Urgent patching is required for all Totolink A7100RU devices. Administrators should ensure the latest firmware is deployed to mitigate the risk of remote command execution and potential network-wide compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setUPnPCfg function, specifically through the enable parameter in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-5851

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi component. An unauthenticated attacker can manipulate the enable parameter to inject and execute arbitrary OS commands.

Business Impact

This vulnerability enables full remote control of the affected device, potentially exposing the entire local area network to unauthorized surveillance or data exfiltration. With a CVSS score of 9.8, the impact includes total loss of device integrity and potential compromise of connected internal assets.

Remediation Plan

Immediate Action: Update the device firmware to the latest version supplied by the vendor to eliminate the command injection vector.

Proactive Monitoring: Review system logs for suspicious process spawning and monitor for unexpected changes to the UPnP configuration.

Compensating Controls: Disable UPnP and restrict access to the web management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available. The ease of remote exploitation makes this a high-priority threat.

Analyst Recommendation

Given the availability of public exploits and the critical nature of command injection, users must prioritize firmware remediation. Ensure all Totolink A7100RU devices are patched to prevent remote code execution attacks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU contains an OS command injection vulnerability in the setVpnPassCfg function, allowing remote attackers to execute arbitrary system commands via the pptpPassThru parameter.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5850

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability within the CGI handler’s setVpnPassCfg function. An unauthenticated remote attacker can inject malicious commands through the pptpPassThru argument.

Business Impact

Successful exploitation grants an attacker complete control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of sensitive data, and the establishment of a persistent foothold for further lateral movement within the corporate environment. Given the CVSS score of 9.8, this poses a severe risk to organizational confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink immediately to patch the vulnerable CGI handler.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous command execution patterns.

Compensating Controls: Implement strict firewall rules to restrict access to the device's administrative interface and CGI endpoints from untrusted external networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability. The risk of active exploitation is high; immediate patching is required.

Analyst Recommendation

The presence of a publicly available exploit for this critical command injection flaw necessitates immediate action. Administrators must prioritize updating the firmware on all exposed A7100RU units to prevent unauthorized system access and potential full device takeover.

---METADATA---
VENDOR: EstrellaXD
PRODUCT: Auto_Bangumi
AFFECTED_VERSIONS: Before 3.2.8
---END_METADATA---

Description Summary:
Auto_Bangumi contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrative access.

Executive Summary:
Auto_Bangumi is susceptible to an authentication bypass via hard-coded default credentials, enabling unauthorized administrative access to the application.

Vulnerability Details

CVE-ID: CVE-2026-58466

Affected Software: EstrellaXD Auto_Bangumi

Affected Versions: Before 3.2.8

Vulnerability: The application seeds default credentials during initial startup when the user table is empty. An unauthenticated attacker can leverage these known credentials to authenticate as an administrator and gain full control over the application.

Business Impact

A CVSS score of 9.8 reflects the critical nature of this flaw, as it permits full administrative takeover of the application. This could result in the unauthorized modification of downloader configurations, interception of RSS feeds, and exposure of sensitive API endpoints, potentially leading to a complete compromise of the automated media management workflow.

Remediation Plan

Immediate Action: Update the application to version 3.2.8 or later, which addresses the insecure default user creation process.

Proactive Monitoring: Review system logs for multiple failed or anomalous login attempts and verify the list of authorized users within the application’s administrative interface.

Compensating Controls: Ensure the instance is not exposed to the public internet and require access via a secure VPN or an authenticated reverse proxy to limit the attack surface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of hard-coded credentials represents a significant security oversight that facilitates immediate unauthorized access. Administrators must update the software and verify that no unauthorized user accounts were created during the period the application was exposed. Access control policies should be strictly enforced to prevent unauthorized actors from reaching the login endpoint.

---METADATA---
VENDOR: ajith-ab
PRODUCT: react-native-receive-sharing-intent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in the react-native-receive-sharing-intent library allows malicious co-resident applications to overwrite files outside the intended cache directory.

Executive Summary:
A path traversal vulnerability in the react-native-receive-sharing-intent library allows malicious co-resident applications to conduct unauthorized file system operations.

Vulnerability Details

CVE-ID: CVE-2026-58460

Affected Software: ajith-ab react-native-receive-sharing-intent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a path traversal vulnerability where a malicious application on the same device can supply a crafted _display_name value containing directory traversal sequences. This allows the attacker to write files to arbitrary locations outside the application’s designated cache directory via the ContentProvider.

Business Impact

The CVSS score of 7.7 reflects the risk of privilege escalation and potential data destruction on mobile devices. If exploited, a malicious application could overwrite critical files or configuration data, leading to application instability or the exfiltration of sensitive information stored within the mobile environment.

Remediation Plan

Immediate Action: Update the react-native-receive-sharing-intent dependency in all affected mobile applications to the version containing the security fix.

Proactive Monitoring: Review application logs for unexpected file write errors or anomalous path components in content provider interactions.

Compensating Controls: Implement strict input validation for all data received via ContentProviders to ensure that file names do not contain path traversal characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers should immediately audit their mobile application dependencies and update the affected library. Given the risk of local file system manipulation, ensuring that inputs are properly sanitized is critical for maintaining the security posture of the mobile application.

---METADATA---
VENDOR: Shenzhen Aitemi E Commerce Co.
PRODUCT: M300 Wi-Fi Repeater
AFFECTED_VERSIONS: Hardware model MT02
---END_METADATA---

Description Summary:
The Shenzhen Aitemi M300 Wi-Fi Repeater is vulnerable to unauthenticated OS command injection via the smacfilter_conf handler, allowing remote attackers to execute arbitrary shell commands as root.

Executive Summary:
A critical OS command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater allows unauthenticated attackers to achieve full root-level device compromise.

Vulnerability Details

CVE-ID: CVE-2026-58457

Affected Software: Shenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater

Affected Versions: Hardware model MT02

Vulnerability: This is an OS command injection vulnerability triggered by the lack of sanitization in the smacfilter_conf web backend handler. An unauthenticated, network-adjacent attacker can inject malicious shell commands into specific GET parameters, which are then executed with root privileges.

Business Impact

Successful exploitation grants an attacker full root-level control over the affected Wi-Fi repeater. This allows for persistent unauthorized access to the local network, traffic interception, and potential lateral movement into internal systems. Given the CVSS score of 9.8, the risk of total device takeover and subsequent network compromise is extreme.

Remediation Plan

Immediate Action: Update the firmware of the Shenzhen Aitemi M300 Wi-Fi Repeater to the latest version provided by the manufacturer.

Proactive Monitoring: Review web access logs for unusual GET requests containing semicolon-delimited payloads directed at the smacfilter_conf handler.

Compensating Controls: Restrict access to the device management interface to trusted administrative subnets or disable remote management features until the firmware is updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk due to the potential for unauthenticated root access. Administrators should prioritize the application of firmware updates immediately to prevent unauthorized device control and potential network-wide security breaches.

---METADATA---
VENDOR: Notifiarr
PRODUCT: dockwatch
AFFECTED_VERSIONS: Through 0.6.567
---END_METADATA---

Description Summary:
Dockwatch is vulnerable to unauthenticated OS command injection via improper session handling and unsanitized input in the composePath parameter.

Executive Summary:
Dockwatch is vulnerable to unauthenticated remote OS command injection, allowing attackers to gain full host control due to insecure Docker socket mounting.

Vulnerability Details

CVE-ID: CVE-2026-58455

Affected Software: Notifiarr dockwatch

Affected Versions: Through 0.6.567

Vulnerability: The vulnerability exists due to a missing exit condition after an authentication redirect, combined with unsanitized input passed to shell_exec() in ajax/compose.php. An attacker can manipulate session flags to bypass authentication and inject arbitrary shell commands.

Business Impact

With a CVSS score of 9.8, this flaw allows an attacker to achieve full host system compromise. Because Dockwatch is typically deployed with the Docker socket mounted, a successful command injection allows the attacker to escape the container, modify host-level files, and gain complete control over the underlying infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of dockwatch to ensure proper authentication enforcement and input sanitization.

Proactive Monitoring: Monitor system process logs for unexpected shell execution originating from the web server process and audit Docker container configurations for security risks.

Compensating Controls: If immediate patching is not possible, remove the Docker socket mount from the container or restrict network access to the dockwatch interface using firewall rules.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that effectively grants host-level access to any unauthenticated attacker. Remediation must be performed immediately, and environments should be audited for signs of prior unauthorized access. Given the risk of container breakout, users should prioritize the principle of least privilege regarding Docker socket access in all deployments.

---METADATA---
VENDOR: JAIOTlink
PRODUCT: C492A-W6 Wi-Fi IP Camera
AFFECTED_VERSIONS: 4.8.30.57701411
---END_METADATA---

Description Summary:
JAIOTlink C492A-W6 IP cameras contain hard-coded default credentials that allow network-adjacent attackers to gain unauthorized administrative access.

Executive Summary:
JAIOTlink C492A-W6 Wi-Fi IP cameras are susceptible to unauthorized access due to hard-coded default credentials, enabling full control over camera functionality.

Vulnerability Details

CVE-ID: CVE-2026-58453

Affected Software: JAIOTlink C492A-W6 Wi-Fi IP Camera

Affected Versions: 4.8.30.57701411

Vulnerability: The device features hard-coded credentials that grant network-adjacent attackers administrative access via the HTTP service on port 80. This allows unauthorized access to video streams, snapshots, and sensitive configuration interfaces, including a command injection surface.

Business Impact

The CVSS score of 9.8 reflects the ease of access and the potential for total device compromise. Unauthorized control of IP cameras can lead to the loss of physical security, privacy violations, and the potential for the camera to be used as a foothold for further network exploitation.

Remediation Plan

Immediate Action: Update the camera firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the camera's management interface and audit existing device configurations.

Compensating Controls: Place IP cameras on an isolated VLAN with strict network access control lists (ACLs) to prevent unauthorized network-adjacent access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing JAIOTlink C492A-W6 cameras must treat this as a high-priority issue. Beyond firmware updates, network segmentation is essential to restrict access to management interfaces and mitigate the risk posed by hard-coded credentials.

---METADATA---
VENDOR: JAIOTlink
PRODUCT: C492A-W6 Wi-Fi IP Camera
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware version 4 contain a security vulnerability that may lead to unauthorized access.

Executive Summary:
A high-severity vulnerability in JAIOTlink C492A-W6 IP cameras could allow attackers to gain unauthorized access to camera feeds or device controls.

Vulnerability Details

CVE-ID: CVE-2026-58452

Affected Software: JAIOTlink C492A-W6 Wi-Fi IP Camera

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within firmware version 4 of the JAIOTlink C492A-W6 device. It potentially allows an attacker to bypass authentication mechanisms to interact with the device's management interface.

Business Impact

A CVSS score of 8.8 indicates a critical exposure for physical security systems. Unauthorized access could result in the compromise of video surveillance data, privacy violations, or the use of these devices as entry points into the broader internal network, creating severe reputational and security risks.

Remediation Plan

Immediate Action: Identify all deployed C492A-W6 units and apply the vendor-provided firmware update that addresses this vulnerability.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the camera devices, which may indicate unauthorized remote access or command-and-control communication.

Compensating Controls: Isolate IP cameras on a dedicated VLAN with no direct internet access and restrict management interface access to a hardened jump host.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this as a priority update. Given the public-facing nature of many IP cameras, the risk of remote exploitation is elevated; ensure all devices are patched or logically isolated from the public internet immediately to prevent compromise.

---METADATA---
VENDOR: neuml
PRODUCT: txtai
AFFECTED_VERSIONS: Through 9.10.0
---END_METADATA---

Description Summary:
The txtai API /reindex endpoint is vulnerable to remote code execution due to improper input validation in the function parameter, which allows arbitrary code execution if authentication is disabled.

Executive Summary:
A critical remote code execution vulnerability in txtai allows unauthorized attackers to run arbitrary commands on the server when the API is exposed without token-based authentication.

Vulnerability Details

CVE-ID: CVE-2026-58449

Affected Software: neuml txtai

Affected Versions: Through 9.10.0

Vulnerability: The /reindex endpoint fails to validate the function body parameter, which is resolved via txtai.util.Resolver. When the API is deployed without a mandatory TOKEN, an unauthenticated attacker can supply a malicious callable, such as subprocess.getoutput, to execute commands on the host.

Business Impact

With a CVSS score of 9.8, this vulnerability allows an attacker to gain full command execution under the privileges of the application process. This could lead to complete system takeover, unauthorized access to the underlying data, and the ability to move laterally within the environment.

Remediation Plan

Immediate Action: Update txtai to the latest version and ensure that the new reindex configuration flag is properly implemented to secure the endpoint.

Proactive Monitoring: Review application logs for unauthorized calls to the /reindex endpoint and monitor for unexpected subprocess creation or shell activity emanating from the txtai process.

Compensating Controls: Immediately enable token-based authentication for the txtai API and place the service behind a Web Application Firewall (WAF) to filter suspicious requests attempting to reach the /reindex endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using txtai must treat this as a critical update. If the API is currently exposed without authentication, it is highly recommended to take the service offline until the patch is applied and security tokens are correctly configured to prevent unauthorized command execution.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An HMAC ambiguity in Gitea Actions Artifacts allows cross-repository data reads and cross-task state writes, compromising the integrity and confidentiality of CI/CD pipelines.

Executive Summary:
A critical vulnerability in Gitea Actions allows attackers to bypass repository boundaries, resulting in unauthorized access to sensitive artifacts and the ability to manipulate CI/CD task states.

Vulnerability Details

CVE-ID: CVE-2026-58426

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves an HMAC ambiguity in the V4 signed URLs for Actions Artifacts, which can be exploited by an authenticated user to perform unauthorized read operations across repositories and write operations across tasks.

Business Impact

Exploitation of this flaw undermines the security of the entire CI/CD environment. Attackers could steal proprietary source code or build secrets, or inject malicious code into build processes by manipulating task states. The CVSS score of 9.6 highlights the extreme risk to the software supply chain and organizational development integrity.

Remediation Plan

Immediate Action: Update the Gitea instance to the latest version as specified in the vendor's security advisory to address the HMAC validation logic.

Proactive Monitoring: Review CI/CD pipeline logs for unauthorized artifact access or unexpected changes to task statuses.

Compensating Controls: Implement strict repository-level access controls and minimize the use of shared runners where possible to reduce the blast radius of potential exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for supply chain compromise, organizations utilizing Gitea Actions must prioritize this patch. Security teams should work closely with DevOps engineers to ensure the update is validated in a non-production environment before full deployment to critical CI/CD infrastructure.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Gitea workflow approval mechanism allows users to bypass the designated approval gate for permanent fork pull requests.

Executive Summary:
A workflow approval bypass vulnerability in Gitea Open Source Git Server compromises the integrity of the code review process by allowing unauthorized pull request merges.

Vulnerability Details

CVE-ID: CVE-2026-58424

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a logic flaw in the permanent fork PR workflow, which fails to properly enforce approval gates. This allows authenticated users with sufficient repository access to bypass mandatory review processes and merge code changes without authorization.

Business Impact

Exploitation of this flaw undermines the secure software development lifecycle (SDLC) by enabling the injection of unverified or malicious code into protected branches. With a CVSS score of 8.9, this vulnerability poses a high risk to code integrity, which could be leveraged to introduce backdoors or supply chain vulnerabilities into the production environment.

Remediation Plan

Immediate Action: Apply the vendor-provided security update immediately upon release to restore integrity to the pull request approval gates.

Proactive Monitoring: Audit recent pull request activity and merge history to identify any code changes that were merged without the required approvals.

Compensating Controls: Enforce manual code reviews via external process or implement branch protection rules that require administrative intervention for critical merges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant breakdown in repository governance. Organizations should treat this as a high-priority issue and ensure that all development workflows are re-validated once the patch is applied to ensure no unauthorized code was introduced during the vulnerable window.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A malformed SSH sub-verb allows unauthenticated attackers to bypass LFS authentication, resulting in unauthorized read access to private repositories.

Executive Summary:
A critical authentication bypass vulnerability in Gitea Open Source Git Server exposes private repository data to unauthorized actors.

Vulnerability Details

CVE-ID: CVE-2026-58423

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a logic flaw in the LFS (Large File Storage) authentication mechanism triggered by a malformed SSH sub-verb. The flaw allows an unauthenticated attacker to bypass security checks and gain unauthorized read access to private repository contents.

Business Impact

Successful exploitation leads to the exposure of proprietary source code, intellectual property, and sensitive configuration data stored within private repositories. Given the CVSS score of 7.7, this represents a significant risk to organizational confidentiality and competitive advantage, potentially leading to long-term reputational damage.

Remediation Plan

Immediate Action: Identify and apply the vendor-provided security update as soon as it becomes available to patch the LFS authentication logic.

Proactive Monitoring: Review SSH and LFS access logs for anomalous sub-verb patterns or unexpected read requests targeting private repositories.

Compensating Controls: Implement strict network access controls (ACLs) to limit SSH access to the Gitea instance to known, trusted IP ranges until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass authentication for private repositories constitutes a severe threat to code integrity and confidentiality. Administrators must prioritize the installation of official patches and monitor access logs for signs of unauthorized repository enumeration or data exfiltration.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea Gitea Open Source Git Server: 0 through 1.26.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authorization flaw in the OAuth sign-in callback mechanism allows attackers to silently re-enable previously disabled administrator accounts.

Executive Summary:
A critical authorization bypass in Gitea Open Source Git Server allows attackers to regain access to disabled accounts, posing a severe risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-58422

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea Gitea Open Source Git Server: 0 through 1.26.1

Vulnerability: This vulnerability involves improper authorization handling during the OAuth sign-in callback process. An attacker can exploit this to silently re-enable accounts that have been explicitly disabled by administrators, effectively bypassing account lockout security policies.

Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability represents a severe threat to the integrity and confidentiality of the environment. Successful exploitation allows unauthorized access to potentially privileged accounts, leading to full system compromise, data theft, and loss of control over the Git infrastructure.

Remediation Plan

Immediate Action: Update Gitea to version 1.26.2 or later to address the flaw in the OAuth callback authentication logic.

Proactive Monitoring: Review audit logs for unexpected account reactivations or suspicious OAuth sign-in events, particularly for accounts that were previously marked as disabled.

Compensating Controls: Temporarily disable OAuth provider integration if patching cannot be performed immediately, forcing users to authenticate via standard local credentials.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jul 3, 2026, proof-of-concept exploits are available. The ability to bypass administrative account controls makes this an urgent priority for all Gitea administrators.

Analyst Recommendation

This is a critical security issue that requires immediate attention. Security teams must ensure all instances are updated to the latest version to prevent unauthorized account access and potential privilege escalation.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea Gitea Open Source Git Server: 0 up to (excluding) 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated Regular Expression Denial of Service (ReDoS) vulnerability exists in Gitea's CODEOWNERS pattern matching, allowing attackers to cause excessive resource consumption.

Executive Summary:
An unauthenticated ReDoS vulnerability in Gitea Open Source Git Server allows remote attackers to trigger a denial of service via crafted CODEOWNERS patterns.

Vulnerability Details

CVE-ID: CVE-2026-58421

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea Gitea Open Source Git Server: 0 up to (excluding) 1.26.2

Vulnerability: This is an unauthenticated ReDoS vulnerability affecting the CODEOWNERS pattern matching functionality. By submitting specially crafted patterns, an attacker can exhaust system resources, leading to a denial of service.

Business Impact

The CVSS score of 7.5 (High) reflects the potential for significant service disruption. While the vulnerability does not lead to data exfiltration or unauthorized modification, the resulting denial of service can render the Git infrastructure unavailable to developers, stalling CI/CD pipelines and software delivery processes.

Remediation Plan

Immediate Action: Upgrade all Gitea instances to version 1.26.2 or later to apply the necessary patches for pattern matching logic.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for sudden spikes that may indicate attempts to trigger ReDoS conditions.

Compensating Controls: Implement WAF rules to sanitize or block malformed inputs in requests targeting repository configuration files or CODEOWNERS patterns.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jul 3, 2026, proof-of-concept exploits are available for this vulnerability. Given the ease of exploitation, immediate patching is recommended to prevent service degradation.

Analyst Recommendation

The availability of proof-of-concept exploits significantly elevates the risk of this vulnerability being leveraged by malicious actors. Organizations should prioritize updating their Gitea installations to version 1.26.2 immediately to neutralize the threat.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea Open Source Git Server < 1.26.3 and < 1.27.0-dev
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Gitea Notification API leaks private issue metadata even after access has been revoked, resulting in an information disclosure vulnerability.

Executive Summary:
A high-severity information disclosure vulnerability in the Gitea Notification API allows unauthorized access to private issue metadata, necessitating an immediate update to version 1.26.3 or later.

Vulnerability Details

CVE-ID: CVE-2026-58419

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea Open Source Git Server < 1.26.3 and < 1.27.0-dev

Vulnerability: The vulnerability is an information disclosure flaw (CWE-200) within the Notification API. It occurs because the API fails to correctly enforce access control checks when retrieving issue metadata, allowing users to view sensitive information even after their access permissions have been revoked.

Business Impact

The CVSS score of 7.5 (High) highlights the risk to sensitive intellectual property. If exploited, an attacker could gain visibility into private development issues, security vulnerabilities, or project roadmaps, leading to significant competitive harm and loss of confidentiality for all projects hosted on the affected Gitea instance.

Remediation Plan

Immediate Action: Update Gitea to version 1.26.3 or higher immediately to apply the necessary access control patches.

Proactive Monitoring: Review audit logs for suspicious API access patterns, particularly queries directed at the Notification API that may have been performed by users whose access was recently revoked.

Compensating Controls: If an immediate update is not feasible, restrict public access to the Gitea API and implement IP-based access controls to limit the surface area available to potential attackers.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 3, 2026, there is public information available regarding this vulnerability. Given the ease of access to the API and the existence of proof-of-concept information, the risk of exploitation is notable.

Analyst Recommendation

This vulnerability represents a significant risk to the confidentiality of development environments. Organizations should prioritize updating their Gitea instances to version 1.26.3 or later to ensure that access control logic is correctly enforced for all API endpoints.