---METADATA---
VENDOR: isaacs
PRODUCT: node-tar
AFFECTED_VERSIONS: < 7.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The node-tar library is vulnerable to an infinite loop condition when processing malformed tar archives, resulting in denial-of-service.

Executive Summary:
A high-severity denial-of-service vulnerability in node-tar can be exploited by processing malicious archives, causing the application to hang.

Vulnerability Details

CVE-ID: CVE-2026-59874

Affected Software: isaacs node-tar

Affected Versions: < 7.5.18

Vulnerability: The library is susceptible to an infinite loop (CWE-835) during the processing of archive files. An unauthenticated attacker can trigger this condition by providing a specially crafted tar archive to the application.

Business Impact

The vulnerability can be used to cause an application crash or indefinite hang, leading to service downtime. With a CVSS score of 8.7, this represents a significant threat to any service or pipeline that processes untrusted tar files, potentially impacting CI/CD workflows or file upload features.

Remediation Plan

Immediate Action: Upgrade the node-tar dependency to version 7.5.18 or later to ensure the infinite loop condition is resolved.

Proactive Monitoring: Monitor application logs and system resource usage for processes stuck in a high-CPU state during file extraction or archive processing operations.

Compensating Controls: Implement strict file size and type validation for all incoming archives before passing them to the extraction utility.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw is automatable and affects a widely used library, the risk of exploitation is elevated.

Analyst Recommendation

This vulnerability should be addressed immediately in all Node.js projects utilizing the node-tar library. Ensure that all dependencies are audited and updated to version 7.5.18 to prevent potential denial-of-service attacks against your infrastructure.

---METADATA---
VENDOR: isaacs
PRODUCT: node-tar
AFFECTED_VERSIONS: < 7.5.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The node-tar library for Node.js fails to enforce resource limits during archive extraction, allowing attackers to trigger denial-of-service via crafted gzip bombs.

Executive Summary:
A critical vulnerability in the isaacs node-tar library allows unauthenticated attackers to cause resource exhaustion by submitting maliciously crafted archives.

Vulnerability Details

CVE-ID: CVE-2026-59873

Affected Software: isaacs node-tar

Affected Versions: < 7.5.19

Vulnerability: This vulnerability (CWE-770) stems from a failure to enforce hard upper bounds on total decompressed data, entry counts, or decompression ratios. An unauthenticated attacker can supply a crafted archive that exhausts CPU and disk space upon processing.

Business Impact

The ability to trigger resource exhaustion poses a significant risk to service availability. Successful exploitation can lead to a complete denial-of-service for applications relying on the library, potentially impacting critical business workflows. Given the CVSS score of 9.2, this vulnerability is considered critical as it allows for trivial exploitation against exposed services.

Remediation Plan

Immediate Action: Update the isaacs node-tar library to version 7.5.19 or later immediately to implement necessary resource constraints.

Proactive Monitoring: Monitor server CPU and disk usage metrics for anomalous spikes during archive processing tasks.

Compensating Controls: Implement strict file size limits and scan all incoming archives via a robust security gateway or sandbox before handing them off to the node-tar processing logic.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a high-risk vector for availability-based attacks. Organizations utilizing node-tar for file uploads or processing must prioritize updating to version 7.5.19 to ensure proper resource management is enforced.

---METADATA---
VENDOR: Vim
PRODUCT: Vim
AFFECTED_VERSIONS: < 9.2.0735
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in Vim allows local attackers to execute arbitrary code via malicious input, potentially resulting in full system compromise.

Executive Summary:
Vim versions prior to 9.2.0735 are vulnerable to a code injection flaw that could allow a local attacker to execute arbitrary commands with the privileges of the user running the application.

Vulnerability Details

CVE-ID: CVE-2026-59858

Affected Software: Vim

Affected Versions: < 9.2.0735

Vulnerability: This vulnerability is identified as CWE-94: Improper Control of Generation of Code. The flaw allows an attacker to inject and execute arbitrary code, requiring user interaction (typically opening a malicious file) to trigger the exploit.

Business Impact

The vulnerability carries a CVSS score of 8.4, which is categorized as High. A successful exploit could lead to full loss of confidentiality, integrity, and availability for the local user session. In environments where Vim is used by administrative or automated service accounts, this could facilitate privilege escalation or lateral movement within the host system.

Remediation Plan

Immediate Action: Update the Vim installation to version 9.2.0735 or later immediately to resolve the injection flaw.

Proactive Monitoring: Audit command-line history and system logs for unexpected child processes or unusual shell invocations triggered by the Vim editor.

Compensating Controls: Implement strict file access controls and ensure that untrusted files are opened in restricted modes (e.g., vim -Z or rvim) where applicable.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this code injection vulnerability necessitates prompt action. Organizations should prioritize patching all systems running Vim to the specified secure version to prevent unauthorized command execution.

---METADATA---
VENDOR: Vim
PRODUCT: Vim
AFFECTED_VERSIONS: < 9.2.0736
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability (CWE-94) exists in the Vim text editor, allowing for arbitrary code execution when processing malicious input.

Executive Summary:
Vim versions prior to 9.2.0736 contain a code injection vulnerability that could allow an attacker to execute arbitrary commands on a user's system.

Vulnerability Details

CVE-ID: CVE-2026-59856

Affected Software: Vim

Affected Versions: < 9.2.0736

Vulnerability: The vulnerability is an improper control of generation of code (CWE-94) within the Vim text editor. An attacker can exploit this by enticing a user to open a specially crafted file, leading to arbitrary code execution with the user's privileges.

Business Impact

With a CVSS score of 8.4, this vulnerability is critical for environments where Vim is used to process untrusted files. Successful exploitation could lead to full system compromise, unauthorized data access, and lateral movement within the network, as the attacker inherits the permissions of the user running the application.

Remediation Plan

Immediate Action: Upgrade all Vim installations to version 9.2.0736 or later immediately.

Proactive Monitoring: Monitor for unexpected shell invocations or unusual child processes spawned by the Vim editor.

Compensating Controls: Utilize sandboxing or containerization to run Vim when opening untrusted files, and disable dangerous modeline features in the editor configuration.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the prevalence of Vim in development and administrative workflows, patching is of the highest priority. System administrators should verify current versions and enforce the update to 9.2.0736 across all workstations and servers to mitigate the risk of code injection.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan is vulnerable to stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags, potentially allowing remote execution of malicious scripts.

Executive Summary:
An unauthenticated Cross-Site Scripting (XSS) vulnerability in SiYuan could allow attackers to execute arbitrary code in the context of a user's session.

Vulnerability Details

CVE-ID: CVE-2026-59855

Affected Software: SiYuan

Affected Versions: < 3.7.1

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-80) resulting from the failure to properly sanitize HTML input. As the attack vector is network-based and requires no authentication, an attacker can inject malicious scripts into the application that execute when viewed by other users.

Business Impact

Successful exploitation of this vulnerability can lead to full account takeover, session hijacking, and the theft of sensitive personal knowledge data stored within the SiYuan instance. With a CVSS score of 8.6, this flaw presents a high risk of unauthorized access and potential data exfiltration, significantly impacting the confidentiality and integrity of the user's workspace.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.1 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web access logs for unusual patterns or payloads containing script tags associated with user input fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded, which may mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity and the ease of exploitation, organizations and individuals using SiYuan must prioritize updating to version 3.7.1. Failure to patch may allow attackers to compromise the integrity of the knowledge management system and gain unauthorized access to stored data.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SiYuan personal knowledge management system contains multiple vulnerabilities, including Cross-site Scripting (XSS) and Code Injection, allowing for unauthorized remote execution.

Executive Summary:
SiYuan is affected by critical vulnerabilities, including XSS and code injection, that could allow an attacker to execute malicious code within the user's environment.

Vulnerability Details

CVE-ID: CVE-2026-59833

Affected Software: siyuan-note

Affected Versions: < 3.7.1

Vulnerability: The software fails to properly neutralize user input (CWE-79, CWE-116) and control code generation (CWE-94), facilitating XSS and arbitrary code injection. These flaws allow an unauthenticated attacker to inject malicious scripts that execute in the context of the victim's session.

Business Impact

These vulnerabilities present a high risk to users of the SiYuan platform, as successful exploitation could lead to session hijacking, credential theft, or the execution of arbitrary commands on the host machine. With a CVSS score of 8.6, the potential for widespread impact on knowledge management systems is significant, especially if used in collaborative environments.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.1 or later to apply the necessary security patches and input validation controls.

Proactive Monitoring: Inspect web access logs for unusual script-based payloads and monitor for unauthorized modifications to local knowledge base files.

Compensating Controls: Use strict Content Security Policy (CSP) headers to mitigate the impact of potential XSS attacks if immediate updates are delayed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of code injection in a desktop/web-based application is inherently dangerous.

Analyst Recommendation

Users and administrators should prioritize updating to SiYuan version 3.7.1 immediately. These vulnerabilities allow for significant client-side and potentially server-side compromise, making timely remediation essential for maintaining the security of stored sensitive knowledge assets.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: < 3.7.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan is vulnerable to path traversal, allowing authenticated users to access sensitive files outside of the intended directory structure.

Executive Summary:
A path traversal vulnerability in SiYuan allows an authenticated user to read sensitive files from the server, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59832

Affected Software: SiYuan SiYuan

Affected Versions: < 3.7.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22/CWE-23) that allows an authenticated attacker to escape the application's root directory. The attack is performed over the network and requires the attacker to have an existing user account.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a high risk to data confidentiality. An attacker could exploit this flaw to read arbitrary files on the server, potentially exposing configuration files, credentials, or sensitive user data, leading to a total breach of the application's security posture.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.1 or later to resolve the path traversal flaw.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences (e.g., "../") in requests.

Compensating Controls: Implement strict file system permissions for the user running the SiYuan service to ensure the application cannot access files outside of its designated data directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing SiYuan must prioritize upgrading to version 3.7.1. Given the risk of unauthorized file access, failing to patch this vulnerability leaves the environment exposed to credential theft and sensitive data exfiltration by authenticated users.

---METADATA---
VENDOR: metabase
PRODUCT: metabase
AFFECTED_VERSIONS: >= 1.58.0, < 1.58.15, >= 1.59.0, < 1.59.12, >= 1.60.0, < 1.60.6.3, >= 1.61.0, < 1.61.1.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Metabase instances using H2 database connections are vulnerable to remote code execution via the deserialization of untrusted data in native query results.

Executive Summary:
A critical deserialization vulnerability in Metabase allows authenticated users to execute arbitrary code on the server when connected to an H2 database.

Vulnerability Details

CVE-ID: CVE-2026-59827

Affected Software: metabase metabase

Affected Versions: >= 1.58.0, < 1.58.15, >= 1.59.0, < 1.59.12, >= 1.60.0, < 1.60.6.3, >= 1.61.0, < 1.61.1.4

Vulnerability: The vulnerability exists in the handling of H2 native query results. The application deserializes arbitrary Java objects returned in columns of type OTHER without validation, enabling an authenticated attacker with native query privileges to achieve code execution.

Business Impact

Successful exploitation allows an attacker to bypass application-level controls and execute code directly on the Metabase host. This poses a severe risk of data breach, as the attacker could access the underlying database, credentials, or other system assets. The CVSS score of 9.9 highlights the extreme severity of this flaw, particularly for organizations using Metabase for business intelligence.

Remediation Plan

Immediate Action: Update Metabase to versions 1.58.15, 1.59.12, 1.60.6.3, 1.61.1.4, or later immediately.

Proactive Monitoring: Audit database query logs for suspicious activity, particularly queries involving native H2 calls or unexpected usage of the OTHER data type.

Compensating Controls: Restrict access to the Metabase interface and limit the ability of users to run native database queries to only trusted administrative accounts until patches are applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score and the potential for complete system takeover, applying the vendor-provided patches is the only effective mitigation. Security teams should prioritize patching instances that are exposed to untrusted users or that utilize H2 databases.

---METADATA---
VENDOR: Metabase
PRODUCT: Metabase
AFFECTED_VERSIONS: 1.55.0 to 1.58.15.0, 1.59.0 to 1.59.11, 1.60.0 to 1.60.6.2, 1.61.0 to 1.61.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Metabase fails to validate H2 database connection properties, allowing an authenticated administrator to execute arbitrary Java code on the server.

Executive Summary:
An authenticated administrator can exploit a code injection vulnerability in Metabase, potentially leading to complete server compromise.

Vulnerability Details

CVE-ID: CVE-2026-59826

Affected Software: Metabase

Affected Versions: 1.55.0 through 1.61.1 (specific ranges provided in metadata)

Vulnerability: The application fails to validate unsafe H2 connection properties during database creation. This allows an authenticated administrator to inject and execute arbitrary Java code on the underlying server, bypassing intended application constraints.

Business Impact

While this vulnerability requires administrative authentication, the impact is critical (CVSS 9.1). Successful exploitation grants an attacker the ability to execute code with the privileges of the Metabase application, leading to total system compromise, unauthorized data access, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Metabase to versions 1.58.15.1, 1.59.12, 1.60.6.3, or 1.61.2, depending on your current deployment branch.

Proactive Monitoring: Monitor for unusual database connection strings or unexpected Java process activity originating from the Metabase server.

Compensating Controls: Limit access to the Metabase administrative interface to trusted personnel only and implement network segmentation to isolate the server.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this as a high-priority update. Since the vulnerability allows for arbitrary code execution, ensuring that the software is updated to the patched versions is the only effective way to prevent potential exploitation by malicious insiders or compromised administrator accounts.

---METADATA---
VENDOR: BerriAI
PRODUCT: LiteLLM
AFFECTED_VERSIONS: < 1.84.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
LiteLLM proxy server contains a critical authentication vulnerability that allows unauthenticated access to sensitive functions.

Executive Summary:
A critical authentication bypass vulnerability in LiteLLM prior to version 1.84.0 permits unauthenticated access to sensitive proxy server functions.

Vulnerability Details

CVE-ID: CVE-2026-59822

Affected Software: BerriAI LiteLLM

Affected Versions: < 1.84.0

Vulnerability: The vulnerability involves improper authentication and missing capability checks (CWE-287, CWE-306) within the LiteLLM proxy server. This allows an unauthenticated remote attacker to interact with the API gateway without valid credentials.

Business Impact

The lack of authentication on an AI gateway proxy can lead to unauthorized access to downstream LLM APIs, potentially resulting in significant financial costs, data exposure, or the misuse of sensitive model configurations. With a CVSS score of 8.8, this flaw constitutes a high-severity risk that could lead to full compromise of the gateway's intended access controls.

Remediation Plan

Immediate Action: Update the LiteLLM deployment to version 1.84.0 or later to enforce proper authentication protocols.

Proactive Monitoring: Monitor proxy traffic and API call logs for unexpected patterns or requests originating from unauthorized or unknown IP addresses.

Compensating Controls: Implement network-level access controls, such as an IP allowlist or a WAF, to restrict access to the LiteLLM proxy instance until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of authentication in a proxy gateway, this vulnerability should be treated with extreme urgency. Organizations must update to version 1.84.0 immediately to prevent unauthorized access to their AI infrastructure.

---METADATA---
VENDOR: PasswordPusher
PRODUCT: PasswordPusher
AFFECTED_VERSIONS: 0 up to 2.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PasswordPusher is susceptible to a redirect-based Cross-Site Scripting (XSS) vulnerability due to improper input validation of data-URI schemes in URL push payloads.

Executive Summary:
A high-severity XSS vulnerability in PasswordPusher allows unauthenticated attackers to execute malicious scripts via crafted URL payloads.

Vulnerability Details

CVE-ID: CVE-2026-59802

Affected Software: PasswordPusher

Affected Versions: 0 up to 2.8.1

Vulnerability: The application fails to properly sanitize input, allowing for a redirect-based XSS attack. This flaw permits unauthenticated attackers to inject malicious scripts into the application environment via specifically crafted data-URI schemes.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized script execution in the context of a victim's browser session. This may result in session hijacking, the theft of sensitive credentials, or redirection to malicious third-party domains, potentially leading to significant reputational and data security impacts. Given the CVSS score of 8.2, this vulnerability represents a substantial risk to organizational security.

Remediation Plan

Immediate Action: Upgrade to PasswordPusher version 2.8.1 or later to implement the necessary input validation patches.

Proactive Monitoring: Monitor access logs for unusual URL structures or requests containing encoded data-URI schemes that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect incoming URL parameters and block malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of an XSS vulnerability in a credential management tool is particularly concerning. Administrators should prioritize patching to version 2.8.1 immediately to prevent potential session compromise and ensure the integrity of the PasswordPusher deployment.

---METADATA---
VENDOR: decolua
PRODUCT: 9Router
AFFECTED_VERSIONS: 0 through 0.4.41
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authentication vulnerability in decolua 9Router allows unauthenticated remote attackers to interact with management API endpoints.

Executive Summary:
Unauthenticated access to 9Router API endpoints allows remote attackers to manipulate provider connections, potentially exposing credentials and hijacking traffic.

Vulnerability Details

CVE-ID: CVE-2026-59801

Affected Software: decolua 9Router

Affected Versions: 0 through 0.4.41

Vulnerability: The application lacks necessary authentication middleware in its Next.js API routes, specifically under src/app/api/providers/. This flaw (CWE-306) allows any unauthenticated user to perform administrative actions, including the deletion of connections or redirection of traffic.

Business Impact

The ability to manipulate provider connections carries severe business consequences, including the theft of sensitive API keys and OAuth tokens. By redirecting AI traffic, attackers can intercept proprietary data or disrupt service operations, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the 9Router instance to a version beyond 0.4.41 as soon as a patch is released by the vendor.

Proactive Monitoring: Review API access logs for unauthorized requests to the /api/providers/ endpoint, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement network-level access controls to restrict access to the API endpoints to authorized IP addresses only until the software is updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as an API design oversight makes it highly exploitable once identified.

Analyst Recommendation

This vulnerability presents a high risk to data confidentiality and integrity. Organizations utilizing 9Router should treat this as a high-priority item, ensuring that management interfaces are not exposed to the public internet and that the software is updated immediately upon the availability of a fix.

---METADATA---
VENDOR: decolua
PRODUCT: 9router
AFFECTED_VERSIONS: 0 up to (excluding) 0.4.44
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
9Router contains an OS command injection vulnerability in an unauthenticated API endpoint, allowing remote attackers to execute arbitrary system commands as root.

Executive Summary:
A critical OS command injection vulnerability in 9Router allows remote, unauthenticated attackers to achieve full system compromise via arbitrary command execution.

Vulnerability Details

CVE-ID: CVE-2026-59800

Affected Software: decolua 9router

Affected Versions: 0 up to (excluding) 0.4.44

Vulnerability: The /api/tunnel/tailscale-install endpoint fails to authenticate requests and improperly sanitizes the sudoPassword input, which is passed directly to a shell process, enabling command injection.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability, which allows an attacker to execute commands with root privileges. Successful exploitation can lead to total system takeover, lateral movement within the network, and the exfiltration of sensitive configuration or user data. Confirmed exploitation in the wild further elevates the urgency of this advisory.

Remediation Plan

Immediate Action: Update 9router to version 0.4.44 or later immediately to patch the affected API endpoint.

Proactive Monitoring: Inspect system logs for suspicious process spawning, particularly those involving sudo or shell execution triggered by the web service, as exploitation has been observed in the wild.

Compensating Controls: Restrict network access to the 9Router management interface and associated API endpoints to authorized IP addresses only via network-level firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, exploitation of this vulnerability has been observed in the wild by the Shadowserver Foundation. Immediate patching is mandatory to secure the environment against active threats.

Analyst Recommendation

Given the confirmed active exploitation of this flaw, this issue should be treated with the highest level of urgency. Organizations running 9Router must apply the vendor-provided update immediately to neutralize this critical command injection risk.

---METADATA---
VENDOR: JetBrains
PRODUCT: TeamCity
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JetBrains TeamCity contains an improper authorization vulnerability (CWE-862) that may allow an authenticated user to perform unauthorized actions.

Executive Summary:
An improper authorization flaw in JetBrains TeamCity allows authenticated users to exceed their defined privileges, posing a risk of unauthorized system modification.

Vulnerability Details

CVE-ID: CVE-2026-59796

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1.2

Vulnerability: This is an improper authorization vulnerability where the application fails to adequately verify the permissions of an authenticated user. This allows a standard authenticated user to perform actions typically reserved for higher-privileged roles.

Business Impact

Successful exploitation could result in full unauthorized access to sensitive build configurations, project settings, or administrative functions. With a CVSS score of 8.1, this vulnerability presents a critical risk to the security posture of the development environment, potentially allowing attackers to inject malicious code into build artifacts.

Remediation Plan

Immediate Action: Update all instances of JetBrains TeamCity to version 2026.1.2 to resolve the missing authorization checks.

Proactive Monitoring: Review access control logs and audit trails to identify any suspicious activity where users are accessing functions outside their standard scope.

Compensating Controls: Enforce strict Role-Based Access Control (RBAC) and ensure that administrative interfaces are restricted to trusted network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should apply the vendor-provided patch immediately. Given that this vulnerability allows for privilege escalation, it is imperative to verify that all user roles are correctly configured after the update is applied.

---METADATA---
VENDOR: JetBrains
PRODUCT: TeamCity
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JetBrains TeamCity is vulnerable to Cross-Site Scripting (CWE-79), potentially allowing an attacker to execute arbitrary scripts in a user's browser.

Executive Summary:
A Cross-Site Scripting vulnerability in JetBrains TeamCity could allow unauthorized script execution, posing a significant risk to user session integrity.

Vulnerability Details

CVE-ID: CVE-2026-59795

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1.2

Vulnerability: This vulnerability is a Cross-Site Scripting (XSS) flaw. The attack vector is network-based and requires user interaction, where an attacker could trick a user into executing malicious JavaScript within the context of the TeamCity interface.

Business Impact

The exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of a logged-in user, or the exfiltration of sensitive information. Given the CVSS score of 8.1, the high impact on confidentiality and integrity necessitates immediate attention to prevent potential compromise of build pipelines and administrative accounts.

Remediation Plan

Immediate Action: Upgrade JetBrains TeamCity to version 2026.1.2 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor application logs for unusual request patterns, particularly those involving script tags or unexpected URL parameters.

Compensating Controls: Implement a strict Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) to filter malicious payloads from incoming web traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing JetBrains TeamCity must prioritize patching to version 2026.1.2. Failure to remediate this issue exposes the CI/CD environment to significant risk of manipulation and data theft.

---METADATA---
VENDOR: JetBrains
PRODUCT: TeamCity
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JetBrains TeamCity contains a Cross-Site Scripting (XSS) vulnerability allowing authenticated users with low privileges to execute malicious scripts in the context of the application.

Executive Summary:
An authenticated Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity may allow unauthorized script execution within the application context.

Vulnerability Details

CVE-ID: CVE-2026-59794

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1.2

Vulnerability: The application is susceptible to Cross-Site Scripting (CWE-79), which can be triggered by authenticated users with low privileges. This flaw allows for the injection of malicious client-side scripts that execute when viewed by other users, including administrators.

Business Impact

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to organizational security. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, and potential compromise of sensitive CI/CD pipeline configurations.

Remediation Plan

Immediate Action: Upgrade to TeamCity version 2026.1.2 or later as specified by the vendor.

Proactive Monitoring: Review web server and application audit logs for unusual script injections or unexpected URL parameters associated with user profile updates or build configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect and sanitize incoming HTTP requests, providing a layer of protection until the update can be deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, which limits the attack surface to existing users.

Analyst Recommendation

Given the High severity rating and the potential for lateral movement within the development environment, administrators should prioritize updating TeamCity instances. Patching is the only effective way to neutralize the underlying vulnerability in the application logic.

---METADATA---
VENDOR: JetBrains
PRODUCT: TeamCity
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.2
CONFIDENCE: high
MISSING: technical_details
---END_METADATA---

Description Summary:
JetBrains TeamCity contains a vulnerability related to external control of file name or path, impacting versions prior to 2026.1.2.

Executive Summary:
A high-severity vulnerability in JetBrains TeamCity allows authenticated attackers to potentially compromise the integrity or confidentiality of the build server.

Vulnerability Details

CVE-ID: CVE-2026-59793

Affected Software: JetBrains TeamCity

Affected Versions: 0 up to (excluding) 2026.1.2

Vulnerability: The vulnerability is classified as CWE-73 (External Control of File Name or Path), which may allow an authenticated attacker to manipulate file paths. This often leads to unauthorized file access or modification within the TeamCity environment.

Business Impact

With a CVSS score of 8.8, this flaw represents a significant risk to the CI/CD pipeline. Unauthorized access to build configurations, source code, or deployment artifacts can lead to supply chain compromise, where an attacker could inject malicious code into production software builds.

Remediation Plan

Immediate Action: Update all JetBrains TeamCity instances to version 2026.1.2 or later to mitigate the path manipulation vulnerability.

Proactive Monitoring: Monitor access logs for anomalous file path requests or attempts to access configuration directories outside of standard user scope.

Compensating Controls: Restrict access to the TeamCity administrative interface to trusted internal networks and employ WAF rules to detect directory traversal attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given TeamCity's central role in the software development lifecycle, this vulnerability must be treated with high priority. Organizations should verify their current deployment version and apply the update to 2026.1.2 immediately to prevent potential pipeline contamination.

---METADATA---
VENDOR: JetBrains
PRODUCT: IntelliJ IDEA
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.4, 2026.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JetBrains IntelliJ IDEA is vulnerable to remote code execution due to path traversal in project workspace ID handling.

Executive Summary:
A critical path traversal vulnerability in JetBrains IntelliJ IDEA allows remote attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-59792

Affected Software: JetBrains IntelliJ IDEA

Affected Versions: 0 up to (excluding) 2026.1.4, 2026.2

Vulnerability: This vulnerability involves a path traversal flaw in the project workspace ID handling mechanism. An attacker can leverage this to escape expected directories and execute arbitrary code, necessitating user interaction.

Business Impact

The ability to execute arbitrary code on developer workstations presents a severe security risk, potentially leading to full system compromise, exfiltration of proprietary source code, and lateral movement into the corporate network. With a CVSS score of 9.6, this vulnerability is classified as critical, reflecting the high potential for total system takeover.

Remediation Plan

Immediate Action: Upgrade to version 2026.1.4 or higher immediately to apply the patch for the path traversal flaw.

Proactive Monitoring: Review system access logs for anomalous file path requests or unexpected process execution patterns originating from the IDE.

Compensating Controls: Ensure that developer machines operate under the principle of least privilege, minimizing the impact of potential code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this remote code execution vulnerability, immediate patching is required. Organizations should prioritize the deployment of the updated version across all developer environments to prevent potential compromise of source code repositories and sensitive development assets.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiAclRules function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the mode parameter.

Vulnerability Details

CVE-ID: CVE-2026-5978

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiAclRules function in /cgi-bin/cstecgi.cgi fails to sanitize the mode argument, allowing remote command injection.

Business Impact

The CVSS score of 9.8 signifies a critical risk. Successful exploitation allows an attacker to seize control of the router, leading to potential data interception and lateral network movement.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update.

Proactive Monitoring: Review system logs for suspicious activity and unauthorized command execution.

Compensating Controls: Disable remote access to the web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

All Totolink A7100RU units must be updated immediately to the latest firmware to prevent unauthorized remote command execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiBasicCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability Details

CVE-ID: CVE-2026-5977

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiBasicCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business Impact

With a CVSS score of 9.8, this flaw allows for total system compromise. Attackers can gain persistent access, manipulate network settings, and compromise the security of all devices connected to the router.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or anomalous traffic patterns.

Compensating Controls: Isolate the management interface from the public internet using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits exist for this vulnerability. The risk of exploitation is high and immediate action is required.

Analyst Recommendation

Immediate firmware updates are required for all Totolink A7100RU units to mitigate this critical command injection risk. Failure to patch leaves the device fully vulnerable to remote takeover.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setStorageCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the sambaEnabled parameter.

Vulnerability Details

CVE-ID: CVE-2026-5976

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setStorageCfg function in /cgi-bin/cstecgi.cgi improperly handles the sambaEnabled argument. An attacker can exploit this to inject and execute arbitrary OS commands remotely.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation grants the attacker full control over the affected hardware, which can be used to exfiltrate data, monitor network traffic, or serve as a launchpad for further network attacks.

Remediation Plan

Immediate Action: Update the device to the latest available firmware provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected execution of shell commands or configuration changes.

Compensating Controls: Restrict access to the device's web management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available and actively being used in the wild. The risk of exploitation is critical.

Analyst Recommendation

Due to the availability of public exploits and the severity of the command injection, immediate firmware updates are required to secure affected Totolink A7100RU devices against remote compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setDmzCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5975

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setDmzCfg function within the /cgi-bin/cstecgi.cgi component fails to sanitize the wanIdx argument. This flaw allows a remote attacker to inject and execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability allows complete device takeover. An attacker can gain persistent access to the router, intercept network traffic, and use the device as a pivot point to attack other systems on the internal network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink for the A7100RU.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempted management interface access from unknown sources.

Compensating Controls: Disable remote management access on the WAN interface and ensure the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits for this vulnerability are available. The risk of exploitation is extremely high, and immediate action is required to secure the device.

Analyst Recommendation

This is a critical vulnerability that allows for full device compromise. Given the availability of public exploits, all affected Totolink A7100RU devices should be updated or isolated from the network immediately to prevent unauthorized access.

---METADATA---
VENDOR: Coollabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.469
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a critical risk to self-hosted server environments.

Vulnerability Details

CVE-ID: CVE-2026-59734

Affected Software: Coollabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. An attacker with low-level authenticated access can manipulate input parameters to inject and execute arbitrary system commands on the host server.

Business Impact

Successful exploitation allows an attacker to gain full control over the server hosting the Coolify instance. With a CVSS score of 8.8, this vulnerability carries a high risk of total system compromise, unauthorized data access, and the potential for lateral movement into the wider network infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later immediately to include the necessary input neutralization patches.

Proactive Monitoring: Review system and application logs for unusual process execution patterns or unexpected shell invocations originating from the Coolify service account.

Compensating Controls: Implement strict network segmentation and ensure the application runs with the least privilege necessary to limit the blast radius of a potential command injection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of potential remote code execution, administrators should prioritize updating their Coolify instances. Ensure that all security patches are applied and verify that the application is isolated from sensitive internal resources.

---METADATA---
VENDOR: withastro
PRODUCT: Astro
AFFECTED_VERSIONS: >= 6.4.7, < 6.4.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Astro web framework contains a vulnerability where non-canonical URL paths can be used to bypass authorization decisions.

Executive Summary:
A critical authorization bypass vulnerability in the Astro framework allows unauthenticated attackers to potentially access restricted content by manipulating URL paths.

Vulnerability Details

CVE-ID: CVE-2026-59731

Affected Software: withastro Astro

Affected Versions: >= 6.4.7, < 6.4.8

Vulnerability: This vulnerability involves the use of non-canonical URL paths that circumvent authorization logic. Unauthenticated attackers can leverage these paths to gain unauthorized access to data that should otherwise be protected.

Business Impact

The ability for an attacker to bypass authorization controls directly undermines the confidentiality of the hosted content. This could lead to the unauthorized exposure of sensitive information, potentially resulting in regulatory non-compliance and loss of consumer trust. With a CVSS score of 8.2, this vulnerability demands immediate attention from development and security teams.

Remediation Plan

Immediate Action: Update the Astro framework to version 6.4.8 or later to resolve the canonicalization and authorization logic flaws.

Proactive Monitoring: Review application access logs for attempts to access restricted paths using variations of URL encoding or non-canonical path structures.

Compensating Controls: Implement strict URL normalization at the reverse proxy or WAF layer to ensure only canonical paths are processed by the backend application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of the framework in content delivery, this authorization bypass poses a high risk to data integrity and confidentiality. Organizations must verify their current version and apply the patch to version 6.4.8 as a matter of urgency.

---METADATA---
VENDOR: Ruvnet
PRODUCT: Ruflo
AFFECTED_VERSIONS: < 3.16.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Ruflo's default deployment exposes unauthenticated MCP endpoints, allowing remote attackers to execute terminal commands and steal API keys.

Executive Summary:
A critical authentication bypass in Ruflo allows unauthenticated attackers to gain remote code execution and steal sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-59726

Affected Software: Ruvnet Ruflo

Affected Versions: Prior to 3.16.3

Vulnerability: The application fails to enforce authentication on the MCP bridge endpoints (/mcp and /mcp/:group). This allows an unauthenticated, remote attacker to invoke critical functions, execute OS commands, and exfiltrate sensitive provider API keys.

Business Impact

With a CVSS score of 10.0, this vulnerability is critical. It allows an attacker to achieve full remote code execution, gain access to sensitive API keys, and poison the agent learning-store. This risk is severe, as it grants complete control over the container environment and the integrity of the data processed by the agent.

Remediation Plan

Immediate Action: Update Ruflo to version 3.16.3 or later immediately to patch the authentication bypass.

Proactive Monitoring: Review logs for unauthorized access to the /mcp endpoints and check for anomalous terminal command execution within the container environment.

Compensating Controls: If an immediate update is not possible, place the Ruflo deployment behind a strict firewall or VPN that restricts access to the MCP endpoints to known-good IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents an existential risk to the integrity of the Ruflo deployment. All users should prioritize upgrading to version 3.16.3 immediately to close the unauthenticated access paths that permit remote code execution and credential theft.

---METADATA---
VENDOR: Cline
PRODUCT: Cline
AFFECTED_VERSIONS: < 3.0.30
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cline contains an Origin Validation Error (CWE-346) that can allow unauthorized cross-origin interactions with the coding agent.

Executive Summary:
An origin validation vulnerability in the Cline autonomous coding agent could allow an attacker to perform unauthorized actions, posing a significant risk to development environments.

Vulnerability Details

CVE-ID: CVE-2026-59723

Affected Software: Cline

Affected Versions: < 3.0.30

Vulnerability: This vulnerability involves a failure to properly validate the origin of incoming requests, potentially allowing malicious actors to interact with the Cline IDE extension or CLI assistant. The attack vector is identified as adjacent, requiring user interaction to facilitate the exploitation of the origin validation flaw.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized code execution or sensitive information disclosure within a developer's environment. Given the high CVSS score of 8.8, this flaw represents a significant risk to the integrity of software development pipelines and the confidentiality of source code repositories.

Remediation Plan

Immediate Action: Update the Cline extension or CLI tool to version 3.0.30 or later immediately.

Proactive Monitoring: Review IDE and system logs for unexpected outbound network connections or unauthorized command execution patterns originating from the Cline extension.

Compensating Controls: Ensure development environments are isolated from untrusted local networks and maintain strict endpoint security controls to monitor for suspicious process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators and individual developers should verify their current version of Cline and apply the 3.0.30 update without delay to prevent potential cross-origin attacks against their development environment.

---METADATA---
VENDOR: Leantime
PRODUCT: Leantime
AFFECTED_VERSIONS: 0 through 3.4.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that fails to properly validate state parameters.

Executive Summary:
A high-severity Cross-Site Request Forgery (CSRF) vulnerability in Leantime’s OIDC authentication mechanism could allow an attacker to hijack user sessions.

Vulnerability Details

CVE-ID: CVE-2026-59713

Affected Software: Leantime Leantime

Affected Versions: 0 through 3.4.4

Vulnerability: The vulnerability exists in the verifyState() method, which performs unconditional state verification. This allows an unauthenticated attacker to bypass OIDC security controls via a crafted CSRF attack.

Business Impact

The CVSS score of 8.1 highlights a critical risk to user account security. A successful exploit could lead to full account takeover, unauthorized access to sensitive project management data, and potential lateral movement within the application, severely impacting organizational data confidentiality.

Remediation Plan

Immediate Action: Upgrade to the latest version of Leantime provided by the vendor to ensure the OIDC state verification logic is correctly implemented.

Proactive Monitoring: Review authentication logs for suspicious OIDC callback patterns or spikes in login attempts originating from unknown sources.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block suspicious cross-site requests that lack valid state tokens.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Leantime with OIDC enabled must treat this as a high-priority update. Failure to patch allows for trivial bypass of authentication mechanisms, putting all user accounts at risk of compromise.

---METADATA---
VENDOR: Leantime
PRODUCT: Leantime
AFFECTED_VERSIONS: 0 through 3.4.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The JSON-RPC API in Leantime contains an authorization bypass that allows authenticated users to retrieve sensitive credential information from other accounts.

Executive Summary:
A critical authorization bypass in the Leantime JSON-RPC API allows authenticated users to exfiltrate password hashes, TOTP secrets, and session tokens.

Vulnerability Details

CVE-ID: CVE-2026-59712

Affected Software: Leantime Leantime

Affected Versions: 0 through 3.4.4

Vulnerability: The Users::getUser method lacks necessary authorization checks (CWE-639), enabling an authenticated user to perform unauthorized lookups of sensitive user credential rows. This allows an attacker with standard user privileges to gain access to highly sensitive security data of other users.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting the significant risk of full account takeover. Unauthorized access to password hashes, multi-factor authentication secrets, and session tokens effectively invalidates the security posture of the entire platform, potentially leading to widespread compromise of user accounts and administrative access.

Remediation Plan

Immediate Action: Update to the patched version of Leantime provided by the vendor.

Proactive Monitoring: Review audit logs for anomalous or high-frequency calls to the Users::getUser JSON-RPC method, particularly those requesting data for multiple distinct user IDs.

Compensating Controls: Restrict API access to trusted network segments and ensure robust logging is enabled for all JSON-RPC interface interactions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the exposure of sensitive authentication material, this vulnerability must be treated as a critical security priority. Organizations should apply the vendor-supplied security update immediately to prevent credential harvesting and potential lateral movement across the platform.

---METADATA---
VENDOR: LocalAI
PRODUCT: LocalAI
AFFECTED_VERSIONS: 0 through v4.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
LocalAI contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /models/apply endpoint that allows attackers to force the server to fetch arbitrary internal URLs.

Executive Summary:
An unauthenticated server-side request forgery vulnerability in LocalAI enables remote attackers to perform unauthorized requests against internal infrastructure, risking significant data exposure.

Vulnerability Details

CVE-ID: CVE-2026-59707

Affected Software: LocalAI LocalAI

Affected Versions: 0 through v4.3.1

Vulnerability: The vulnerability exists in the POST /models/apply endpoint, which fails to properly validate input, allowing an unauthenticated attacker to induce the server to make arbitrary requests to internal network resources.

Business Impact

This SSRF vulnerability is critical as it allows attackers to bypass perimeter firewalls and interact with internal services that are not intended to be publicly accessible. With a CVSS score of 8.6, this flaw poses a severe risk of internal network reconnaissance, potential interaction with internal APIs, and the exfiltration of sensitive configuration or data.

Remediation Plan

Immediate Action: Update LocalAI to the latest available version that contains the patch for the /models/apply endpoint.

Proactive Monitoring: Monitor network egress logs for unexpected connections originating from the LocalAI server to internal IP addresses or restricted infrastructure.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests to the /models/apply endpoint that contain suspicious or internal-facing destination URLs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to perform SSRF via an unauthenticated endpoint represents a high-risk security gap. Administrators must act immediately to apply the vendor-provided update and verify that the application is isolated from sensitive internal network segments.

---METADATA---
VENDOR: mem0
PRODUCT: mem0
AFFECTED_VERSIONS: 0 through a3154d5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Unauthenticated configuration endpoints in mem0 expose plaintext API keys and allow for server-side request forgery (SSRF) attacks against internal services.

Executive Summary:
Critical vulnerabilities in mem0 configuration endpoints allow unauthenticated attackers to steal sensitive API keys and perform unauthorized internal network requests.

Vulnerability Details

CVE-ID: CVE-2026-59706

Affected Software: mem0 mem0

Affected Versions: 0 through a3154d5

Vulnerability: The application exposes configuration API endpoints without authentication, enabling attackers to retrieve plaintext secrets and manipulate parameters like ollama_base_url to trigger SSRF attacks.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a severe threat to both infrastructure and third-party service security. Exposure of LLM API keys can lead to significant financial costs and data misuse, while the SSRF capability allows attackers to probe internal network resources that are otherwise shielded from the internet.

Remediation Plan

Immediate Action: Update to the latest version of mem0 to implement mandatory authentication for configuration endpoints.

Proactive Monitoring: Monitor API access logs for requests to /api/v1/config/ and audit outgoing traffic from the server to detect anomalous SSRF attempts against internal metadata or management services.

Compensating Controls: Implement network segmentation to isolate the mem0 server and restrict its ability to reach sensitive internal services or cloud metadata endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The exposure of plaintext secrets combined with the ability to perform SSRF makes this a critical security concern. Users must apply the latest updates immediately to protect sensitive credentials and prevent the exploitation of internal network resources.

---METADATA---
VENDOR: mem0
PRODUCT: mem0
AFFECTED_VERSIONS: 0 up to (excluding) a3154d5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The mem0 API component suffers from an unauthenticated access vulnerability allowing remote attackers to read, write, or delete user memories and trigger a denial-of-service state.

Executive Summary:
An unauthenticated access vulnerability in the mem0 API allows remote attackers to perform unauthorized data operations and cause system-wide denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-59705

Affected Software: mem0 mem0

Affected Versions: 0 up to (excluding) a3154d5

Vulnerability: This vulnerability involves missing authentication middleware on critical API routers, which permits unauthenticated attackers to manipulate user memory records or execute a global pause command to disrupt service.

Business Impact

The ability for an unauthenticated attacker to read, modify, or delete arbitrary user memory presents a catastrophic risk to data privacy and integrity. With a CVSS score of 9.8, this critical vulnerability could lead to total compromise of user data and prolonged operational downtime, resulting in significant reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade the mem0 software to the version containing the commit a3154d5 or later immediately.

Proactive Monitoring: Review application logs for unauthorized access patterns to API endpoints and monitor system performance for sudden, unauthorized global service interruptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict access control policies to block unauthenticated access to the /api/ path until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security failure that necessitates immediate remediation. Administrators must prioritize updating the mem0 environment to the patched version to prevent unauthorized data access and potential service disruption.

---METADATA---
VENDOR: Repomix
PRODUCT: Repomix
AFFECTED_VERSIONS: 0 up to (excluding) 1.14.1, 0 through c748b52
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Repomix contains a server-side request forgery (SSRF) vulnerability in the POST /api/pack endpoint, allowing unauthenticated attackers to make arbitrary outbound requests.

Executive Summary:
A critical SSRF vulnerability in Repomix allows unauthenticated attackers to perform unauthorized requests, potentially exposing private network resources and cloud metadata.

Vulnerability Details

CVE-ID: CVE-2026-59702

Affected Software: Repomix Repomix

Affected Versions: 0 up to (excluding) 1.14.1, 0 through c748b52

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability occurring in the POST /api/pack endpoint. The application fails to sanitize input URLs, allowing unauthenticated attackers to force the server to initiate requests to internal network addresses, cloud metadata services, or local filesystem paths.

Business Impact

The ability to perform SSRF poses a significant risk to internal infrastructure. Attackers can leverage this flaw to bypass perimeter firewalls, exfiltrate sensitive cloud metadata (such as IAM credentials), or scan internal network segments. With a CVSS score of 9.3, this vulnerability represents a critical threat that could lead to full compromise of the hosting environment.

Remediation Plan

Immediate Action: Upgrade to version 1.14.1 or later immediately to incorporate necessary URL validation logic.

Proactive Monitoring: Inspect server access logs for anomalous requests to the /api/pack endpoint, specifically looking for attempts to access internal IPs (e.g., 169.254.169.254) or local file paths.

Compensating Controls: Implement strict egress filtering on the server hosting Repomix to prevent unauthorized outbound requests to sensitive internal and cloud management endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its high CVSS score, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its unauthenticated nature and potential for internal network reconnaissance. Administrators must prioritize updating the software to the patched version 1.14.1 to eliminate the SSRF vector. If an immediate update is not feasible, egress traffic from the application server should be restricted to known-good destinations only.

---METADATA---
VENDOR: TeamT5
PRODUCT: ThreatSonar Anti-Ransomware
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
TeamT5 ThreatSonar Anti-Ransomware contains an arbitrary file deletion vulnerability.

Executive Summary:
An arbitrary file deletion vulnerability in TeamT5 ThreatSonar Anti-Ransomware allows attackers to delete critical system files, potentially leading to system instability.

Vulnerability Details

CVE-ID: CVE-2026-5966

Affected Software: TeamT5 ThreatSonar Anti-Ransomware

Affected Versions: See vendor advisory

Vulnerability: This vulnerability allows an attacker to delete arbitrary files on the system. Depending on the privileges of the application, this could lead to the deletion of critical system files, causing denial-of-service (DoS) conditions.

Business Impact

The ability to delete arbitrary files can disrupt business-critical services and lead to significant system downtime. With a CVSS score of 8.1, this flaw poses a high risk to the availability and reliability of the environments protected by the software.

Remediation Plan

Immediate Action: Update ThreatSonar Anti-Ransomware to the latest version released by TeamT5 to patch the file handling vulnerability.

Proactive Monitoring: Monitor system logs for unexpected file deletion activity or service failures that may indicate an ongoing exploitation attempt.

Compensating Controls: Ensure the application runs with the minimum necessary privileges and restrict access to the filesystem using operating system-level permissions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing TeamT5 ThreatSonar must prioritize this update to prevent potential service disruptions. Applying the vendor-provided patch is the only effective way to mitigate the risk of arbitrary file deletion.

---METADATA---
VENDOR: NewSoft
PRODUCT: NewSoftOA
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
NewSoftOA is susceptible to an unauthenticated OS command injection vulnerability, permitting remote attackers to execute arbitrary commands on the server.

Executive Summary:
An unauthenticated OS command injection vulnerability in NewSoftOA allows remote attackers to gain full control of the application server.

Vulnerability Details

CVE-ID: CVE-2026-5965

Affected Software: NewSoft NewSoftOA

Affected Versions: See vendor advisory

Vulnerability: This is an OS command injection flaw that does not require user authentication, allowing an attacker to inject and execute arbitrary commands directly on the server's operating system.

Business Impact

As an unauthenticated, critical-severity vulnerability (CVSS 9.8), this flaw allows for total system compromise. Consequences include unauthorized access to sensitive corporate data, lateral movement within the network, and potential full-scale system destruction or ransomware deployment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by NewSoft for the NewSoftOA platform immediately.

Proactive Monitoring: Monitor server logs for unexpected shell commands or suspicious network traffic patterns indicative of reconnaissance or exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns (e.g., shell meta-characters).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of authentication requirements makes this vulnerability exceptionally dangerous. It is imperative that all instances of NewSoftOA be updated immediately to prevent unauthorized remote access to the server environment.

---METADATA---
VENDOR: Digiwin
PRODUCT: EasyFlow .NET
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Digiwin EasyFlow .NET contains a SQL injection vulnerability allowing unauthenticated remote attackers to manipulate database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in Digiwin EasyFlow .NET poses a critical risk of complete database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-5964

Affected Software: Digiwin EasyFlow .NET

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands into the application. The flaw enables unauthorized parties to read, modify, or delete sensitive data stored within the backend database.

Business Impact

The exploitation of this vulnerability can result in the full compromise of the application's database, leading to unauthorized disclosure or destruction of sensitive corporate information. With a CVSS score of 9.8, this flaw represents a critical risk to business operations, data integrity, and compliance requirements.

Remediation Plan

Immediate Action: Update Digiwin EasyFlow .NET to the latest available version provided by the vendor to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database access logs for unusual patterns, such as unexpected query structures, unauthorized data export attempts, or large-scale record deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection signatures to detect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity and the unauthenticated nature of this vulnerability, immediate patching is required. Organizations should prioritize updating their Digiwin EasyFlow .NET instances to prevent potential data breaches and unauthorized system access.

---METADATA---
VENDOR: Digiwin
PRODUCT: EasyFlow .NET
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Digiwin EasyFlow .NET contains a SQL injection vulnerability allowing unauthenticated remote attackers to manipulate database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in Digiwin EasyFlow .NET poses a critical risk of complete database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-5963

Affected Software: Digiwin EasyFlow .NET

Affected Versions: See vendor advisory

Vulnerability: This is a SQL injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands into the application. The flaw enables unauthorized parties to read, modify, or delete sensitive data stored within the backend database.

Business Impact

The exploitation of this vulnerability can result in the full compromise of the application's database, leading to unauthorized disclosure or destruction of sensitive corporate information. With a CVSS score of 9.8, this flaw represents a critical risk to business operations, data integrity, and compliance requirements.

Remediation Plan

Immediate Action: Update Digiwin EasyFlow .NET to the latest available version provided by the vendor to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database access logs for unusual patterns, such as unexpected query structures, unauthorized data export attempts, or large-scale record deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection signatures to detect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity and the unauthenticated nature of this vulnerability, immediate patching is required. Organizations should prioritize updating their Digiwin EasyFlow .NET instances to prevent potential data breaches and unauthorized system access.

---METADATA---
VENDOR: Inrove Software and Internet Services
PRODUCT: BiEticaret
AFFECTED_VERSIONS: < v3.3.57
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BiEticaret is vulnerable to SQL injection, allowing unauthenticated attackers to execute arbitrary SQL commands against the database.

Executive Summary:
An SQL injection vulnerability in Inrove Software and Internet Services BiEticaret allows remote, unauthenticated attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-5955

Affected Software: Inrove Software and Internet Services BiEticaret

Affected Versions: < v3.3.57

Vulnerability: The application fails to properly neutralize special elements within SQL commands, enabling SQL injection. This allows an unauthenticated attacker to manipulate database queries, potentially leading to unauthorized data extraction, modification, or total destruction of the database contents.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. It provides an attacker with the ability to bypass application security controls to access, steal, or corrupt sensitive customer and business data, which could lead to significant financial loss and severe reputational damage.

Remediation Plan

Immediate Action: Update the BiEticaret software to version v3.3.57 or later to address the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for unusual or highly complex query structures that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection attack patterns as an immediate, temporary mitigation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the criticality of SQL injection flaws necessitates immediate remediation.

Analyst Recommendation

SQL injection is a severe security risk that can lead to total database compromise. It is imperative that users of the BiEticaret platform update to the patched version immediately to secure their database environment against potential exploitation.

---METADATA---
VENDOR: wpWax
PRODUCT: Directorist
AFFECTED_VERSIONS: 0 through 8.8.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Directorist plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code on the server.

Executive Summary:
A critical deserialization flaw in the wpWax Directorist plugin allows unauthenticated attackers to execute arbitrary code, creating an immediate risk of full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-59518

Affected Software: wpWax Directorist

Affected Versions: 0 through 8.8.2

Vulnerability: This is a Deserialization of Untrusted Data (CWE-502) vulnerability. The plugin lacks proper verification of input, allowing unauthenticated attackers to inject malicious objects that can lead to remote code execution.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary PHP code, potentially leading to total site takeover, data breach, and the deployment of persistent backdoors. The CVSS score of 9.8 highlights the severity, as the lack of required authentication makes it easily exploitable by remote actors, threatening the entire underlying infrastructure.

Remediation Plan

Immediate Action: Update the Directorist plugin to a version beyond 8.8.2 as soon as the vendor provides a patch.

Proactive Monitoring: Review web server logs for irregular payload structures or unexpected code execution attempts associated with the Directorist plugin endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious serialized objects and prevent unauthenticated access to sensitive plugin functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the nature of object injection, it is highly likely that exploitation attempts will be automated once the vulnerability details become widely known.

Analyst Recommendation

The severity of this issue mandates an immediate update. If an update is not yet available, consider temporarily deactivating the Directorist plugin until a patched version is released to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Sergey
PRODUCT: AIWU
AFFECTED_VERSIONS: 0 through 1.5.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Sergey AIWU WordPress plugin contains a Blind SQL Injection vulnerability, permitting unauthenticated attackers to execute malicious database queries.

Executive Summary:
A critical SQL injection vulnerability in the Sergey AIWU WordPress plugin enables unauthenticated attackers to compromise database confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59515

Affected Software: Sergey AIWU

Affected Versions: 0 through 1.5.4

Vulnerability: This vulnerability is a Blind SQL Injection (CWE-89) that occurs because the plugin does not properly sanitize user-supplied input before executing SQL commands. The vulnerability is network-exploitable without requiring authentication (AV:N/PR:N).

Business Impact

Successful exploitation of this vulnerability could allow an attacker to read data from the database, potentially exposing user credentials, configuration secrets, or other sensitive application data. The CVSS score of 9.3 underscores the extreme risk to the application's backend security and the potential for large-scale data theft.

Remediation Plan

Immediate Action: Update the AIWU plugin to the latest version immediately. If an update is unavailable, deactivate the plugin until the vendor provides a remediation.

Proactive Monitoring: Review web server and database error logs for signs of SQL injection attempts, including common SQL syntax characters (e.g., ', --, UNION) in unexpected input fields.

Compensating Controls: Implement a WAF to filter malicious traffic and block requests containing common SQL injection signatures directed at the AIWU plugin.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this a high-priority target for automated scanning tools.

Analyst Recommendation

The severity of this issue necessitates an immediate response. Administrators must ensure all instances of the AIWU plugin are updated to the latest version to eliminate the SQL injection vector and protect against potential unauthorized data access.

---METADATA---
VENDOR: AIL Project
PRODUCT: AIL Framework
AFFECTED_VERSIONS: 0 through v6.9.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The AIL Framework is susceptible to a path traversal vulnerability within its PDF object handling component, potentially allowing unauthorized file access.

Executive Summary:
A path traversal vulnerability in the AIL Framework allows authenticated attackers to potentially access sensitive files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59510

Affected Software: AIL Project AIL Framework

Affected Versions: 0 through v6.9.0

Vulnerability: The application fails to properly sanitize input during PDF object processing, which enables path traversal. This vulnerability requires a low-privileged authenticated user to trigger the flaw.

Business Impact

The ability to perform path traversal allows an attacker to read arbitrary files on the underlying server, which may lead to the exposure of sensitive configuration files, credentials, or proprietary data. With a CVSS score of 7.1, this is classified as a High severity issue. Failure to mitigate this risk could result in a full compromise of the application's data confidentiality and potential escalation of privileges within the host environment.

Remediation Plan

Immediate Action: Update the AIL Framework to a version beyond v6.9.0 once the vendor releases a patched version. In the interim, restrict access to the PDF processing functionality to trusted users only.

Proactive Monitoring: Review application access logs for unusual file path patterns or directory traversal sequences (e.g., ../) associated with PDF handling requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block path traversal patterns in incoming request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This path traversal vulnerability represents a significant security risk to the AIL Framework. Administrators should prioritize monitoring for anomalous activity and prepare to deploy the vendor-supplied patch as soon as it becomes available to ensure the integrity and confidentiality of the host system.

---METADATA---
VENDOR: cve-search
PRODUCT: cve-search
AFFECTED_VERSIONS: v4.0 through v6.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The cve-search application is vulnerable to improper input validation in its API, allowing unauthenticated remote attackers to read arbitrary MongoDB collections, including administrative credentials.

Executive Summary:
An unauthenticated input validation vulnerability in cve-search allows remote attackers to exfiltrate administrative credentials from the underlying MongoDB database.

Vulnerability Details

CVE-ID: CVE-2026-59509

Affected Software: cve-search

Affected Versions: v4.0 through v6.0.0

Vulnerability: This vulnerability is an Improper Input Validation (CWE-20) issue located in the POST /fetch_cve_data endpoint. By manipulating request parameters, an unauthenticated attacker can query arbitrary MongoDB collections, including those containing administrative user hashes.

Business Impact

Successful exploitation allows an attacker to extract user data and password hashes, which can then be cracked offline to gain full administrative control over the cve-search instance. With a CVSS score of 9.2, this represents a critical risk, especially if the instance is used to manage sensitive vulnerability management data or is integrated into other security workflows.

Remediation Plan

Immediate Action: Update the cve-search software to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Review access logs for the /fetch_cve_data endpoint, specifically looking for unusual regex patterns or attempts to access collections other than those intended for standard use.

Compensating Controls: Restrict network access to the cve-search instance using IP allowlisting or VPN requirements to prevent unauthorized access to the API endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of access to administrative hashes, this vulnerability must be patched immediately. Ensure that the update is applied and verify that the instance is not exposed to the public internet without proper authentication or network-level restrictions.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in ISC BIND 9 leads to a use-after-free vulnerability, potentially causing undefined behavior or service disruption.

Executive Summary:
A race condition vulnerability in ISC BIND 9 could lead to a use-after-free condition, posing a risk of service instability or potential remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-5947

Affected Software: ISC BIND 9

Affected Versions: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This vulnerability is caused by a race condition (CWE-362) that triggers a use-after-free (CWE-416) condition. The flaw can be triggered remotely by sending specific queries, making it a serious concern for DNS infrastructure.

Business Impact

The CVSS score of 7.5 reflects a High severity. As DNS is a foundational service, successful exploitation could lead to denial-of-service (DoS) conditions, potentially causing widespread network outages and service unavailability for the organization.

Remediation Plan

Immediate Action: Upgrade to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1 immediately.

Proactive Monitoring: Monitor BIND server logs for crashes or unexpected restarts, which may indicate attempted exploitation of the race condition.

Compensating Controls: Ensure that BIND instances are protected by access control lists (ACLs) to limit query sources and minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of DNS infrastructure, this patch should be prioritized in all production environments. Verify your current BIND version immediately and schedule an emergency maintenance window to apply the relevant security update.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, 9.20.9-S1 through 9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple flaws in the BIND 9 named component allow for improper input validation and out-of-bounds reads when handling non-Internet DNS message classes.

Executive Summary:
A critical vulnerability in the ISC BIND 9 DNS server software allows for potential service disruption or crashes due to improper handling of specific DNS message classes.

Vulnerability Details

CVE-ID: CVE-2026-5946

Affected Software: ISC BIND 9

Affected Versions: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and associated Subscription Edition (S1) versions.

Vulnerability: This vulnerability involves improper input validation (CWE-20), out-of-bounds read (CWE-125), and reachable assertions (CWE-617) within named. It can be triggered by unauthenticated remote attackers sending specially crafted DNS queries containing non-standard classes like CHAOS, HESIOD, or meta-classes.

Business Impact

Successful exploitation of this flaw can lead to a denial-of-service (DoS) condition, crashing the DNS service and rendering name resolution unavailable for dependent infrastructure. Given the CVSS score of 7.5, this poses a significant risk to network availability and business continuity.

Remediation Plan

Immediate Action: Upgrade to the patched releases: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1.

Proactive Monitoring: Monitor named service logs for frequent restarts or crash reports coinciding with unusual DNS query traffic patterns.

Compensating Controls: Implement firewall rules to drop non-standard DNS query traffic if your environment does not require support for CHAOS or HESIOD classes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations running BIND 9 must prioritize patching to the versions listed above. Given the potential for automated exploitation, failure to address this flaw could lead to significant infrastructure outages.