---METADATA---
VENDOR: Unknown
PRODUCT: Frontend File Manager Plugin
AFFECTED_VERSIONS: 0 through 23.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Frontend File Manager Plugin for WordPress is vulnerable to path traversal and improper file handling, allowing attackers to manipulate file operations.

Executive Summary:
A critical file path manipulation vulnerability in the Frontend File Manager Plugin enables unauthorized file operations, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-12277

Affected Software: Unknown Frontend File Manager Plugin

Affected Versions: 0 through 23.6

Vulnerability: The plugin suffers from improper control of file names or paths (CWE-73). This allows an attacker to interact with files outside of the intended directory, potentially leading to unauthorized file modification or deletion.

Business Impact

The CVSS score of 8.7 (High) reflects the severity of this vulnerability, as it allows for significant impact on system availability and integrity. Successful exploitation could lead to the deletion of critical system files or the overwriting of configuration files, causing catastrophic service disruption and potential loss of data integrity.

Remediation Plan

Immediate Action: Immediately update to the latest version of the plugin or disable it until a secure patch is confirmed and applied.

Proactive Monitoring: Monitor server logs for unusual file system access patterns and attempts to access files outside of the standard web application directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block path traversal patterns (e.g., ../) in HTTP requests.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 8, 2026, there is a known public proof-of-concept exploit available for this vulnerability. The risk is elevated due to the availability of exploit code, and immediate remediation is strongly advised.

Analyst Recommendation

Given the existence of a public exploit, the urgency to remediate this vulnerability is extreme. Organizations should prioritize updating or removing this plugin to prevent exploitation, as the technical impact on file integrity is significant.

---METADATA---
VENDOR: Themeum
PRODUCT: Tutor LMS
AFFECTED_VERSIONS: Tutor LMS WordPress plugin before 3.9.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Tutor LMS WordPress plugin fails to enforce capability checks in its page-builder integrations, allowing unauthorized access to restricted course content.

Executive Summary:
A vulnerability in the Tutor LMS WordPress plugin allows authenticated users to bypass critical access controls, potentially exposing private or paid course content.

Vulnerability Details

CVE-ID: CVE-2026-12275

Affected Software: Themeum Tutor LMS

Affected Versions: Tutor LMS WordPress plugin before 3.9.13

Vulnerability: The plugin fails to perform necessary enrollment and purchase capability checks within its Droip and Kirki page-builder integrations. This allows authenticated users with subscriber-level access to bypass security restrictions and access private or paid course materials.

Business Impact

With a CVSS score of 7.1, this vulnerability poses a significant risk to the business model of organizations relying on paid course content. Unauthorized access could lead to loss of revenue, intellectual property theft, and reputational damage. The ability of low-privileged users to bypass these checks undermines the integrity of the platform's access control system.

Remediation Plan

Immediate Action: Update the Tutor LMS WordPress plugin to version 3.9.13 or later immediately.

Proactive Monitoring: Monitor site traffic for unusual access patterns to paid or private course pages by subscriber-level accounts.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect requests for unauthorized attempts to access protected course resources.

Exploitation Status

Public Exploit Available: Yes (per public PoC availability)

Analyst Notes: As of July 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable due to the missing capability checks in widely used page-builder integrations.

Analyst Recommendation

The presence of a proof-of-concept makes this vulnerability an immediate concern. Administrators must verify that all instances of the Tutor LMS plugin are updated to version 3.9.13 or later to prevent unauthorized access to restricted course content.

---METADATA---
VENDOR: Zohocorp
PRODUCT: ManageEngine Password Manager Pro / PAM360
AFFECTED_VERSIONS: Password Manager Pro: 0 up to 13232, PAM360: 0 up to 8551
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ManageEngine Password Manager Pro and PAM360 are vulnerable to authentication bypass due to improper SAML signature verification, allowing unauthorized access to the application.

Executive Summary:
An authentication bypass vulnerability in Zohocorp ManageEngine products allows attackers to circumvent security controls due to flawed SAML signature validation.

Vulnerability Details

CVE-ID: CVE-2026-12263

Affected Software: Zohocorp ManageEngine Password Manager Pro, Zohocorp ManageEngine PAM360

Affected Versions: Password Manager Pro prior to 13232, PAM360 prior to 8551

Vulnerability: The vulnerability stems from improper verification of cryptographic signatures (CWE-347) within the SAML implementation. An attacker can craft malicious SAML assertions to bypass authentication mechanisms and gain unauthorized access to the application.

Business Impact

The CVSS score of 8.8 underscores the gravity of this authentication bypass in products designed for privileged access management. Unauthorized access to these platforms could grant an attacker control over highly sensitive credentials, leading to widespread compromise of the entire enterprise infrastructure.

Remediation Plan

Immediate Action: Update ManageEngine Password Manager Pro to version 13232 or higher, and PAM360 to version 8551 or higher, immediately.

Proactive Monitoring: Audit authentication logs for suspicious login activity or unauthorized access attempts occurring via SAML identity providers.

Compensating Controls: If immediate patching is not feasible, restrict network access to the management interfaces of these applications to known trusted IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it a high-value target for attackers looking to gain administrative access to privileged accounts.

Analyst Recommendation

Given that these tools manage the most sensitive credentials in an organization, this update is critical. Administrators must apply the patches immediately and verify the integrity of their SAML configurations to prevent unauthorized access.

---METADATA---
VENDOR: Mura Software
PRODUCT: CMS
AFFECTED_VERSIONS: Mura Software CMS: 10.0.712
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Mura Software CMS contains a critical remote code execution vulnerability via the “method” parameter in the “/index.cfm/_api/json/v1/default” endpoint, allowing unauthenticated injection of CFML code.

Executive Summary:
A critical remote code execution vulnerability in Mura Software CMS allows unauthenticated attackers to execute arbitrary code, posing a severe risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-12257

Affected Software: Mura Software CMS

Affected Versions: Mura Software CMS: 10.0.712

Vulnerability: This vulnerability is a code injection flaw (CWE-94) triggered by improper validation of the "method" parameter within POST requests. The attacker requires no authentication (AV:N/AC:L/AT:N/PR:N) to reach the affected endpoint and execute arbitrary ColdFusion Markup Language (CFML) expressions.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code typically results in a total compromise of the affected server. Given the CVSS score of 9.3, this represents an extreme risk, enabling unauthorized data access, lateral movement within the network, and potential full system takeover.

Remediation Plan

Immediate Action: As there is currently no official patch, administrators should restrict network access to the affected endpoint or disable the vulnerable API functionality if it is not business-critical.

Proactive Monitoring: Monitor server logs for suspicious POST requests directed at "/index.cfm/_api/json/v1/default" containing CFML syntax or unusual Java object instantiations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious payloads targeting ColdFusion engine parameters and unexpected input in API method calls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the direct execution context of the ColdFusion engine.

Analyst Recommendation

This vulnerability is highly severe and requires immediate attention to prevent potential exploitation. Because no official vendor solution is currently available, prioritize the implementation of network-level access controls and WAF filtering to shield the vulnerable endpoint until a patch is released.

---METADATA---
VENDOR: ThemeFusion
PRODUCT: Avada
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A PHP object injection vulnerability exists in the Avada theme, allowing authenticated contributors to execute arbitrary code.

Executive Summary:
The Avada theme is vulnerable to a PHP object injection flaw that allows authenticated contributors to achieve remote code execution, posing a high risk to WordPress site integrity.

Vulnerability Details

CVE-ID: CVE-2026-12256

Affected Software: ThemeFusion Avada

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a PHP object injection flaw residing within the Avada theme. It requires the attacker to have at least 'Contributor' level authentication to trigger the malicious payload.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full site compromise, data exfiltration, and the installation of persistent backdoors, significantly impacting business operations and data confidentiality.

Remediation Plan

Immediate Action: Update the Avada theme to the latest patched version provided by ThemeFusion.

Proactive Monitoring: Audit WordPress user accounts to ensure only authorized individuals hold Contributor or higher privileges and monitor server logs for suspicious PHP execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the Avada theme must prioritize updating to the latest secure version immediately. Given the potential for remote code execution, restricting user access levels until a patch is applied is strongly advised to mitigate the attack surface.

---METADATA---
VENDOR: MainWP
PRODUCT: MainWP Child
AFFECTED_VERSIONS: 0 up to (excluding) 6.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The MainWP Child plugin for WordPress is vulnerable to an authentication bypass issue, potentially allowing unauthorized access to the affected site.

Executive Summary:
An authentication vulnerability in the MainWP Child plugin poses a significant risk to WordPress site security by enabling unauthorized administrative interactions.

Vulnerability Details

CVE-ID: CVE-2026-12255

Affected Software: MainWP MainWP Child

Affected Versions: 0 up to (excluding) 6.1.2

Vulnerability: The plugin is affected by an improper authentication flaw (CWE-287). While the attack requires high complexity, it allows an attacker to potentially bypass authentication, which could lead to full administrative compromise of the affected WordPress site.

Business Impact

Successful exploitation could result in a total compromise of the WordPress site, including the ability to execute arbitrary code, modify site content, or exfiltrate sensitive data. Given the CVSS score of 8.1, the potential for total impact on confidentiality, integrity, and availability makes this a critical security priority.

Remediation Plan

Immediate Action: Update the MainWP Child plugin to version 6.1.2 or later immediately.

Proactive Monitoring: Conduct a thorough review of WordPress user accounts and plugin configuration logs for any signs of unauthorized activity or unexpected administrative changes.

Compensating Controls: Restrict access to administrative interfaces via IP whitelisting or VPNs and employ a WAF to monitor for suspicious requests directed at the MainWP Child plugin components.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The high potential impact warrants immediate attention despite the required attack complexity.

Analyst Recommendation

Organizations relying on MainWP for site management must treat this vulnerability as a high priority. Administrators should verify that all installations are updated to version 6.1.2 or later to mitigate the risk of a full system compromise.

---METADATA---
VENDOR: NLTK
PRODUCT: NLTK (Natural Language Toolkit)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the NLTK library has been identified that may allow for unauthorized processing or system impact.

Executive Summary:
The NLTK library is affected by a high-severity vulnerability that could permit unauthorized actions within environments utilizing the toolkit.

Vulnerability Details

CVE-ID: CVE-2026-12252

Affected Software: NLTK NLTK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This issue affects NLTK version 3. The vulnerability involves improper handling of inputs, which could be leveraged by an attacker to impact the system running the toolkit.

Business Impact

The CVSS score of 7.8 indicates a high severity level, suggesting that successful exploitation could lead to significant system compromise. Organizations relying on this library for data processing or natural language tasks face risks including unauthorized code execution or data manipulation, potentially impacting the integrity of the dependent application.

Remediation Plan

Immediate Action: Update the NLTK library to the latest patched version recommended by the maintainers as soon as it becomes available.

Proactive Monitoring: Monitor for suspicious process execution patterns or unexpected resource consumption in environments where NLTK is utilized.

Compensating Controls: Ensure that applications using NLTK run within a restricted environment or container with minimal privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, immediate action is required to update all instances of the NLTK library. Security teams must ensure that dependency management processes are updated to incorporate the fix as soon as possible to protect the integrity of the application stack.

---METADATA---
VENDOR: Ultimate Member
PRODUCT: Ultimate Member
AFFECTED_VERSIONS: 0 up to (excluding) 2.12.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Ultimate Member WordPress plugin is vulnerable to improper privilege management, which could allow an attacker to gain unauthorized access or elevate their permissions.

Executive Summary:
An improper privilege management flaw in the Ultimate Member plugin for WordPress creates a high risk of unauthorized access and potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-12251

Affected Software: Ultimate Member WordPress Plugin

Affected Versions: 0 up to (excluding) 2.12.1

Vulnerability: This vulnerability involves improper privilege management, classified as CWE-269, where the application fails to correctly validate or enforce user role restrictions.

Business Impact

If successfully exploited, this vulnerability could allow a malicious actor to gain administrative access or perform actions reserved for higher-privileged accounts. With a CVSS score of 8.1, the potential for unauthorized administrative control presents a significant threat to the security and operational continuity of the affected WordPress site.

Remediation Plan

Immediate Action: Update the Ultimate Member plugin to version 2.12.1 or later to resolve the privilege management flaw.

Proactive Monitoring: Audit user account activity and privilege changes to identify any unauthorized modifications or suspicious administrative actions.

Compensating Controls: Implement strict access control lists and restrict administrative access to known, trusted IP addresses while the update is being deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires high complexity, the impact of privilege escalation makes this a high-priority security concern.

Analyst Recommendation

Privilege management flaws can lead to complete site takeover. Administrators should verify their current version of Ultimate Member and apply the update to version 2.12.1 immediately to prevent unauthorized privilege escalation.

---METADATA---
VENDOR: TUBITAK BILGEM
PRODUCT: Pardus Domain Joiner
AFFECTED_VERSIONS: 0.5.2 up to (excluding) 0.5.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pardus Domain Joiner is susceptible to an information disclosure vulnerability where sensitive data is exposed during process invocation, enabling potential excavation.

Executive Summary:
A high-severity vulnerability in Pardus Domain Joiner exposes sensitive information during process invocation, increasing the risk of credential or configuration theft.

Vulnerability Details

CVE-ID: CVE-2026-12250

Affected Software: TUBITAK BILGEM Pardus Domain Joiner

Affected Versions: 0.5.2 up to (excluding) 0.5.4

Vulnerability: The application is vulnerable to the invocation of a process using visible sensitive information (CWE-214). This occurs when sensitive parameters or credentials are exposed in plain view, such as in process command lines, during the domain joining operation.

Business Impact

The exposure of sensitive information during system operations can lead to the compromise of domain credentials or other security-sensitive configurations. With a CVSS score of 7.9, this vulnerability poses a high risk of identity theft or unauthorized network access, potentially affecting the integrity and confidentiality of the entire enterprise domain environment.

Remediation Plan

Immediate Action: Update Pardus Domain Joiner to version 0.5.4 or the latest available vendor patch.

Proactive Monitoring: Monitor process execution logs and command-line auditing tools to identify instances where sensitive strings might be exposed by the application.

Compensating Controls: Implement strict environment-level security to limit the visibility of running processes to only those users with a legitimate business need for that information.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the update of this software to ensure that sensitive domain-joining credentials are not inadvertently exposed to local users. Promptly applying the patch is the most effective method to prevent potential credential theft and subsequent lateral movement within the network.

---METADATA---
VENDOR: Canonical
PRODUCT: ADSys
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unspecified vulnerability exists in Canonical ADSys upstream versions through v0, requiring immediate review of vendor security disclosures.

Executive Summary:
A high-severity vulnerability has been identified in the Canonical ADSys utility, necessitating immediate attention from system administrators to prevent potential security compromise.

Vulnerability Details

CVE-ID: CVE-2026-12249

Affected Software: Canonical ADSys

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a security issue found in the Canonical ADSys upstream code. Technical details regarding the exploit vector are currently limited, and administrators should consult the vendor's official security bulletin for the specific scope of the flaw.

Business Impact

As a component often involved in Active Directory integration and system management, a vulnerability in ADSys could lead to unauthorized system configuration changes or privilege escalation. With a CVSS score of 8.3, this issue is classified as high-severity and warrants immediate remediation to protect the integrity of managed Ubuntu environments.

Remediation Plan

Immediate Action: Consult the Canonical security advisory and apply all available patches for ADSys immediately.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unexpected configuration changes on machines utilizing ADSys.

Compensating Controls: Restrict access to configuration management interfaces and ensure that administrative accounts are highly protected until the patch is verified.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this high-severity advisory with urgency. Canonical frequently updates their security notices; ensure that your patch management systems are configured to pull the latest security updates for ADSys to mitigate this risk.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: NSD (Name Server Daemon)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the NLnet Labs NSD software, potentially allowing for significant service disruption or unauthorized control.

Executive Summary:
The NSD authoritative DNS server is affected by a high-severity vulnerability that could lead to significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2026-12245

Affected Software: NLnet Labs NSD

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a critical flaw in the NSD authoritative DNS server. While specific exploitation vectors are currently limited, such flaws typically involve memory corruption or packet handling errors that can be triggered by unauthenticated remote attackers.

Business Impact

The exploitation of a DNS server presents a severe risk to organizational availability and security posture. Given the CVSS score of 8.7, a successful attack could lead to denial-of-service conditions, resulting in the inability of internal and external clients to resolve critical domain names, thereby causing widespread system downtime and potential redirection of traffic.

Remediation Plan

Immediate Action: Monitor official NLnet Labs security bulletins and apply the latest security patch as soon as it is released.

Proactive Monitoring: Review DNS server logs for anomalous request patterns or sudden spikes in traffic that may indicate exploitation attempts.

Compensating Controls: Ensure the DNS infrastructure is protected by rate-limiting and access control lists (ACLs) to restrict traffic to known, trusted sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of DNS in network operations, this vulnerability poses a significant risk to infrastructure stability. Organizations should prioritize patching as soon as the vendor provides an update and maintain rigorous monitoring of DNS traffic to detect any signs of compromise.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: NSD (Name Server Daemon)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
NSD is vulnerable to a heap overflow during AXFR zone transfers when processing maliciously crafted SVCB resource records.

Executive Summary:
A heap overflow vulnerability in the NSD name server allows a malicious primary zone authority to trigger a crash or potentially execute arbitrary code on a secondary DNS server.

Vulnerability Details

CVE-ID: CVE-2026-12244

Affected Software: NLnet Labs NSD

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from improper handling of SVCB resource record rdata sizes during AXFR transfers, which causes an integer wrap-around in a (uint16_t) variable. This leads to an insufficient memory allocation and a subsequent heap overflow, which can be triggered by an attacker controlling the primary zone.

Business Impact

A successful exploit of this vulnerability could lead to a denial-of-service (DoS) condition by crashing the DNS service, potentially impacting name resolution for the entire organization. With a CVSS score of 8.7, the risk of arbitrary code execution cannot be ruled out, which would allow an attacker to gain a foothold on critical DNS infrastructure.

Remediation Plan

Immediate Action: Update the NSD installation to the latest patched version released by NLnet Labs as soon as it becomes available.

Proactive Monitoring: Monitor DNS server logs for unexpected service crashes and review traffic patterns for large or malformed AXFR requests.

Compensating Controls: Restrict zone transfers (AXFR/IXFR) to trusted IP addresses only to prevent unauthorized primary servers from interacting with your secondary instances.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining stable DNS infrastructure is critical to overall network availability. Security teams should prioritize patching NSD instances to prevent both service disruption and potential system-level compromise. Regularly audit the list of authorized primary servers for all secondary zone configurations to minimize the attack surface.

---METADATA---
VENDOR: NLTK Project
PRODUCT: NLTK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in NLTK version 3 that may lead to potential system compromise.

Executive Summary:
The NLTK library (version 3) is susceptible to a high-severity vulnerability that could result in arbitrary code execution or data exposure.

Vulnerability Details

CVE-ID: CVE-2026-12243

Affected Software: NLTK Project NLTK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the processing logic of NLTK version 3. It may allow an attacker to trigger malicious behavior through specially crafted inputs, regardless of the authentication state of the user.

Business Impact

With a CVSS score of 7.5, this vulnerability poses a substantial risk to applications relying on NLTK for natural language processing. Successful exploitation could lead to unauthorized data access or the execution of arbitrary commands, potentially compromising the confidentiality and integrity of the underlying host system.

Remediation Plan

Immediate Action: Update the NLTK library to the latest secure version recommended by the NLTK Project as soon as it becomes available.

Proactive Monitoring: Monitor application logs for unexpected input patterns or unusual system process execution associated with NLTK workloads.

Compensating Controls: Implement input validation and sanitization layers to filter untrusted data before it is processed by the NLTK library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the library's widespread use in data processing pipelines, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately audit their software dependencies to identify the use of vulnerable NLTK versions. Prioritize the application of vendor-provided patches or library updates to eliminate this vector of attack and protect critical data processing environments.

---METADATA---
VENDOR: WordPress
PRODUCT: AdRotate Banner Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection, potentially allowing remote code execution.

Executive Summary:
The AdRotate Banner Manager plugin for WordPress contains a critical PHP Code Injection vulnerability that could allow unauthenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-12242

Affected Software: WordPress AdRotate Banner Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an improper input validation flaw that permits PHP Code Injection. The vulnerability is exploitable by unauthenticated users, as the plugin fails to properly sanitize inputs before processing them in a dangerous manner.

Business Impact

A successful exploit of this vulnerability results in full server compromise, allowing attackers to read, modify, or delete sensitive application data. Given the CVSS score of 8.8, this represents a high-severity risk to business continuity and data integrity, potentially leading to total system takeover and lateral movement within the WordPress environment.

Remediation Plan

Immediate Action: Update the AdRotate Banner Manager plugin to the latest available version provided by the vendor.

Proactive Monitoring: Inspect web server access logs for suspicious POST requests containing PHP syntax or unexpected file modification timestamps.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block common code injection patterns and restrict access to the plugin's administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Organizations utilizing the AdRotate Banner Manager plugin must prioritize applying the latest security patches to mitigate the risk of remote code execution. If a patch is not immediately available, administrators should consider disabling the plugin until a secure version is released.

---METADATA---
VENDOR: WordPress
PRODUCT: Export User Data Plugin
AFFECTED_VERSIONS: All versions up to, and including, 2
---END_METADATA---

Description Summary:
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to improper file path validation in the unserialize function.

Executive Summary:
A critical arbitrary file deletion vulnerability in the Export User Data WordPress plugin allows attackers to remove essential system files, potentially leading to a complete site outage.

Vulnerability Details

CVE-ID: CVE-2026-12240

Affected Software: WordPress Export User Data Plugin

Affected Versions: All versions up to, and including, 2

Vulnerability: The plugin fails to adequately sanitize input before processing it through the unserialize function, allowing an attacker to manipulate file paths. This vulnerability likely requires elevated privileges, though the impact is significant due to the potential for permanent data loss or site destruction.

Business Impact

The ability to delete arbitrary files on the server can result in complete site downtime, loss of configuration, or the removal of critical security files. With a CVSS score of 8.0, this high-severity vulnerability poses an immediate threat to the operational continuity and integrity of the affected WordPress site.

Remediation Plan

Immediate Action: Update the Export User Data plugin to the latest available version, or deactivate and remove the plugin if it is not strictly necessary for business operations.

Proactive Monitoring: Monitor file system integrity and review WordPress administrative audit logs for unusual file deletion activity or unauthorized plugin configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious serialized input and restrict file system access permissions to the minimum necessary for the web server user.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the ease of triggering file deletion, the potential for exploitation is high.

Analyst Recommendation

Site administrators should treat this vulnerability with urgency. If an update is not immediately available, the safest course of action is to disable the plugin entirely to prevent potential site destruction by unauthorized parties.

---METADATA---
VENDOR: parisneo
PRODUCT: lollms
AFFECTED_VERSIONS: versions prior to 2.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the parisneo lollms API allows attackers to inject malicious scripts that execute in the context of other users, including administrators.

Executive Summary:
A stored XSS vulnerability in parisneo lollms enables remote attackers to achieve account takeover or session hijacking by injecting malicious scripts into the application Home Feed.

Vulnerability Details

CVE-ID: CVE-2026-12228

Affected Software: parisneo lollms

Affected Versions: versions prior to 2.2.0

Vulnerability: This vulnerability is a stored cross-site scripting flaw located in the create_post function within the backend/routers/social/init.py file. An authenticated attacker can inject malicious JavaScript into the social feature, which is then executed in the browsers of other users who view the Home Feed.

Business Impact

Successful exploitation poses a severe risk to organizational security, as the execution of malicious scripts in an administrator's browser can lead to complete account takeover and session hijacking. Given the CVSS score of 8.7, this is classified as a high-severity issue that could facilitate wormable attacks, potentially compromising the integrity of the entire application environment and exposing sensitive data processed by the LLM system.

Remediation Plan

Immediate Action: Update parisneo lollms to version 2.2.0 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for unusual POST requests directed at the /api/prompts/share endpoint and monitor for unexpected client-side script execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads targeting the social API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of input sanitization when handling user-provided content in a shared social context.

Analyst Recommendation

The severity of this vulnerability is elevated by the potential for administrative account compromise. Administrators must prioritize upgrading to version 2.2.0 immediately to eliminate the injection vector and secure the application against unauthorized access and potential wormable exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Dokan Pro
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via the update_capabilities REST endpoint, allowing unauthorized users to elevate their access levels.

Executive Summary:
The Dokan Pro plugin for WordPress contains a critical privilege escalation flaw that could allow an attacker to gain unauthorized administrative control over the site.

Vulnerability Details

CVE-ID: CVE-2026-12224

Affected Software: WordPress Dokan Pro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an insecure REST API endpoint, update_capabilities, which fails to properly validate user permissions. An attacker can exploit this to escalate their current user privileges, potentially gaining full administrative access to the WordPress installation.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to the entire web application. Privilege escalation allows an attacker to bypass standard security controls, leading to total site compromise, data exfiltration, or the injection of malicious code, which could result in significant reputational damage and loss of customer trust.

Remediation Plan

Immediate Action: Update the Dokan Pro plugin to the latest version immediately to patch the vulnerable REST endpoint.

Proactive Monitoring: Monitor WordPress user role changes and administrative login activity for any unexpected modifications to user capabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests targeting the update_capabilities REST endpoint until the plugin can be updated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in plugins are frequently targeted by automated botnets. It is critical to patch the Dokan Pro plugin immediately. Organizations should also perform a security audit of current administrative users to ensure no unauthorized accounts were created during the period the site remained vulnerable.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A buffer overflow in the Yealink SIP-T46U Web FastCGI service allows local network attackers to trigger a crash or potentially execute arbitrary code.

Executive Summary:
A stack-based buffer overflow in the Yealink SIP-T46U Web FastCGI service poses a significant security risk for devices accessible via the local network.

Vulnerability Details

CVE-ID: CVE-2026-12222

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the mod_webd.BlueToothTest function within the /api/inner/bttest file. An attacker with local network access can exploit this by sending specially crafted btMac, pin, or reserved arguments to the Web FastCGI service.

Business Impact

The CVSS score of 8.0 indicates a high potential for impact. Successful exploitation could lead to a denial-of-service or arbitrary code execution, resulting in the loss of device confidentiality, integrity, or availability.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware updates. Restrict network access to the device to prevent unauthorized parties from reaching the Web FastCGI interface.

Proactive Monitoring: Monitor for anomalous traffic directed at the /api/inner/bttest endpoint and investigate any unexpected device reboots.

Compensating Controls: Use a firewall or VLAN configuration to ensure the device's management interface is not reachable from untrusted network segments.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit exists. The vulnerability is highly exploitable by any attacker with access to the local network, necessitating immediate defensive measures.

Analyst Recommendation

The combination of a public exploit and the high CVSS score makes this a critical security issue. Organizations using Yealink SIP-T46U devices should verify their firmware versions and restrict management interface access to prevent exploitation.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Yealink SIP-T46U firmware upgrade handler allows local network attackers to disrupt service or execute arbitrary code.

Executive Summary:
A stack-based buffer overflow in the Yealink SIP-T46U upgrade handler exposes the device to potential compromise by attackers with local network access.

Vulnerability Details

CVE-ID: CVE-2026-12221

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the sprintf function located in the /api/upgrade/upgrade file. Exploitation is possible by manipulating the uid/start_offset arguments within the Firmware Chunk Upload Handler.

Business Impact

The CVSS score of 8.0 confirms the high severity of this vulnerability. Successful exploitation could lead to full device compromise, potentially enabling an attacker to intercept communications or use the device as a pivot point within the local network.

Remediation Plan

Immediate Action: Apply firmware updates from Yealink as soon as they become available. Segment the management network to prevent unauthorized access to device API endpoints.

Proactive Monitoring: Review device access logs for frequent or malformed requests to the /api/upgrade/ path.

Compensating Controls: Implement network-level access control lists (ACLs) to ensure only authorized workstations can communicate with the SIP phone's management interface.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit is available. The requirement for local network access does not significantly diminish the risk, as an attacker already present on the network can leverage this to escalate their presence.

Analyst Recommendation

Due to the public availability of an exploit, this vulnerability must be treated with high urgency. Administrators should isolate the device management interfaces and monitor for any suspicious traffic targeting the firmware upgrade handlers.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: Yealink SIP-T46U 108.86.0.118
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Yealink SIP-T46U firmware upgrade component allows local network attackers to potentially achieve remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Yealink SIP-T46U firmware handling could allow attackers on the local network to compromise the device.

Vulnerability Details

CVE-ID: CVE-2026-12220

Affected Software: Yealink SIP-T46U

Affected Versions: Yealink SIP-T46U 108.86.0.118

Vulnerability: This is a stack-based buffer overflow in the mod_upgrade.SparePartsUpload function within the /api/upgrade/accupgradebychunk component. An attacker with local network access can trigger this by sending malicious data to the Firmware Chunk Upload handler.

Business Impact

With a CVSS score of 8.0, this vulnerability presents a high risk of unauthorized device control. Exploitation could allow an attacker to gain persistent access to telecommunications hardware, facilitating eavesdropping or further network lateral movement.

Remediation Plan

Immediate Action: Apply the latest firmware security updates provided by Yealink. If no update is available, isolate the device management interface from the general network.

Proactive Monitoring: Monitor network traffic for anomalous firmware upload attempts or unexpected API calls to the /api/upgrade/ endpoint.

Compensating Controls: Restrict access to the device's web management interface to trusted administrative IP addresses using network segmentation or ACLs.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit exists for this vulnerability. While exploitation requires local network access, the potential for device compromise is high and warrants immediate attention.

Analyst Recommendation

Given the availability of a public exploit and the potential for full device compromise, users must restrict access to the affected SIP phone's management interface immediately. Apply any available firmware patches from the manufacturer as soon as they are released.

Executive Summary:
A high-severity vulnerability has been identified in the BROWAN COMMUNICATIONS PrismX MX100 AP controller. This flaw allows a remote attacker with existing privileges to upload malicious files, which can then be executed to gain complete control over the affected server. Successful exploitation could lead to data theft, network disruption, and further unauthorized access into the corporate network.

Vulnerability Details

CVE-ID: CVE-2026-1222

Affected Software: BROWAN COMMUNICATIONS PrismX MX100 AP controller

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an Arbitrary File Upload vulnerability. An attacker who has already obtained privileged credentials for the device's management interface can exploit this flaw by uploading a specially crafted file, such as a web shell. The application fails to properly validate the uploaded file's type or content, allowing the malicious file to be saved to a web-accessible directory on the server. The attacker can then execute the code within the file by navigating to its URL, resulting in arbitrary code execution with the permissions of the web server process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.2. A successful exploit would result in a complete compromise of the PrismX MX100 AP controller. This could allow an attacker to intercept or manipulate network traffic, steal sensitive configuration data, disable wireless network services, or use the compromised controller as a pivot point to launch further attacks against the internal network. The specific risks to the organization include data breaches, operational downtime, and a loss of integrity for the managed network environment.

Remediation Plan

Immediate Action: Apply the security updates provided by BROWAN COMMUNICATIONS to all affected PrismX MX100 AP controllers immediately. Before and after patching, closely monitor devices for any signs of compromise and review historical access and system logs for indicators of exploitation.

Proactive Monitoring: Monitor web server and application logs for suspicious file upload events, particularly files with executable extensions (e.g., .php, .jsp, .sh, .aspx). Scrutinize network traffic for unexpected outbound connections originating from the AP controller. Implement file integrity monitoring on the device's web directories to detect the creation of unauthorized files.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Restrict access to the device's management interface to a limited set of trusted IP addresses or a dedicated management VLAN.
• Deploy a Web Application Firewall (WAF) with rules to inspect and block malicious or unexpected file types from being uploaded.
• Ensure all administrative credentials for the device are strong, unique, and not default.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 20, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability requires the attacker to be authenticated with privileges, which reduces the risk of widespread, opportunistic attacks. However, threat actors who have already gained a foothold in a network may leverage this vulnerability for privilege escalation or lateral movement.

Analyst Recommendation
Given the high severity score and the potential for complete system compromise, it is strongly recommended that organizations prioritize the immediate application of vendor-supplied patches to all affected controllers. Although this vulnerability is not currently on the CISA KEV list and requires prior authentication, the impact of a successful exploit is severe. If patching is delayed, the compensating controls outlined above, particularly restricting network access to the management interface, should be implemented as a critical interim measure to reduce the attack surface.

---METADATA---
VENDOR: Yealink
PRODUCT: SIP-T46U
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Yealink SIP-T46U IP phone firmware, potentially allowing for unauthorized system impact.

Executive Summary:
A critical security vulnerability in Yealink SIP-T46U firmware poses a significant risk to enterprise communication infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-12218

Affected Software: Yealink SIP-T46U

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Yealink SIP-T46U firmware; while specific authentication requirements are currently undisclosed, such flaws often involve improper input validation or insufficient access controls within the device's management interface.

Business Impact

Successful exploitation of this high-severity vulnerability (CVSS 8.0) could lead to unauthorized access to enterprise communication devices. This may result in call interception, eavesdropping, or the pivot of attackers into internal voice-over-IP (VoIP) networks, causing substantial reputational damage and operational disruption.

Remediation Plan

Immediate Action: Administrators should verify the current firmware version of all deployed SIP-T46U units and apply the latest security updates provided by Yealink immediately.

Proactive Monitoring: Review device access logs for unusual login attempts or unexpected configuration changes originating from unauthorized IP addresses.

Compensating Controls: Isolate VoIP devices on a dedicated, firewalled VLAN to restrict management access to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Yealink SIP-T46U devices must prioritize this update. Ensure that all firmware management is conducted over secure, segmented networks to minimize exposure while awaiting vendor-specific patching guidance.

---METADATA---
VENDOR: DVDFab
PRODUCT: Virtual Drive
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in DVDFab Virtual Drive, which may permit unauthorized system-level interactions.

Executive Summary:
A high-severity vulnerability in DVDFab Virtual Drive poses a risk of unauthorized access or system instability on affected hosts.

Vulnerability Details

CVE-ID: CVE-2026-12217

Affected Software: DVDFab Virtual Drive

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the DVDFab Virtual Drive software, potentially involving improper validation of virtual image files or system drivers that could be exploited to cause system-level impact.

Business Impact

With a CVSS score of 7.8, this flaw represents a significant risk to endpoint integrity. Exploitation could allow an attacker to execute arbitrary code or gain unauthorized control over the system, potentially leading to data exfiltration or system-wide compromise.

Remediation Plan

Immediate Action: Update the DVDFab Virtual Drive software to the most current version available from the vendor.

Proactive Monitoring: Review system logs for unusual driver activity or unexpected application crashes that may indicate an exploitation attempt.

Compensating Controls: Use application control policies to restrict the execution of untrusted software or the mounting of unauthorized virtual drive images.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should audit their environments for the presence of DVDFab Virtual Drive and apply the necessary patches. If the software is not required for business operations, consider uninstalling it to reduce the attack surface.

---METADATA---
VENDOR: Qihoo 360
PRODUCT: Total Security
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in Qihoo 360 Total Security, potentially impacting the effectiveness of the endpoint protection suite.

Executive Summary:
A high-severity vulnerability in Qihoo 360 Total Security could allow attackers to bypass security protections or compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-12214

Affected Software: Qihoo 360 Total Security

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a security flaw within the Qihoo 360 Total Security suite, potentially allowing an attacker to manipulate the software's protective mechanisms or execute code with elevated permissions.

Business Impact

A CVSS score of 7.8 indicates a high risk to organizational security. Successful exploitation could render the security software ineffective, leaving the host vulnerable to further attacks, malware delivery, or unauthorized access to sensitive local data.

Remediation Plan

Immediate Action: Apply the latest security updates released by Qihoo 360 to all systems running the Total Security suite immediately.

Proactive Monitoring: Monitor security logs for alerts indicating the deactivation or modification of the antivirus software or unexpected system behavior.

Compensating Controls: Ensure that additional layers of security, such as network-level filtering and host-based firewalls, are active to mitigate the risk of exploit delivery.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize updating endpoint protection software to ensure that the security suite itself does not become an attack vector. Verify that automatic updates are enabled and functioning across the environment.

Executive Summary:
A critical vulnerability has been identified in multiple PrismX products, allowing unauthenticated remote attackers to gain full access to the device's database. This is due to hard-coded credentials stored within the device firmware, which could lead to a complete compromise of data confidentiality, integrity, and availability. Immediate patching is required to prevent potential data breaches and system takeover.

Vulnerability Details

CVE-ID: CVE-2026-1221

Affected Software: PrismX Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The PrismX MX100 AP controller firmware contains static, hard-coded database credentials. A remote, unauthenticated attacker can extract these credentials by analyzing the firmware file. Once obtained, the attacker can use these credentials to directly log in to the device's database, bypassing all authentication mechanisms and gaining privileged access to the stored data.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation grants an attacker direct administrative access to the database, posing a significant risk to the organization. Potential consequences include unauthorized access to sensitive configuration data, customer information, or network credentials; modification or deletion of critical data leading to service disruption; and using the compromised device as a pivot point for further attacks within the network. This can result in severe financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Organizations must immediately apply the security updates provided by the vendor to all affected PrismX products. After patching, it is crucial to monitor systems for any signs of compromise that may have occurred prior to the update and review all database access logs for unauthorized connections.

Proactive Monitoring: Implement enhanced monitoring for database access attempts originating from untrusted or unexpected IP addresses. Network traffic should be monitored for unusual data flows from the database server, which could indicate data exfiltration. System logs should be reviewed for authentication attempts using the now-public hard-coded credentials.

Compensating Controls: If immediate patching is not feasible, implement network segmentation to restrict access to the database port from untrusted networks, such as the internet. Deploy an Intrusion Prevention System (IPS) or Web Application Firewall (WAF) with rules to detect and block login attempts using the known hard-coded credentials. If possible, manually change the default database password on the device, though this may not be supported on all firmware versions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of Jan 20, 2026, there are no known public exploits actively targeting this vulnerability. However, due to the trivial nature of exploiting hard-coded credentials, it is highly likely that threat actors will reverse-engineer the firmware to discover the credentials and weaponize this vulnerability in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the ease of exploitation, this vulnerability presents a clear and present danger to the organization. We strongly recommend that all affected PrismX products be patched immediately, treating this as the highest priority. Although this CVE is not currently listed on the CISA KEV catalog, its high impact and low attack complexity make it a prime candidate for future inclusion and widespread exploitation. Organizations should assume they are being targeted and act decisively to mitigate this risk.

---METADATA---
VENDOR: ShopXO
PRODUCT: ShopXO
AFFECTED_VERSIONS: ShopXO up to 6.7.1
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability in the ShopXO Crontab.php controller allows attackers to manipulate scheduled tasks and bypass authorization.

Executive Summary:
An unauthenticated vulnerability in ShopXO allows remote attackers to bypass authorization mechanisms by manipulating scheduled tasks in the Crontab controller.

Vulnerability Details

CVE-ID: CVE-2026-12204

Affected Software: ShopXO

Affected Versions: ShopXO up to 6.7.1

Vulnerability: This vulnerability stems from improper access control in the Crontab.php controller, which allows an unauthenticated remote attacker to trigger or manipulate scheduled tasks. By bypassing existing authorization checks, an attacker can potentially execute unauthorized actions.

Business Impact

The CVSS score of 7.3 (High) highlights the significant risk of unauthorized access and potential system compromise. If exploited, an attacker could gain control over administrative tasks, leading to data tampering, unauthorized site modifications, or complete system takeover.

Remediation Plan

Immediate Action: Upgrade to the latest version of ShopXO that includes the security patch for Crontab.php authorization vulnerabilities.

Proactive Monitoring: Review web server logs for suspicious requests directed at the Crontab.php controller or unexpected execution of administrative scheduled tasks.

Compensating Controls: Restrict access to administrative controllers and cron-related endpoints using IP whitelisting or by requiring authentication at the web server (e.g., Nginx/Apache) level.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a public exploit is available for this vulnerability. The lack of authentication requirements makes this a high-risk target for automated exploitation.

Analyst Recommendation

This vulnerability is highly critical due to the availability of a public exploit and the lack of required authentication. Organizations running ShopXO should treat this as a high-priority remediation task and apply necessary updates immediately to secure their platform from unauthorized access.

---METADATA---
VENDOR: Ritlabs
PRODUCT: TinyWeb Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the Ritlabs TinyWeb Server, affecting versions up to 1.

Executive Summary:
The Ritlabs TinyWeb Server is subject to a high-severity security vulnerability that could lead to unauthorized system access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-12200

Affected Software: Ritlabs TinyWeb Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of the TinyWeb Server, potentially allowing for remote exploitation by unauthorized parties. The exact mechanism of the flaw requires careful review of the vendor’s security bulletin.

Business Impact

The CVSS score of 7.3 highlights the significant risk posed to web services hosted on TinyWeb. Successful exploitation could result in full service compromise, unauthorized data disclosure, or total system downtime, severely impacting business continuity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Ritlabs immediately to secure the web server environment.

Proactive Monitoring: Review server access logs for anomalous requests or attempts to execute unauthorized commands on the host.

Compensating Controls: Place the TinyWeb server behind a robust reverse proxy or WAF that can filter malicious requests before they reach the server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This server software is critical to web operations and should be patched immediately. Ensure that the web server is not exposed to the public internet unless absolutely necessary.

---METADATA---
VENDOR: Microweber
PRODUCT: Microweber CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in versions of Microweber CMS, potentially allowing for unauthorized system interaction.

Executive Summary:
A security vulnerability in Microweber CMS requires immediate attention to protect against potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-12198

Affected Software: Microweber CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified weakness within the Microweber CMS platform. Without further disclosure, administrators should treat this as a potential entry point for unauthenticated or partially authenticated attackers to influence system operations.

Business Impact

With a CVSS score of 7.3, this high-severity vulnerability could lead to compromise of website integrity or data exposure. Successful exploitation may allow an attacker to bypass security controls, resulting in unauthorized content modification or administrative actions.

Remediation Plan

Immediate Action: Update Microweber CMS to the latest patched version available from the official vendor website.

Proactive Monitoring: Perform a comprehensive review of administrative access logs and monitor for unexpected changes to site configuration or core files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns targeting CMS administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score suggests that exploitation would be impactful.

Analyst Recommendation

Administrators must verify their current installation version and apply the vendor's patch immediately. Maintaining an up-to-date CMS is critical to defending against known and unknown web-based attack vectors.

---METADATA---
VENDOR: Ruijie
PRODUCT: EG105G-P
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in the Ruijie EG105G-P network gateway, potentially compromising device security.

Executive Summary:
A critical security flaw in the Ruijie EG105G-P network gateway exposes the device to potential unauthorized access or control.

Vulnerability Details

CVE-ID: CVE-2026-12197

Affected Software: Ruijie EG105G-P

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the Ruijie EG105G-P gateway. Given the nature of network hardware vulnerabilities, it is likely that this issue could be exploited by remote, unauthenticated attackers to gain unauthorized control over the gateway device.

Business Impact

The CVSS score of 7.2 indicates a high-severity risk. A compromised gateway can serve as a pivot point for attackers to intercept network traffic, launch man-in-the-middle attacks, or gain unauthorized access to the internal network, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Check the Ruijie support website for firmware updates and apply them to all affected EG105G-P units.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempts to access the management interface from unauthorized subnets.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses and disable unnecessary management services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the device's role as a network perimeter gateway, the potential for exploitation is extremely high.

Analyst Recommendation

Urgent action is required to patch this network gateway. Failure to secure the perimeter device could lead to a full compromise of the internal network infrastructure. Ensure all management consoles are isolated from public access.

---METADATA---
VENDOR: HestiaCP
PRODUCT: HestiaCP
AFFECTED_VERSIONS: 0 up to (excluding) 8be23943c7e3231f66d226ca931c76f93be98412
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The HestiaCP panel cronjob feature contains a broken access control vulnerability that allows authenticated users to escalate privileges.

Executive Summary:
HestiaCP versions prior to the commit 8be23943c7e3231f66d226ca931c76f93be98412 contain a broken access control vulnerability allowing for unauthorized administrative actions.

Vulnerability Details

CVE-ID: CVE-2026-12196

Affected Software: HestiaCP

Affected Versions: 0 up to (excluding) 8be23943c7e3231f66d226ca931c76f93be98412

Vulnerability: This vulnerability is categorized as an improper authentication/broken access control issue within the cronjob management feature. An attacker with a low-privileged account can manipulate the cronjob scheduling functionality to perform unauthorized administrative actions, effectively leading to full panel takeover.

Business Impact

The CVSS score of 8.3 reflects the significant danger of administrative takeover. A successful exploit allows an attacker to gain full control over the HestiaCP panel, enabling them to compromise hosted websites, modify server configurations, and access sensitive user data, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update HestiaCP to the latest version or apply the specific patch referenced in the vendor's repository (commit 8be23943c7e3231f66d226ca931c76f93be98412).

Proactive Monitoring: Audit existing cronjobs for unauthorized entries and monitor server access logs for anomalous requests directed at the panel's management interface.

Compensating Controls: Restrict access to the HestiaCP administration panel to trusted IP addresses only and enforce multi-factor authentication (MFA) where available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities in control panels are critical. Administrators must apply the provided patch or upgrade immediately to prevent attackers from seizing administrative control of the server environment.

---METADATA---
VENDOR: myVesta
PRODUCT: vesta
AFFECTED_VERSIONS: 0 up to (excluding) 95d7e43bf286d6881ca753dac93cb42d98cc7422
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The myVesta control panel contains an authenticated remote code execution vulnerability due to improper neutralization of special elements in OS commands.

Executive Summary:
An authenticated remote code execution vulnerability in myVesta allows attackers with low-level privileges to gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-12195

Affected Software: myVesta vesta

Affected Versions: 0 up to (excluding) 95d7e43bf286d6881ca753dac93cb42d98cc7422

Vulnerability: This is an OS command injection (CWE-78) vulnerability that can be exploited by an authenticated attacker. By injecting malicious input, an attacker can execute arbitrary code on the underlying server hosting the control panel.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high risk of server compromise. Successful exploitation grants an attacker the ability to execute code with the privileges of the web application, leading to potential data theft, server-wide malware installation, or full administrative takeover of the hosting environment.

Remediation Plan

Immediate Action: Update the myVesta installation to the latest version or apply the specific commit referenced in the vendor documentation to remediate the command injection vector.

Proactive Monitoring: Inspect system logs for suspicious shell activity or unexpected process spawning initiated by the web service user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block OS command injection attempts in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution vulnerabilities are critical. Administrators should treat this as a priority update, especially for internet-facing installations. Ensure that all web application components are updated and that the underlying OS is hardened to limit the impact of a potential compromise.

---METADATA---
VENDOR: VS Revo Group
PRODUCT: Revo Uninstaller
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Revo Uninstaller, which may allow for unauthorized manipulation of system processes.

Executive Summary:
A high-severity vulnerability in Revo Uninstaller could allow local attackers to gain elevated privileges or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-12193

Affected Software: VS Revo Group Revo Uninstaller

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Revo Uninstaller application, likely involving insecure handling of system calls or service permissions that could be leveraged by an authenticated user to perform unauthorized actions.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a significant risk to endpoint security. Exploitation could allow an attacker to bypass standard security controls, leading to total system compromise, data theft, or the installation of persistent malicious software on affected workstations.

Remediation Plan

Immediate Action: Update Revo Uninstaller to the latest version released by the vendor to ensure all security patches are applied.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution, particularly those involving installer services or unauthorized privilege escalation attempts.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) solutions to block unauthorized modification of system-level binaries or sensitive registry keys.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should immediately inventory all instances of Revo Uninstaller. Given the potential for privilege escalation, applying the vendor-provided patch is essential to maintain the integrity of the host operating system.

---METADATA---
VENDOR: GALAYOU
PRODUCT: Y4
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the GALAYOU Y4 device, which could be leveraged to compromise device security.

Executive Summary:
A high-severity vulnerability in the GALAYOU Y4 device exposes the system to potential unauthorized access and exploitation.

Vulnerability Details

CVE-ID: CVE-2026-12192

Affected Software: GALAYOU Y4

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security flaw has been determined in the GALAYOU Y4 hardware/firmware interface. This vulnerability could permit unauthorized interactions with the device’s administrative or data-handling functions.

Business Impact

The CVSS score of 8.8 indicates a critical threat level for the affected device. Successful exploitation could allow an attacker to gain control over the device, leading to privacy loss or the device being utilized as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Check the manufacturer’s support portal for firmware updates and apply them to all affected devices immediately.

Proactive Monitoring: Monitor the device's network traffic for unusual outbound connections or unauthorized access attempts.

Compensating Controls: Isolate affected devices on a dedicated network segment or VLAN to minimize the potential blast radius of a successful compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Device owners should prioritize the installation of the latest firmware patches provided by GALAYOU. If a patch is not yet available, the device should be restricted from external network access to prevent remote exploitation.

---METADATA---
VENDOR: Comma AI
PRODUCT: Openpilot
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been identified in Comma AI Openpilot that may pose a security risk to the affected system.

Executive Summary:
A vulnerability in Comma AI Openpilot requires immediate attention to prevent potential unauthorized system impacts.

Vulnerability Details

CVE-ID: CVE-2026-12191

Affected Software: Comma AI Openpilot

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified flaw within the Openpilot software platform. Due to the limited technical disclosure, the authentication requirements remain indeterminate; users should assume a risk of unauthorized interaction.

Business Impact

The identified vulnerability carries a CVSS score of 7.8, indicating a high level of severity. Successful exploitation could lead to unauthorized system access or functional disruption, potentially impacting the safety and operational integrity of the host vehicle's driver assistance systems.

Remediation Plan

Immediate Action: Consult the official Comma AI security portal to identify and apply the latest security patches or firmware updates.

Proactive Monitoring: Monitor system logs for anomalous execution patterns or unauthorized configuration changes.

Compensating Controls: Ensure the device is isolated from untrusted networks to minimize the attack surface while awaiting vendor patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of driver-assist systems, the potential for exploitation is considered high.

Analyst Recommendation

Given the high CVSS score, organizations and individual users should treat this as a priority update. Apply the latest vendor-supplied patches as soon as they become available to mitigate the risk of unauthorized system manipulation.

---METADATA---
VENDOR: GL
PRODUCT: Unknown
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in GL software, requiring immediate attention to prevent unauthorized system exploitation.

Executive Summary:
A high-severity security vulnerability in GL software poses a substantial risk to system security and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-12187

Affected Software: GL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security vulnerability has been detected within the GL software architecture. While specific mechanics are currently under investigation, the flaw is categorized with a high impact on the target environment.

Business Impact

The CVSS score of 8.8 underscores the severity of this issue, indicating a high potential for successful exploitation by malicious actors. Failure to address this vulnerability may result in unauthorized data access, service outages, and potential reputational damage to the organization.

Remediation Plan

Immediate Action: Apply all available security patches provided by the vendor to the affected GL software components.

Proactive Monitoring: Implement enhanced logging and monitoring for any unusual activity or unauthorized configuration changes within the application.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for patterns that may exploit known vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high CVSS score, it is imperative that organizations treat this as a high-priority task. Administrators should ensure that all instances are updated to the latest secure version immediately.

---METADATA---
VENDOR: GL
PRODUCT: Unknown
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in GL software, which may lead to unauthorized system access or information disclosure.

Executive Summary:
A high-severity security weakness in GL software has been identified, potentially exposing the system to unauthorized access or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-12186

Affected Software: GL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A weakness has been identified in the internal logic of the GL software. Further technical details remain limited, but the flaw generally allows for unauthorized interactions with the application.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality and integrity of the system. Unauthorized access to the affected environment could lead to the theft of sensitive data or the disruption of critical business processes.

Remediation Plan

Immediate Action: Review vendor communication channels for security bulletins and apply all relevant patches or firmware updates.

Proactive Monitoring: Review access logs for anomalous behavior or unauthorized administrative actions occurring within the GL environment.

Compensating Controls: Restrict network access to the affected service using firewall rules, ensuring only authorized users can interact with the management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the remediation of this vulnerability due to its high severity. We recommend immediate patching and the enforcement of strict network segmentation until updates are successfully deployed.

---METADATA---
VENDOR: Legion of the Bouncy Castle Inc.
PRODUCT: BC-JAVA, BC-LTS-JAVA
AFFECTED_VERSIONS: BC-JAVA: 0-1.84; BC-LTS-JAVA: 2.73.0-2.73.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Bouncy Castle for Java contains a memory allocation vulnerability that can be triggered by a remote attacker via user interaction, potentially causing a denial of service.

Executive Summary:
An unauthenticated remote attacker can trigger a denial of service in Bouncy Castle for Java by providing crafted inputs that cause excessive memory allocation during processing.

Vulnerability Details

CVE-ID: CVE-2026-12185

Affected Software: Legion of the Bouncy Castle Inc. BC-JAVA and BC-LTS-JAVA

Affected Versions: BC-JAVA: 0 up to 1.85; BC-LTS-JAVA: 2.73.0 up to 2.73.12

Vulnerability: The library suffers from CWE-789, which is a failure to properly validate size values during memory allocation. While the vulnerability requires user interaction, it remains accessible to unauthenticated remote attackers who can influence the data processed by the library.

Business Impact

This vulnerability carries a CVSS score of 7.1, reflecting a high risk of service disruption. By forcing excessive memory usage, an attacker can crash the application, leading to downtime for systems relying on Bouncy Castle for secure operations or internal cryptographic tasks.

Remediation Plan

Immediate Action: Update to Bouncy Castle versions 1.85 (for BC-JAVA) or 2.73.12 (for BC-LTS-JAVA) to resolve the memory allocation defect.

Proactive Monitoring: Review application performance metrics and error logs for patterns of memory-related exceptions or service restarts.

Compensating Controls: Deploy a Web Application Firewall or input validation filter to block malformed or excessively large cryptographic payloads before they reach the library.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction slightly reduces the immediate risk compared to fully automated attacks, but remediation remains necessary.

Analyst Recommendation

Security teams should schedule the update of Bouncy Castle dependencies to the latest version to neutralize this denial of service risk. Prioritize systems where the library processes untrusted user-supplied data, as these are the most likely vectors for exploitation.

---METADATA---
VENDOR: Nefteprodukttekhnika
PRODUCT: BUK TS-G Gas Station Automation System
AFFECTED_VERSIONS: Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux
---END_METADATA---

Description Summary:
The BUK TS-G automation system contains an authentication bypass vulnerability that allows remote, unauthenticated attackers to execute arbitrary administrative actions.

Executive Summary:
A critical authentication bypass vulnerability in the Nefteprodukttekhnika BUK TS-G system allows unauthenticated attackers to gain full administrative control over gas station operations.

Vulnerability Details

CVE-ID: CVE-2026-12183

Affected Software: Nefteprodukttekhnika BUK TS-G Gas Station Automation System

Affected Versions: Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux

Vulnerability: The system suffers from an improper authentication flaw (CWE-287) where the /php/ajax-login.php endpoint fails to validate credentials and improperly grants administrative access. Subsequent privileged endpoints do not validate server-side sessions, allowing a remote unauthenticated attacker to manipulate sensitive industrial components.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to operational technology (OT) environments. An attacker could remotely manipulate fuel tank gauges, dispensers, cash registers, and pricing rules, potentially leading to significant financial loss, physical safety hazards at gas stations, and complete compromise of industrial control integrity.

Remediation Plan

Immediate Action: Update the BUK TS-G automation system to the latest version as specified in the vendor advisory.

Proactive Monitoring: Monitor network traffic for unauthorized access to the /php/ directory and review system logs for unexpected administrative changes or login attempts.

Compensating Controls: Isolate the automation system from the public internet using a firewall and ensure access is restricted to authorized VPN connections only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 13, 2026, a public exploit is available, and the lack of session validation makes this vulnerability trivial to exploit. Immediate mitigation is required to prevent unauthorized industrial control.

Analyst Recommendation

Given the critical severity and the availability of functional exploit code, this vulnerability represents an urgent threat to facility operations. Administrators must apply the vendor-provided updates immediately and verify that the affected systems are not exposed to the public internet.

---METADATA---
VENDOR: D-Link
PRODUCT: DCS-935L
AFFECTED_VERSIONS: D-Link DCS-935L 1.10.01.
---END_METADATA---

Description Summary:
A format string vulnerability in the D-Link DCS-935L HTTP handler allows remote attackers to compromise the device via the snprintf function in the CGI binary.

Executive Summary:
A critical remote format string vulnerability in D-Link DCS-935L cameras could allow an unauthenticated attacker to execute arbitrary commands on the device.

Vulnerability Details

CVE-ID: CVE-2026-12174

Affected Software: D-Link DCS-935L

Affected Versions: D-Link DCS-935L 1.10.01.

Vulnerability: The vulnerability exists in the snprintf function within the /web/cgi-bin/greece/rhea file of the HTTP Handler component. It is a classic format string flaw that can be triggered remotely without authentication.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical. Successful exploitation allows for remote code execution, granting an attacker full control over the surveillance camera. This poses severe risks, including unauthorized access to video feeds, lateral movement into the local network, and the potential for the device to be recruited into a botnet.

Remediation Plan

Immediate Action: Update the device firmware to the version provided by D-Link that addresses the format string vulnerability in the HTTP handler.

Proactive Monitoring: Inspect network traffic for unusual HTTP GET or POST requests directed at the camera's CGI interface.

Compensating Controls: Isolate affected cameras on a dedicated VLAN and restrict access via firewall rules to known, trusted management IP addresses.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 14, 2026, a public exploit is available for this vulnerability. Organizations using this hardware should consider it at immediate risk of exploitation.

Analyst Recommendation

Given the availability of a public exploit and the remote nature of this vulnerability, immediate patching is required. If a firmware update cannot be applied immediately, the device should be disconnected from the public internet or placed behind a robust firewall/VPN gateway to prevent unauthorized access.

---METADATA---
VENDOR: Little
PRODUCT: GameFirst Anti-Cheat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper validation vulnerability exists in the GFAC_Sys_x64 driver for GameFirst Anti-Cheat, which could lead to unauthorized system-level actions.

Executive Summary:
An improper validation flaw in the GameFirst Anti-Cheat driver presents a high-severity risk, potentially allowing local attackers to escalate privileges or interact with the kernel.

Vulnerability Details

CVE-ID: CVE-2026-12168

Affected Software: Little GameFirst Anti-Cheat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an improper validation issue within the GFAC_Sys_x64 driver. Because this is a kernel-level driver, successful exploitation typically allows an attacker to bypass security restrictions or achieve elevated privileges on the host system.

Business Impact

The CVSS score of 7.8 indicates a high-severity risk, specifically regarding the potential for privilege escalation on local machines. If exploited, an attacker could gain control over the host system, bypass security software, or maintain persistence, resulting in a total compromise of the affected workstation.

Remediation Plan

Immediate Action: Update the GameFirst Anti-Cheat software to the latest version provided by the vendor to ensure the driver is patched.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor for suspicious driver loading or kernel-level modifications.

Compensating Controls: Restrict local administrative privileges to prevent unauthorized software installation or driver manipulation on workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Vulnerabilities in anti-cheat drivers are highly attractive to threat actors due to their elevated system permissions. Administrators should ensure that all systems utilizing this software are patched immediately, and consider limiting the use of software that requires kernel-level drivers in high-security environments.

---METADATA---
VENDOR: Little (GameFirst)
PRODUCT: GameFirst Anti-Cheat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Minifilter communication port for the GameFirst Anti-Cheat driver, GFAC_Sys_x64, may expose the system to unauthorized interactions.

Executive Summary:
The GameFirst Anti-Cheat driver contains a vulnerability in its communication port that could potentially be leveraged to impact system security.

Vulnerability Details

CVE-ID: CVE-2026-12167

Affected Software: Little GameFirst Anti-Cheat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Minifilter communication port used by the GFAC_Sys_x64 driver. Such vulnerabilities typically involve improper validation of input or insufficient access control, which could allow local attackers to interact with or disrupt the driver's operations.

Business Impact

With a CVSS score of 7.8, this High-severity vulnerability could allow an attacker with local access to interact with a kernel-mode driver. This poses a risk of system instability, potential privilege escalation, or bypassing security controls enforced by the anti-cheat software, which could undermine the integrity of the host machine.

Remediation Plan

Immediate Action: Update the GameFirst Anti-Cheat software to the latest version recommended by the vendor.

Proactive Monitoring: Monitor system logs for unexpected driver behavior or errors related to the GFAC_Sys_x64 component.

Compensating Controls: Ensure that local user permissions are strictly limited to prevent unauthorized software execution that could interact with kernel-mode drivers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel-mode vulnerabilities are inherently dangerous due to the level of access they afford. It is critical that security teams apply the vendor's updates immediately to ensure the GameFirst Anti-Cheat driver is properly secured against potential local exploitation.

---METADATA---
VENDOR: Contest Gallery
PRODUCT: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Contest Gallery WordPress plugin is vulnerable to privilege escalation, allowing authenticated attackers to elevate their access level within the application.

Executive Summary:
A high-severity privilege escalation vulnerability in the Contest Gallery WordPress plugin allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-12165

Affected Software: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin suffers from a privilege escalation flaw due to insufficient authorization checks. An authenticated attacker can leverage this vulnerability to gain higher-level permissions than those originally assigned to their account.

Business Impact

Successful exploitation allows an attacker to gain administrative control over the WordPress site. This can lead to complete site takeover, unauthorized data access, modification of content, and potential injection of malicious scripts, resulting in significant reputational and operational damage. The CVSS score of 8.8 reflects the high severity of unauthorized privilege acquisition.

Remediation Plan

Immediate Action: Update the Contest Gallery plugin to the latest version provided by the vendor immediately.

Proactive Monitoring: Review WordPress user account logs for suspicious account activity or unauthorized elevation of roles.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to detect and block suspicious administrative requests or unauthorized parameter manipulation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete site compromise, administrators should treat this vulnerability with high urgency. Immediately audit existing user roles and apply available plugin updates to mitigate the risk of unauthorized privilege escalation.

---METADATA---
VENDOR: Devolutions
PRODUCT: Remote Desktop Manager
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An input validation vulnerability in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026 allows for potential security compromise.

Executive Summary:
Improper input validation in Devolutions Remote Desktop Manager's SSH Elevate Shell feature presents a high-severity risk to administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-12161

Affected Software: Devolutions Remote Desktop Manager

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from improper input validation within the SSH Elevate Shell component. This allows an attacker to bypass security constraints when initiating elevated shell sessions.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical for environments where administrative access is managed through this software. Exploitation could allow an attacker to gain unauthorized elevated privileges, potentially leading to total control over remote systems managed by the application.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Devolutions to the affected Remote Desktop Manager installation.

Proactive Monitoring: Review audit logs for suspicious SSH shell elevation requests and monitor for unexpected administrative activities.

Compensating Controls: Limit the use of the SSH Elevate Shell feature and enforce the principle of least privilege for accounts using Remote Desktop Manager.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability targets an administrative utility, it provides a high-value target for attackers. Users should verify their version against the vendor's security advisory and apply the necessary updates immediately to secure their remote management infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: RegistrationMagic – User Registration Forms Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 6.

Executive Summary:
A critical Cross-Site Request Forgery vulnerability in the RegistrationMagic WordPress plugin allows unauthenticated attackers to perform unauthorized actions on behalf of a logged-in user.

Vulnerability Details

CVE-ID: CVE-2026-12158

Affected Software: WordPress RegistrationMagic – User Registration Forms Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to trick an authenticated user into executing unwanted actions within the application. The vulnerability stems from insufficient anti-CSRF token validation within the plugin's administrative or user-facing forms.

Business Impact

Successful exploitation could lead to unauthorized administrative actions, such as modifying plugin configurations or creating unauthorized user accounts. Given the CVSS score of 8.8, this poses a significant risk to the integrity and security of the WordPress instance, potentially leading to full site compromise.

Remediation Plan

Immediate Action: Audit the WordPress environment for the presence of the RegistrationMagic plugin and ensure it is updated to the latest available version provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious POST requests originating from unexpected referrers that target plugin-specific administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common CSRF patterns and unauthorized requests directed at the WordPress backend.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score of 8.8 underscores the necessity for prompt mitigation. Administrators should prioritize updating this plugin immediately. If a patch is not yet available, consider disabling or removing the plugin until a secure version is released to maintain the security posture of the site.

---METADATA---
VENDOR: rabilal
PRODUCT: WP Learn Manager
AFFECTED_VERSIONS: 1.1.8 and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP Learn Manager plugin for WordPress contains an authorization bypass vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins on the host site.

Executive Summary:
An authorization bypass in the WP Learn Manager WordPress plugin allows unauthenticated attackers to execute arbitrary plugin installations on the target site.

Vulnerability Details

CVE-ID: CVE-2026-12153

Affected Software: rabilal WP Learn Manager

Affected Versions: 1.1.8 and earlier

Vulnerability: This is a missing authorization vulnerability (CWE-862) occurring within the plugin's AJAX handlers, where the software fails to verify user permissions before allowing critical administrative actions.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk of site takeover. By enabling the installation of arbitrary plugins, an attacker can effectively achieve remote code execution, inject malicious scripts, or install backdoors, leading to full site compromise and potential data exfiltration.

Remediation Plan

Immediate Action: Update the WP Learn Manager plugin to the latest available version on the WordPress repository immediately.

Proactive Monitoring: Review the list of installed plugins for any unauthorized or unrecognized additions and audit site activity logs for suspicious AJAX requests.

Compensating Controls: If an update is not immediately feasible, disable the plugin entirely and consider utilizing a Web Application Firewall (WAF) to block malicious requests targeting the plugin's AJAX endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous as it grants unauthenticated attackers the ability to modify the server environment. Site administrators should act immediately to update the plugin and conduct a security audit of their WordPress installation to ensure no unauthorized plugins have been deployed.

---METADATA---
VENDOR: saadiqbal
PRODUCT: Wholesale for WooCommerce
AFFECTED_VERSIONS: 0 through 2.0.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Wholesale for WooCommerce plugin for WordPress is vulnerable to improper privilege management, allowing an authenticated attacker to escalate privileges.

Executive Summary:
A privilege escalation vulnerability in the Wholesale for WooCommerce WordPress plugin allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-12144

Affected Software: saadiqbal Wholesale for WooCommerce

Affected Versions: 0 through 2.0.5

Vulnerability: This is a privilege management flaw (CWE-269) within the plugin's request handling logic. The vulnerability requires the attacker to be authenticated with low privileges to trigger the escalation.

Business Impact

Successful exploitation allows an attacker to elevate their privileges to an administrative level. This compromise leads to full control over the WordPress installation, potentially resulting in data exfiltration, unauthorized content modification, or complete system takeover. The high CVSS score of 8.8 reflects the significant impact on system integrity and confidentiality.

Remediation Plan

Immediate Action: There is currently no patched version available. Users should deactivate and remove the Wholesale for WooCommerce plugin until a security update is released by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for unauthorized changes to administrative roles or suspicious user creation events.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at wholesale functionality, though total protection cannot be guaranteed without a patch.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of exploitation once an attacker has authenticated as a standard user.

Analyst Recommendation

Given the severity of the privilege escalation, administrators must treat this as a critical risk. Since no patch is available, the only effective mitigation is the immediate removal of the vulnerable plugin to prevent unauthorized access to the site's administrative functions.

---METADATA---
VENDOR: IBM
PRODUCT: webMethods Integration (on prem)
AFFECTED_VERSIONS: 10.15, 10.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM webMethods Integration is vulnerable to unauthenticated remote code execution via deserialization of untrusted data in the WmServiceMock package.

Executive Summary:
An unauthenticated remote code execution vulnerability exists in IBM webMethods Integration, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12118

Affected Software: IBM webMethods Integration (on prem)

Affected Versions: 10.15, 10.11

Vulnerability: This vulnerability involves the deserialization of untrusted data (CWE-502) within the WmServiceMock development utility. An unauthenticated remote attacker can leverage this flaw to execute arbitrary code on the underlying host.

Business Impact

Successful exploitation allows an attacker to gain full control over the affected server, potentially leading to data exfiltration, service disruption, or lateral movement within the corporate network. With a CVSS score of 9.8, this flaw represents a maximum severity risk that requires immediate attention to prevent total system compromise.

Remediation Plan

Immediate Action: Remove the WmServiceMock package from all production Integration Server nodes immediately, as it is a development-only utility that should not be present in production environments.

Proactive Monitoring: Review system and access logs for suspicious activity, particularly incoming requests that appear to be malformed or contain unexpected serialized objects.

Compensating Controls: Ensure all production instances are isolated from untrusted networks and utilize network segmentation to restrict access to the Integration Server.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of authentication required to interact with the vulnerable package.

Analyst Recommendation

The presence of development utilities like WmServiceMock in production environments introduces unnecessary and critical attack surfaces. Administrators must prioritize the removal of this package from all production and internet-facing systems to eliminate the risk of remote code execution.

---METADATA---
VENDOR: Xerte
PRODUCT: Xerte Online Tools
AFFECTED_VERSIONS: 0 up to v3.15.5, 0 up to 3.14.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in Xerte Online Tools allows unauthenticated attackers to achieve Remote Code Execution (RCE) by manipulating the antivirus binary path to execute arbitrary PHP code.

Executive Summary:
A critical remote code execution vulnerability in Xerte Online Tools allows unauthenticated attackers to fully compromise the host system by injecting and executing malicious PHP payloads.

Vulnerability Details

CVE-ID: CVE-2026-12116

Affected Software: Xerte Xerte Online Tools

Affected Versions: 0 up to (excluding) v3.15.5; 0 up to (excluding) 3.14.6

Vulnerability: This vulnerability stems from improper control of code generation (CWE-94), where an unauthenticated attacker can modify the antivirus binary path within the tools server settings to point to a PHP interpreter, facilitating arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected server, leading to potential data exfiltration, service disruption, and lateral movement within the network. With a CVSS score of 9.8, this flaw represents a critical risk that could result in total system compromise and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade Xerte Online Tools to version 3.15.5 or 3.14.6 immediately to resolve the vulnerable configuration path handling.

Proactive Monitoring: Review server logs for anomalous modifications to application settings or unexpected execution of PHP files originating from the tools directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block suspicious requests targeting server configuration endpoints and restrict access to the administration interface to trusted IP ranges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of unauthenticated remote code execution. Organizations should prioritize the application of the vendor-provided patches immediately to mitigate the risk of unauthorized system access and potential full-scale compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: Satellite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the foreman-mcp-server component of Red Hat Satellite may allow for unauthorized system interaction.

Executive Summary:
A high-severity flaw in Red Hat Satellite's foreman-mcp-server poses a significant risk of unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-12112

Affected Software: Red Hat Satellite

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the foreman-mcp-server component, which handles communication protocols for system management. While specific authentication requirements are not detailed, flaws in management components often allow authenticated users to escalate privileges or bypass intended controls.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over infrastructure managed by Red Hat Satellite. Given the CVSS score of 7.8, this represents a high risk to organizational security, potentially enabling lateral movement or full compromise of managed endpoints, leading to significant operational downtime and data integrity loss.

Remediation Plan

Immediate Action: Review the official Red Hat security advisory for the release of a patch and apply it to all Satellite instances immediately.

Proactive Monitoring: Inspect system access logs for anomalous behavior related to the foreman-mcp-server process or unexpected administrative activity.

Compensating Controls: Restrict network access to the Satellite management interface to trusted administrative segments only to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate attention from IT security teams. Administrators should prioritize identifying vulnerable instances and applying vendor-supplied updates as soon as they become available to prevent potential system compromise.