---METADATA---
VENDOR: Drupal
PRODUCT: Formatter Field
AFFECTED_VERSIONS: 0.0.0 to 2.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Drupal Formatter Field module contains an object injection vulnerability due to improper control of dynamically determined object attributes.

Executive Summary:
The Drupal Formatter Field module is affected by a critical object injection vulnerability that could allow attackers to manipulate application data and behavior.

Vulnerability Details

CVE-ID: CVE-2026-12535

Affected Software: Drupal Formatter Field

Affected Versions: 0.0.0 to 2.0.0

Vulnerability: The vulnerability involves improper control of dynamically determined object attributes, leading to potential object injection. This allows an unauthenticated attacker to manipulate how the application processes data, potentially leading to arbitrary code execution or data corruption.

Business Impact

The CVSS score of 9.8 indicates a critical severity level, posing a significant threat to the entire Drupal installation. Successful exploitation allows an attacker to inject and manipulate objects, which can result in full system compromise, unauthorized data modification, or the execution of malicious logic within the server environment.

Remediation Plan

Immediate Action: Update the Drupal Formatter Field module to version 2.0.0 or later to resolve the underlying object injection flaw.

Proactive Monitoring: Review system and application logs for unusual object-related errors or anomalies that might indicate an attempted injection attack.

Compensating Controls: Deploy a WAF with rules designed to detect and block common object injection patterns or abnormal input structures that could trigger this vulnerability.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Object injection flaws are typically complex to exploit but carry high impact, making patching essential.

Analyst Recommendation

Given the critical impact of object injection vulnerabilities, organizations must prioritize updating the Formatter Field module. Testing the update in a staging environment before deployment is recommended to ensure compatibility, but the urgency of this patch suggests a rapid deployment timeline.

---METADATA---
VENDOR: Redux Framework
PRODUCT: Redux Framework
AFFECTED_VERSIONS: 0 up to (excluding) 4.5.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Redux Framework plugin for WordPress contains an improper privilege management vulnerability that allows authenticated users to gain unauthorized access to restricted functions.

Executive Summary:
The Redux Framework WordPress plugin is susceptible to an improper privilege management flaw, which could allow authenticated attackers to perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-12525

Affected Software: Redux Framework

Affected Versions: 0 up to (excluding) 4.5.13

Vulnerability: The plugin suffers from improper privilege management (CWE-269), which permits authenticated users to escalate their permissions or access restricted administrative functionality.

Business Impact

An attacker who successfully exploits this vulnerability can gain elevated privileges within the WordPress environment. This level of access grants the attacker the ability to modify site configurations, inject malicious content, or compromise sensitive user information. The CVSS score of 8.8 highlights the critical danger of privilege escalation in a production web application.

Remediation Plan

Immediate Action: Update the Redux Framework plugin to version 4.5.13 or higher to resolve the privilege management flaw.

Proactive Monitoring: Review user roles and permissions logs for any suspicious escalation of rights or unusual administrative activities.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common privilege escalation patterns associated with WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the vulnerability is not considered automatable.

Analyst Recommendation

Administrative teams should treat this vulnerability with high urgency due to the risk of privilege escalation. Apply the update immediately and audit existing user accounts to ensure no unauthorized accounts have been created or modified during the period the site remained vulnerable.

---METADATA---
VENDOR: Zephyr Project
PRODUCT: Zephyr
AFFECTED_VERSIONS: 2.4.0 up to 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Zephyr HL7800 cellular modem driver allows for potential memory corruption during the processing of AT command responses.

Executive Summary:
A critical memory corruption vulnerability in the Zephyr RTOS HL7800 driver could allow adjacent attackers to trigger system instability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-12522

Affected Software: Zephyr Project Zephyr

Affected Versions: 2.4.0 up to 4.4.2

Vulnerability: This is a buffer overflow vulnerability (CWE-787) located in the on_cmd_atcmdinfo_ipaddr function. The vulnerability is exploitable by an adjacent attacker (someone on the same network segment) who does not require prior authentication.

Business Impact

The potential for memory corruption in an RTOS environment often results in a complete system crash or arbitrary code execution, which can disrupt critical embedded operations. With a CVSS score of 8.8, this vulnerability represents a high-risk vector for devices utilizing the HL7800 modem driver.

Remediation Plan

Immediate Action: Update the Zephyr project codebase to a version that includes the fix provided in commit a1cbced64181bc0bdf95e1fd7118f2bb70cf679b.

Proactive Monitoring: Monitor network traffic directed toward the modem interface for malformed AT command responses or unexpected communication patterns.

Compensating Controls: If immediate patching is not possible, isolate affected devices from untrusted network segments to mitigate the risk of adjacent exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it highly susceptible to exploitation if the modem interface is exposed to a hostile network environment.

Analyst Recommendation

Given the potential for remote code execution in embedded systems, this update should be treated with high urgency. Developers must integrate the provided security patch into their firmware build pipeline immediately to secure the device communication stack.

---METADATA---
VENDOR: Unknown
PRODUCT: Quotes llama
AFFECTED_VERSIONS: 0 up to 3.1.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Quotes llama WordPress plugin contains a SQL injection vulnerability that allows unauthenticated attackers to read sensitive database information, including password hashes.

Executive Summary:
A critical SQL injection vulnerability in the Quotes llama WordPress plugin allows unauthenticated attackers to exfiltrate sensitive data from the database.

Vulnerability Details

CVE-ID: CVE-2026-12512

Affected Software: Quotes llama

Affected Versions: 0 up to 3.1.6

Vulnerability: This is a SQL injection vulnerability (CWE-89) occurring because the plugin fails to sanitize user-supplied parameters before incorporating them into SQL queries. The vulnerability allows unauthenticated attackers to perform UNION-based queries to extract information from the database.

Business Impact

The CVSS score of 8.6 reflects the high severity of this vulnerability, as it allows for the remote extraction of critical data such as password hashes. This could lead to full site compromise, unauthorized administrative access, and significant data breaches if not remediated promptly.

Remediation Plan

Immediate Action: Update the Quotes llama plugin to version 3.1.6 or the latest available version immediately.

Proactive Monitoring: Audit database logs for suspicious queries that utilize UNION operators or patterns indicative of data exfiltration.

Compensating Controls: Utilize a WordPress-specific security plugin or a WAF to filter malicious SQL injection attempts directed at the site.

Exploitation Status

Public Exploit Available: No confirmed public exploit (weaponized) is available.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers due to the lack of required authentication.

Analyst Recommendation

This vulnerability represents a significant risk to WordPress site owners. Given the availability of a proof-of-concept and the high CVSS score, updating the plugin to the patched version is a mandatory security task to prevent potential database compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: AI Engine
AFFECTED_VERSIONS: < 3.5.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The AI Engine WordPress plugin before 3.5.5 allows authenticated users with editor access to perform path traversal and write arbitrary files to the server.

Executive Summary:
A path traversal vulnerability in the AI Engine WordPress plugin allows authenticated attackers to execute arbitrary file writes on the host server.

Vulnerability Details

CVE-ID: CVE-2026-12511

Affected Software: WordPress AI Engine

Affected Versions: < 3.5.5

Vulnerability: The plugin fails to sanitize user supplied filenames during file downloads, which permits authenticated users with editor level privileges to perform path traversal and write attacker controlled bytes to arbitrary locations on the server filesystem.

Business Impact

This vulnerability poses a significant risk to server integrity, as an attacker with editor access can overwrite critical system or application files. Given the CVSS score of 8.1, this is classified as a high severity issue that could lead to full system compromise if the attacker successfully uploads or overwrites executable code.

Remediation Plan

Immediate Action: Update the AI Engine plugin to version 3.5.5 or later immediately.

Proactive Monitoring: Review access logs for suspicious file upload activity or requests containing path traversal sequences, such as dot dot slash patterns.

Compensating Controls: Ensure that the web server process runs with the least privilege necessary to limit the impact of potential arbitrary file writes.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit in available data)

Analyst Notes: As of Jul 14, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The flaw is inherently exploitable by any authenticated user assigned the editor role.

Analyst Recommendation

The ability for an authenticated user to perform arbitrary file writes represents a critical failure in input validation. Administrators should prioritize updating the AI Engine plugin to version 3.5.5 to eliminate this path traversal vector and prevent potential remote code execution scenarios.

---METADATA---
VENDOR: Loytec
PRODUCT: LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI
AFFECTED_VERSIONS: 0 through 8.4.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Loytec automation devices contain an improper authentication vulnerability in the PAM configuration that may allow for unauthorized access.

Executive Summary:
A critical authentication flaw in the PAM configuration of various Loytec devices could allow authenticated attackers to bypass security controls, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12504

Affected Software: Loytec LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI

Affected Versions: 0 through 8.4.16

Vulnerability: The vulnerability stems from improper authentication (CWE-287) and weak password requirements (CWE-521) within the Pluggable Authentication Module (PAM) configuration. It requires an attacker to already possess high-level privileges to exploit the configuration flaw.

Business Impact

By exploiting this authentication weakness, an attacker with high privileges can bypass existing security barriers, leading to total control over the device. This severity is underscored by a CVSS score of 8.4, representing a substantial risk to the availability and integrity of industrial control systems that rely on these devices for operational management.

Remediation Plan

Immediate Action: Upgrade all affected Loytec device firmware to version 8.4.18 to remediate the PAM configuration vulnerability.

Proactive Monitoring: Monitor authentication logs for unusual login patterns or attempts to reset credentials through non-standard channels.

Compensating Controls: Enforce multi-factor authentication where supported and restrict network access to device management interfaces to trusted segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a configuration-based issue within the authentication subsystem.

Analyst Recommendation

Addressing this authentication flaw is essential to preventing unauthorized administrative escalation. Organizations must move quickly to update the firmware to version 8.4.18 to ensure that the PAM configuration is properly secured against potential exploitation.

---METADATA---
VENDOR: Loytec
PRODUCT: L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD, LIP-ME20xC
AFFECTED_VERSIONS: 0 through 8.4.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A symlink attack in the /usr/bin/larm_starter utility of various Loytec devices allows authenticated attackers to escalate privileges to root.

Executive Summary:
An authenticated privilege escalation vulnerability in multiple Loytec hardware products allows local attackers to gain root access via symlink manipulation.

Vulnerability Details

CVE-ID: CVE-2026-12503

Affected Software: Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD, and LIP-ME20xC

Affected Versions: 0 through 8.4.16

Vulnerability: This is an improper link resolution vulnerability (CWE-59) that permits an authenticated user with 'larmapp' privileges to modify protected system files. By exploiting a symlink attack on specific SSL configuration files, an attacker can make sensitive system files writable, facilitating a full root privilege escalation.

Business Impact

With a CVSS score of 9.2, this vulnerability represents a severe threat to the integrity and security of industrial control systems. Successful exploitation grants an attacker full control over the affected hardware, potentially leading to unauthorized process manipulation, system shutdown, or persistent backdoors within the operational technology network.

Remediation Plan

Immediate Action: Upgrade the firmware of all affected Loytec devices to version 8.4.18 or later as recommended by the vendor.

Proactive Monitoring: Audit system logs for unauthorized attempts to modify sensitive files like /etc/passwd or unusual activities originating from the 'larmapp' user context.

Compensating Controls: Restrict physical and network access to the device management interfaces to prevent unauthorized users from reaching the authentication layer required to initiate the attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete system compromise once authentication is achieved.

Analyst Recommendation

Organizations utilizing Loytec industrial hardware must verify current firmware versions across their fleet immediately. Updating to firmware 8.4.18 is the only definitive way to remediate this privilege escalation risk and prevent unauthorized root-level access.

---METADATA---
VENDOR: Loytec
PRODUCT: LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI
AFFECTED_VERSIONS: 0 through 8.4.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Loytec automation devices contain an improper privilege management vulnerability in the ltsudo utility that allows for escalated privileges.

Executive Summary:
A privilege management flaw in the ltsudo utility of various Loytec automation devices permits high-privileged users to escalate their access levels, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-12502

Affected Software: Loytec LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI

Affected Versions: 0 through 8.4.16

Vulnerability: This vulnerability involves improper privilege management (CWE-269) within the /usr/bin/ltsudo binary. The attack requires an authenticated user with high privileges to successfully exploit the system.

Business Impact

Exploitation of this vulnerability allows an already high-privileged user to gain total control over the affected automation hardware. With a CVSS score of 8.4, this poses a high risk to industrial control environments, potentially leading to unauthorized system configuration changes or the disruption of critical operational technology services.

Remediation Plan

Immediate Action: Upgrade the firmware of all affected Loytec devices to version 8.4.18 immediately.

Proactive Monitoring: Audit logs for any suspicious activity involving the ltsudo utility or unauthorized attempts to modify system-level configurations.

Compensating Controls: Restrict physical and network access to the management interfaces of these devices to only authorized administrative personnel.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-level authentication limits the attack surface to existing administrative accounts.

Analyst Recommendation

Given the critical nature of industrial control systems, maintaining firmware integrity is vital. Administrators should prioritize the firmware update to 8.4.18 to eliminate this privilege escalation vector and secure the administrative control plane.

---METADATA---
VENDOR: Loytec
PRODUCT: LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI
AFFECTED_VERSIONS: 0 through 8.4.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the OPC XML-DA server statistics of various Loytec devices allows unauthenticated attackers to execute malicious scripts in a user's browser.

Executive Summary:
A stored cross-site scripting vulnerability in multiple Loytec products allows unauthenticated attackers to execute arbitrary scripts in the context of an administrative session.

Vulnerability Details

CVE-ID: CVE-2026-12496

Affected Software: Loytec LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI

Affected Versions: 0 through 8.4.16

Vulnerability: This is a stored XSS vulnerability (CWE-79) triggered by improper neutralization of input within the OPC XML-DA server statistics. The vulnerability is exploitable by an unauthenticated attacker, though it requires a user to interact with the malicious content.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session. This can be used to steal session cookies, perform unauthorized actions on behalf of an administrator, or redirect users to malicious sites, potentially leading to full device compromise. Given the CVSS score of 8.7, this vulnerability represents a high risk to operational technology environments.

Remediation Plan

Immediate Action: Upgrade firmware for all affected Loytec devices to version 8.4.18.

Proactive Monitoring: Monitor device traffic for anomalous input strings directed at the OPC XML-DA server statistics interface. Audit web logs for signs of script injection attempts.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious input patterns, and restrict network access to device management interfaces to authorized personnel only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable via web interfaces, making prompt firmware updates critical for protecting device integrity.

Analyst Recommendation

Loytec device administrators should treat this vulnerability with high urgency. Given that the flaw allows for unauthenticated interaction, the risk of external exploitation is elevated. Applying the 8.4.18 firmware update is the only definitive way to neutralize this cross-site scripting risk.

---METADATA---
VENDOR: Zaytech
PRODUCT: Clover Payment Gateway for WooCommerce
AFFECTED_VERSIONS: 0 up to (excluding) 1.3.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin contains an improper authentication vulnerability that allows unauthenticated attackers to manipulate payment processes.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Clover Payment Gateway for WooCommerce plugin poses a high risk to transaction integrity.

Vulnerability Details

CVE-ID: CVE-2026-12493

Affected Software: Zaytech Clover Payment Gateway for WooCommerce

Affected Versions: 0 up to (excluding) 1.3.6

Vulnerability: The plugin suffers from an Improper Authentication flaw (CWE-287), which allows unauthenticated remote attackers to bypass security controls and potentially perform unauthorized actions within the payment gateway integration.

Business Impact

Successful exploitation of this vulnerability could lead to the compromise of financial transaction integrity, potentially allowing attackers to interfere with payment processing or bypass validation. Given the CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent direct financial loss or reputational damage to the e-commerce platform.

Remediation Plan

Immediate Action: Update the Clover Payment Gateway by Zaytech for WooCommerce plugin to version 1.3.6 or later immediately.

Proactive Monitoring: Review WooCommerce transaction logs for anomalous payment statuses or unauthorized order modifications originating from unknown sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific endpoints until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature.

Analyst Recommendation

The potential for unauthorized manipulation of payment workflows makes this a critical priority for any organization utilizing this plugin. Administrators must verify the version currently in use and apply the 1.3.6 update without delay to secure the transaction environment.

---METADATA---
VENDOR: Happy Coders
PRODUCT: OTP Login for WooCommerce
AFFECTED_VERSIONS: 1.5 up to (excluding) 2.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Happy Coders OTP Login for WooCommerce plugin fails to validate one-time passwords during the authentication process, allowing unauthorized account access.

Executive Summary:
A critical authentication bypass in the Happy Coders OTP Login for WooCommerce plugin permits unauthenticated attackers to hijack any user account, including administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-12492

Affected Software: Happy Coders OTP Login for WooCommerce

Affected Versions: 1.5 up to (excluding) 2.8

Vulnerability: The plugin contains an authentication bypass flaw where the system fails to confirm that a valid one-time password was provided before granting access. This allows an unauthenticated attacker to log in as any existing user or create new unauthorized accounts.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to e-commerce platforms using the affected plugin. An attacker gaining administrative access could exfiltrate sensitive customer data, modify store configurations, or conduct fraudulent transactions, resulting in severe financial and reputational damage.

Remediation Plan

Immediate Action: Update the Happy Coders OTP Login for WooCommerce plugin to version 2.8 or later immediately.

Proactive Monitoring: Review user account logs for anomalous logins, particularly those occurring without valid OTP challenge-response patterns.

Compensating Controls: If an immediate update is not possible, disable the OTP login functionality or restrict access to the authentication endpoints via a Web Application Firewall until a patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw represents a fundamental failure in the authentication logic.

Analyst Recommendation

This vulnerability is highly critical and trivial to exploit. Store administrators must treat this as a high-priority incident and apply the provided update immediately to prevent full site takeover and unauthorized data access.

---METADATA---
VENDOR: NLnet
PRODUCT: NSD
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the NSD name server software fails to properly enforce client certificate authentication when a provide-xfr is configured with a tls-auth-name.

Executive Summary:
The NLnet NSD name server contains an authentication flaw that may allow unauthorized zone transfers due to improper validation of TLS client certificates.

Vulnerability Details

CVE-ID: CVE-2026-12490

Affected Software: NLnet NSD

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This issue exists when a provide-xfr configuration utilizes tls-auth-name, where a secondary server requesting a transfer fails to provide the required client certificate. This results in a breakdown of the expected authentication handshake between primary and secondary name servers.

Business Impact

The failure to enforce proper certificate-based authentication for zone transfers poses a significant risk to DNS integrity. An attacker could potentially conduct unauthorized zone transfers, leading to sensitive information disclosure regarding internal network architecture and DNS records. With a CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and availability of DNS services.

Remediation Plan

Immediate Action: Update the NSD software to the latest version provided by the vendor to ensure proper TLS authentication enforcement.

Proactive Monitoring: Review DNS server logs for unexpected or unauthorized zone transfer requests, particularly those originating from untrusted or unknown secondary IP addresses.

Compensating Controls: Restrict access to zone transfer services at the network layer using firewall rules to permit only known and verified secondary server IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of DNS infrastructure, organizations should prioritize the identification and patching of affected NSD instances. Immediate verification of TLS configuration settings is advised to ensure that zone transfers are only permitted when valid, verified credentials are presented.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: 2.09
---END_METADATA---

Description Summary:
Multiple OS command injection vulnerabilities in the GeoVision GV-I/O Box 4E allow remote attackers to execute arbitrary commands via crafted network packets.

Executive Summary:
A critical command injection vulnerability in GeoVision GV-I/O Box 4E allows remote attackers to execute system commands through unauthenticated network requests.

Vulnerability Details

CVE-ID: CVE-2026-12486

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: 2.09

Vulnerability: The internal library libNetSetObj.so fails to sanitize input before passing it to the system() call within the CNetSetObj::m_F_n_Set_IP_Addr function. This flaw is reachable via the network-exposed DVRSearch service and Network.cgi endpoint, allowing remote command injection.

Business Impact

With a CVSS score of 9.1, this vulnerability poses an extreme risk, as it allows attackers to gain persistent access to the hardware device. This can lead to device takeover, credential theft, and the use of the device as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Update the firmware of the GV-I/O Box 4E to the latest version provided by the vendor.

Proactive Monitoring: Monitor network traffic for suspicious requests targeting the DVRSearch service or Network.cgi endpoint, specifically looking for shell metacharacters in parameters.

Compensating Controls: Restrict network access to the management interfaces of the I/O Box using network segmentation or firewall rules to limit exposure to trusted internal segments only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights significant security deficiencies in the device's network configuration handling. Administrators must apply the latest firmware updates immediately and restrict management access to the device to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-I/O Box 4E
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The GeoVision GV-I/O Box 4E contains a stack-based buffer overflow in the DVRSearch service, allowing unauthenticated attackers to trigger remote code execution via malformed UDP packets.

Executive Summary:
A critical stack-based buffer overflow in the GeoVision GV-I/O Box 4E allows unauthenticated remote attackers to execute arbitrary code by sending crafted UDP packets to the device.

Vulnerability Details

CVE-ID: CVE-2026-12485

Affected Software: GeoVision GV-I/O Box 4E

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The DVRSearch service, which listens on UDP port 10001, contains a stack-based buffer overflow. An attacker can send a malformed UDP message that, when processed, causes an out-of-bounds copy into a local buffer, leading to memory corruption and potential code execution.

Business Impact

The CVSS score of 10.0 reflects the critical nature of this vulnerability, as it allows unauthenticated remote code execution on an embedded device. An attacker could gain full control over the I/O Box, potentially manipulating physical relays or using the device as a foothold for further attacks on the internal network.

Remediation Plan

Immediate Action: Consult the official GeoVision security advisory and apply the latest firmware update to address the buffer overflow in the DVRSearch service.

Proactive Monitoring: Monitor network traffic for unusual or malformed UDP packets sent to port 10001 and review device logs for signs of service crashes or unauthorized access.

Compensating Controls: If patching is delayed, isolate the GV-I/O Box 4E on a restricted VLAN and block external access to port 10001 at the network perimeter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the maximum severity score and the lack of authentication required to trigger this vulnerability, immediate remediation is mandatory. System administrators should prioritize firmware updates or network-level isolation to prevent unauthorized access to these embedded devices.

---METADATA---
VENDOR: Keras
PRODUCT: Keras
AFFECTED_VERSIONS: 3.15.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Keras version 3.15.0 is vulnerable to unsafe deserialization of attacker-controlled PyTorch pickle data via the keras.layers.TorchModuleWrapper.from_config method.

Executive Summary:
A vulnerability in Keras allows for arbitrary code execution through unsafe deserialization of untrusted PyTorch data structures.

Vulnerability Details

CVE-ID: CVE-2026-12484

Affected Software: Keras

Affected Versions: 3.15.0

Vulnerability: This flaw stems from improper deserialization of untrusted data (CWE-502). The affected method invokes torch.load with weights_only=False, which permits the execution of arbitrary code when processing malicious Keras layer configurations that are not properly sandboxed.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to machine learning pipelines and development environments. An attacker who can influence the model configuration files can achieve arbitrary code execution on the host system, potentially leading to unauthorized data access or the compromise of the underlying compute infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of Keras that addresses the unsafe deserialization behavior.

Proactive Monitoring: Audit data input paths for machine learning models to ensure that only trusted configurations are processed and monitor system calls for unexpected process execution originating from the Keras library.

Compensating Controls: Ensure that all model loading occurs within a SafeModeScope(True) context to enforce safe deserialization practices until a permanent patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires the processing of untrusted or maliciously crafted model configurations to be triggered.

Analyst Recommendation

Organizations utilizing Keras for model deployment should verify their current version and update immediately to the latest release. Developers should exercise caution when loading model configurations from external or untrusted sources to prevent exploitation of this deserialization flaw.

---METADATA---
VENDOR: Keras Team
PRODUCT: Keras
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in Keras version 3 that may expose the machine learning framework to security risks.

Executive Summary:
A high-severity vulnerability in the Keras machine learning framework poses a significant risk to the integrity and security of model deployment environments.

Vulnerability Details

CVE-ID: CVE-2026-12481

Affected Software: Keras Team Keras

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Keras framework, potentially allowing for unauthorized operations within the machine learning pipeline. The specific authentication requirements and entry vectors depend on the underlying implementation, necessitating immediate review of the vendor's security disclosure.

Business Impact

The exploitation of this flaw could lead to the compromise of machine learning models or the underlying infrastructure hosting them. Given the CVSS score of 8.8, the potential for unauthorized access or data manipulation is substantial, which could result in severe reputational damage or the integrity loss of proprietary research and production environments.

Remediation Plan

Immediate Action: Review the official Keras security advisories and apply the latest security patches or updates provided by the Keras Team immediately.

Proactive Monitoring: Monitor system logs for anomalous execution patterns or unexpected API calls originating from the Keras environment.

Compensating Controls: Implement strict network segmentation and restrict access to the server hosting the Keras framework to authorized personnel only to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability requires immediate attention from security administrators and data science teams managing Keras deployments. You must prioritize the verification of your current version and apply all relevant security updates to mitigate the risk of unauthorized access to your machine learning infrastructure.

---METADATA---
VENDOR: Open
PRODUCT: DICOM Web Viewer Framework
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The DICOM Web Viewer Framework contains a server-side request forgery vulnerability due to improper validation of URL parameters in the DICOMWebProxy and DICOMJSON data sources.

Executive Summary:
The DICOM Web Viewer Framework is susceptible to an unauthenticated server-side request forgery vulnerability that could allow attackers to perform unauthorized requests on behalf of the server.

Vulnerability Details

CVE-ID: CVE-2026-12473

Affected Software: Open DICOM Web Viewer Framework

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the failure to validate arbitrary URL parameters within the default configuration of the DICOMWebProxy and DICOMJSON components. This allows an unauthenticated attacker to force the application to make requests to internal or external resources.

Business Impact

A successful exploit could allow attackers to bypass network segmentation, probe internal services, or exfiltrate sensitive data from the internal network. With a CVSS score of 8.2, this high-severity vulnerability poses a significant risk to the confidentiality and integrity of infrastructure hosting medical imaging data.

Remediation Plan

Immediate Action: Identify and disable the vulnerable DICOMWebProxy and DICOMJSON data sources if they are not strictly required for business operations.

Proactive Monitoring: Review web server and network egress logs for anomalous requests originating from the framework to unauthorized or internal IP addresses.

Compensating Controls: Implement strict egress filtering on the host machine to prevent the application from accessing internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing this framework should prioritize verifying their configuration against vendor documentation. Given the potential for unauthorized internal network access, applying any available vendor security updates is mandatory to mitigate the risk of lateral movement.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition within the Google Chrome Updater for macOS could allow an attacker to interfere with the update process, potentially leading to unauthorized operations.

Executive Summary:
A high-severity race condition in the Google Chrome Updater for macOS allows for potential unauthorized system-level manipulation.

Vulnerability Details

CVE-ID: CVE-2026-12468

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a race condition in the browser's updater mechanism. An attacker could potentially exploit the timing of update operations to gain elevated control over the application's lifecycle or security parameters.

Business Impact

An attacker successfully exploiting the updater component could potentially bypass security updates or force the installation of unauthorized code, undermining the integrity of the browser environment. With a CVSS score of 8.3, this represents a major risk to enterprise endpoint security and the reliability of automated patch management processes.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 149 or higher to patch the race condition within the updater module.

Proactive Monitoring: Review system logs for anomalous activity specifically related to the browser update process or unexpected installation events.

Compensating Controls: Utilize endpoint management tools to strictly control binary execution permissions and prevent unauthorized modifications to application directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining a secure update mechanism is critical for browser integrity. Organizations must immediately update Google Chrome on all macOS systems to ensure that the updater component is no longer susceptible to this race condition.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability exists in the WebRTC component of Google Chrome on Windows, potentially allowing for arbitrary code execution.

Executive Summary:
A heap buffer overflow in the Google Chrome WebRTC component poses a significant risk of remote code execution on affected Windows systems.

Vulnerability Details

CVE-ID: CVE-2026-12466

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a heap buffer overflow vulnerability located within the WebRTC implementation of the browser. It likely requires a user to interact with malicious web content to trigger the memory corruption flaw.

Business Impact

A successful exploit of this vulnerability could allow an attacker to execute arbitrary code within the context of the browser. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full system compromise, data exfiltration, or the installation of persistent malware on user endpoints.

Remediation Plan

Immediate Action: Update all instances of Google Chrome on Windows to version 149 or later immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by the Google Chrome browser or unusual network activity following web browsing sessions.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are active to identify and block memory-based exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser-based vulnerabilities are frequent targets for threat actors seeking initial access. IT administrators must prioritize the deployment of the latest Chrome security updates to all managed endpoints to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition vulnerability exists within the Safe Browsing component of Google Chrome for macOS, potentially allowing for memory corruption or bypass of security features.

Executive Summary:
A race condition in the Google Chrome Safe Browsing component on macOS presents a high-severity risk of unauthorized system interaction.

Vulnerability Details

CVE-ID: CVE-2026-12454

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a race condition vulnerability within the Safe Browsing module. The vulnerability requires a local attacker to potentially leverage timing discrepancies to gain unauthorized access or manipulate browser security states.

Business Impact

Successful exploitation of this race condition could lead to a compromise of browser security controls, potentially exposing the user to malicious content that the Safe Browsing feature is designed to block. Given the CVSS score of 8.3, this flaw poses a significant risk to organizational data integrity and endpoint security if leveraged to deliver further payloads.

Remediation Plan

Immediate Action: Update Google Chrome to version 149 or later immediately to incorporate the necessary race condition fixes.

Proactive Monitoring: Monitor endpoint security logs for unusual browser process behavior or unauthorized attempts to modify browser configurations.

Compensating Controls: Ensure that endpoint protection software is active and configured to detect and block suspicious code execution originating from web browser processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the security posture of macOS workstations. Administrators should prioritize the deployment of the latest Google Chrome updates to all managed devices to mitigate the risk of exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Downloads component of Google Chrome on Android allows potential memory corruption and system instability.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome’s Android download manager could allow for remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12452

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a use-after-free flaw within the download management system of the browser. An unauthenticated attacker could exploit this by tricking a user into downloading a malicious file, leading to memory corruption.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. Since the vulnerability resides in the download handler, it poses a direct risk to mobile devices, potentially allowing attackers to gain persistence or access sensitive files on the Android device.

Remediation Plan

Immediate Action: Update Google Chrome on all Android devices to version 149 or later via the Google Play Store.

Proactive Monitoring: Review logs for unusual download activity or failed file-handling operations on corporate mobile devices.

Compensating Controls: Implement mobile device management (MDM) policies to restrict unauthorized file downloads and enforce strict application sandboxing.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mobile endpoints are often overlooked in patch management cycles. It is critical to ensure all Android devices are updated to version 149 to prevent attackers from leveraging this download-based vulnerability to compromise mobile assets.

---METADATA---
VENDOR: Google
PRODUCT: Chrome (Android WebView)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An inappropriate implementation vulnerability exists in the WebView component of Google Chrome on Android versions prior to 149.

Executive Summary:
A high-severity implementation flaw in Google Chrome’s Android WebView could lead to unauthorized access or security bypass for applications relying on the browser engine.

Vulnerability Details

CVE-ID: CVE-2026-12448

Affected Software: Google Chrome (Android WebView)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an implementation error within the WebView component, which allows applications to display web content. An attacker could potentially leverage this flaw to bypass security controls, though the specific attack vector typically requires interaction with a malicious web resource.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical for organizations that utilize WebView in custom Android applications. Successful exploitation could allow an attacker to bypass sandbox protections, potentially leading to unauthorized access to user data or malicious code execution within the context of the vulnerable application.

Remediation Plan

Immediate Action: Update the Google Chrome / WebView component to version 149 or later via the Google Play Store or system update channels.

Proactive Monitoring: Monitor for anomalous application crashes or unexpected behavior in Android applications that utilize the WebView component.

Compensating Controls: Ensure that applications using WebView implement strict Content Security Policies (CSP) to mitigate potential web-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ubiquity of WebView, the potential for widespread exploitation is high.

Analyst Recommendation

Organizations must prioritize updating all Android devices and applications that rely on the WebView component. Regular updates to the Chrome browser engine are the only effective method to mitigate this implementation-level vulnerability.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability in the WebRTC component of Google Chrome could lead to remote code execution.

Executive Summary:
A critical heap buffer overflow in Google Chrome’s WebRTC implementation presents a substantial risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12447

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a heap buffer overflow within the WebRTC subsystem, which handles real-time communication. An unauthenticated attacker can trigger this overflow by sending specially crafted packets, potentially leading to arbitrary code execution.

Business Impact

With a CVSS score of 8.8, this vulnerability is highly dangerous as it affects the WebRTC stack, which is frequently used for modern communication tools. Successful exploitation could lead to total system compromise, bypassing standard browser security boundaries.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 149 or higher immediately.

Proactive Monitoring: Monitor for unexpected network traffic or spikes in WebRTC-related service usage that may indicate exploitation.

Compensating Controls: Use a network-level firewall or Web Application Firewall to inspect and filter suspicious traffic patterns associated with WebRTC.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Heap buffer overflows are classic vectors for remote code execution. Given the ubiquity of WebRTC, it is imperative that all browser instances are updated to version 149 immediately to close this critical security gap.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Web Authentication component of Google Chrome allows potential attackers to compromise browser security.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome’s Web Authentication module could allow attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-12443

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw is a use-after-free vulnerability within the Web Authentication API. An unauthenticated attacker can exploit this by directing a user to a malicious site, potentially leading to memory corruption and code execution.

Business Impact

The CVSS score of 8.8 reflects the high potential for system-level impact. Exploitation of the Web Authentication component could bypass critical security controls, potentially leading to unauthorized access to sensitive web applications and services.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Google to move to Chrome version 149 or later.

Proactive Monitoring: Monitor network traffic for unusual authentication attempts or patterns consistent with browser-based exploitation.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to identify and block suspicious process spawning originating from the browser.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication modules are high-value targets for attackers. Organizations must prioritize patching this vulnerability to prevent potential session hijacking or persistent access gained through memory corruption.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the password management component of Google Chrome on Android may lead to unauthorized access or system instability.

Executive Summary:
A critical use-after-free vulnerability in Google Chrome on Android poses a significant risk to user credentials and device security.

Vulnerability Details

CVE-ID: CVE-2026-12442

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a use-after-free condition within the password management subsystem. An unauthenticated attacker could trigger this flaw to achieve code execution or sensitive information disclosure via a malicious web request.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to mobile endpoint security. Compromise of the password manager could lead to the exposure of stored corporate credentials, resulting in unauthorized access to internal systems and potential data breaches.

Remediation Plan

Immediate Action: Update Google Chrome on all Android devices to version 149 or later via the Google Play Store.

Proactive Monitoring: Monitor mobile device management (MDM) platforms for outdated browser versions and ensure all devices are running patched software.

Compensating Controls: Enforce organizational policies requiring the use of enterprise-grade password managers rather than browser-native storage where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mobile security is a critical vector for corporate data access. Security teams should mandate an immediate update to version 149 for all Android devices to mitigate the risk of credential theft and remote exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the File Input component of Google Chrome on Linux, potentially allowing for arbitrary code execution.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome on Linux exposes users to potential remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12441

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a use-after-free flaw located within the File Input handler of the browser. An unauthenticated attacker could exploit this memory corruption issue by enticing a user to interact with a specially crafted web page.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk to organizational endpoints. Successful exploitation could lead to full system compromise, unauthorized data access, and potential lateral movement within the network, significantly impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Update all installations of Google Chrome on Linux to version 149 or later immediately.

Proactive Monitoring: Review system logs for unusual browser crashes or unexpected process behavior that may indicate exploitation attempts.

Compensating Controls: Ensure that browser-based endpoint protection and sandboxing features are fully enabled and up to date to restrict the impact of malicious code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical nature of browser-based memory corruption flaws, organizations must prioritize this update. Deploy the vendor-provided patch across all Linux workstations immediately to neutralize the risk of remote exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 149
---END_METADATA---

Description Summary:
A Use-After-Free (UAF) vulnerability in Google Chrome's Digital Credentials component allows for potential remote code execution or system instability.

Executive Summary:
A high-severity Use-After-Free vulnerability in Google Chrome allows attackers to execute arbitrary code through specially crafted web content.

Vulnerability Details

CVE-ID: CVE-2026-12439

Affected Software: Google Chrome

Affected Versions: prior to 149

Vulnerability: This is a memory corruption vulnerability (Use-After-Free) located in the Digital Credentials implementation. An attacker can trigger this condition by enticing a user to visit a malicious website, potentially leading to arbitrary code execution within the browser's context.

Business Impact

With a CVSS score of 8.8, this flaw is highly dangerous as it allows for browser-based attacks that can bypass security boundaries. Successful exploitation could lead to data theft, session hijacking, or the installation of malicious software on the end-user's device.

Remediation Plan

Immediate Action: Update Google Chrome to version 149 or later to incorporate the vendor's security fixes.

Proactive Monitoring: Monitor endpoint logs for abnormal browser crashes or unexpected behavior that may indicate an attempted UAF exploit.

Compensating Controls: Use endpoint protection software that can detect and block known exploit patterns and maintain strict browser security policies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser-based UAF vulnerabilities are frequently targeted by attackers. It is critical that all enterprise environments push the update to version 149 immediately to ensure user protection.

---METADATA---
VENDOR: Google
PRODUCT: Chrome on Android
AFFECTED_VERSIONS: Versions prior to 149
---END_METADATA---

Description Summary:
An inappropriate implementation vulnerability in the WebView component of Google Chrome on Android may allow for unauthorized behavior by malicious applications.

Executive Summary:
Google Chrome on Android contains a high-severity WebView implementation vulnerability that could lead to unauthorized access or execution of malicious processes.

Vulnerability Details

CVE-ID: CVE-2026-12438

Affected Software: Google Chrome on Android

Affected Versions: Versions prior to 149

Vulnerability: This is an inappropriate implementation vulnerability within the WebView component, which allows Android apps to display web content. The flaw could potentially be exploited by a malicious application to bypass security restrictions and interact with web content in an unauthorized manner.

Business Impact

The WebView component is integral to many Android applications, and a compromise here could allow for cross-site scripting or the exposure of sensitive session data within the app. With a CVSS score of 8.3, this flaw poses a significant risk to the mobile security posture of organizations that allow Android devices in their enterprise environment.

Remediation Plan

Immediate Action: Ensure all Android devices across the organization are updated to Google Chrome version 149 or later to remediate the WebView vulnerability.

Proactive Monitoring: Utilize Mobile Device Management (MDM) solutions to track and enforce minimum version compliance across the device fleet.

Compensating Controls: Restrict the installation of untrusted or non-vetted applications on corporate-managed Android devices to reduce the attack surface for WebView-based exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mobile security is a critical pillar of a modern enterprise strategy; therefore, this update should be pushed to all managed mobile devices immediately. IT administrators should verify that the Chrome browser and the underlying system WebView are updated to the patched version to prevent potential exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to 149
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the WebShare component of Google Chrome on Windows allows for potential exploitation.

Executive Summary:
A use-after-free vulnerability in the Google Chrome WebShare feature on Windows platforms creates a significant risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-12437

Affected Software: Google Chrome

Affected Versions: Prior to 149

Vulnerability: This vulnerability is a use-after-free flaw located within the WebShare component of Google Chrome. It occurs when the browser improperly handles memory, potentially allowing an unauthorized attacker to trigger a crash or execute code by manipulating the browser's state.

Business Impact

Successful exploitation can lead to browser compromise, potentially allowing an attacker to escape the browser sandbox or execute arbitrary code on the underlying operating system. With a CVSS score of 8.3, the vulnerability presents a high risk to end-user systems, necessitating swift remediation to prevent potential data theft or system infection.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 149 or later immediately to resolve the memory management issue.

Proactive Monitoring: Monitor for browser-related crashes or unexpected behavior that may indicate attempts to exploit memory corruption flaws.

Compensating Controls: Employ browser-based security policies and ensure that end-users are running supported, patched operating systems to provide defense-in-depth.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that browser vulnerabilities are frequently targeted, upgrading to the patched version of Google Chrome is critical. Security teams should enforce the update across all managed endpoints to ensure users are protected against this high-severity memory vulnerability.

---METADATA---
VENDOR: GitLab
PRODUCT: GitLab CE/EE
AFFECTED_VERSIONS: 18.0 up to 19.0.5, 19.1 up to 19.1.3, 19.2 up to 19.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GitLab CE/EE is vulnerable to an improper control of object attributes, allowing an authenticated user to perform unauthorized modifications.

Executive Summary:
A vulnerability in GitLab CE/EE allows authenticated users to manipulate object attributes, potentially leading to unauthorized system changes or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-12436

Affected Software: GitLab CE/EE

Affected Versions: 18.0 up to 19.0.5, 19.1 up to 19.1.3, 19.2 up to 19.2.1

Vulnerability: This issue is an improper control of dynamically determined object attributes (CWE-915). It requires an authenticated user to successfully exploit the flaw.

Business Impact

The vulnerability carries a CVSS score of 8.4, reflecting a high severity risk. Successful exploitation could allow a malicious actor to modify system objects, potentially resulting in unauthorized administrative access, data integrity loss, or significant service disruption within the GitLab environment.

Remediation Plan

Immediate Action: Upgrade GitLab installations to versions 19.0.5, 19.1.3, 19.2.1, or later immediately.

Proactive Monitoring: Review audit logs for suspicious configuration changes or unexpected modifications to project or user attributes.

Compensating Controls: Implement strict access control lists and principle of least privilege to limit the impact of compromised accounts until patching is complete.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector is high, but the potential for total technical impact necessitates prompt remediation.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators should prioritize updating their GitLab instances. Applying the vendor-supplied patches is the only reliable way to neutralize this risk.

---METADATA---
VENDOR: Pravel
PRODUCT: SignUp & SignIn
AFFECTED_VERSIONS: Up to and including 1.0.0
---END_METADATA---

Description Summary:
The Pravel SignUp & SignIn WordPress plugin contains an authentication bypass vulnerability allowing unauthenticated attackers to reset any user password and achieve full account takeover.

Executive Summary:
A critical authentication bypass vulnerability in the Pravel SignUp & SignIn plugin allows unauthenticated attackers to hijack any user account, including administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-12417

Affected Software: Pravel SignUp & SignIn

Affected Versions: Up to and including 1.0.0

Vulnerability: The plugin's pravel_change_password() AJAX handler lacks nonce verification and capability checks, while using a flawed equality check that allows unauthenticated attackers to reset passwords by supplying empty parameters.

Business Impact

Successful exploitation results in total account takeover, providing attackers with administrative access to the WordPress environment. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized data exfiltration, site defacement, and the installation of persistent malicious backdoors.

Remediation Plan

Immediate Action: Update the Pravel SignUp & SignIn plugin to the latest version immediately to patch the insecure AJAX handler.

Proactive Monitoring: Review admin-ajax.php access logs for unusual POST requests containing the pravel_change_password action and unexpected user ID targets.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to site integrity and security. Administrators must prioritize updating the plugin to the latest version to eliminate the possibility of unauthenticated account takeover and privilege escalation.

---METADATA---
VENDOR: Pravel
PRODUCT: Invoice Generator
AFFECTED_VERSIONS: Up to and including 1.0.0
---END_METADATA---

Description Summary:
The Invoice Generator WordPress plugin contains an account takeover vulnerability via an insecure password reset function that allows unauthenticated attackers to hijack any user account.

Executive Summary:
A critical vulnerability in the Pravel Invoice Generator plugin allows unauthenticated attackers to perform full account takeover of any user, including administrators.

Vulnerability Details

CVE-ID: CVE-2026-12416

Affected Software: Pravel Invoice Generator

Affected Versions: Up to and including 1.0.0

Vulnerability: The vulnerability exists in the pravel_invoice_change_password() function, which lacks both nonce verification and authorization checks. Because the function utilizes a loose equality comparison for activation codes, an unauthenticated attacker can bypass the reset process to set an arbitrary password for any target account.

Business Impact

Successful exploitation results in full unauthorized administrative control over the affected WordPress site. This leads to complete data compromise, potential distribution of malicious content, and total loss of system integrity. With a CVSS score of 9.8, this flaw represents the highest level of risk to business continuity and data security.

Remediation Plan

Immediate Action: Immediately update the Pravel Invoice Generator plugin to the latest available patched version.

Proactive Monitoring: Review WordPress user logs for unexpected password changes or the creation of new administrative accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized requests to the pravel_invoice_change_password() AJAX endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the ease of exploitation, immediate action is required to prevent unauthorized access. Site administrators must prioritize updating the plugin and auditing user accounts to ensure no unauthorized modifications have occurred.

---METADATA---
VENDOR: Pravel
PRODUCT: Invoice Generator
AFFECTED_VERSIONS: Up to and including 1.0.0
---END_METADATA---

Description Summary:
The Invoice Generator plugin for WordPress is vulnerable to unauthenticated privilege escalation, allowing attackers to modify arbitrary user accounts and hijack administrator sessions.

Executive Summary:
The Invoice Generator plugin for WordPress contains a critical privilege escalation flaw that allows unauthenticated attackers to gain full administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-12415

Affected Software: Pravel Invoice Generator

Affected Versions: Up to and including 1.0.0

Vulnerability: The plugin fails to perform capability checks or nonce verification on the pravel_invoice_edit_account() AJAX function. This allows an unauthenticated attacker to manipulate user account data via POST requests, facilitating account takeover through the password reset mechanism.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. A successful exploit grants an attacker administrative access, leading to full data exfiltration, modification of financial documentation, and the potential for persistent backdoors within the WordPress environment, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Invoice Generator plugin to the latest available version immediately to patch the missing capability check.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at wp-admin/admin-ajax.php involving user account modifications.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge unauthorized AJAX requests targeting the identified vulnerable function.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path to administrative takeover without authentication. Administrators must prioritize updating the plugin immediately. If an immediate update is not possible, the plugin should be deactivated until the patch is applied to prevent unauthorized access.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A broken access control vulnerability in the devLXDInstancePatchHandler component of Canonical LXD allows unauthorized storage volume access between guests.

Executive Summary:
Canonical LXD is affected by a broken access control vulnerability that permits untrusted guests to read or overwrite the storage volumes of other instances.

Vulnerability Details

CVE-ID: CVE-2026-12411

Affected Software: Canonical LXD

Affected Versions: See vendor advisory

Vulnerability: The flaw exists in the devLXDInstancePatchHandler component, which improperly validates device PATCH requests. An untrusted guest can exploit this to mount and manipulate custom storage volumes belonging to other guests, effectively breaking the isolation boundaries of the LXD container environment.

Business Impact

The CVSS score of 8.4 highlights the severity of this privilege escalation and cross-container compromise. This vulnerability allows for significant data exposure and integrity loss, as an attacker could potentially modify or steal sensitive data across container boundaries, threatening the entire multi-tenant infrastructure.

Remediation Plan

Immediate Action: Apply all security patches released by Canonical for the LXD package immediately.

Proactive Monitoring: Review LXD audit logs for suspicious or unauthorized device PATCH requests or unexpected volume mounting activities.

Compensating Controls: Where possible, isolate highly sensitive workloads on separate physical hosts to provide an additional layer of security beyond container isolation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for cross-container data access, this vulnerability must be treated with high urgency in multi-tenant or shared-hosting environments. Administrators should audit their LXD configurations and apply the necessary patches as soon as they become available.

---METADATA---
VENDOR: E2Pdf
PRODUCT: Export Pdf Tool for WordPress
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The E2Pdf – Export Pdf Tool for WordPress plugin is vulnerable to a missing authorization flaw, potentially exposing sensitive PDF generation functions to unauthorized users.

Executive Summary:
The E2Pdf plugin for WordPress contains a missing authorization vulnerability that could allow unauthorized access to sensitive functionality.

Vulnerability Details

CVE-ID: CVE-2026-12407

Affected Software: E2Pdf – Export Pdf Tool for WordPress

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is caused by a missing authorization check on critical plugin functions, allowing an attacker to perform actions without the required administrative permissions. This flaw effectively bypasses intended security controls within the plugin's framework.

Business Impact

With a CVSS score of 8.8, this flaw represents a significant risk, as it may allow unauthorized users to generate or export sensitive documents. This could result in unauthorized data exposure and potential non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Update the E2Pdf plugin to the latest version released by the vendor.

Proactive Monitoring: Review audit logs for unauthorized access to PDF generation or export functions within the WordPress environment.

Compensating Controls: Restrict access to the WordPress administrative dashboard and plugin configuration pages to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for unauthorized data exfiltration necessitates immediate remediation.

Analyst Recommendation

Administrators should prioritize updating the E2Pdf plugin immediately. Ensuring that all plugins are running the latest version is critical to maintaining the security and confidentiality of site data.

---METADATA---
VENDOR: MemberGlut
PRODUCT: MemberGlut
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The MemberGlut WordPress plugin fails to validate user roles during registration, allowing unauthenticated attackers to register as administrators and compromise the site.

Executive Summary:
A critical privilege management vulnerability in the MemberGlut WordPress plugin allows unauthenticated attackers to gain administrative access.

Vulnerability Details

CVE-ID: CVE-2026-12394

Affected Software: MemberGlut MemberGlut

Affected Versions: 0 up to (excluding) 1.1.5

Vulnerability: This vulnerability involves improper privilege management within the plugin registration flow. An unauthenticated attacker can manipulate registration requests to assign themselves arbitrary roles, such as administrator.

Business Impact

The ability for an unauthenticated user to escalate privileges to administrator status represents a total compromise of the affected WordPress site. Given the CVSS score of 9.8, this vulnerability poses an extreme risk of data exfiltration, site defacement, and potential installation of persistent backdoors.

Remediation Plan

Immediate Action: Update the MemberGlut plugin to version 1.1.5 or higher immediately to enforce proper role validation.

Proactive Monitoring: Audit user account creation logs for suspicious administrator registrations or unusual account creation patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious registration attempts or restrict access to the registration endpoint for untrusted networks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of access controls on the registration function.

Analyst Recommendation

This is a critical security vulnerability that allows full site takeover without authentication. Administrators must prioritize updating the MemberGlut plugin immediately. If an update is not immediately feasible, consider disabling public registration functionality to prevent exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Ninja Forms
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Ninja Forms plugin for WordPress is vulnerable to unauthorized data access due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST API endpoint.

Executive Summary:
A missing authorization check in the Ninja Forms plugin allows unauthenticated attackers to potentially access sensitive data via the REST API.

Vulnerability Details

CVE-ID: CVE-2026-1239

Affected Software: WordPress Ninja Forms

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from a missing capability check on the ninja-forms-views/token/refresh REST callback. An unauthenticated attacker can invoke this function to potentially retrieve sensitive tokens or data managed by the plugin.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive user or form data, violating data privacy regulations. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the WordPress environment.

Remediation Plan

Immediate Action: Update the Ninja Forms plugin to the latest available version provided by the vendor to ensure the authorization check is properly implemented.

Proactive Monitoring: Review REST API access logs for unusual requests directed at the ninja-forms-views endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to the vulnerable REST API path until an update can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of interacting with REST API endpoints, this vulnerability poses a clear risk of unauthorized data exposure. Organizations should prioritize patching this plugin immediately and audit their WordPress environment for any suspicious API activity.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Ansible Automation Platform 2
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
The Event-Driven Ansible server is vulnerable to event injection due to insufficient verification of data authenticity and reliance on spoofable HTTP headers.

Executive Summary:
A flaw in the Red Hat Ansible Automation Platform 2 Event-Driven Ansible server allows unauthenticated attackers to inject malicious events into protected streams.

Vulnerability Details

CVE-ID: CVE-2026-12383

Affected Software: Red Hat Ansible Automation Platform 2

Affected Versions: See vendor advisory

Vulnerability: The vulnerability (CWE-345) involves permissive access controls and an over-reliance on a spoofable Subject HTTP header during mTLS authentication. This flaw permits an attacker to inject arbitrary events into event streams that are intended to be protected by mTLS, thereby triggering unintended downstream automation.

Business Impact

With a CVSS score of 7.5, this vulnerability presents a significant risk to the integrity of automated infrastructure workflows. Successful exploitation allows an attacker to manipulate automation outcomes, which could lead to unauthorized configuration changes, system disruption, or the execution of arbitrary tasks within the managed environment.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the specific patch version and apply the required updates to the Event-Driven Ansible server.

Proactive Monitoring: Inspect automation logs for anomalous event triggers or events originating from unexpected or non-authenticated sources.

Compensating Controls: Restrict network access to the EDA server to trusted management subnets and enforce strict mTLS validation policies at the network edge if possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the risk should be managed according to standard vulnerability management cycles.

Analyst Recommendation

This vulnerability represents a serious risk to automated systems and requires prompt attention. Organizations should monitor the Red Hat security portal for the latest patch information and apply the necessary updates to secure their Ansible automation pipelines against event injection.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Ansible Automation Platform
AFFECTED_VERSIONS: 2.6 for RHEL 9 and 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in the Red Hat Ansible Automation Platform Gateway Envoy proxy configuration allows for authentication bypass through spoofing.

Executive Summary:
A critical authentication bypass vulnerability in the Red Hat Ansible Automation Platform Gateway proxy allows unauthenticated attackers to spoof identity, potentially leading to unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-12382

Affected Software: Red Hat Ansible Automation Platform 2.6

Affected Versions: 2.6 for RHEL 9 (fixed in 0:2.6.20260422-1.el9ap and later); 2.6 (fixed in 1777311120 and later)

Vulnerability: This is an authentication bypass vulnerability (CWE-290) located in the Envoy proxy configuration of the AAP Gateway. The issue allows remote, unauthenticated attackers to bypass authentication mechanisms by spoofing requests.

Business Impact

Successful exploitation allows an attacker to bypass authentication, which could lead to full unauthorized access to the automation platform. With a CVSS score of 8.2, this poses a high risk to the integrity of automated workflows and the security of managed infrastructure across the enterprise.

Remediation Plan

Immediate Action: Apply the vendor-provided security errata (RHSA-2026:13508 or RHSA-2026:13545) immediately to update the AAP Gateway components.

Proactive Monitoring: Monitor proxy logs for unusual traffic patterns or requests that originate from unexpected sources or bypass standard authentication headers.

Compensating Controls: Ensure that the AAP Gateway is not exposed to the public internet and utilize network segmentation to limit access to the management interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving proxy configuration, suggests that internal security controls are insufficient if the proxy itself is compromised.

Analyst Recommendation

Given the high impact on integrity and the critical nature of automation platforms, organizations must treat this update with high priority. Apply the provided Red Hat errata as soon as possible to ensure the integrity of your automation environment.

---METADATA---
VENDOR: WordPress
PRODUCT: Appointment Booking Calendar Plugin and Scheduling Plugin
AFFECTED_VERSIONS: 0 through 1.1.28
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Appointment Booking Calendar Plugin for WordPress is vulnerable to insecure deserialization of untrusted data, potentially leading to remote code execution.

Executive Summary:
An insecure deserialization vulnerability in the Appointment Booking Calendar Plugin for WordPress could allow an unauthenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-12378

Affected Software: WordPress Appointment Booking Calendar Plugin and Scheduling Plugin

Affected Versions: 0 through 1.1.28

Vulnerability: The plugin is susceptible to insecure deserialization (CWE-502), which occurs when untrusted data is processed without adequate validation. This flaw can be triggered by an attacker without requiring authentication.

Business Impact

This vulnerability carries a CVSS score of 8.1, indicating a high risk of total system compromise. Successful exploitation could grant an attacker full control over the web server, leading to sensitive data exfiltration, malware installation, and complete loss of system availability.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor server logs for unexpected execution of system commands or spikes in traffic to booking-related endpoints.

Compensating Controls: Use a WAF to inspect incoming traffic for serialized objects or malicious payloads frequently associated with deserialization attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be treated with extreme urgency. Organizations using this plugin must verify their current version and apply the patch as soon as possible to prevent potential compromise.

---METADATA---
VENDOR: Uncanny Owl
PRODUCT: Uncanny Automator Pro
AFFECTED_VERSIONS: 7.3.0.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Uncanny Automator Pro WordPress plugin was distributed with a backdoor, allowing unauthenticated attackers to gain administrative access and exfiltrate site credentials.

Executive Summary:
A supply chain compromise of the Uncanny Automator Pro plugin has introduced a backdoor that grants unauthenticated attackers full administrative control over affected WordPress sites.

Vulnerability Details

CVE-ID: CVE-2026-12375

Affected Software: Uncanny Owl Uncanny Automator Pro

Affected Versions: 7.3.0.5

Vulnerability: The plugin was distributed with malicious, hidden functionality (CWE-912) following a compromise of the vendor's distribution infrastructure. This backdoor allows unauthenticated attackers to hijack administrator sessions and beacon sensitive security keys to external servers.

Business Impact

This vulnerability is catastrophic, as it facilitates complete takeover of the WordPress instance. With a CVSS score of 9.8, the impact includes full loss of site confidentiality, integrity, and availability, potentially leading to widespread data breaches and the deployment of persistent malware.

Remediation Plan

Immediate Action: Update the Uncanny Automator Pro plugin to version 7.3.0.6 or later immediately.

Proactive Monitoring: Audit administrator accounts for unauthorized additions and monitor outgoing network traffic for suspicious connections to unknown external IP addresses.

Compensating Controls: If an immediate update is not feasible, disable the plugin entirely until the site can be audited for signs of compromise and updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 7, 2026, there is no public information indicating widespread active exploitation of this specific backdoor. However, given the nature of the supply chain compromise, the risk of targeted exploitation is extremely high.

Analyst Recommendation

Organizations using Uncanny Automator Pro must treat this as a high-priority incident. Beyond applying the patch, administrators should perform a comprehensive security audit of their WordPress environment to ensure that no backdoors or unauthorized administrative accounts were created while the vulnerable version was active.

---METADATA---
VENDOR: Zephyr Project
PRODUCT: Zephyr
AFFECTED_VERSIONS: 1.12.0 up to (excluding) 4.5.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability exists in the Zephyr RTOS dynamic kernel-object disposal path, specifically within the unref_check function in the userspace kernel component.

Executive Summary:
A high-severity use-after-free vulnerability in the Zephyr RTOS kernel could allow a local authenticated attacker to achieve total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12366

Affected Software: Zephyr Project Zephyr

Affected Versions: 1.12.0 up to (excluding) 4.5.0

Vulnerability: The flaw (CWE-416) resides in the dynamic kernel-object disposal path of the Zephyr kernel. An attacker with low-level local privileges can trigger this use-after-free condition to gain unauthorized control over kernel memory structures.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to systems utilizing the Zephyr RTOS. Exploitation could lead to arbitrary code execution within the kernel, resulting in total system failure, data corruption, or the bypass of security boundaries designed to protect the runtime environment.

Remediation Plan

Immediate Action: Update the Zephyr RTOS environment to version 4.5.0 or later, which contains the necessary security patches for the kernel disposal logic.

Proactive Monitoring: Audit local access permissions and monitor for kernel-level crashes or unexpected reboots that may indicate exploitation attempts against the kernel memory management system.

Compensating Controls: Restrict local access to the device and ensure that userspace applications are strictly sandboxed, limiting the ability of low-privileged processes to interact with sensitive kernel-object functions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of this flaw makes it complex to exploit, typically requiring deep knowledge of the target system architecture.

Analyst Recommendation

Given the potential for complete system control, the security update for the Zephyr kernel should be applied as part of the next scheduled maintenance window. Ensuring that the RTOS is running the latest patched version is essential for maintaining device security in embedded and IoT deployments.

---METADATA---
VENDOR: zephyrproject
PRODUCT: zephyr
AFFECTED_VERSIONS: 2.6.0 up to (excluding) 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The user-space system-call verifier in Zephyr RTOS contains a memory-safety vulnerability in the logging subsystem.

Executive Summary:
A memory-safety vulnerability in the Zephyr RTOS logging subsystem allows for potential privilege escalation or system instability.

Vulnerability Details

CVE-ID: CVE-2026-12364

Affected Software: zephyrproject zephyr

Affected Versions: 2.6.0 up to (excluding) 4.4.2

Vulnerability: The system-call verifier z_vrfy_z_log_msg_static_create within the logging subsystem fails to enforce proper memory safety constraints. This vulnerability is exploitable by an authenticated user with low privileges.

Business Impact

Exploitation of this memory-safety flaw could allow a local attacker to bypass system-call protections, leading to information disclosure or a denial-of-service condition. Given the CVSS score of 8.4, the vulnerability is high-risk, particularly in environments where Zephyr is deployed in secure or mission-critical embedded systems.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to address the vulnerable system-call verifier.

Proactive Monitoring: Monitor system logs for unexpected crashes or error conditions originating from the logging subsystem which may indicate attempted exploitation.

Compensating Controls: Ensure that user-space applications are strictly sandboxed and that system-call interfaces are restricted to the minimum necessary functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is confirmed to be fixed in the upstream repository via commit 77aa26d8b940f39778154f02563caf15d02efdac.

Analyst Recommendation

Given the potential for system-wide impact, organizations using Zephyr should prioritize updating to the patched version. Verify that the build environment incorporates the fix to ensure the integrity of the deployed firmware.

---METADATA---
VENDOR: SailPoint
PRODUCT: IdentityIQ
AFFECTED_VERSIONS: 8.5 through 8.5p1, 8.4 through 8.4p4, 8.3 through 8.3p5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SailPoint IdentityIQ is vulnerable to unauthorized API access due to improper validation of OAuth bearer tokens, allowing unauthenticated attackers to retrieve protected data.

Executive Summary:
A critical authentication bypass in SailPoint IdentityIQ allows unauthenticated attackers to access sensitive APIs and data.

Vulnerability Details

CVE-ID: CVE-2026-12341

Affected Software: SailPoint IdentityIQ

Affected Versions: 8.3 through 8.3p5, 8.4 through 8.4p4, and 8.5 through 8.5p1

Vulnerability: The application fails to properly validate OAuth bearer tokens, which permits unauthenticated actors to interact with protected APIs and gain unauthorized access to sensitive identity information.

Business Impact

This vulnerability poses a severe risk to organizational security, as it directly impacts identity and access management systems. With a CVSS score of 8.8, the ability for an unauthenticated attacker to bypass authentication mechanisms could result in large-scale data exfiltration and complete loss of confidentiality regarding user identities and permissions.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patches or updates as outlined in the latest SailPoint security advisory.

Proactive Monitoring: Review API access logs for anomalous traffic patterns or unauthorized requests originating from unknown or suspicious sources.

Compensating Controls: Restrict access to the IdentityIQ API to known, trusted IP ranges and ensure that network-level access controls are strictly enforced.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving authentication bypass, makes it highly attractive for targeted attacks.

Analyst Recommendation

Given the central role of IdentityIQ in enterprise security, this vulnerability must be treated with extreme urgency. Administrators should prioritize the application of vendor patches to protect the integrity and confidentiality of the identity management environment.

---METADATA---
VENDOR: WordPress
PRODUCT: Text to Speech for WP (AI Voices by Mementor)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Text to Speech for WP plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 1.

Executive Summary:
A sensitive information exposure vulnerability in the Text to Speech for WP plugin could lead to the unauthorized disclosure of private data.

Vulnerability Details

CVE-ID: CVE-2026-1233

Affected Software: WordPress Text to Speech for WP (AI Voices by Mementor)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly protect sensitive information, allowing unauthorized access to data that should be restricted. This exposes the WordPress installation to potential data privacy concerns.

Business Impact

With a CVSS score of 7.5, this high-severity vulnerability could lead to the unauthorized disclosure of sensitive organizational or user data. This creates significant compliance risks and could result in reputational damage if private information is exposed.

Remediation Plan

Immediate Action: Update the "Text to Speech for WP" plugin to the latest version.

Proactive Monitoring: Review logs for unauthorized access to sensitive plugin endpoints or data directories.

Compensating Controls: Ensure that sensitive information is not stored within the paths accessible by the plugin if the plugin is not strictly necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize updating this plugin to prevent data exposure. If no update is available, consider disabling the plugin to mitigate the risk to sensitive information.

---METADATA---
VENDOR: Unknown
PRODUCT: Networking HTTP Component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Networking HTTP component could potentially lead to arbitrary code execution or system instability.

Executive Summary:
A high-severity use-after-free vulnerability in the Networking HTTP component presents a critical risk of memory corruption and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12291

Affected Software: Networking HTTP Component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free vulnerability occurring within the HTTP processing logic. This flaw typically occurs when memory is accessed after it has been freed, which can be manipulated to trigger crashes or execute arbitrary code.

Business Impact

Memory corruption vulnerabilities are highly dangerous as they can lead to remote code execution (RCE) and full system compromise. With a CVSS score of 8.8, this flaw represents a significant threat to the availability and confidentiality of the affected software and the underlying host system.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by the software vendor to address memory management flaws in the HTTP component.

Proactive Monitoring: Monitor system logs for recurring service crashes or memory-related errors that may indicate exploitation attempts.

Compensating Controls: Ensure the application is running with the least privilege necessary and utilize endpoint protection solutions to detect anomalous process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the severity of use-after-free vulnerabilities, immediate patching is required to prevent potential exploitation. Security teams should prioritize identifying affected instances and scheduling deployment of the vendor's security updates as soon as they become available.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox/Thunderbird
AFFECTED_VERSIONS: Firefox up to 151, Firefox ESR up to (excluding) 115.37.0, Firefox ESR from (including) 140.0 up to (excluding) 140.12.0
---END_METADATA---

Description Summary:
A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla products, which can be triggered remotely via user interaction.

Executive Summary:
A privilege escalation flaw in the WebRender component of Mozilla products allows remote attackers to elevate privileges through user interaction.

Vulnerability Details

CVE-ID: CVE-2026-12289

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: Firefox up to 151, Firefox ESR up to (excluding) 115.37.0, Firefox ESR from (including) 140.0 up to (excluding) 140.12.0

Vulnerability: This is a privilege escalation vulnerability in the Graphics: WebRender component. The attack can be initiated remotely without authentication, though it specifically requires user interaction to execute.

Business Impact

With a CVSS score of 8.8, this vulnerability is considered a high-priority threat. Successful exploitation allows an attacker to gain elevated privileges, potentially leading to full system compromise, data theft, or the installation of malicious software. The requirement for user interaction does not significantly lower the risk in enterprise environments where end-user workstations are frequent targets.

Remediation Plan

Immediate Action: Update to Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, or Thunderbird 152/140.12 as applicable.

Proactive Monitoring: Review endpoint security logs for signs of unauthorized process execution or unexpected privilege changes following browser activity.

Compensating Controls: Use browser-based security policies to restrict the execution of untrusted scripts and content, and maintain robust endpoint detection and response (EDR) coverage.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation and the ubiquity of these browsers, immediate patching is required. Security teams should prioritize the deployment of the specified versions across all managed workstations and servers to close this critical security gap.

---METADATA---
VENDOR: Shibboleth
PRODUCT: Shibboleth WordPress plugin
AFFECTED_VERSIONS: Shibboleth WordPress plugin versions before 2.5.4.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Shibboleth WordPress plugin fails to properly verify identity headers, allowing unauthenticated attackers to spoof sessions and potentially gain administrative access.

Executive Summary:
The Shibboleth WordPress plugin is vulnerable to an improper authentication flaw that allows unauthenticated remote attackers to forge identity headers and gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-12281

Affected Software: Shibboleth WordPress plugin

Affected Versions: Shibboleth WordPress plugin versions before 2.5.4.

Vulnerability: This is an improper authentication vulnerability (CWE-287) where the plugin fails to close sessions when HTTP header identity mode is active without an anti-spoofing key. This allows an unauthenticated remote attacker to inject malicious headers and bypass authentication mechanisms entirely.

Business Impact

Successful exploitation poses a critical risk to organizational security, as it grants unauthorized actors full administrative access to the WordPress environment. Given the CVSS score of 8.1, this represents a high-severity threat that could lead to complete data compromise, unauthorized modification of site content, and potential lateral movement into federated identity systems.

Remediation Plan

Immediate Action: Update the Shibboleth WordPress plugin to version 2.5.4 or later immediately.

Proactive Monitoring: Review web server and WordPress access logs for anomalous login activity or requests containing unexpected identity headers.

Compensating Controls: Ensure that the plugin is configured with a robust anti-spoofing key and verify that network-level controls restrict access to identity headers to trusted sources only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for total authentication bypass in federated environments.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of WordPress installations, particularly in academic or enterprise environments using federated authentication. Administrators must prioritize updating the plugin to version 2.5.4 or later to prevent unauthorized administrative access.