---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple and Nice Shopping Cart Script
AFFECTED_VERSIONS: SourceCodester Simple and Nice Shopping Cart Script 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the /admin/mensproductdeletequery.php file of SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to execute arbitrary SQL commands.

Executive Summary:
An SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables unauthenticated attackers to manipulate backend database queries through unsanitized input parameters.

Vulnerability Details

CVE-ID: CVE-2026-14653

Affected Software: SourceCodester Simple and Nice Shopping Cart Script

Affected Versions: SourceCodester Simple and Nice Shopping Cart Script 1.0

Vulnerability: The vulnerability exists in the /admin/mensproductdeletequery.php file, where the user_id parameter fails to undergo adequate sanitization. This allows an unauthenticated remote attacker to inject malicious SQL commands, potentially bypassing security controls or manipulating stored data.

Business Impact

With a CVSS score of 7.3, this flaw represents a significant risk to the integrity and confidentiality of the shopping cart system. Successful exploitation could allow an attacker to delete or modify product data, compromise administrative accounts, or gain unauthorized access to sensitive customer information stored in the database.

Remediation Plan

Immediate Action: As there is no official patch, administrators should disable the affected functionality or restrict access to the /admin directory to trusted IP addresses only.

Proactive Monitoring: Monitor server logs for abnormal HTTP requests targeting the mensproductdeletequery.php file, specifically looking for URL-encoded SQL injection payloads.

Compensating Controls: Utilize a WAF to inspect and filter incoming traffic for SQL injection strings, specifically targeting the user_id parameter in administrative request paths.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of access to public exploits, the risk of targeted attacks is elevated.

Analyst Recommendation

Security teams must prioritize isolating the administrative interface of this application. Given the lack of a vendor-provided patch, the primary defense must be a combination of strict network access controls and robust WAF filtering to prevent unauthorized database interactions.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple and Nice Shopping Cart Script
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows unauthenticated attackers to conduct malicious database operations.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 poses a high risk of unauthorized database query execution.

Vulnerability Details

CVE-ID: CVE-2026-14652

Affected Software: SourceCodester Simple and Nice Shopping Cart Script

Affected Versions: 1.0

Vulnerability: This application is vulnerable to SQL injection (CWE-89) due to improper neutralization of special elements used in SQL commands. The vulnerability is accessible over the network and does not require the attacker to be authenticated.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a significant risk to the business, as it allows attackers to potentially read, modify, or delete data within the application's database. Such an event could lead to a compromise of customer privacy, loss of business continuity, and potential regulatory penalties.

Remediation Plan

Immediate Action: Apply all available vendor patches immediately; if no update is available, restrict access to the application to trusted networks only.

Proactive Monitoring: Monitor database query logs for unusual activity, such as unexpected syntax or large volumes of data being queried in short intervals.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and block incoming HTTP requests containing SQL injection attack signatures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of this SQL injection vulnerability necessitates urgent attention. Organizations should verify their current version, apply available patches, and ensure that robust defensive layers, such as WAFs, are active to block potential exploitation attempts.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Voting System
AFFECTED_VERSIONS: code-projects Online Voting System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the test_input function of /saveVote.php in code-projects Online Voting System 1.0, allowing unauthenticated remote attackers to execute malicious SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Voting System 1.0 allows attackers to remotely manipulate input parameters, risking the integrity of the voting data.

Vulnerability Details

CVE-ID: CVE-2026-14649

Affected Software: code-projects Online Voting System

Affected Versions: code-projects Online Voting System 1.0

Vulnerability: The vulnerability is located in the test_input function within the /saveVote.php file. The system fails to properly secure the voterName, voterEmail, voterID, and selectedCandidate parameters, allowing an attacker to inject arbitrary SQL commands without any authentication or user interaction.

Business Impact

The CVSS score of 7.3 highlights a high-severity threat to the system's data integrity. Exploitation could allow an attacker to manipulate voting results, exfiltrate voter PII (Personally Identifiable Information), or compromise the underlying database, which undermines the entire purpose of an online voting platform.

Remediation Plan

Immediate Action: In the absence of an official patch, administrators should take the system offline if possible or restrict access to the voting portal until the code can be manually hardened.

Proactive Monitoring: Review application logs for suspicious entries in the parameters passed to /saveVote.php and monitor database performance for signs of unauthorized query execution.

Compensating Controls: Deploy WAF rules designed to block SQL injection patterns specifically targeting the /saveVote.php endpoint to mitigate the risk of automated exploitation.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the availability of public exploits necessitates immediate defensive action.

Analyst Recommendation

This vulnerability is critical due to the potential for data tampering in a system designed for sensitive information collection. Administrators must implement immediate defensive measures and monitor for any signs of unauthorized access, as the lack of authentication requirements makes this an attractive target for attackers.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Voting System
AFFECTED_VERSIONS: code-projects Online Voting System up to 0.x/1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the login component of code-projects Online Voting System allows unauthenticated attackers to compromise the system via the test_input function.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Voting System poses a critical risk of administrative account compromise.

Vulnerability Details

CVE-ID: CVE-2026-14648

Affected Software: code-projects Online Voting System

Affected Versions: code-projects Online Voting System up to 0.x/1.0

Vulnerability: This is a SQL injection vulnerability located in the test_input function within /authentication.php. An unauthenticated remote attacker can exploit this by manipulating the adminUserName or adminPassword parameters to bypass authentication or gain unauthorized administrative access.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized access to sensitive application data. Successful exploitation could allow an attacker to gain full administrative control over the voting system, potentially leading to the manipulation of voting results, data exfiltration, or complete system compromise, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Since no official patch is available, restrict access to the login interface via IP allowlisting or VPN requirements until a secure version is released.

Proactive Monitoring: Monitor application logs for abnormal patterns in the adminUserName or adminPassword fields, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting authentication endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the existence of public exploit code, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitation and the critical nature of the compromised component, organizations currently running the Online Voting System should treat this as a high-priority risk. If the software cannot be updated or patched, it should be taken offline or placed behind robust network-level access controls to prevent unauthorized remote exploitation.

---METADATA---
VENDOR: Sonatype
PRODUCT: Nexus Repository 3
AFFECTED_VERSIONS: 3.19.0 up to (excluding) 3.95.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Sonatype Nexus Repository 3 contains a type confusion vulnerability in the REST privileges API that allows authenticated users to perform unauthorized privilege escalation.

Executive Summary:
A high severity privilege escalation vulnerability in Sonatype Nexus Repository 3 allows authenticated attackers to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-14644

Affected Software: Sonatype Nexus Repository 3

Affected Versions: 3.19.0 up to (excluding) 3.95.0

Vulnerability: This vulnerability (CWE-843) involves type confusion within the REST privileges API, which can be exploited by an authenticated user with low privileges to escalate their permissions.

Business Impact

Successful exploitation allows an attacker to gain elevated privileges within the Nexus Repository, potentially leading to full administrative control over the application. Given the CVSS score of 8.6, this represents a significant risk to the integrity and availability of software supply chain assets stored within the repository. Unauthorized access could result in the compromise of proprietary source code, malicious injection of artifacts, or complete system takeover.

Remediation Plan

Immediate Action: Update Sonatype Nexus Repository 3 to version 3.95.0 or later immediately to resolve the vulnerable API logic.

Proactive Monitoring: Review audit logs for suspicious activity involving the REST privileges API, particularly focusing on unexpected permission changes or privilege escalation attempts by standard user accounts.

Compensating Controls: Restrict access to the Nexus Repository REST API to trusted internal IP addresses and implement robust identity and access management policies to limit the potential impact of credential compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, which limits the attack surface to existing users.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the potential for complete privilege escalation. Administrators should prioritize updating the software to version 3.95.0 as soon as possible to neutralize this threat.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the SourceCodester Class and Exam Timetabling System, allowing unauthenticated remote attackers to manipulate the ID argument in /edit_class2.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System enables potential unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14642

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System 1.0

Vulnerability: The vulnerability is a SQL injection flaw in the /edit_class2.php file. An unauthenticated attacker can exploit this by sending malicious input through the ID argument, potentially allowing unauthorized database queries.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a high risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to the underlying database, enabling an attacker to view, modify, or delete sensitive class and exam information, which could disrupt educational operations and compromise student privacy.

Remediation Plan

Immediate Action: Immediately restrict public access to the /edit_class2.php file and the associated application directory.

Proactive Monitoring: Review web server and database logs for suspicious requests targeting the edit_class2.php script, particularly those containing unexpected URL parameters.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that contain SQL injection patterns targeting the ID parameter.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of public exploit scripts necessitates immediate defensive measures to mitigate the risk of targeted attacks.

Analyst Recommendation

The availability of public exploit tools significantly increases the risk of this vulnerability. Administrators should prioritize securing the application through input validation or network-level access controls. We strongly recommend monitoring for any signs of unauthorized database interaction until a vendor-supplied patch is applied.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in edit_course.php.

Executive Summary:
A critical SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System allows remote, unauthenticated attackers to compromise database integrity and potentially exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-14641

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /edit_course.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to inject malicious SQL code directly into the database query.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of the application's data. With a CVSS score of 7.3, this flaw is categorized as High severity, enabling an attacker to bypass authentication, read or modify administrative data, or potentially perform unauthorized administrative actions. Such a breach could lead to severe reputational damage, the loss of sensitive academic or user information, and operational disruption.

Remediation Plan

Immediate Action: As there is no official patch currently available, administrators should restrict access to the affected /edit_course.php file to trusted IP addresses only. If the application is not business-critical, consider disabling the affected module until a vendor-supplied update is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns, particularly those containing SQL syntax characters (e.g., ', --, UNION) directed at the ID parameter in edit_course.php. Alert on any unusual spikes in database error logs or unexpected administrative account activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application. Ensure that database permissions for the web service account are restricted to the principle of least privilege to limit the impact of a successful query injection.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 5, 2026, public exploit details are available for this vulnerability. The lack of authentication requirements and the existence of public proof-of-concept material significantly increase the risk of exploitation.

Analyst Recommendation

Given the availability of public exploit code and the ease of exploitation, immediate defensive measures are required. Organizations utilizing this software must implement the recommended compensating controls and maintain a high state of vigilance. Ensure that all systems are monitored closely until a permanent patch is provided by the vendor.

---METADATA---
VENDOR: CodeAstro
PRODUCT: Apartment Visitor Management System
AFFECTED_VERSIONS: CodeAstro Apartment Visitor Management System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the CodeAstro Apartment Visitor Management System allows unauthenticated remote attackers to execute malicious queries via the Username argument in /index.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the CodeAstro Apartment Visitor Management System poses a severe risk of unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-14640

Affected Software: CodeAstro Apartment Visitor Management System

Affected Versions: CodeAstro Apartment Visitor Management System 1.0

Vulnerability: This is a SQL injection vulnerability in the login component located at /index.php. An unauthenticated attacker can exploit this by injecting malicious input into the Username argument, which can lead to unauthorized database access and potentially remote code execution.

Business Impact

The CVSS score of 7.3 reflects the high risk of this vulnerability, as it allows unauthenticated attackers to interact with the database. A successful exploit could lead to full compromise of the visitor management system, resulting in the leakage of resident data, unauthorized access to secure facilities, and potential long-term persistence within the network.

Remediation Plan

Immediate Action: Immediately place the application behind a secure gateway or restrict access to authorized internal networks only.

Proactive Monitoring: Inspect server logs for unusual HTTP POST requests to /index.php that deviate from standard authentication patterns or contain database-specific syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block SQL injection attempts directed at the Username field.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. Despite this, the potential for remote code execution makes this a critical security concern requiring urgent attention.

Analyst Recommendation

Due to the risk of remote code execution, this vulnerability should be remediated with the highest urgency. If a patch is unavailable, administrators must assume the system is vulnerable to exploitation and implement robust perimeter defenses to prevent unauthorized access to the login endpoint.

---METADATA---
VENDOR: kirilkirkov
PRODUCT: Ecommerce-CodeIgniter-Bootstrap
AFFECTED_VERSIONS: up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A deserialization and improper input validation vulnerability exists in kirilkirkov Ecommerce-CodeIgniter-Bootstrap, potentially allowing unauthenticated remote code execution or system impact.

Executive Summary:
A critical deserialization vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap application exposes unauthenticated users to potential remote system impact.

Vulnerability Details

CVE-ID: CVE-2026-14637

Affected Software: kirilkirkov Ecommerce-CodeIgniter-Bootstrap

Affected Versions: up to commit 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Vulnerability: The application suffers from improper input validation and insecure deserialization. These flaws allow an unauthenticated attacker to supply malicious input that may lead to significant system-level impacts.

Business Impact

The vulnerability carries a CVSS score of 8.2 (High), reflecting the significant risk of unauthorized system interaction. Successful exploitation could lead to full application compromise, potentially resulting in data exfiltration or unauthorized administrative control over the underlying server environment, which constitutes a severe threat to business continuity.

Remediation Plan

Immediate Action: Review the official GitHub repository for the provided fix commit (49b20f53de2b7ec34e920b11c863f1491d911a04) and update your deployment immediately.

Proactive Monitoring: Inspect server logs for unexpected serialized objects or malformed input strings directed at application entry points.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block suspicious serialized payloads before they reach the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the nature of deserialization vulnerabilities, immediate attention is required. Administrators should verify their current commit hash and apply the vendor-provided patch as soon as possible to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: kirilkirkov
PRODUCT: Ecommerce-CodeIgniter-Bootstrap
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability exists in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap application, potentially allowing unauthorized access to files.

Executive Summary:
A path traversal vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap application poses a significant risk of unauthorized file access.

Vulnerability Details

CVE-ID: CVE-2026-14635

Affected Software: kirilkirkov Ecommerce-CodeIgniter-Bootstrap

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Path Traversal (CWE-22) flaw. It allows an unauthenticated attacker to manipulate file paths, potentially leading to unauthorized access to sensitive files on the server.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files or application source code. With a CVSS score of 7.3, this high-severity flaw represents a substantial threat to data confidentiality and the overall integrity of the web application.

Remediation Plan

Immediate Action: Review the official project repository and apply the latest security patches provided by the vendor.

Proactive Monitoring: Monitor server logs for suspicious URL patterns containing directory traversal sequences such as "../".

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing this software must prioritize the application of provided security updates. Failure to patch may expose the host environment to unauthorized file system access, necessitating immediate remediation efforts.

---METADATA---
VENDOR: jairiidriss
PRODUCT: restaurant-website-php-mysql
AFFECTED_VERSIONS: 521428b5b612449df0cf4a5d15ee40cba67f3d35
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The restaurant-website-php-mysql application contains an authentication vulnerability that allows unauthorized access to the system.

Executive Summary:
The jairiidriss restaurant-website-php-mysql application is vulnerable to authentication bypass, potentially granting unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-14622

Affected Software: jairiidriss restaurant-website-php-mysql

Affected Versions: 521428b5b612449df0cf4a5d15ee40cba67f3d35

Vulnerability: The application suffers from missing or improper authentication (CWE-306, CWE-287). This allows an unauthenticated attacker to access restricted functions or data without providing valid credentials.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a High risk. Unauthorized access to a restaurant management system can lead to the theft of customer data, compromise of administrative accounts, and total loss of system integrity. The lack of authentication controls effectively removes the primary barrier against malicious activity.

Remediation Plan

Immediate Action: Review the official repository for any security updates or patches. If no official patch exists, implement strict network access controls to limit exposure to the application.

Proactive Monitoring: Review application logs for unauthorized access patterns, specifically looking for requests to administrative endpoints by non-privileged accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to sensitive application directories and common administrative entry points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of proper authentication mechanisms is a critical security failure that requires immediate attention. Organizations utilizing this software should restrict public access to the application until a formal patch is applied or until sufficient compensating controls are verified to be effectively blocking unauthorized access attempts.

---METADATA---
VENDOR: RT-Thread
PRODUCT: RT-Thread
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the RT-Thread operating system up to version 5, potentially impacting system security posture.

Executive Summary:
A critical security flaw in the RT-Thread real-time operating system requires immediate attention to prevent potential exploitation and maintain system integrity.

Vulnerability Details

CVE-ID: CVE-2026-14606

Affected Software: RT-Thread

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This security flaw resides within the RT-Thread framework, potentially allowing attackers to bypass security controls or trigger unstable system states. The authentication requirements remain undefined, so security teams should assume a worst-case scenario regarding attacker access levels.

Business Impact

The CVSS score of 7.8 underscores the High severity of this issue, indicating that an attacker could potentially gain unauthorized influence over the device's operational logic. Failure to address this could lead to prolonged downtime, loss of data integrity, and potential compromise of connected industrial or IoT infrastructure.

Remediation Plan

Immediate Action: Identify all deployments of the RT-Thread OS within the environment and apply the latest vendor-supplied security patches as soon as they become available.

Proactive Monitoring: Monitor system logs for irregular activity, such as unexpected process termination or unauthorized attempts to access system-level configurations.

Compensating Controls: Employ a Web Application Firewall (WAF) or network-based Intrusion Detection System (IDS) to inspect traffic for signatures associated with known RT-Thread exploitation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates a rapid response from security teams managing embedded systems. Ensure that all affected RT-Thread versions are tracked and updated immediately upon the release of vendor patches, and maintain strict monitoring to detect any potential unauthorized access attempts during the transition period.

---METADATA---
VENDOR: RT-Thread
PRODUCT: RT-Thread
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in RT-Thread up to version 5 that may allow for unauthorized system impact.

Executive Summary:
A high-severity vulnerability in the RT-Thread real-time operating system presents a significant risk to embedded device integrity and operational stability.

Vulnerability Details

CVE-ID: CVE-2026-14605

Affected Software: RT-Thread

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the RT-Thread operating system core; while specific technical triggers remain under investigation, such flaws typically involve memory corruption or improper input validation. The authentication requirements for this vulnerability are currently unspecified, necessitating a cautious approach to exposure.

Business Impact

Successful exploitation of this flaw could result in unauthorized code execution, leading to potential device compromise or service disruption. Given the CVSS score of 7.8, this vulnerability is categorized as High, posing a substantial risk to systems relying on RT-Thread for critical functions and industrial control operations.

Remediation Plan

Immediate Action: Review the official RT-Thread security portal for the latest firmware or kernel patches and apply them to all affected embedded systems immediately.

Proactive Monitoring: Implement robust logging on devices where possible and monitor for anomalous system reboots, unexpected memory usage, or unauthorized communication patterns.

Compensating Controls: Utilize network segmentation to isolate vulnerable devices from critical networks, effectively reducing the attack surface until a permanent patch is deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the assessment of their firmware inventory to identify instances of RT-Thread. Proactive patching is the only definitive method to mitigate this risk; if immediate updates are unavailable, internal network isolation should be strictly enforced to limit potential impact.

---METADATA---
VENDOR: TIMLEGGE
PRODUCT: Crypt::DSA
AFFECTED_VERSIONS: 0 up to (excluding) 1.22
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Crypt::DSA uses a biased random number generator for signing nonces and private keys, potentially allowing an attacker to recover private keys.

Executive Summary:
A vulnerability in the Crypt::DSA Perl module allows for private-key recovery due to the use of a biased random number generator.

Vulnerability Details

CVE-ID: CVE-2026-14570

Affected Software: TIMLEGGE Crypt::DSA

Affected Versions: 0 up to (excluding) 1.22

Vulnerability: This is a cryptographic flaw (CWE-330) where the Crypt::DSA::Util::makerandom function forces the high bit of random values, resulting in insufficient entropy. The vulnerability is exploitable by an unauthenticated remote attacker who can observe signing operations to derive the private key.

Business Impact

The compromise of DSA private keys allows an attacker to forge digital signatures, effectively bypassing authentication or integrity controls. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to the confidentiality of signed communications and the integrity of systems relying on this library for cryptographic operations.

Remediation Plan

Immediate Action: Upgrade to version 1.22 or later, which implements uniform random number generation via Crypt::DSA::Util::randombelow. Furthermore, you must revoke and regenerate any cryptographic keys that were used with the affected versions.

Proactive Monitoring: Review audit logs for unusual cryptographic activity or repeated signature failures that might indicate an attempt to collect signing nonces.

Compensating Controls: Since this is a library-level vulnerability, transition to an alternative, actively maintained cryptographic library as soon as possible, as Crypt::DSA has been deprecated since version 1.20.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it undermines the fundamental security of the DSA implementation.

Analyst Recommendation

The severity of this cryptographic weakness cannot be overstated; the ability to recover private keys renders all signatures generated by affected versions untrustworthy. Organizations must prioritize updating to version 1.22 or migrating to a modern, supported cryptographic solution immediately to restore the integrity of their signing processes.

---METADATA---
VENDOR: Innotim Software Telecommunications and Consulting Trade Ltd.
PRODUCT: Logsign SIEM
AFFECTED_VERSIONS: 6.4.97 up to (excluding) 6.4.114
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability exists in Logsign SIEM involving insufficiently protected credentials, which allows an authenticated attacker with high privileges to retrieve sensitive embedded data.

Executive Summary:
An insufficiently protected credentials vulnerability in Logsign SIEM allows high-privileged users to extract sensitive data, posing a critical security risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-14564

Affected Software: Innotim Software Telecommunications and Consulting Trade Ltd. Logsign SIEM

Affected Versions: 6.4.97 up to (excluding) 6.4.114

Vulnerability: This is an Insufficiently Protected Credentials vulnerability (CWE-522) that allows an attacker with high privileges to access sensitive information. The attack vector is network-based, but it requires an attacker to already possess administrative or high-level credentials to exploit the flaw.

Business Impact

The ability to retrieve sensitive embedded data from a Security Information and Event Management (SIEM) system is a high-impact event. Given the CVSS score of 9.0, this vulnerability could allow an attacker to obtain credentials or configuration data, leading to lateral movement, further unauthorized access to integrated systems, and potential compromise of the entire security monitoring infrastructure.

Remediation Plan

Immediate Action: Update Logsign SIEM to version 6.4.114 or later immediately to address the credential protection flaw.

Proactive Monitoring: Review administrative access logs for unusual queries or bulk data retrieval actions performed by high-privileged accounts.

Compensating Controls: Ensure that access to the SIEM management console is restricted to trusted networks and that multi-factor authentication is strictly enforced for all administrative sessions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high privileges mitigates the risk from external unauthenticated actors, but internal threats remain a concern.

Analyst Recommendation

This vulnerability represents a significant risk to the confidentiality of sensitive system data. Administrators should prioritize the update to version 6.4.114 to rectify this weakness. Given the critical nature of SIEM platforms in an organization's security posture, patching should be scheduled as a high-priority task.

---METADATA---
VENDOR: SoftMarket
PRODUCT: Digital Marketplace WordPress plugin
AFFECTED_VERSIONS: through 1.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SoftMarket Digital Marketplace WordPress plugin contains an authentication bypass flaw in its email-verification flow, allowing unauthenticated users to impersonate any verified account.

Executive Summary:
A critical authentication bypass vulnerability in the SoftMarket Digital Marketplace WordPress plugin allows unauthenticated attackers to hijack any user account.

Vulnerability Details

CVE-ID: CVE-2026-14557

Affected Software: SoftMarket Digital Marketplace WordPress plugin

Affected Versions: through 1.0.0

Vulnerability: The plugin fails to properly validate authentication tokens within its email-verification process. This allows an unauthenticated attacker to supply a target user ID and successfully authenticate as that user, effectively bypassing standard login security measures.

Business Impact

The CVSS score of 9.1 underscores the severity of this authentication bypass, as it allows an attacker to assume the identity of any user, including administrators. This can lead to unauthorized access to personal data, financial information, or administrative dashboards, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Update the SoftMarket Digital Marketplace plugin to a version greater than 1.0.0. If an update is not immediately available, consider disabling the plugin to prevent account takeover.

Proactive Monitoring: Audit user account activity and session logs for irregular logins or suspicious account modification behavior.

Compensating Controls: Enforce multi-factor authentication for all user roles where possible, as it may provide an additional layer of defense against account impersonation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to completely subvert the authentication mechanism of the platform.

Analyst Recommendation

This vulnerability represents a high-risk scenario for any organization utilizing the SoftMarket plugin for marketplace operations. Immediate updates are required to close the security gap and protect user accounts from unauthorized access and impersonation.

---METADATA---
VENDOR: WordPress
PRODUCT: zportals
AFFECTED_VERSIONS: 0 up to (excluding) 6.3.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The zportals WordPress plugin lacks proper file validation, allowing authenticated users to upload arbitrary PHP files and achieve remote code execution.

Executive Summary:
A critical file upload vulnerability in the zportals WordPress plugin permits authenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-14553

Affected Software: WordPress zportals

Affected Versions: 0 up to (excluding) 6.3.4

Vulnerability: The plugin exhibits an unrestricted file upload vulnerability (CWE-434) by trusting client-supplied content types and failing to sanitize file extensions. This allows any authenticated user, including those with low-level subscriber privileges, to upload malicious PHP scripts.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a severe threat to the entire hosting environment. Successful exploitation grants an attacker the ability to execute arbitrary code, potentially leading to full server compromise, unauthorized data access, and lateral movement within the network.

Remediation Plan

Immediate Action: Update the zportals plugin to version 6.3.4 or later immediately.

Proactive Monitoring: Audit the file upload directories for the presence of unexpected PHP files or scripts with suspicious naming conventions.

Compensating Controls: Restrict permissions on web-accessible upload directories to prevent the execution of scripts, and utilize a WAF to inspect and block file upload requests containing suspicious extensions.

Exploitation Status

Public Exploit Available: Yes, a public Proof-of-Concept is available.

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the ease with which low-privilege accounts can achieve total control.

Analyst Recommendation

The risk of remote code execution necessitates immediate patching. Administrators should verify that all user accounts are properly managed and limit the exposure of file upload features until the update is applied.

---METADATA---
VENDOR: servereye GmbH
PRODUCT: servereye Windows Agent (Sensorhub)
AFFECTED_VERSIONS: 0 through 20.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The servereye Windows Agent (Sensorhub) contains vulnerabilities related to insecure file permissions and improper privilege management, potentially leading to local privilege escalation.

Executive Summary:
Multiple security flaws in the servereye Windows Agent allow a local, authenticated attacker to escalate privileges and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-14551

Affected Software: servereye GmbH servereye Windows Agent (Sensorhub)

Affected Versions: 0 through 20.15

Vulnerability: The agent is susceptible to insecure temporary file creation (CWE-379), improper privilege management (CWE-269), and path manipulation (CWE-73). These vulnerabilities allow a low-privileged local user to manipulate the service environment and escalate their privileges on the host system.

Business Impact

An attacker who has already gained low-level access to the host machine can leverage these flaws to achieve full system control. With a CVSS score of 8.8, the ability to escalate privileges poses a critical risk to the overall security of the server, potentially leading to unauthorized data access, persistence, and total system compromise.

Remediation Plan

Immediate Action: Update the servereye Windows Agent to version 20.16 or higher to resolve the privilege management and file permission issues.

Proactive Monitoring: Review system logs for unauthorized attempts to modify service configurations or access restricted directories associated with the sensorhub service.

Compensating Controls: Restrict local user access to the server and ensure that the principle of least privilege is strictly enforced for all service accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by local users who have already gained access to the system.

Analyst Recommendation

The risk of local privilege escalation requires urgent attention. System administrators should deploy the vendor-supplied update to version 20.16 as soon as possible to mitigate the risk of local attacks.

---METADATA---
VENDOR: TrueBooker
PRODUCT: TrueBooker WordPress Plugin
AFFECTED_VERSIONS: 0 up to (excluding) 1.2.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The TrueBooker WordPress plugin fails to validate account ownership during password resets, allowing unauthenticated attackers to hijack any user account, including administrative accounts.

Executive Summary:
A critical vulnerability in the TrueBooker WordPress plugin allows unauthenticated remote attackers to perform a full site takeover by resetting arbitrary user passwords.

Vulnerability Details

CVE-ID: CVE-2026-14545

Affected Software: TrueBooker WordPress Plugin

Affected Versions: 0 up to (excluding) 1.2.4

Vulnerability: The plugin suffers from improper privilege management where front-end account handlers do not verify user identity during the password reset process. This flaw allows an unauthenticated attacker to supply a target username and set a new password, granting them full unauthorized access to the victim's account.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. A successful exploit grants an attacker immediate administrative access, which can be used to deploy malicious scripts, exfiltrate sensitive customer data, or deface the website. Such an incident poses a significant threat to organizational integrity and user privacy.

Remediation Plan

Immediate Action: Update the TrueBooker WordPress plugin to version 1.2.4 or later immediately to apply the necessary security validation.

Proactive Monitoring: Review WordPress user access logs for suspicious password reset activity or unauthorized administrative logins.

Compensating Controls: If an immediate update is not possible, disable the TrueBooker plugin entirely until the patch is applied, or implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's front-end password reset endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to the lack of required authentication.

Analyst Recommendation

Given the ease of exploitation and the potential for full site compromise, administrators must prioritize this update. Ensure that all plugin versions are audited and updated to 1.2.4 to eliminate this critical account takeover vector.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux 10
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An integer overflow in the HPLIP hpcups processing path allows a remote attacker to escalate privileges or execute arbitrary code via specially crafted print data.

Executive Summary:
A critical integer overflow vulnerability in Red Hat Enterprise Linux 10's HPLIP software permits remote attackers to achieve arbitrary code execution or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-14544

Affected Software: Red Hat Enterprise Linux 10

Affected Versions: See vendor advisory

Vulnerability: This is an integer overflow vulnerability within the HPLIP (HP Linux Imaging and Printing) software, specifically in the hpcups processing component. It is an incomplete fix for a prior vulnerability and enables remote attackers to trigger arbitrary code execution or escalate privileges by sending malicious print data.

Business Impact

Arbitrary code execution at the system level is a critical threat, as it allows attackers to gain full control over affected machines. With a CVSS score of 9.8, this flaw represents a significant risk to the confidentiality, integrity, and availability of any system running RHEL 10 with the vulnerable printing components enabled.

Remediation Plan

Immediate Action: Update Red Hat Enterprise Linux 10 to the latest available version which contains the corrected HPLIP packages.

Proactive Monitoring: Monitor system logs for unexpected crashes or unauthorized processes spawned by the printing service.

Compensating Controls: Disable the printing service or restrict network access to print services to trusted internal sources only if patching cannot be performed immediately.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to the potential for remote code execution. Administrators should prioritize updating RHEL 10 systems to the latest version immediately to ensure the integer overflow protection is correctly implemented. If immediate patching is not feasible, restricting access to print services is a necessary temporary measure to contain the risk.

---METADATA---
VENDOR: Google
PRODUCT: mcp-toolbox
AFFECTED_VERSIONS: 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An authentication bypass and audience confusion vulnerability in the Google OAuth provider component of mcp-toolbox allows unauthenticated attackers to compromise authentication flows.

Executive Summary:
A high-severity authentication bypass in the Google mcp-toolbox OAuth provider allows unauthenticated attackers to manipulate authentication tokens and potentially gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-14541

Affected Software: Google mcp-toolbox

Affected Versions: 1.4.0

Vulnerability: The OAuth provider component suffers from improper authentication validation, enabling audience confusion. This allows an unauthenticated attacker to bypass security checks during the authentication process.

Business Impact

This vulnerability undermines the trust and identity verification mechanisms of the application. With a CVSS score of 8.0, the potential for unauthorized access to sensitive user sessions or administrative functions is high, which may lead to data exfiltration and total system compromise.

Remediation Plan

Immediate Action: Update to the latest version of Google mcp-toolbox to resolve the OAuth provider defect. Consult the vendor repository for the specific release addressing the authentication bypass.

Proactive Monitoring: Review authentication and session logs for unusual patterns or failed login attempts that deviate from standard user behavior.

Compensating Controls: Ensure that OAuth clients are configured with strict redirect URI validation and audience checks while awaiting the official patch.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw requires precise knowledge of the OAuth implementation to exploit.

Analyst Recommendation

Authentication bypass vulnerabilities are critical and must be addressed with urgency. Security teams should ensure the update is deployed as soon as it is available to maintain the integrity of user identity and access management.

---METADATA---
VENDOR: Google
PRODUCT: mcp-toolbox
AFFECTED_VERSIONS: 0.3.0 through 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the generic HTTP source and tool components of Google mcp-toolbox allows unauthenticated attackers to perform unauthorized outbound requests.

Executive Summary:
A high-severity SSRF vulnerability in Google mcp-toolbox enables unauthenticated attackers to force the server to perform unauthorized outbound requests, risking internal network exposure.

Vulnerability Details

CVE-ID: CVE-2026-14540

Affected Software: Google mcp-toolbox

Affected Versions: 0.3.0 through 1.4.0

Vulnerability: The generic HTTP source and tool components lack sufficient validation of user-supplied URLs, allowing for Server-Side Request Forgery (SSRF). This vulnerability is accessible to unauthenticated attackers.

Business Impact

An attacker can leverage this SSRF to scan internal network infrastructure, interact with internal APIs, or access restricted cloud metadata services. The CVSS score of 8.0 underscores the risk of lateral movement and potential exposure of sensitive internal resources.

Remediation Plan

Immediate Action: Apply the vendor-provided security update immediately. The fix is associated with commit d67cfbe8ddca5a50c9577ea11feaf5c94d0acace in the upstream repository.

Proactive Monitoring: Inspect outbound network traffic logs from the server for unexpected connections to internal IP addresses or sensitive cloud service endpoints.

Compensating Controls: Enforce strict egress filtering on the host running mcp-toolbox to prevent it from initiating unauthorized connections to internal resources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are frequently used as a stepping stone for further exploitation of internal services.

Analyst Recommendation

SSRF vulnerabilities can bypass perimeter security, making them highly dangerous. Administrators should prioritize patching this issue to secure the server against internal network reconnaissance and potential data theft.

---METADATA---
VENDOR: Google
PRODUCT: mcp-toolbox
AFFECTED_VERSIONS: 1.3.0, 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in the Google mcp-toolbox HTTP API tool invocation endpoint allows unauthenticated users to perform unauthorized actions.

Executive Summary:
A high-severity authorization bypass in Google mcp-toolbox permits unauthenticated attackers to invoke tools via the HTTP API, posing a significant risk of unauthorized system operations.

Vulnerability Details

CVE-ID: CVE-2026-14537

Affected Software: Google mcp-toolbox

Affected Versions: 1.3.0, 1.4.0

Vulnerability: The application fails to properly enforce authorization checks within the direct HTTP API tool invocation endpoint. This vulnerability is exploitable by unauthenticated attackers with network access to the service.

Business Impact

Successful exploitation allows unauthorized actors to execute arbitrary tools within the mcp-toolbox environment. Given the high CVSS score of 8.1, this flaw could lead to full compromise of the tool integration layer, resulting in unauthorized data access, manipulation, or service disruption.

Remediation Plan

Immediate Action: Update Google mcp-toolbox to the latest available version as provided by the vendor. Review the linked GitHub pull request for specific implementation details regarding the authorization fix.

Proactive Monitoring: Monitor API access logs for anomalous tool invocation patterns or requests originating from unknown or suspicious IP addresses.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the API endpoint to authorized internal segments only. Use a Web Application Firewall (WAF) to filter and block suspicious API requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered inherently dangerous due to its lack of authentication requirements.

Analyst Recommendation

The vulnerability poses a severe risk to the integrity and availability of integrated systems. Organizations should prioritize patching this component immediately to prevent unauthorized tool execution.

---METADATA---
VENDOR: Devolutions
PRODUCT: Server
AFFECTED_VERSIONS: Devolutions Server 2026.2.4.0 through 2026.2.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Devolutions Server 2026.2.4.0 through 2026.2.9.0 fails to enforce mandatory multi-factor authentication (MFA) policies when encountering invalid default values, allowing credentialed bypass.

Executive Summary:
An MFA bypass vulnerability in Devolutions Server allows authenticated users to circumvent mandatory security policies, posing a critical risk to sensitive data access.

Vulnerability Details

CVE-ID: CVE-2026-14536

Affected Software: Devolutions Server

Affected Versions: 2026.2.4.0 through 2026.2.9.0

Vulnerability: This vulnerability involves the improper enforcement of mandatory multi-factor authentication (MFA) policies. An attacker possessing valid user credentials can bypass the MFA requirement when the server encounters an invalid default MFA value, allowing them to authenticate without completing the secondary verification step.

Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability significantly undermines the organization's identity and access management strategy. Successful exploitation allows unauthorized access to sensitive systems protected by Devolutions Server, potentially leading to unauthorized data exposure, system manipulation, or further lateral movement within the network.

Remediation Plan

Immediate Action: Update Devolutions Server to version 2026.2.11.0 or higher immediately.

Proactive Monitoring: Audit user access logs for unusual login patterns, particularly for accounts that should have been subjected to MFA but show successful authentication without it.

Compensating Controls: Enforce strict conditional access policies at the identity provider level (if applicable) and restrict network access to the Devolutions Server instance to authorized IP ranges only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of MFA bypass flaws, the potential for exploitation by malicious actors is high.

Analyst Recommendation

Organizations must prioritize updating to the patched version, 2026.2.11.0, to restore the integrity of their authentication processes. Given the critical impact of bypassing mandatory security controls, this update should be treated as a high-priority maintenance task.

---METADATA---
VENDOR: Trail of Bits
PRODUCT: fickling
AFFECTED_VERSIONS: 0 through 0.1.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Trail of Bits fickling is susceptible to a protection mechanism failure, allowing for potential exploitation of the deserialization process.

Executive Summary:
Trail of Bits fickling versions up to 0.1.11 are vulnerable to a protection mechanism failure that could lead to unauthorized system access and code execution.

Vulnerability Details

CVE-ID: CVE-2026-14535

Affected Software: Trail of Bits fickling

Affected Versions: 0 through 0.1.11

Vulnerability: The application suffers from a protection mechanism failure (CWE-693) that permits an unauthenticated attacker to bypass existing security controls during the deserialization of untrusted data. This failure allows the injection of malicious inputs that the application fails to properly sanitize or reject.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a high-risk scenario for any environment utilizing the fickling package. Exploitation could result in the total compromise of the application, leading to data exfiltration, service disruption, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the fickling package to version 0.1.12 or higher to ensure all protection mechanisms are correctly enforced.

Proactive Monitoring: Review system and application logs for unusual execution patterns or unauthorized attempts to interact with the deserialization functions.

Compensating Controls: Deploy strict input validation at the application layer and ensure that the host environment is segmented from critical production assets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the risk of unauthorized execution, organizations should treat this update with high priority. Transitioning to version 0.1.12 is the only reliable method to remediate the identified protection mechanism failure.

---METADATA---
VENDOR: Trail of Bits
PRODUCT: fickling
AFFECTED_VERSIONS: 0 through 0.1.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Trail of Bits fickling is vulnerable to deserialization of untrusted data and incomplete input validation, allowing potential arbitrary code execution.

Executive Summary:
Trail of Bits fickling versions up to 0.1.10 contain a critical deserialization vulnerability that could allow an attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-14534

Affected Software: Trail of Bits fickling

Affected Versions: 0 through 0.1.10

Vulnerability: This vulnerability involves the deserialization of untrusted data (CWE-502) combined with an incomplete list of disallowed inputs (CWE-184). An unauthenticated attacker can exploit this flaw to execute arbitrary code by supplying a malicious payload to the application.

Business Impact

The successful exploitation of this vulnerability poses a severe risk to organizational data integrity and system availability. Given the CVSS score of 8.8, this flaw facilitates full system compromise, potentially leading to unauthorized data access and complete loss of control over the host environment.

Remediation Plan

Immediate Action: Upgrade to version 0.1.11 or later immediately to incorporate the necessary input validation and security patches.

Proactive Monitoring: Monitor application logs for suspicious inbound traffic or unexpected object deserialization patterns that deviate from standard operational behavior.

Compensating Controls: Implement strict network ingress filtering and utilize a Web Application Firewall (WAF) to inspect and block payloads containing serialized data structures until the update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this deserialization vulnerability necessitates immediate attention. Administrators must prioritize updating to version 0.1.11 to effectively neutralize the risk of arbitrary code execution.

Executive Summary:
A critical vulnerability has been identified in the KiloView Encoder Series, which lacks proper authentication for sensitive administrative functions. This flaw allows any unauthenticated attacker on the network to create or delete administrator accounts, granting them complete control over the affected devices and potentially compromising the entire video streaming infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-1453

Affected Software: KiloView Encoder Series

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is classified as a "Missing Authentication for Critical Function." A specific function or API endpoint responsible for user account management (specifically creating and deleting administrator-level accounts) does not require any form of authentication. An unauthenticated attacker can send a specially crafted request directly to this unprotected endpoint to create a new administrator account for themselves or delete existing legitimate administrator accounts, effectively locking out authorized users and achieving a full system compromise.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation would grant an attacker complete administrative control over the KiloView encoder. This could lead to severe business consequences, including disruption of live video streams, unauthorized access to and exfiltration of sensitive video content, device reconfiguration to launch further attacks within the network, and a complete loss of device availability. The reputational damage and operational downtime resulting from such an attack pose a significant risk to the organization.

Remediation Plan

Immediate Action: Immediately apply the security updates provided by the vendor. The primary remediation is to update all affected KiloView Encoder Series products to the latest patched version, which corrects the missing authentication flaw. After patching, review all administrator accounts on the device to ensure no unauthorized accounts exist.

Proactive Monitoring: Monitor web server access logs on the devices for any unusual or direct requests to user management or administrative API endpoints, especially from untrusted internal or external IP addresses. Implement alerts for the creation or deletion of administrator-level accounts. Network traffic should be monitored for suspicious connections to the device's management interface.

Compensating Controls: If immediate patching is not feasible, implement network segmentation to restrict access to the device's management interface. Use a firewall to create strict access control lists (ACLs), allowing connections only from a limited set of trusted administrator workstations. Consider placing the device behind a web application firewall (WAF) with rules designed to block unauthorized access to sensitive administrative paths.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, Jan 29, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the simplicity of exploiting a missing authentication flaw, proof-of-concept code could be developed with minimal effort. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Due to the critical CVSS score of 9.8 and the direct path to full system compromise, this vulnerability represents a severe and immediate threat. We strongly recommend that organizations identify all affected KiloView Encoder Series devices and apply the vendor-supplied patches as an urgent priority. If patching cannot be performed immediately, the compensating controls outlined above must be implemented without delay to reduce the attack surface and mitigate the risk of a hostile takeover of these critical infrastructure components.

---METADATA---
VENDOR: IBM
PRODUCT: WebSphere Application Server
AFFECTED_VERSIONS: IBM WebSphere Application Server 9.0 and 8.5; IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM WebSphere Application Server is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled, potentially allowing unauthorized network requests.

Executive Summary:
A critical server-side request forgery vulnerability in IBM WebSphere Application Server permits unauthenticated attackers to perform unauthorized requests, necessitating immediate patching.

Vulnerability Details

CVE-ID: CVE-2026-14529

Affected Software: IBM WebSphere Application Server and WebSphere Application Server - Liberty

Affected Versions: IBM WebSphere Application Server 9.0, 8.5; Liberty 17.0.0.3 through 26.0.0.8

Vulnerability: The application fails to properly validate requests within the SIP container feature (sipServlet-1.1), leading to SSRF. This vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The CVSS score of 9.4 indicates a critical severity level, reflecting the potential for total system impact. An attacker could leverage this SSRF flaw to interact with internal services that are not exposed to the public internet, potentially leading to unauthorized data access, internal service disruption, or further exploitation of backend infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided interim fix or fix pack that resolves APAR PH72053 or DT495928 as detailed in the IBM security advisory.

Proactive Monitoring: Review application logs for unusual outbound network traffic or unexpected internal API calls originating from the WebSphere server.

Compensating Controls: If patching is delayed, disable the sipServlet-1.1 feature in the Liberty configuration if it is not required for your business operations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for internal network discovery and service interaction.

Analyst Recommendation

Given the high CVSS score and the potential for unauthenticated exploitation, this vulnerability poses a significant risk to internal network segments. Organizations should prioritize the application of the specified IBM patches or disable the vulnerable feature immediately to prevent unauthorized access.

---METADATA---
VENDOR: wupsales
PRODUCT: AI Copilot – Content Generator
AFFECTED_VERSIONS: 0 through 1.5.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An authorization bypass in the AI Copilot WordPress plugin allows unauthenticated attackers to create administrator accounts and achieve full site takeover.

Executive Summary:
An unauthenticated authorization bypass in the AI Copilot plugin for WordPress enables attackers to escalate privileges to administrator and fully compromise the site.

Vulnerability Details

CVE-ID: CVE-2026-14526

Affected Software: wupsales AI Copilot – Content Generator

Affected Versions: 0 through 1.5.6

Vulnerability: The plugin fails to perform adequate capability checks on administrative actions. Unauthenticated attackers can leverage a publicly exposed nonce to execute workflows, including the creation of new administrator accounts.

Business Impact

This vulnerability carries a CVSS score of 9.8, representing a critical risk to site integrity and security. An attacker who gains administrator access can install malicious plugins, exfiltrate user data, or use the site to distribute malware, leading to severe reputational damage and legal liability.

Remediation Plan

Immediate Action: There is currently no patched version available. Deactivate and remove the AI Copilot – Content Generator plugin until a secure update is released by the vendor.

Proactive Monitoring: Audit the WordPress user database for any newly created administrator accounts that were not authorized by legitimate staff members.

Compensating Controls: Utilize a Web Application Firewall (WAF) to restrict access to the plugin's workflow controller endpoints and block requests containing malicious workflow payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of a patch makes this a high-risk scenario that requires immediate administrative intervention to prevent exploitation.

Analyst Recommendation

Because no patch currently exists, the only effective way to mitigate this risk is to deactivate the plugin immediately. Administrators should monitor the vendor's security advisory channels closely and only re-enable the plugin once a verified update confirms the vulnerability is resolved.

---METADATA---
VENDOR: prosolution
PRODUCT: ProSolution WP Client
AFFECTED_VERSIONS: 0 through 2.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The ProSolution WP Client WordPress plugin is vulnerable to unauthenticated arbitrary file deletion via path traversal, potentially leading to remote code execution.

Executive Summary:
A critical path traversal vulnerability in the ProSolution WP Client plugin allows unauthenticated attackers to delete arbitrary files, posing a risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14524

Affected Software: prosolution ProSolution WP Client

Affected Versions: 0 through 2.0.8

Vulnerability: Insufficient validation in the proSol_fileDeleteProcess function allows an unauthenticated attacker to manipulate file paths. By poisoning a session with a path traversal key, an attacker can delete sensitive files like wp-config.php, which can lead to remote code execution.

Business Impact

With a CVSS score of 9.1, this vulnerability presents a severe risk of data loss and service interruption. The ability to delete arbitrary files allows an attacker to disable security mechanisms or force a site reset, leading to total loss of control over the application.

Remediation Plan

Immediate Action: Update the ProSolution WP Client plugin to version 2.0.9 or later to resolve the path traversal flaw.

Proactive Monitoring: Inspect server logs for requests involving the proSol_fileUploadModalProcess or proSol_fileDeleteProcess functions that contain suspicious directory traversal patterns.

Compensating Controls: Deploy a Web Application Firewall to inspect and block requests that attempt to pass directory traversal sequences through the plugin's filename parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The two-step nature of the attack requires a specific sequence, but it remains accessible to any unauthenticated visitor who can read the frontend nonce.

Analyst Recommendation

Administrators should treat this as a high-priority update. Updating to version 2.0.9 is the only effective way to mitigate the risk of arbitrary file deletion and potential server compromise.

---METADATA---
VENDOR: IBM
PRODUCT: App Connect Enterprise
AFFECTED_VERSIONS: 13.0.1.0 through 13.0.7.2, 12.0.1.0 through 12.0.12.27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM App Connect Enterprise is vulnerable to OS Command Injection, allowing an adjacent attacker to execute arbitrary commands on the underlying host.

Executive Summary:
A critical OS Command Injection vulnerability in IBM App Connect Enterprise allows adjacent attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14522

Affected Software: IBM App Connect Enterprise

Affected Versions: 13.0.1.0 through 13.0.7.2, 12.0.1.0 through 12.0.12.27

Vulnerability: This vulnerability is an OS Command Injection flaw (CWE-78) occurring when the application fails to properly neutralize special elements in input. The attack vector is adjacent, meaning the attacker must be on the same local network segment, and it requires no authentication to execute arbitrary commands.

Business Impact

Successful exploitation leads to a total compromise of the affected server, including unauthorized access to sensitive data, potential lateral movement within the network, and complete loss of system integrity. With a CVSS score of 8.8, this vulnerability poses a severe risk to business operations, as it allows for the execution of arbitrary code with the privileges of the application process.

Remediation Plan

Immediate Action: Apply the vendor-provided fix by upgrading to the latest version of IBM App Connect Enterprise or applying the specific patch associated with APAR IT49745, which includes upgrading to Fix Pack 13.0.8.0.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected shell commands originating from the application service account.

Compensating Controls: Implement network segmentation to restrict access to the IBM App Connect Enterprise management interface, ensuring only authorized devices can communicate with the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for remote code execution without authentication.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise via OS command injection, this vulnerability should be prioritized for immediate remediation. Organizations should verify their current versioning and apply the IBM-provided patches as soon as possible to neutralize this critical threat.

---METADATA---
VENDOR: IBM
PRODUCT: WebSphere Application Server
AFFECTED_VERSIONS: 9.0, 8.5
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
IBM WebSphere Application Server versions 9.0 and 8.5 are susceptible to pre-authentication unsafe deserialization, enabling remote attackers to bypass authentication or execute arbitrary code.

Executive Summary:
A critical deserialization flaw in IBM WebSphere Application Server allows unauthenticated remote attackers to execute arbitrary code or bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-14512

Affected Software: IBM WebSphere Application Server

Affected Versions: 9.0, 8.5

Vulnerability: The application is vulnerable to unsafe deserialization of untrusted data, which can be triggered by a remote, unauthenticated attacker. This flaw allows for the execution of arbitrary code or unauthorized access to administrative functions by manipulating serialized objects.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to organizational infrastructure. Successful exploitation results in total system compromise, potentially exposing sensitive data, enabling the installation of persistent backdoors, and facilitating further attacks against the internal network.

Remediation Plan

Immediate Action: Apply the relevant interim fix for APAR PH72166 or upgrade to Fix Pack 9.0.5.29 or later as specified in the IBM security advisory.

Proactive Monitoring: Monitor application server logs for unexpected deserialization errors and anomalous inbound traffic patterns targeting administrative ports or services.

Compensating Controls: Deploy a WAF with rules configured to detect and block serialized Java objects in HTTP requests that do not originate from trusted sources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Deserialization vulnerabilities are inherently dangerous due to their potential to bypass standard security filters.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for unauthenticated remote exploitation, immediate patching is required. Administrators must follow the specific instructions provided in the IBM support portal to ensure the relevant APAR fixes are correctly applied to their environments.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow OSS
AFFECTED_VERSIONS: 1.0.0 through 1.10.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM Langflow OSS is vulnerable to OS Command Injection, allowing authenticated users with low privileges to execute arbitrary system commands on the host server.

Executive Summary:
A high-severity OS command injection vulnerability in IBM Langflow OSS (CVE-2026-14499) allows authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-14499

Affected Software: IBM Langflow OSS

Affected Versions: 1.0.0 through 1.10.1

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that occurs due to improper neutralization of special elements in system commands. An attacker with low-level authenticated access can manipulate input parameters to execute unauthorized commands on the underlying operating system.

Business Impact

Successful exploitation allows an attacker to gain full control over the application server, potentially leading to total data compromise, lateral movement within the network, or persistent unauthorized access. With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Upgrade IBM Langflow OSS to version 1.10.2 or later as instructed by the vendor.

Proactive Monitoring: Monitor system logs for suspicious process execution, unexpected shell spawns, or unusual outbound network connections originating from the Langflow application service.

Compensating Controls: Ensure the application is running with the principle of least privilege, specifically restricting the permissions of the service account executing the Langflow processes to prevent further system compromise.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high CVSS score is driven by the potential for full system compromise, even though it requires low-level authentication to trigger.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations should prioritize updating their Langflow OSS deployments to version 1.10.2 to eliminate the risk of remote command execution.

---METADATA---
VENDOR: Daggerhart
PRODUCT: Query Wrangler
AFFECTED_VERSIONS: 0 through 1.5.57
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Query Wrangler plugin for WordPress is susceptible to Remote Code Execution via an unrestricted file upload vulnerability, which can be exploited by authenticated users.

Executive Summary:
The Query Wrangler plugin for WordPress contains a critical Remote Code Execution vulnerability that could allow an authenticated attacker to compromise the host server.

Vulnerability Details

CVE-ID: CVE-2026-14498

Affected Software: Daggerhart Query Wrangler

Affected Versions: 0 through 1.5.57

Vulnerability: The plugin is vulnerable to CWE-434, where improper validation allows an authenticated user to upload malicious files, leading to Remote Code Execution.

Business Impact

An attacker successfully exploiting this vulnerability could execute arbitrary code, leading to total system compromise, data theft, or the installation of persistent backdoors. The CVSS score of 8.8 reflects the high potential for impact and the relative ease of exploitation for an authenticated user.

Remediation Plan

Immediate Action: Update the Query Wrangler plugin to version 1.5.58 or later immediately.

Proactive Monitoring: Audit server file systems for unexpected files or scripts in plugin-related directories.

Compensating Controls: Utilize a WAF to restrict access to administrative functions and detect malicious file upload attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent in the way the plugin handles file uploads within its administrative interfaces.

Analyst Recommendation

Immediate remediation is required to secure the environment against potential Remote Code Execution attacks. Administrators should verify that all installations are updated to version 1.5.58 and review access logs for any suspicious activity involving the plugin.

---METADATA---
VENDOR: wpdo5ea
PRODUCT: DoLogin Security
AFFECTED_VERSIONS: 0 through 4.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The DoLogin Security plugin for WordPress is vulnerable to authentication bypass due to the use of a cryptographically weak pseudo-random number generator.

Executive Summary:
A critical authentication bypass vulnerability in the wpdo5ea DoLogin Security plugin allows attackers to compromise user accounts through predictable random number generation.

Vulnerability Details

CVE-ID: CVE-2026-14495

Affected Software: wpdo5ea DoLogin Security

Affected Versions: 0 through 4.3

Vulnerability: The plugin utilizes a cryptographically weak pseudo-random number generator (PRNG) when handling authentication tokens. This allows an authenticated attacker to predict generated values and bypass security controls to gain unauthorized access to other user accounts.

Business Impact

This vulnerability carries a CVSS score of 8.8, indicating a high risk to account integrity and data privacy. Successful exploitation allows an attacker to impersonate legitimate users or gain unauthorized access to administrative functions, potentially resulting in widespread data theft or full site compromise.

Remediation Plan

Immediate Action: Deactivate or remove the DoLogin Security plugin immediately, as the use of insecure PRNGs renders current versions fundamentally unsafe.

Proactive Monitoring: Review authentication logs for anomalous login patterns or multiple failed attempts that might indicate an attacker testing for predictable token sequences.

Compensating Controls: Enforce multi-factor authentication (MFA) via a different, secure plugin and ensure that administrative interfaces are restricted to trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypass vulnerabilities are highly critical as they undermine the primary security gate of the application. Administrators should remove the affected plugin immediately and rotate credentials for any accounts that may have been accessible while the vulnerable software was active.

---METADATA---
VENDOR: deveasel
PRODUCT: Demi – One Click Demo Import, Backup & Site Migration
AFFECTED_VERSIONS: 0 through 0.0.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Demi plugin for WordPress is vulnerable to path traversal, allowing unauthenticated attackers to delete arbitrary directories on the host server.

Executive Summary:
A path traversal vulnerability in the Demi WordPress plugin allows unauthenticated attackers to perform unauthorized directory deletions, posing a high risk to system availability.

Vulnerability Details

CVE-ID: CVE-2026-14490

Affected Software: deveasel Demi – One Click Demo Import, Backup & Site Migration

Affected Versions: 0 through 0.0.7

Vulnerability: The plugin contains an improper limitation of a pathname to a restricted directory (CWE-22). An unauthenticated attacker can exploit this flaw to delete arbitrary directories on the WordPress installation, potentially causing significant service disruption.

Business Impact

Successful exploitation allows an attacker to remove critical directories, leading to a complete loss of site functionality or data unavailability. With a CVSS score of 7.5, this high-severity vulnerability highlights the risk of destructive actions that could result in substantial operational downtime and recovery costs.

Remediation Plan

Immediate Action: Update the Demi plugin to the latest available version beyond 0.0.7 to remediate the directory traversal flaw.

Proactive Monitoring: Review web server logs for suspicious requests targeting the plugin's directory structure or unexpected deletion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal patterns (e.g., ../) in incoming HTTP requests directed at the plugin's path.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of required authentication for the destructive operation.

Analyst Recommendation

The severity of this issue necessitates immediate attention. Administrators should verify their current plugin version and apply the update immediately to prevent potential service-disrupting attacks.

---METADATA---
VENDOR: globalprogramming
PRODUCT: WHMCS Bridge
AFFECTED_VERSIONS: 0 through 6.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to a failure to validate file types in the connect() function.

Executive Summary:
An arbitrary file upload vulnerability in the WHMCS Bridge plugin allows authenticated attackers to execute malicious code on the server, resulting in potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14489

Affected Software: globalprogramming WHMCS Bridge

Affected Versions: 0 through 6.9

Vulnerability: This vulnerability (CWE-434) exists due to insufficient file type validation within the connect() function. An authenticated attacker can upload arbitrary files, including malicious scripts, which can then be executed by the server.

Business Impact

With a CVSS score of 8.8 (High), this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation allows for Remote Code Execution (RCE), which could result in complete data exfiltration, the deployment of ransomware, or the utilization of the server as a node in a larger botnet, causing significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Update the WHMCS Bridge plugin to the latest version if available, or deactivate and remove the plugin immediately to prevent unauthorized file uploads.

Proactive Monitoring: Review web server directories, particularly upload folders, for unexpected executable files (e.g., .php, .pl, .py) and anomalous traffic patterns.

Compensating Controls: Use a Web Application Firewall (WAF) configured to inspect and block unauthorized file uploads and non-standard file extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Arbitrary file upload vulnerabilities are critical entry points for attackers. We advise immediate action to secure the affected environment by removing the plugin if an update is not available, as the risk of remote code execution is severe.

---METADATA---
VENDOR: tombgtn
PRODUCT: Simple Coherent Form
AFFECTED_VERSIONS: 0 through 2.4.13
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Simple Coherent Form WordPress plugin contains a path traversal vulnerability allowing unauthenticated remote file deletion and potential code execution.

Executive Summary:
A critical path traversal vulnerability in the Simple Coherent Form WordPress plugin allows unauthenticated attackers to delete arbitrary server files.

Vulnerability Details

CVE-ID: CVE-2026-14487

Affected Software: tombgtn Simple Coherent Form

Affected Versions: 0 through 2.4.13

Vulnerability: The plugin suffers from insufficient path validation in the removeUploadDir function. Furthermore, the scf_get_id_upload endpoint fails to enforce authorization, allowing unauthenticated attackers to forge the necessary removal nonce using a hardcoded salt.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an unauthenticated attacker to delete critical system files, including wp-config.php, which can lead to complete site takeover or remote code execution. The impact includes significant service downtime, potential data loss, and the total compromise of the WordPress environment.

Remediation Plan

Immediate Action: Update the Simple Coherent Form plugin to the latest available version that addresses these security flaws.

Proactive Monitoring: Review web server access logs for requests directed at scf_get_id_upload and unexpected file deletion activity.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's file removal endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on hardcoded salts and the lack of authentication make this vulnerability trivial to exploit. Site administrators should update the plugin immediately or disable it until a patch is applied to prevent unauthorized file manipulation.

---METADATA---
VENDOR: pietror91
PRODUCT: RapiSafe – Secure Multi File Upload for Contact Form 7
AFFECTED_VERSIONS: 0 through 1.0.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The RapiSafe WordPress plugin is vulnerable to unauthenticated arbitrary file deletion via path traversal, which may lead to remote code execution.

Executive Summary:
A critical path traversal vulnerability in the RapiSafe WordPress plugin allows unauthenticated attackers to delete arbitrary files, potentially resulting in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14484

Affected Software: pietror91 RapiSafe – Secure Multi File Upload for Contact Form 7

Affected Versions: 0 through 1.0.4

Vulnerability: This flaw exists due to insufficient validation in the handleAjaxRemoveUpload function, allowing unauthenticated attackers to perform path traversal. By leveraging a publicly exposed nonce, an attacker can delete sensitive server files, such as wp-config.php, to facilitate remote code execution.

Business Impact

Successful exploitation allows an attacker to delete critical application files, leading to immediate service disruption and potential remote code execution. Given the CVSS score of 9.1, this vulnerability poses a severe threat to data integrity and system availability, warranting immediate attention.

Remediation Plan

Immediate Action: As no patch is currently available, disable or uninstall the RapiSafe plugin immediately until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting the handleAjaxRemoveUpload function or unusual attempts to access core configuration files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences or unauthorized calls to the plugin's AJAX endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of acquiring the required nonce, which effectively removes the authentication barrier.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate response. Because no fix has been released, administrators must prioritize the removal of the plugin from their environment to prevent potential site takeover.

---METADATA---
VENDOR: realtyna
PRODUCT: Realtyna Organic IDX plugin + WPL Real Estate
AFFECTED_VERSIONS: 0 through 5.2.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Realtyna Organic IDX plugin + WPL Real Estate for WordPress is vulnerable to unauthenticated arbitrary file uploads due to missing validation and static API credentials.

Executive Summary:
A critical arbitrary file upload vulnerability in the Realtyna Organic IDX plugin allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-14483

Affected Software: realtyna Realtyna Organic IDX plugin + WPL Real Estate

Affected Versions: 0 through 5.2.0

Vulnerability: The plugin suffers from an unrestricted file upload vulnerability (CWE-434) caused by a lack of file type validation and the use of static, publicly documented API credentials. This permits an unauthenticated attacker to upload executable files, leading to remote code execution.

Business Impact

The CVSS score of 9.8 reflects the ease of exploitation and the severity of the potential outcome. An attacker can gain control over the WordPress site, leading to site defacement, data theft, or complete compromise of the underlying server. This poses a significant threat to the operational integrity and reputation of any business relying on this plugin.

Remediation Plan

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the Realtyna Organic IDX plugin and WPL Real Estate plugin from their WordPress environments. Do not re-enable the plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server logs for suspicious requests to plugin-specific directories or I/O endpoints. Scan the file system for unauthorized script files that may have been uploaded via this vector.

Compensating Controls: Use a Web Application Firewall to block access to the vulnerable I/O service endpoints. Implement strict file system permissions to prevent the execution of scripts in any upload-accessible folders.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on static, default API keys significantly lowers the barrier for exploitation.

Analyst Recommendation

Due to the critical risk and the absence of a patch, deactivation of the affected plugin is the only secure course of action. Organizations must prioritize removing this software to prevent potential remote code execution attacks. Continue to monitor vendor communications for the release of a secure version.

---METADATA---
VENDOR: shen2
PRODUCT: 多说社会化评论框 (Duoshuo Social Comment Box)
AFFECTED_VERSIONS: 0 through 1.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The 多说社会化评论框 WordPress plugin is susceptible to a privilege escalation vulnerability, allowing authenticated attackers to elevate their access level.

Executive Summary:
A privilege escalation vulnerability in the 多说社会化评论框 plugin allows authenticated users to gain unauthorized administrative access, posing a significant threat to WordPress site integrity.

Vulnerability Details

CVE-ID: CVE-2026-14482

Affected Software: shen2 多说社会化评论框

Affected Versions: 0 through 1.2

Vulnerability: The plugin contains an improper privilege management flaw (CWE-269). This vulnerability allows an authenticated attacker to manipulate user permissions, potentially granting themselves administrative privileges within the WordPress environment.

Business Impact

The successful exploitation of this vulnerability permits unauthorized privilege escalation, which can lead to a full site compromise. With a CVSS score of 8.8 (High), this flaw poses a severe risk, as an attacker with low-level access can gain control over site content, user databases, and system configurations, leading to unauthorized data access or total service disruption.

Remediation Plan

Immediate Action: Audit the WordPress user list for unauthorized accounts and remove the vulnerable plugin if a security update is not available from the vendor.

Proactive Monitoring: Monitor WordPress user role change logs and administrative login activity for suspicious patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests targeting plugin-specific API endpoints or administrative functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk to the confidentiality and integrity of the affected WordPress instance. We strongly recommend immediate removal of the plugin unless a verified secure version is provided by the developer, as privilege escalation flaws are frequently targeted by threat actors to gain persistent administrative access.

---METADATA---
VENDOR: OpenPLC
PRODUCT: OpenPLC
AFFECTED_VERSIONS: v3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authenticated arbitrary file write vulnerability in the OpenPLC Runtime v3 web UI allows attackers to achieve native code execution by uploading malicious C++ source files.

Executive Summary:
A critical arbitrary file write vulnerability in OpenPLC Runtime v3 allows authenticated users to escalate privileges to full native code execution.

Vulnerability Details

CVE-ID: CVE-2026-14480

Affected Software: OpenPLC

Affected Versions: v3

Vulnerability: This vulnerability is an authenticated arbitrary file write issue (CWE-73) in the legacy web UI program-upload workflow. An attacker can supply a malicious filename to write files to arbitrary locations; by overwriting C++ source files within the runtime core, the attacker can force code execution during the compilation process.

Business Impact

The CVSS score of 9.9 reflects the extreme risk of total system compromise. Since OpenPLC is often deployed in industrial control environments, this flaw could be leveraged to gain persistence, disrupt critical processes, or manipulate physical hardware controls. The impact includes severe operational downtime and the potential for physical safety risks.

Remediation Plan

Immediate Action: Upgrade to OpenPLC v4 immediately, as v3 is end-of-life and will not receive further security patches.

Proactive Monitoring: Audit the OpenPLC runtime directory for unexpected file modifications or the presence of unauthorized C++ source files.

Compensating Controls: Restrict access to the OpenPLC web management interface to authorized, segmented management networks only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

OpenPLC v3 is deprecated and insecure. Users must transition to OpenPLC v4 as soon as possible, as no patches exist for the v3 branch. Continued use of v3 exposes the environment to significant risk of complete takeover.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (SSSD)
AFFECTED_VERSIONS: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat OpenShift Container Platform 4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A path traversal vulnerability in the SSSD AD GPO provider of Red Hat Enterprise Linux allows for potential unauthorized file access.

Executive Summary:
A path traversal flaw in the SSSD AD GPO provider across multiple versions of Red Hat Enterprise Linux and OpenShift creates a high-risk security exposure.

Vulnerability Details

CVE-ID: CVE-2026-14476

Affected Software: Red Hat Enterprise Linux (SSSD AD GPO provider)

Affected Versions: Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat OpenShift Container Platform 4

Vulnerability: This vulnerability (CWE-23) is a relative path traversal flaw within the SSSD AD GPO provider. It requires high-privileged access (PR:H) to exploit, but allows for a container-escaped scope (S:C) to perform unauthorized file system operations.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the integrity and confidentiality of Linux environments. Although it requires high privileges, the ability to perform path traversal in the context of SSSD/AD integration could allow an attacker to read or manipulate sensitive system files, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory and apply the relevant SSSD patches for your specific RHEL or OpenShift version.

Proactive Monitoring: Review system audit logs for unauthorized file access attempts or anomalous behavior originating from the SSSD service.

Compensating Controls: Enforce strict file system permissions and ensure that high-privileged accounts are monitored through robust Identity and Access Management (IAM) practices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While the requirement for high privileges mitigates the immediate risk from external actors, this vulnerability remains a critical threat to internal security. System administrators should prioritize applying the vendor-provided patches during the next maintenance window to prevent potential privilege escalation or lateral movement.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Enterprise Linux (RHEL) / OpenShift
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the SSSD LDAP sudo provider within Red Hat Enterprise Linux and OpenShift allows potential security misconfiguration risks.

Executive Summary:
A high-severity security flaw in the SSSD LDAP sudo provider across multiple Red Hat products may result in insecure resource initialization.

Vulnerability Details

CVE-ID: CVE-2026-14474

Affected Software: Red Hat Enterprise Linux (6, 7, 8, 9, 10) and OpenShift Container Platform 4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the SSSD (System Security Services Daemon) LDAP sudo provider and is classified as an insecure default resource initialization. This typically requires an authenticated user with existing access to the system environment to leverage the flawed provider logic.

Business Impact

Exploitation of this flaw could lead to unauthorized privilege escalation or the bypass of intended sudo security policies. With a CVSS score of 8.8, this vulnerability represents a significant threat to internal access control mechanisms, potentially granting attackers administrative control over affected RHEL or OpenShift nodes.

Remediation Plan

Immediate Action: Review the Red Hat Security Advisory (RHSA) portal for the specific package updates corresponding to your distribution and apply the security patches immediately.

Proactive Monitoring: Audit sudo logs and SSSD configuration files for unexpected changes or anomalies in user privilege delegation patterns.

Compensating Controls: Restrict access to systems utilizing SSSD for LDAP authentication and ensure that sudoers files are managed via secure, centralized configuration management tools.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the broad footprint of Red Hat Enterprise Linux and OpenShift in enterprise environments, this vulnerability necessitates an immediate audit of SSSD configurations. Administrators must apply vendor-supplied patches as soon as they become available to maintain the integrity of system-level access controls.