---METADATA---
VENDOR: ail-project
PRODUCT: ail-framework
AFFECTED_VERSIONS: 0 through 7.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A reflected cross-site scripting vulnerability in the AIL Framework /tag/add_tags endpoint allows authenticated attackers to execute arbitrary scripts in a user session.

Executive Summary:
A reflected cross-site scripting vulnerability in AIL Framework permits authenticated attackers to inject malicious scripts, potentially leading to session theft or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-71445

Affected Software: ail-project ail-framework

Affected Versions: 0 through 7.0.0

Vulnerability: The application contains a reflected cross-site scripting flaw within the /tag/add_tags endpoint (CWE-79). This requires the attacker to be authenticated with low privileges and requires user interaction to execute the malicious payload.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a high risk to user accounts and session integrity. An attacker could potentially steal session cookies or perform unauthorized actions on behalf of a legitimate user, leading to potential data compromise or administrative control within the framework.

Remediation Plan

Immediate Action: Update the AIL Framework to the latest available version provided by the vendor to resolve the input sanitization issue.

Proactive Monitoring: Review web access logs for suspicious input parameters within the /tag/add_tags endpoint that contain script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns targeting application parameters.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this requires authentication, the impact remains significant due to the potential for privilege escalation or session hijacking.

Analyst Recommendation

Security teams should ensure that all instances of AIL Framework are updated to the latest version immediately. Furthermore, users should be trained to exercise caution when interacting with untrusted links that may trigger reflected scripts within the application.

---METADATA---
VENDOR: onyx-dot-app
PRODUCT: onyx
AFFECTED_VERSIONS: < 3.1.10, >= 3.2.0, < 3.2.14, >= 3.3.0-beta.0, < 4.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Onyx is vulnerable to sensitive information exposure because it incorrectly stores and leaks per-user OAuth tokens to unauthorized users through shared configuration records.

Executive Summary:
An authorization vulnerability in onyx-dot-app Onyx versions prior to 3.1.10, 3.2.14, and 4.0.0 allows authenticated users to access the sensitive OAuth credentials of other users.

Vulnerability Details

CVE-ID: CVE-2026-71424

Affected Software: onyx-dot-app onyx

Affected Versions: < 3.1.10, >= 3.2.0, < 3.2.14, >= 3.3.0-beta.0, < 4.0.0

Vulnerability: The vulnerability stems from the improper handling of per-user tokens, which are copied into shared administrative database records. As a result, any user with basic access can retrieve these tokens via specific API endpoints, leading to an incorrect authorization outcome.

Business Impact

Successful exploitation allows an authenticated attacker to steal OAuth Authorization headers belonging to other users, including potentially administrative accounts. This leads to unauthorized account access and potential data compromise across the platform. With a CVSS score of 9.6, the risk of privilege escalation and lateral movement is extreme.

Remediation Plan

Immediate Action: Update the Onyx platform to version 3.1.10, 3.2.14, or 4.0.0 to remediate the token storage and exposure flaw.

Proactive Monitoring: Review application logs for unusual API activity targeting the /api/mcp/servers endpoints and investigate any unauthorized attempts to access or use OAuth tokens.

Compensating Controls: Implement strict access control lists at the network or application level to restrict API access until the patch is applied.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in a fundamental design error regarding shared state and authorization, which requires careful remediation to ensure data isolation.

Analyst Recommendation

The vulnerability presents a significant risk to user identity and platform integrity. Organizations using the Onyx AI platform should apply the provided security updates immediately to prevent the unauthorized exposure and potential misuse of sensitive user credentials.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the Totolink A8000RU CGI handler, allowing unauthenticated remote attackers to execute arbitrary system commands via the CsteSystem function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7140

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the CsteSystem function within the /cgi-bin/cstecgi.cgi component, where improper input validation of the HTTP argument enables remote OS command injection. The attack does not require authentication.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to network infrastructure. Successful exploitation allows an attacker to gain full control over the router, potentially leading to unauthorized network access, data exfiltration, or the redirection of traffic, resulting in severe operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Apply the latest security firmware update provided by Totolink immediately.

Proactive Monitoring: Monitor network traffic and device logs for suspicious HTTP requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those containing shell metacharacters.

Compensating Controls: Restrict access to the device's management interface to trusted IP addresses via a firewall or ACL to prevent external exploitation.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available for this vulnerability. Given the ease of remote execution and the availability of functional exploits, the potential for active exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize patching the affected Totolink A8000RU devices to mitigate the risk of remote code execution. If patching is not immediately feasible, ensure the management interface is not exposed to the internet.

---METADATA---
VENDOR: Adobe
PRODUCT: Campaign Classic
AFFECTED_VERSIONS: 0 through ACC v7: 7.4.3 build 9399
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Adobe Campaign Classic contains an incorrect authorization vulnerability that permits unauthenticated remote attackers to achieve arbitrary code execution.

Executive Summary:
A critical authorization vulnerability in Adobe Campaign Classic enables unauthenticated remote code execution, threatening the entire application environment.

Vulnerability Details

CVE-ID: CVE-2026-71398

Affected Software: Adobe Campaign Classic

Affected Versions: 0 through ACC v7: 7.4.3 build 9399

Vulnerability: The software suffers from an incorrect authorization flaw (CWE-863) that allows an unauthenticated, remote attacker to bypass security controls and execute arbitrary code.

Business Impact

With a CVSS score of 10.0, this vulnerability represents a maximum-severity risk. Successful exploitation grants an attacker full control over the application, leading to potential data breaches, unauthorized system modifications, and significant operational disruption.

Remediation Plan

Immediate Action: Update Adobe Campaign Classic to ACC v7: 7.4.4 build 9400 immediately to apply the necessary authorization fixes.

Proactive Monitoring: Review system access logs for anomalous activity and monitor for unexpected service execution processes that may indicate exploitation attempts.

Compensating Controls: Implement strict network-level access controls to ensure the Campaign Classic interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Aug 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Security teams must ensure all instances of Adobe Campaign Classic are updated to the specified patch level to mitigate the risk of unauthorized remote code execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the mode parameter in the setWiFiAclRules function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7139

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability affects the setWiFiAclRules function in /cgi-bin/cstecgi.cgi. The mode parameter is not properly sanitized, facilitating remote OS command injection by an unauthenticated attacker.

Business Impact

The device is susceptible to total compromise, which can result in severe network security breaches. The 9.8 CVSS score confirms the high severity and potential for exploitation.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version and disable Wi-Fi ACL rules if not required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes and suspicious command activity.

Compensating Controls: Use a firewall to block all WAN-side access to the management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

Immediate firmware updates are required to mitigate this threat. If a patch is unavailable, isolate the device from external networks to prevent unauthorized remote access.

---METADATA---
VENDOR: Adobe
PRODUCT: ColdFusion
AFFECTED_VERSIONS: ColdFusion 2025 (0 to 2025.0.11), ColdFusion 2023 (0 to 2023.0.22)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in Adobe ColdFusion could allow an attacker to execute arbitrary code in the context of the current user.

Executive Summary:
Adobe ColdFusion suffers from an incorrect authorization flaw that may enable an attacker to perform unauthorized actions or execute code in the context of the current user session.

Vulnerability Details

CVE-ID: CVE-2026-71387

Affected Software: Adobe ColdFusion

Affected Versions: ColdFusion 2025 (0 through 2025.0.11) and ColdFusion 2023 (0 through 2023.0.22)

Vulnerability: This is an incorrect authorization vulnerability where the application fails to properly validate user permissions. This allows an attacker on an adjacent network to potentially bypass security controls and execute arbitrary code.

Business Impact

The ability to bypass authorization mechanisms represents a significant security failure, as it allows attackers to operate with the permissions of the current user. Given the CVSS score of 8.8, this vulnerability poses a high risk of unauthorized system access, data compromise, and potential full system takeover if the affected user holds elevated privileges.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patches, upgrading ColdFusion to version 2025.0.12 or 2023.0.23.

Proactive Monitoring: Monitor application access logs for unauthorized access attempts or unusual patterns in administrative function calls.

Compensating Controls: Restrict network access to the ColdFusion server to trusted IP addresses and enforce strict access control lists to mitigate potential lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authorization flaws are inherently high risk, as they directly negate the security policies defined within the application.

Analyst Recommendation

Addressing this incorrect authorization vulnerability is critical to maintaining the security posture of the application. Administrators should deploy the identified patches as soon as possible to ensure that authorization controls are correctly enforced and to minimize the risk of unauthorized code execution.

---METADATA---
VENDOR: Adobe
PRODUCT: ColdFusion
AFFECTED_VERSIONS: ColdFusion 2025 (0 to 2025.0.11), ColdFusion 2023 (0 to 2023.0.22)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-site Scripting (XSS) vulnerability in Adobe ColdFusion could allow an attacker to execute arbitrary code in the context of the current user.

Executive Summary:
Adobe ColdFusion is susceptible to a Cross-site Scripting vulnerability that may allow an attacker to execute arbitrary code in the context of an authenticated or interacting user.

Vulnerability Details

CVE-ID: CVE-2026-71386

Affected Software: Adobe ColdFusion

Affected Versions: ColdFusion 2025 (0 through 2025.0.11) and ColdFusion 2023 (0 through 2023.0.22)

Vulnerability: The software contains a Cross-site Scripting vulnerability that permits the injection of malicious scripts. This flaw can be triggered over an adjacent network and requires user interaction to facilitate arbitrary code execution.

Business Impact

Exploitation of this XSS vulnerability could allow an attacker to hijack user sessions or execute malicious scripts in the context of the application. With a CVSS score of 8.8, this presents a high risk of data theft or unauthorized administrative actions, which could severely impact the confidentiality and integrity of the affected platform.

Remediation Plan

Immediate Action: Update Adobe ColdFusion to version 2025.0.12 or 2023.0.23 as provided in the vendor security advisory.

Proactive Monitoring: Review web application logs for suspicious script injection attempts or anomalous requests targeting ColdFusion administrative interfaces.

Compensating Controls: Utilize a Web Application Firewall to block common XSS payloads and sanitize incoming HTTP requests to the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for user interaction and adjacent network access limits its exploitability compared to direct internet-facing attacks.

Analyst Recommendation

Organizations running Adobe ColdFusion must apply the provided updates immediately to remediate the Cross-site Scripting vulnerability. Prompt patching is essential to prevent potential session hijacking and code execution risks within the application environment.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the tz parameter in the setNtpCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7138

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setNtpCfg function of the /cgi-bin/cstecgi.cgi file, where the tz parameter can be used to inject and execute OS commands remotely.

Business Impact

An attacker can gain complete control over the device, threatening network security and integrity. The 9.8 CVSS score indicates an extreme level of risk.

Remediation Plan

Immediate Action: Apply the latest firmware update and disable unnecessary NTP configuration settings.

Proactive Monitoring: Monitor router logs for suspicious command execution patterns.

Compensating Controls: Restrict management access to the router via internal network only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to prevent potential exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the sambaEnabled parameter in the setStorageCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7137

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setStorageCfg function within /cgi-bin/cstecgi.cgi due to insufficient sanitization of the sambaEnabled parameter, enabling remote OS command injection.

Business Impact

The flaw grants an attacker full control over the router, which can lead to data breaches or network-wide compromise. The 9.8 CVSS score emphasizes the severity of this risk.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable Samba/storage sharing features if they are not necessary.

Proactive Monitoring: Review system logs for unexpected system-level command execution.

Compensating Controls: Use a firewall to restrict access to the device's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Urgent firmware updates are necessary to secure the device. If an update is not immediately available, disable all unnecessary features and restrict external access to the device.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the wanIdx parameter in the setDmzCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7136

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setDmzCfg function in the /cgi-bin/cstecgi.cgi file. Improper input validation on the wanIdx parameter allows for remote OS command injection.

Business Impact

The vulnerability provides an attacker with complete control over the device, facilitating unauthorized access to the network. The 9.8 CVSS score confirms the high severity and potential for large-scale impact.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable DMZ features if not strictly required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or anomalous process execution.

Compensating Controls: Block WAN-side access to the management interface using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available.

Analyst Recommendation

Immediate remediation is required. Organizations should ensure all Totolink devices are running the latest firmware to protect against this critical threat.

---METADATA---
VENDOR: Nuxt
PRODUCT: Nuxt
AFFECTED_VERSIONS: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt is susceptible to code and output injection due to improper neutralization of special elements, potentially allowing unauthorized code execution.

Executive Summary:
The Nuxt framework is affected by an injection vulnerability that could allow attackers to execute arbitrary code within the application environment.

Vulnerability Details

CVE-ID: CVE-2026-71320

Affected Software: Nuxt Nuxt

Affected Versions: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10

Vulnerability: This vulnerability involves improper neutralization of special elements used in downstream components, categorized as both code and output injection. The vulnerability does not require authentication to reach the affected components.

Business Impact

Injection vulnerabilities in web frameworks often lead to Cross-Site Scripting (XSS) or remote code execution, depending on the implementation. With a CVSS score of 8.1, this represents a high-risk scenario where an attacker could compromise the integrity of the application and the confidentiality of user data.

Remediation Plan

Immediate Action: Upgrade to Nuxt version 3.21.10 or 4.5.1 to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs for unexpected input patterns or unusual server-side errors that may indicate injection attempts.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation routines to mitigate the impact of potential injection attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous as it affects the core framework, making all downstream applications potentially susceptible.

Analyst Recommendation

Organizations utilizing the Nuxt framework should verify their current version and apply the recommended updates as soon as possible. Failure to patch may expose applications to severe injection-based attacks.

---METADATA---
VENDOR: nuxt
PRODUCT: nuxt
AFFECTED_VERSIONS: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt contains vulnerabilities related to improper handling of case sensitivity and incorrect authorization, which may lead to unauthorized access or information disclosure.

Executive Summary:
A high-severity authorization and case-sensitivity flaw in the Nuxt framework creates a risk of unauthorized data access and integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-71315

Affected Software: nuxt nuxt

Affected Versions: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10

Vulnerability: This issue combines CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). These flaws allow an unauthenticated attacker to bypass authorization checks through case-manipulated requests.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a high risk to applications built on the Nuxt framework. Successful exploitation could result in the disclosure of sensitive information or unauthorized modification of data, potentially leading to a breach of privacy or loss of application control.

Remediation Plan

Immediate Action: Update the Nuxt framework to version 3.21.10 or 4.5.1 as appropriate for your deployment.

Proactive Monitoring: Monitor server access logs for requests using inconsistent casing that may indicate attempts to bypass route-based security controls.

Compensating Controls: Ensure that server-side routing logic is configured to normalize incoming request paths before authorization checks are performed.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of authorization and case-handling flaws suggests a complex, yet highly impactful, attack vector.

Analyst Recommendation

Given the critical role of the Nuxt framework in web applications, immediate patching is required. Organizations should update to the provided fixed versions to ensure that authorization policies are correctly enforced regardless of request case formatting.

---METADATA---
VENDOR: rclone
PRODUCT: rclone
AFFECTED_VERSIONS: >= 1.40.0, < 1.75.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in rclone versions 1.40.0 through 1.74.9 allows authenticated users to read or write files outside of the intended directory via malicious path manipulation.

Executive Summary:
An authenticated path traversal vulnerability in rclone allows unauthorized file system access, requiring an immediate update to version 1.75.0 to secure file operations.

Vulnerability Details

CVE-ID: CVE-2026-71309

Affected Software: rclone rclone

Affected Versions: >= 1.40.0, < 1.75.0

Vulnerability: This vulnerability involves improper limitation of pathnames to a restricted directory (CWE-22), enabling an authenticated attacker to traverse the file system and access or modify files beyond the scope of the configured storage provider.

Business Impact

The CVSS score of 8.6 indicates a critical risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or other critical data stored on the system, potentially resulting in full system compromise.

Remediation Plan

Immediate Action: Upgrade rclone to version 1.75.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit rclone execution logs for unusual file access patterns or attempts to access system directories outside of the designated sync paths.

Compensating Controls: Enforce strict file system permissions for the user account running rclone to limit the impact if a traversal attempt occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable if input sanitization is bypassed during path resolution.

Analyst Recommendation

Given the availability of a proof-of-concept and the high severity of path traversal vulnerabilities, users must upgrade to version 1.75.0 without delay. Failure to patch leaves the underlying file system exposed to unauthorized manipulation by any authenticated user with access to the tool.

---METADATA---
VENDOR: Bolt
PRODUCT: core
AFFECTED_VERSIONS: 0 through 6.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Bolt CMS is vulnerable to a security flaw where content field values are rendered through the Twig environment without a SandboxExtension, potentially allowing unauthorized code execution.

Executive Summary:
Bolt CMS is affected by an improper rendering flaw that could allow an authenticated attacker to compromise system confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-71291

Affected Software: Bolt core

Affected Versions: 0 through 6.1

Vulnerability: The application fails to register a SandboxExtension within the Twig environment, which is classified under CWE-1336. An authenticated attacker can exploit this to perform unauthorized actions within the system.

Business Impact

The vulnerability carries a high CVSS score of 8.8, reflecting the potential for full compromise of the application environment. Successful exploitation could allow an attacker to read or modify sensitive content and potentially disrupt system availability, posing a critical risk to the platform.

Remediation Plan

Immediate Action: Review the Bolt CMS official repository for security patches and upgrade to a version beyond 6.1.

Proactive Monitoring: Monitor server logs for unusual Twig template execution patterns or unexpected changes to content fields.

Compensating Controls: Restrict administrative access to trusted personnel only to minimize the risk of exploitation by authenticated users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of sandboxing in template rendering.

Analyst Recommendation

Due to the severity of this vulnerability, administrators should prioritize updating the Bolt CMS core to a secure version. Organizations should treat this as a high-priority task to prevent potential exploitation of the template rendering mechanism.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: anms
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The NASA-AMMOS ANMS reference implementation exposes its REST API directly to the network without authentication, allowing remote attackers to send unauthorized commands to DTNMA agents.

Executive Summary:
A critical authentication bypass in NASA-AMMOS ANMS exposes the REST API to the network, enabling unauthenticated attackers to execute arbitrary commands and disrupt network management operations.

Vulnerability Details

CVE-ID: CVE-2026-71289

Affected Software: NASA-AMMOS anms and JHUAPL-DTNMA dtnma-tools

Affected Versions: All versions

Vulnerability: The system incorrectly publishes the REST API on the host network without requiring authentication, and the underlying CivetWeb server is configured with a null authentication callback for command-dispatch endpoints.

Business Impact

An attacker can enumerate managed network agents and submit arbitrary command sets, which could lead to unauthorized control over simulated or real ground nodes. This represents a significant risk to the integrity of the network management testbed and associated ground operations.

Remediation Plan

Immediate Action: Update the software to the latest version and ensure the REST API is not exposed to public network interfaces.

Proactive Monitoring: Audit network configurations for any services bound to public interfaces that should be restricted to local or trusted segments.

Compensating Controls: Deploy a firewall or reverse proxy with mandatory authentication to gate access to the REST API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The exposure of sensitive command interfaces without credentials makes the system highly susceptible to unauthorized manipulation.

Analyst Recommendation

While this software is described as a reference implementation, it is vital to secure any instances deployed in operational or testing environments. Administrators must restrict network access and verify that authentication mechanisms are correctly enabled.

---METADATA---
VENDOR: Koha
PRODUCT: Koha
AFFECTED_VERSIONS: 0 through 26.05.01-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Koha's guided report builder contains a SQL injection vulnerability that allows authenticated users to execute arbitrary database commands.

Executive Summary:
A high-severity SQL injection vulnerability in the Koha guided report builder allows authenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-71288

Affected Software: Koha Koha

Affected Versions: 0 through 26.05.01-1

Vulnerability: This vulnerability is a SQL injection (CWE-89) within the guided report builder component, which allows a user with low-level privileges to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to bypass security controls, leading to unauthorized data exfiltration, modification, or complete database destruction. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of sensitive library management data.

Remediation Plan

Immediate Action: Upgrade to a version of Koha beyond 26.05.01-1 to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review application access logs for unusual patterns in the guided reports module and monitor database query logs for suspicious syntax or unexpected execution times.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeting report parameters.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, limiting its exploitability to internal or registered users.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent database-level compromise. Administrators should prioritize updating the Koha installation to the latest patched release to neutralize this injection risk.

---METADATA---
VENDOR: Cacti
PRODUCT: cacti
AFFECTED_VERSIONS: 0 through 1.3.0-dev
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The sanitize_sql_column function in Cacti is vulnerable to SQL injection, potentially allowing an authenticated attacker to manipulate database queries.

Executive Summary:
A SQL injection vulnerability in the Cacti platform allows an authenticated attacker to execute arbitrary database queries, potentially leading to unauthorized data access or modification.

Vulnerability Details

CVE-ID: CVE-2026-71287

Affected Software: Cacti cacti

Affected Versions: 0 through 1.3.0-dev

Vulnerability: The flaw exists in the sanitize_sql_column function (CWE-89), which fails to properly neutralize SQL commands, allowing an authenticated attacker to perform SQL injection attacks.

Business Impact

Successful exploitation permits an attacker to read, modify, or delete sensitive information stored within the Cacti database. Given the CVSS score of 8.8, this vulnerability poses a high risk to data integrity and confidentiality, which could lead to severe operational disruption or loss of administrative control.

Remediation Plan

Immediate Action: Monitor the Cacti project for an official security update and apply it immediately upon release.

Proactive Monitoring: Review database query logs for suspicious patterns or unauthorized SQL syntax, specifically originating from authenticated user sessions.

Compensating Controls: Use a Web Application Firewall to filter malicious SQL injection patterns and ensure database service accounts operate with the minimum necessary permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently critical as it bypasses intended database query sanitization.

Analyst Recommendation

Administrators should treat this SQL injection vulnerability as a high priority. Until a patch is available, it is recommended to audit existing user accounts and limit access to the Cacti interface to trusted personnel only to reduce the attack surface.

---METADATA---
VENDOR: Hugging Face
PRODUCT: peft
AFFECTED_VERSIONS: 0 through 0.19.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The LoRA-GA and CorDA initialization modules in Hugging Face peft are vulnerable to deserialization of untrusted data, which may lead to arbitrary code execution.

Executive Summary:
A high-severity deserialization vulnerability in the Hugging Face peft library could allow an attacker to execute arbitrary code on systems processing malicious model initialization modules.

Vulnerability Details

CVE-ID: CVE-2026-71281

Affected Software: Hugging Face peft

Affected Versions: 0 through 0.19.1

Vulnerability: The vulnerability involves improper deserialization of untrusted data (CWE-502) within the LoRA-GA and CorDA initialization modules, which can be triggered by an unauthenticated attacker via user-assisted interaction.

Business Impact

Exploitation of this vulnerability allows for remote code execution, which could result in complete loss of control over the affected environment. With a CVSS score of 8.8, the potential for unauthorized access to sensitive machine learning models and underlying infrastructure is substantial.

Remediation Plan

Immediate Action: Check the Hugging Face peft repository for the latest security release and update the library to the patched version as soon as it becomes available.

Proactive Monitoring: Monitor applications using the peft library for abnormal execution behavior or unexpected file system modifications during the model loading phase.

Compensating Controls: Implement strict input validation for any model or configuration files loaded by the application and run processes with the least privilege necessary.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently significant because it involves the deserialization of untrusted input, a common vector for code execution.

Analyst Recommendation

Users of the Hugging Face peft library should monitor the official project repository for a security patch. Given the high severity of deserialization flaws, it is critical to restrict the processing of untrusted model files until a fix is applied.

---METADATA---
VENDOR: go-shiori
PRODUCT: shiori
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the DownloadBookmark function of go-shiori allows authenticated attackers to perform unauthorized requests.

Executive Summary:
A high-severity Server-Side Request Forgery vulnerability in the go-shiori bookmarking tool allows authenticated attackers to perform unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-71280

Affected Software: go-shiori shiori

Affected Versions: All versions from 0 and later

Vulnerability: The DownloadBookmark function fails to properly sanitize user-supplied input, leading to a Server-Side Request Forgery (SSRF) vulnerability. An attacker with low-level privileges can leverage this to force the application to interact with internal resources.

Business Impact

An SSRF vulnerability allows an attacker to bypass network access controls, potentially accessing internal services or metadata endpoints that are not exposed to the public internet. Given the CVSS score of 8.5, this vulnerability represents a high risk to organizational infrastructure, as it can be used for internal reconnaissance or to pivot into protected network segments.

Remediation Plan

Immediate Action: Review the official go-shiori repository for available security patches and apply them immediately once released.

Proactive Monitoring: Monitor outgoing network requests from the host running shiori for connections directed toward internal IP addresses or sensitive local services.

Compensating Controls: Deploy the application within a restricted network environment that enforces strict egress filtering to prevent unauthorized internal communication.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for low-level authentication, which serves as an initial barrier to entry.

Analyst Recommendation

While an immediate patch may be pending, the high impact of SSRF necessitates proactive network-level defenses. Administrators should isolate the service from sensitive internal resources and monitor for suspicious outbound traffic until a formal update is deployed.

---METADATA---
VENDOR: iot-ecology
PRODUCT: rust-iot-platform
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The rust-iot-platform software lacks authentication on a calc rule creation endpoint, allowing unauthenticated attackers to execute arbitrary JavaScript code via unsanitized input.

Executive Summary:
An unauthenticated remote code execution vulnerability in rust-iot-platform allows attackers to execute malicious JavaScript within the server process.

Vulnerability Details

CVE-ID: CVE-2026-71278

Affected Software: iot-ecology rust-iot-platform

Affected Versions: 0 and later

Vulnerability: This vulnerability is a Code Injection (CWE-94) flaw where the application fails to perform an authentication check on the POST /calc-rule/create endpoint. An unauthenticated attacker can inject arbitrary JavaScript into a calc rule that the system subsequently executes without sandboxing.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on the server carries a critical risk of full system compromise. With a CVSS score of 9.8, this flaw could lead to complete data exfiltration, unauthorized modification of IoT configurations, or total service disruption, severely impacting business operations and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest available version of rust-iot-platform immediately as provided by the vendor. If a patch is not yet available, restrict network access to the API endpoints to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /calc-rule/create endpoint. Monitor server processes for unexpected child tasks or unusual resource consumption patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the calc-rule management API.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of sandboxing during the evaluation of user-provided scripts makes this target highly susceptible to exploitation once discovered.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention due to the lack of authentication required for exploitation. Administrators must prioritize the application of vendor-supplied updates to neutralize the risk of unauthorized remote code execution.

---METADATA---
VENDOR: openshwprojects
PRODUCT: OpenBK7231T_App
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability exists in the CHANNEL_SetLabel() function of OpenBK7231T_App, which may allow for unauthorized script execution.

Executive Summary:
A high-severity cross-site scripting vulnerability in OpenBK7231T_App could allow an adjacent attacker to execute arbitrary scripts in the context of the user session.

Vulnerability Details

CVE-ID: CVE-2026-71274

Affected Software: openshwprojects OpenBK7231T_App

Affected Versions: 0 and later

Vulnerability: This is a cross-site scripting (CWE-79) vulnerability located in the CHANNEL_SetLabel() function. The vulnerability is exploitable by an unauthenticated attacker positioned on the adjacent network.

Business Impact

The exploitation of this vulnerability could lead to the compromise of sensitive user information and unauthorized actions performed on behalf of legitimate users. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the application environment.

Remediation Plan

Immediate Action: Monitor the official repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review web application logs for unusual request patterns, specifically focusing on parameters interacting with channel labels.

Compensating Controls: Implement a Web Application Firewall to filter malicious scripts and restrict access to the management interface from untrusted networks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be on the adjacent network, which limits the potential attack surface.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize the mitigation of this vulnerability. As no patch is currently identified, administrators must rely on network segmentation and strict access controls to prevent unauthorized access to the application interface until an official vendor update is provided.

---METADATA---
VENDOR: usememos
PRODUCT: memos
AFFECTED_VERSIONS: 0 through 0.29.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A race condition vulnerability exists in the Memos webhook dispatch function within the safeDialContext implementation.

Executive Summary:
Memos is susceptible to a race condition in its webhook dispatch function, which could be leveraged by an authenticated user to achieve unintended network interactions.

Vulnerability Details

CVE-ID: CVE-2026-71272

Affected Software: usememos memos

Affected Versions: 0 through 0.29.1

Vulnerability: This vulnerability is categorized as a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) located in the safeDialContext function. An authenticated attacker can manipulate the dispatch process to potentially bypass intended security checks during the connection phase.

Business Impact

The CVSS score of 8.5 highlights the severity of this flaw. By exploiting this race condition, an attacker may be able to reach internal resources that should be restricted, potentially leading to unauthorized information disclosure or interaction with internal API endpoints.

Remediation Plan

Immediate Action: Monitor the official Memos repository and apply the security update as soon as the vendor releases a patched version addressing the race condition.

Proactive Monitoring: Review application logs for unexpected or rapid webhook dispatch attempts that could indicate an exploitation effort.

Compensating Controls: Employ network-level micro-segmentation to ensure the Memos application has limited visibility into the local network environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions are inherently difficult to exploit reliably, but they remain a high-risk vector in network-facing components.

Analyst Recommendation

Due to the nature of race conditions, patching is the only definitive way to eliminate the vulnerability. Administrators should ensure that the Memos application is isolated within the network until a permanent fix is applied and verified.

---METADATA---
VENDOR: usememos
PRODUCT: memos
AFFECTED_VERSIONS: 0 through 0.29.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability exists in the Memos webhook URL validation logic, specifically within the isReservedIP function.

Executive Summary:
The Memos application contains a server-side request forgery vulnerability in its webhook validation logic that could allow an authenticated user to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-71271

Affected Software: usememos memos

Affected Versions: 0 through 0.29.1

Vulnerability: The flaw, classified as CWE-918, exists in the isReservedIP function within the webhook validation module. An authenticated attacker can exploit this to bypass IP restrictions and force the application to interact with unintended network targets.

Business Impact

With a CVSS score of 8.5, this vulnerability represents a significant risk. If exploited, an attacker could potentially interact with internal infrastructure, leading to unauthorized data access or the bypassing of perimeter security controls for internal-only services.

Remediation Plan

Immediate Action: Users should monitor the official Memos repository for a patched release and update immediately upon availability.

Proactive Monitoring: Audit webhook configuration logs for entries pointing to internal IP addresses or unusual network destinations.

Compensating Controls: Implement strict network-level egress filtering for the server hosting Memos to ensure it cannot communicate with internal-only network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the logic handling webhook validations, which requires authenticated access to trigger.

Analyst Recommendation

The reliance on webhook validation makes this a critical security concern for deployments that allow external integrations. Organizations should restrict administrative access and apply the forthcoming patch as soon as the vendor provides a remediation update.

---METADATA---
VENDOR: Stirling-Tools
PRODUCT: Stirling-PDF
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability exists in the Stirling-PDF ConvertWebsiteToPDF endpoint, allowing unauthenticated attackers to potentially access internal resources.

Executive Summary:
An unauthenticated server-side request forgery vulnerability in Stirling-PDF allows attackers to make unauthorized requests to internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-71270

Affected Software: Stirling-Tools Stirling-PDF

Affected Versions: All versions

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability in the POST /api/v1/convert/url/pdf endpoint. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a significant threat to internal network security. An attacker could leverage this flaw to probe internal infrastructure, access sensitive metadata services, or interact with non-public internal web applications, bypassing perimeter defenses.

Remediation Plan

Immediate Action: Check the Stirling-PDF repository for security updates and apply the latest version to mitigate the SSRF flaw.

Proactive Monitoring: Monitor network traffic for unexpected outbound requests originating from the server hosting Stirling-PDF, particularly requests directed toward internal IP ranges.

Compensating Controls: Restrict the application server's ability to initiate outbound network connections to internal resources using firewall rules or network segmentation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and potential to bypass network perimeters.

Analyst Recommendation

This vulnerability is highly critical due to its potential for internal network reconnaissance. Users should restrict access to the Stirling-PDF instance until a patch is applied and verify that the application cannot reach sensitive internal endpoints.

---METADATA---
VENDOR: thiagoralves
PRODUCT: OpenPLC_v3
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenPLC Runtime v3 contains a path traversal vulnerability in its compile_program function, allowing remote authenticated users to write arbitrary files to the filesystem.

Executive Summary:
A critical path traversal vulnerability in OpenPLC Runtime v3 allows authenticated attackers to achieve remote code execution by overwriting arbitrary system files.

Vulnerability Details

CVE-ID: CVE-2026-71268

Affected Software: thiagoralves OpenPLC_v3

Affected Versions: 0 and later

Vulnerability: The application fails to validate the file path during the processing of uploaded Structured Text files, enabling a path traversal flaw (CWE-22) that permits arbitrary file writes. The vulnerability is accessible to authenticated users, though the presence of hardcoded default credentials significantly lowers the barrier to entry.

Business Impact

Successful exploitation grants an attacker the ability to overwrite sensitive system configuration files or inject malicious code into startup scripts. Given the CVSS score of 9.9, this vulnerability poses a catastrophic risk to system integrity and availability, potentially leading to a complete compromise of the underlying host and any connected industrial control systems.

Remediation Plan

Immediate Action: Upgrade to the latest version of OpenPLC v3 immediately to incorporate path validation logic into the compile_program function.

Proactive Monitoring: Review access logs for unusual file upload activity or attempts to access system directories such as /etc/ or /home/.

Compensating Controls: Change the default credentials (openplc:openplc) immediately and restrict network access to the OpenPLC web interface to trusted management subnets.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the combination of insecure file handling and weak default authentication.

Analyst Recommendation

This is a critical vulnerability that requires immediate remediation. Administrators must prioritize updating the software and enforcing strong, unique credentials to prevent unauthorized access and potential remote code execution.

---METADATA---
VENDOR: rxi
PRODUCT: microtar
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack buffer overflow exists in rxi microtar due to improper boundary checks when copying filenames into the header structure.

Executive Summary:
A critical stack buffer overflow in the rxi microtar library allows for potential remote code execution when processing maliciously crafted filenames.

Vulnerability Details

CVE-ID: CVE-2026-71267

Affected Software: rxi microtar

Affected Versions: 0 and later

Vulnerability: The functions mtar_write_file_header and mtar_write_dir_header perform a strcpy operation into a fixed-size 100-byte stack buffer without verifying the input length. This allows an attacker to supply a filename exceeding 99 characters, triggering an overflow that can be exploited by unauthenticated remote attackers.

Business Impact

Successful exploitation of this buffer overflow could lead to arbitrary code execution, allowing an attacker to gain control over the host process. Given the 9.8 CVSS score, this represents a major threat to system integrity and availability, particularly for applications that handle untrusted archives or user-provided filenames.

Remediation Plan

Immediate Action: Review applications utilizing the microtar library to ensure all input filenames are strictly validated for length before being passed to library functions.

Proactive Monitoring: Monitor for application crashes or segmentation faults that may indicate an attempt to exploit memory corruption vulnerabilities.

Compensating Controls: Compile the application with modern memory safety protections, such as stack canaries and Address Space Layout Randomization (ASLR), to increase the difficulty of successful exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the library's design and requires developers to implement input validation at the call site.

Analyst Recommendation

Developers should immediately audit their use of the microtar library and implement mandatory length checks for all filenames. Until a formal library update is available, manual input sanitization is the most effective way to mitigate this critical risk.

---METADATA---
VENDOR: Aircoookie
PRODUCT: WLED
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The WLED project contains a broken access control vulnerability in the GET /json/cfg endpoint that allows unauthenticated modification of configuration settings.

Executive Summary:
An unauthenticated broken access control flaw in the WLED configuration endpoint exposes the device to unauthorized settings modification.

Vulnerability Details

CVE-ID: CVE-2026-71264

Affected Software: Aircoookie WLED

Affected Versions: 0 and later

Vulnerability: This vulnerability (CWE-862) exists within the /json/cfg endpoint. It permits an unauthenticated attacker to perform unauthorized configuration changes, which could lead to full control over the device settings.

Business Impact

The CVSS score of 8.2 highlights a high risk of unauthorized configuration manipulation. In an industrial or commercial lighting environment, this could lead to service disruption, device bricking, or the use of compromised devices as a pivot point within the internal network.

Remediation Plan

Immediate Action: Review the official WLED project repository for security guidance and apply any available firmware updates. If no update is available, restrict access to the WLED interface to trusted network segments only.

Proactive Monitoring: Monitor network traffic to the WLED device for unauthorized access to the /json/cfg endpoint.

Compensating Controls: Place the device on an isolated VLAN with no direct access from the public internet or untrusted internal segments.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The accessibility of the configuration endpoint without authentication makes this a significant risk for exposed IoT devices.

Analyst Recommendation

Users of WLED should prioritize network-level isolation for these devices until a formal patch is applied. The lack of authentication on the configuration endpoint is a severe security oversight that must be mitigated by restricting network exposure as a primary defense.

---METADATA---
VENDOR: IoTSharp
PRODUCT: IoTSharp
AFFECTED_VERSIONS: All versions prior to the patched version
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
IoTSharp fails to enforce authorization on its BlobStorageController, allowing unauthenticated remote attackers to perform arbitrary file operations via path traversal.

Executive Summary:
A critical authentication bypass and path traversal vulnerability in IoTSharp is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-71262

Affected Software: IoTSharp IoTSharp

Affected Versions: All versions prior to the patched version

Vulnerability: The application fails to apply authorization requirements to the BlobStorageController, permitting unauthenticated attackers to access sensitive endpoints. Furthermore, improper input sanitization on file paths allows for arbitrary file system access, including the potential for remote code execution via web shell upload.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation allows unauthorized actors to read, modify, or delete sensitive data, and potentially gain full control over the host system. Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, the urgency for remediation is extreme to prevent data breaches or total system compromise.

Remediation Plan

Immediate Action: Update to the latest version of IoTSharp as soon as it is made available by the vendor to implement mandatory authorization checks and path sanitization.

Proactive Monitoring: Review application and web server access logs for requests targeting the BlobStorageController or unusual file path patterns that suggest directory traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences (such as double dots and slashes) and restrict access to the BlobStorageController endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 4, 2026. The combination of missing authentication and path traversal makes this an highly attractive target for threat actors.

Analyst Recommendation

Due to confirmed active exploitation in the wild, organizations must prioritize this vulnerability immediately. Apply the latest available vendor security updates and monitor network traffic for signs of compromise until patching is complete.

---METADATA---
VENDOR: ESPHome
PRODUCT: esphome
AFFECTED_VERSIONS: 0 through 2026.7.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
ESPHome through 2026.7.0 contains a vulnerability related to incomplete validation of data, which may allow for significant system impact.

Executive Summary:
ESPHome versions up to 2026.7.0 are affected by an input validation vulnerability that could result in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-71259

Affected Software: ESPHome esphome

Affected Versions: 0 through 2026.7.0

Vulnerability: This vulnerability involves a flaw in configuration validation (CWE-184). The attack vector is local, requiring user interaction to trigger, but could lead to high confidentiality, integrity, and availability impacts.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a high risk to organizational security. Successful exploitation could lead to unauthorized control over the affected ESPHome environment, potentially allowing attackers to manipulate device configurations or gain unauthorized access to the underlying system.

Remediation Plan

Immediate Action: Monitor the official ESPHome GitHub repository for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Review system configuration logs for unexpected validation errors or unauthorized modifications to device settings.

Compensating Controls: Ensure devices running ESPHome are isolated within restricted network segments to limit the potential impact of a local exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Given the high CVSS score and the potential for total impact, administrators should prioritize this issue. Closely track vendor communications regarding the patch, and ensure that all affected instances are updated once a fix is released.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: 0 through 1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
nanoMODBUS contains an out-of-bounds stack read and wild-pointer write vulnerability in its Modbus identification response handling, which can be triggered by a malicious server.

Executive Summary:
A critical memory corruption vulnerability in the nanoMODBUS library allows for potential arbitrary code execution via a malicious server response.

Vulnerability Details

CVE-ID: CVE-2026-71256

Affected Software: debevv nanoMODBUS

Affected Versions: 0 through 1.23.0

Vulnerability: The library fails to perform bounds checking on the object_id field when processing Modbus Device Identification responses (CWE-125). An unauthenticated remote attacker can provide a crafted response that causes an out-of-bounds read, leading to an arbitrary-address write with controlled data.

Business Impact

The ability to perform arbitrary-address writes typically results in remote code execution or complete application crashes. With a CVSS score of 9.8, this vulnerability poses a severe threat to the availability and integrity of any system integrating the nanoMODBUS library.

Remediation Plan

Immediate Action: Monitor the official debevv nanoMODBUS GitHub repository for the release of a patched version. If a patch is not yet available, evaluate the feasibility of disabling Modbus identification features in affected deployments.

Proactive Monitoring: Monitor network traffic for anomalous Modbus protocol traffic patterns or unexpected device identification responses.

Compensating Controls: Deploy network-based intrusion detection systems to inspect Modbus traffic and filter out malformed or suspicious identification response packets.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw makes it highly exploitable for memory corruption attacks.

Analyst Recommendation

This vulnerability is critical due to the potential for memory corruption and code execution. Organizations should track the project repository for updates and move to version 1.23.1 or later as soon as it becomes available.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: 0 through 1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in nanoMODBUS versions up to 1.23.0, potentially allowing for arbitrary code execution or denial of service.

Executive Summary:
The nanoMODBUS library contains a buffer overflow vulnerability that poses a high risk of service disruption or unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-71255

Affected Software: debevv nanoMODBUS

Affected Versions: 0 through 1.23.0

Vulnerability: This is a buffer overflow vulnerability (CWE-787) that occurs due to improper bounds checking. It is remotely exploitable and does not require authentication or user interaction.

Business Impact

The CVSS score of 8.6 reflects the significant risk posed by this vulnerability. Exploitation can lead to service crashes or the compromise of data integrity, which may disrupt critical industrial or automation processes reliant on the nanoMODBUS library.

Remediation Plan

Immediate Action: Check for available vendor updates and apply the latest version of nanoMODBUS immediately upon release.

Proactive Monitoring: Monitor network traffic for malformed MODBUS packets or unexpected spikes in CPU usage that may indicate a crash or exploitation attempt.

Compensating Controls: Deploy network-level intrusion detection systems to identify and block traffic patterns indicative of buffer overflow attempts against MODBUS services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing nanoMODBUS should evaluate their exposure and prepare for an urgent update once the vendor provides a patched release.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: nanoMODBUS through v1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in nanoMODBUS allows unauthenticated attackers to corrupt memory and potentially achieve remote code execution via a malformed Modbus request.

Executive Summary:
A critical out-of-bounds write vulnerability in nanoMODBUS is confirmed to be under active exploitation in the wild.

Vulnerability Details

CVE-ID: CVE-2026-71254

Affected Software: debevv nanoMODBUS

Affected Versions: nanoMODBUS through v1.23.0

Vulnerability: The Modbus server-side function handle_read_file_record fails to validate the cumulative response size of sub-requests, leading to an integer overflow in the accumulator. This allows unauthenticated network clients to trigger an out-of-bounds write, corrupting memory beyond the designated buffer.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe risk to operational technology and embedded systems. Exploitation can lead to a complete denial of service or remote code execution, which may result in the loss of control over industrial processes or critical infrastructure. Inclusion in the CISA KEV catalog necessitates immediate administrative attention.

Remediation Plan

Immediate Action: Update to the latest version of nanoMODBUS to ensure proper bounds checking on cumulative response sizes is enforced.

Proactive Monitoring: Monitor network traffic for malformed Modbus packets or unexpected server crashes which may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation and firewall rules to limit access to Modbus services to authorized, trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 5, 2026. The lack of memory protection on many embedded targets makes this vulnerability particularly dangerous.

Analyst Recommendation

Given the active exploitation and the critical nature of the flaw, IT and OT teams should treat this as a top-priority item. Ensure all deployments of nanoMODBUS are updated and verify that network-level access controls are strictly enforced.

---METADATA---
VENDOR: raghav993
PRODUCT: toner-management
AFFECTED_VERSIONS: All versions
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The toner-management application contains missing authorization checks in its administrative state-changing handlers, allowing unauthorized users to modify system states.

Executive Summary:
A missing authorization vulnerability in the toner-management application allows unauthenticated attackers to perform administrative state changes, creating a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-71252

Affected Software: raghav993 toner-management

Affected Versions: All versions

Vulnerability: This vulnerability (CWE-862) involves the absence of necessary authorization checks for administrative functions. An unauthenticated attacker can interact with state-changing handlers, potentially leading to unauthorized system modifications.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant threat to the operational integrity of the toner-management system. An attacker could alter configurations or system states without authentication, potentially leading to unauthorized control, service disruption, or data manipulation that could impact business operations.

Remediation Plan

Immediate Action: Review the project repository for available security patches or configuration changes, and restrict network access to the administrative interfaces of the application.

Proactive Monitoring: Monitor server access logs for requests directed at administrative endpoints originating from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access attempts to administrative URLs and state-changing API endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Due to the lack of authentication requirements for critical administrative functions, this vulnerability should be addressed with high urgency. If an official patch is not yet available, organizations should move the application to a restricted network segment inaccessible to untrusted users.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the merge parameter in the setWiFiEasyCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7125

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. The merge parameter is inadequately sanitized, allowing remote command injection by an unauthenticated attacker.

Business Impact

The device is subject to total compromise, which poses a significant threat to internal network security. The 9.8 CVSS score justifies treating this as a high-priority security issue.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the Wi-Fi Easy Configuration feature if possible.

Proactive Monitoring: Review router logs for any suspicious system-level commands being executed.

Compensating Controls: Restrict management interface access to local or trusted administrative subnets only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

All affected users should immediately update their firmware. If a patch is unavailable, the device must be isolated from the WAN to prevent remote exploitation.

---METADATA---
VENDOR: Adaltas
PRODUCT: backmeup
AFFECTED_VERSIONS: 0 through 0.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The backmeup npm package is vulnerable to OS command injection due to insecure concatenation of input parameters when constructing shell commands.

Executive Summary:
A high severity OS command injection vulnerability in the Adaltas backmeup package allows authenticated users to execute arbitrary commands on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-71243

Affected Software: Adaltas backmeup

Affected Versions: 0 through 0.0.2

Vulnerability: This vulnerability involves CWE-78: OS Command Injection. The software fails to sanitize input options such as name, source, destination, and filter before including them in shell command strings, allowing an authenticated user with low privileges to inject and execute arbitrary system commands.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting the high risk posed by successful exploitation. An attacker successfully leveraging this flaw could gain full control over the host system, leading to unauthorized data exfiltration, modification of critical system files, or complete service disruption.

Remediation Plan

Immediate Action: Currently, there is no vendor-supplied patch available. Users should evaluate the necessity of the backmeup package and consider removing or disabling it until a secure version is released.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or unexpected shell commands originating from the service user account.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to inspect and block malicious payloads containing shell metacharacters in request parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the direct concatenation of user-controlled input into system-level commands.

Analyst Recommendation

Given the high CVSS score and the nature of command injection, this vulnerability poses a severe threat to system integrity. Organizations using the backmeup package are advised to restrict access to the application and monitor for signs of unauthorized activity while awaiting an official security update.

---METADATA---
VENDOR: crater-invoice
PRODUCT: crater
AFFECTED_VERSIONS: 6.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Crater fails to verify company ownership when accessing notes, allowing authenticated users to bypass authorization checks and view or manage notes belonging to other companies.

Executive Summary:
An authorization bypass vulnerability in Crater version 6.0.6 allows authenticated users to access unauthorized data, posing a significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-71242

Affected Software: crater-invoice crater

Affected Versions: 6.0.6

Vulnerability: This is an authorization bypass vulnerability (CWE-639) where the application relies on blanket permission checks rather than validating that the requesting user owns the specific data record. The flaw is accessible to authenticated users with low privileges.

Business Impact

Successful exploitation permits unauthorized access to sensitive financial notes and records across different company accounts. With a CVSS score of 8.2, this high-severity flaw could lead to significant data breaches, regulatory non-compliance, and loss of client trust by allowing lateral movement between isolated business entities within the platform.

Remediation Plan

Immediate Action: Update the Crater installation to the latest patched version provided by the vendor.

Proactive Monitoring: Review system access logs for unusual patterns, specifically looking for users accessing note records outside of their assigned company context.

Compensating Controls: Implement strict database-level row security or application-layer middleware to enforce company-ownership checks until the official patch is deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user due to the missing ownership comparison logic.

Analyst Recommendation

Given the high CVSS score and the direct impact on data isolation, organizations should prioritize patching this vulnerability. Administrators must verify that their environment is updated to a version beyond 6.0.6 to ensure that company-ownership validation is correctly enforced.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the addrPrefixLen parameter in the setIpv6LanCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7124

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setIpv6LanCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can supply a malicious addrPrefixLen parameter to trigger OS command injection.

Business Impact

This flaw permits total device takeover, which can lead to severe security breaches, including data exfiltration and denial of service. The 9.8 CVSS score reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the vendor-supplied firmware update and disable IPv6 if it is not currently in use.

Proactive Monitoring: Monitor router logs for anomalous execution attempts or unexpected configuration changes.

Compensating Controls: Use a firewall to block access to the management interface from the WAN side.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to mitigate this critical risk.

---METADATA---
VENDOR: absmach
PRODUCT: magistrala
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Magistrala Rules Engine allows authenticated users to execute arbitrary Go or Lua scripts server-side, leading to code injection.

Executive Summary:
A critical code injection vulnerability in the Magistrala Rules Engine allows authenticated attackers to execute arbitrary scripts on the server.

Vulnerability Details

CVE-ID: CVE-2026-71235

Affected Software: absmach magistrala

Affected Versions: 0

Vulnerability: This vulnerability (CWE-94) occurs because the Rules Engine allows authenticated users to embed and execute Go or Lua scripts server-side, which can be leveraged to gain unauthorized system control.

Business Impact

An attacker successfully exploiting this vulnerability gains the ability to execute arbitrary code with the privileges of the Magistrala service, potentially resulting in full system compromise. The CVSS score of 8.8 reflects the high impact on system integrity and the potential for lateral movement within an IoT infrastructure.

Remediation Plan

Immediate Action: Review vendor advisories for available security patches or configuration changes that restrict script execution capabilities within the Rules Engine.

Proactive Monitoring: Audit all user-created rules and monitor server processes for anomalous script execution or unauthorized outbound network traffic originating from the engine.

Compensating Controls: Restrict access to the Rules Engine creation interface to only highly trusted administrators and isolate the Magistrala instance within a segmented network zone.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access necessitates robust identity management to prevent exploitation.

Analyst Recommendation

This vulnerability is highly dangerous due to the nature of server-side code execution. Organizations should immediately review their usage of the Magistrala Rules Engine and apply updates as soon as the vendor provides a formal patch.

---METADATA---
VENDOR: InvoiceNinja
PRODUCT: InvoiceNinja
AFFECTED_VERSIONS: 5.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
InvoiceNinja v5.0.0 is susceptible to Stored Cross-site Scripting (XSS) due to the unsafe rendering of the terms field in the client portal via the Laravel Blade raw output directive.

Executive Summary:
InvoiceNinja v5.0.0 contains a Cross-site Scripting vulnerability that allows authenticated users to execute arbitrary scripts in the client portal, posing a significant risk to user session security.

Vulnerability Details

CVE-ID: CVE-2026-71233

Affected Software: InvoiceNinja InvoiceNinja

Affected Versions: 5.0.0

Vulnerability: The application uses the Laravel Blade {!! !!} directive to render the terms field, which fails to sanitize input, allowing an authenticated user with sufficient privileges to inject malicious scripts that execute in the context of other users.

Business Impact

With a CVSS score of 8.7, this XSS flaw facilitates session hijacking, unauthorized account actions, and potential data theft from the client portal. Such compromises can lead to severe reputational damage and the loss of sensitive financial or client data.

Remediation Plan

Immediate Action: Review vendor documentation for the latest stable release and apply all available security updates to address the improper rendering of user input.

Proactive Monitoring: Inspect web application logs for suspicious script injection patterns in invoice or quote templates and monitor for unauthorized portal access attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with robust XSS filtering rules to detect and block malicious payloads submitted via the invoice terms field.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which limits the attack surface to existing users or compromised accounts.

Analyst Recommendation

Security teams should treat this XSS vulnerability as a priority, particularly for public-facing portals. Immediate remediation through software updates is essential to prevent session-based attacks that could lead to unauthorized data access or platform manipulation.

---METADATA---
VENDOR: thebradleysanders
PRODUCT: IOTSmartHome
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The IOTSmartHome platform is vulnerable to SQL injection via the lastLogin cookie, allowing unauthenticated attackers to bypass authentication and extract sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in IOTSmartHome allows unauthenticated attackers to bypass authentication and exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-71231

Affected Software: thebradleysanders IOTSmartHome

Affected Versions: 0

Vulnerability: This is an SQL Injection (CWE-89) vulnerability located in the checkCookie function within gui/login.php. The application fails to sanitize the decoded contents of the lastLogin cookie before concatenating it into a database query, enabling attackers to inject malicious SQL commands.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, granting them unauthorized access to the application. Furthermore, the use of UNION-based injection allows for the extraction of sensitive information, including user credentials, which could lead to widespread account compromise and a severe breach of confidentiality.

Remediation Plan

Immediate Action: Update IOTSmartHome to the latest version immediately to receive the necessary input sanitization fixes. If an update is unavailable, disable the affected login functionality or restrict access to the web interface.

Proactive Monitoring: Monitor database logs for suspicious query patterns, such as unexpected UNION statements or syntax errors indicative of injection attempts. Review authentication logs for unusual login activity.

Compensating Controls: Utilize a WAF to inspect and block incoming HTTP requests containing suspicious base64-encoded payloads in the lastLogin cookie.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the predictable nature of the cookie-based authentication flow.

Analyst Recommendation

Given the critical severity and the ease of exploitation, immediate remediation is required. Ensure that all database interactions are parameterized and that input validation is strictly enforced to prevent further injection risks.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability in the Totolink A8000RU CGI handler occurs via the setIptvCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7123

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability affects the setIptvCfg function in the /cgi-bin/cstecgi.cgi file, where improper handling of the setIptvCfg argument allows for remote OS command injection.

Business Impact

This vulnerability allows an attacker to gain full control of the network device. The CVSS score of 9.8 indicates that this is a critical risk, potentially allowing an attacker to reroute traffic or disable security controls.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the IPTV configuration feature if not strictly required.

Proactive Monitoring: Monitor for unusual traffic patterns and unauthorized configuration changes on the router.

Compensating Controls: Implement strict network access control lists (ACLs) to prevent unauthorized access to the router's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this vulnerability highly accessible to malicious actors.

Analyst Recommendation

The severity and exploitability of this vulnerability demand immediate attention. Users should update their firmware to the latest available version and apply recommended network hardening techniques immediately.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the enable parameter in the setUPnPCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7122

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi file. Lack of input sanitization on the enable argument permits remote OS command injection by an unauthenticated user.

Business Impact

The flaw provides an attacker with the ability to execute commands with high privileges on the device. Given the 9.8 CVSS score, this represents a major threat to network integrity, allowing for potential man-in-the-middle attacks or total network traffic interception.

Remediation Plan

Immediate Action: Disable UPnP and remote management features immediately, and apply available firmware updates.

Proactive Monitoring: Review system logs for suspicious process execution or unexpected configuration changes.

Compensating Controls: Use a firewall to block external access to the device's web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability. Urgent remediation is recommended.

Analyst Recommendation

Organizations utilizing the Totolink A8000RU must treat this as a critical security incident. The presence of public exploits necessitates immediate isolation of the device from untrusted networks until a secure firmware version can be deployed.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: plandev (sequencing-server)
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The NASA-AMMOS plandev sequencing-server contains an authentication bypass flaw in the session role derivation middleware, allowing unauthenticated attackers to perform unauthorized administrative actions.

Executive Summary:
A critical authentication bypass in the NASA-AMMOS plandev sequencing-server allows unauthenticated attackers to inject arbitrary expansion rules and modify command dictionaries.

Vulnerability Details

CVE-ID: CVE-2026-71214

Affected Software: NASA-AMMOS plandev (sequencing-server)

Affected Versions: 0

Vulnerability: The application incorrectly trusts client-supplied JSON request bodies to derive authorization roles, bypassing the intended JWT-based authentication. This allows unauthenticated users to impersonate administrative roles and perform unauthorized writes to command expansion rules and dictionaries.

Business Impact

This vulnerability carries a CVSS score of 9.8 and allows for the manipulation of sequencing rules that govern spacecraft activities. Unauthorized modification of these rules or command dictionaries could result in significant operational disruption, data integrity loss, and potential safety risks to associated hardware operations.

Remediation Plan

Immediate Action: Update the sequencing-server component to the latest version provided by NASA-AMMOS. Review the vendor security advisory to verify if specific configuration changes are required in addition to the software update.

Proactive Monitoring: Review application access logs for requests to /command-expansion/put-expansion or /put-dictionary that lack valid Authorization headers or show anomalous session_variables.

Compensating Controls: Implement strict network-level access controls to ensure only known, authorized clients can reach the sequencing-server endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it permits unauthorized modification of critical system logic without requiring authentication.

Analyst Recommendation

Given the critical nature of the sequencing-server and the risk posed by arbitrary command expansion, immediate patching is required. Organizations should treat this as a high-priority remediation to ensure the integrity of sequencing operations.