---METADATA---
VENDOR: CalcProgrammer1
PRODUCT: OpenRGB
AFFECTED_VERSIONS: 0 through 1.0rc3
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1274022","name":null,"tags":["issue-tracking"]},{"url":"https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66","name":null,"tags":["patch"]}]
---END_METADATA---

Description Summary:
The OpenRGB network protocol is vulnerable to memory exhaustion and out-of-bounds memory access due to improper validation of inconsistent input data.

Executive Summary:
A high-severity vulnerability in the OpenRGB network protocol allows unauthenticated remote attackers to trigger memory exhaustion or out-of-bounds memory operations, potentially leading to denial of service.

Vulnerability Details

CVE-ID: CVE-2026-18794

Affected Software: CalcProgrammer1 OpenRGB

Affected Versions: 0 through 1.0rc3

Vulnerability: This flaw is classified as improper validation of consistency within input (CWE-1288). An unauthenticated attacker can send crafted network packets to the OpenRGB protocol, causing the application to perform out-of-bounds memory reads and writes, or forcing memory exhaustion.

Business Impact

The vulnerability carries a CVSS score of 8.2, which reflects the high potential for service disruption. Successful exploitation could lead to system crashes or unstable application behavior, resulting in operational downtime for users relying on OpenRGB for device lighting control.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict network access to the OpenRGB service to trusted internal interfaces only. Monitor the vendor's repository for the release of an official security update.

Proactive Monitoring: Review application logs for unexpected service crashes or anomalous network traffic patterns directed at the OpenRGB port.

Compensating Controls: Implement firewall rules to ensure the OpenRGB network protocol is not exposed to the public internet or untrusted network segments.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as a memory-based vulnerability makes it a potential target for stability-focused attacks if the protocol is exposed.

Analyst Recommendation

Given the high CVSS score and the potential for service instability, it is imperative that organizations treat this as a significant risk to system availability. Until a formal patch is available, network isolation of the affected service remains the most effective mitigation strategy to prevent remote exploitation.

---METADATA---
VENDOR: GL.iNet
PRODUCT: AX1800
AFFECTED_VERSIONS: 4.8.0, 4.8.1, 4.8.2, 4.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in GL.iNet AX1800 allows authenticated users with low privileges to execute arbitrary system commands, potentially leading to full system compromise.

Executive Summary:
A command injection vulnerability in GL.iNet AX1800 devices poses a significant risk of remote code execution for authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-18787

Affected Software: GL.iNet AX1800

Affected Versions: 4.8.0, 4.8.1, 4.8.2, 4.8.3

Vulnerability: The device suffers from a command injection flaw (CWE-77). An attacker with low-level authenticated access can manipulate input parameters to execute arbitrary OS commands on the underlying system.

Business Impact

The ability to execute arbitrary commands on a network device can result in complete system takeover, unauthorized access to internal network segments, and potential data interception. Given the CVSS score of 8.8, this vulnerability is categorized as high severity, as it allows an attacker to pivot from the management interface to the broader infrastructure.

Remediation Plan

Immediate Action: Update the GL.iNet AX1800 firmware to a version beyond 4.8.3 as soon as the vendor provides a patch.

Proactive Monitoring: Monitor device logs for unusual command execution patterns or unexpected shell access attempts by low-privileged user accounts.

Compensating Controls: Restrict administrative and low-level access to the device management interface by placing it on a dedicated management VLAN or using firewall rules to limit access to trusted IP addresses.

Exploitation Status

Public Exploit Available: No (no confirmed public weaponized exploit exists in the provided data).

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public GitHub repository discussing this flaw increases the likelihood of exploit development.

Analyst Recommendation

The high CVSS score and the existence of a proof-of-concept mandate immediate attention. Organizations should prioritize updating affected hardware and restricting network access to the management interface to prevent unauthorized exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: CheckView
AFFECTED_VERSIONS: 2.0.29 up to (excluding) 2.3.2
CONFIDENCE: high
MISSING: none
CREDITS: Usama Arshad (finder); WPScan (coordinator)
SOURCES_JSON: [{"url":"https://wpscan.com/vulnerability/f53e1706-e926-4a2c-a2a7-465b4ca5d102/","name":null,"tags":["exploit","vdb-entry","technical-description"]}]
---END_METADATA---

Description Summary:
The CheckView WordPress plugin fails to properly validate REST API authentication, allowing unauthenticated attackers to bypass nonce checks and perform administrative actions via cross-site request forgery.

Executive Summary:
A critical authentication bypass vulnerability in the CheckView WordPress plugin allows unauthenticated attackers to perform administrative actions via malicious links.

Vulnerability Details

CVE-ID: CVE-2026-18786

Affected Software: WordPress CheckView

Affected Versions: 2.0.29 up to (excluding) 2.3.2

Vulnerability: The plugin improperly implements a REST API authentication filter that fails to isolate its scope, allowing attackers to discard authentication errors and execute REST actions as an administrator. This flaw is triggered when an administrator is enticed to click a crafted link, which effectively bypasses intended security controls.

Business Impact

The ability for an attacker to perform administrative actions, such as creating new administrator accounts, poses a catastrophic risk to the integrity and availability of the affected WordPress site. Given the CVSS score of 8.8, this vulnerability is categorized as high severity because it enables full account takeover or site compromise, which may lead to complete data exfiltration, total loss of site control, and significant reputational damage.

Remediation Plan

Immediate Action: Update the CheckView plugin to version 2.3.2 or higher immediately to resolve the authentication filter flaw.

Proactive Monitoring: Audit the WordPress user database for newly created administrative accounts or suspicious modifications to plugin settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block suspicious REST API requests and implement strict administrative access policies to prevent unauthorized interaction with sensitive endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to escalate privileges through client-side interaction.

Analyst Recommendation

This vulnerability represents a high-risk security gap that could lead to the complete compromise of the WordPress environment. Administrators must prioritize updating the CheckView plugin to version 2.3.2 or later to ensure the REST API authentication logic is correctly constrained. Failure to patch this vulnerability leaves the platform susceptible to unauthorized administrative actions and potential site takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: Drag and Drop Multiple File Upload for Contact Form 7
AFFECTED_VERSIONS: 0 up to 1.3.9.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin is vulnerable to code injection, which may allow unauthenticated attackers to execute arbitrary code on the server.

Executive Summary:
The Drag and Drop Multiple File Upload for Contact Form 7 plugin contains a critical code injection vulnerability that could result in full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-18781

Affected Software: WordPress Drag and Drop Multiple File Upload for Contact Form 7

Affected Versions: 0 up to (excluding) 1.3.9.9

Vulnerability: This is a code injection vulnerability (CWE-94) that can be triggered without authentication. By manipulating input parameters, an attacker may be able to force the application to execute unintended code.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting the ability for an attacker to achieve total impact on confidentiality, integrity, and availability. Successful exploitation typically leads to full site takeover, potential malware distribution, or unauthorized access to the underlying server environment.

Remediation Plan

Immediate Action: Update the plugin to version 1.3.9.9 or later immediately. If an update is not available for your specific environment, deactivate the plugin to neutralize the risk.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or unusual POST requests directed at plugin-specific endpoints.

Compensating Controls: Implement file integrity monitoring and ensure the web server user has restricted permissions to prevent arbitrary code execution from escalating to system-level access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of code injection vulnerabilities makes this a high-priority target for automated scanning and exploitation.

Analyst Recommendation

Given the severity of code injection, immediate patching is required. Organizations should treat this as an urgent remediation task to ensure the security of their WordPress infrastructure and hosted data.

---METADATA---
VENDOR: Teracity Software Technologies
PRODUCT: E-OSB
AFFECTED_VERSIONS: 0 up to (excluding) V02.26.07.08.01
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:03:14.838Z
CREDITS: Mehmet Abdullah Adbay (finder)
SOURCES_JSON: [{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0962","name":null,"tags":["government-resource"]}]
---END_METADATA---

Description Summary:
Teracity Software Technologies E-OSB is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands, potentially allowing unauthorized database access.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Teracity Software Technologies E-OSB poses a critical risk of full database compromise.

Vulnerability Details

CVE-ID: CVE-2026-18765

Affected Software: Teracity Software Technologies E-OSB

Affected Versions: 0 up to (excluding) V02.26.07.08.01

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) arising from the failure to sanitize user-supplied input before processing it in database queries. Because the attack vector is network-based with no authentication required, an unauthenticated attacker can execute arbitrary SQL commands against the backend database.

Business Impact

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows for unauthorized data exfiltration, modification, or deletion. Successful exploitation could lead to total compromise of the application data, potential lateral movement within the network, and significant regulatory or reputational damage resulting from a data breach.

Remediation Plan

Immediate Action: Update Teracity Software Technologies E-OSB to version V02.26.07.08.01 or later to remediate the underlying code vulnerability.

Proactive Monitoring: Monitor database query logs for anomalous syntax, such as unexpected use of union statements or comment characters, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious payloads targeting the application until the software update can be applied.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains a highly dangerous and easily automated attack vector, making the absence of public exploits no reason to delay patching.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability and the lack of authentication required for exploitation, administrators should prioritize immediate patching. Ensure that the E-OSB environment is updated to the fixed version without delay to prevent unauthorized access and potential data loss.

---METADATA---
VENDOR: ASUSTOR
PRODUCT: ABP and AES
AFFECTED_VERSIONS: ABP 2.0 through 2.0.7.10171, AES 1.0 through 1.1.1.3113
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
ASUSTOR ABP and AES services utilize a vulnerable inter-process communication mechanism that allows local privilege escalation to NT AUTHORITY\SYSTEM.

Executive Summary:
ASUSTOR ABP and AES background services are susceptible to improper authentication and privilege management, enabling a local attacker to escalate privileges to NT AUTHORITY\SYSTEM.

Vulnerability Details

CVE-ID: CVE-2026-18759

Affected Software: ASUSTOR ABP and AES

Affected Versions: ABP 2.0 through 2.0.7.10171; AES 1.0 through 1.1.1.3113

Vulnerability: The background services run with SYSTEM privileges and use a file-based inter-process communication mechanism that lacks proper authentication and privilege management (CWE-287, CWE-269), allowing a local user to interact with the service maliciously.

Business Impact

An attacker who has already gained low-level access to the system can leverage this vulnerability to achieve full administrative control over the host. This represents a critical risk to system integrity and confidentiality, justifying the high CVSS score of 8.5.

Remediation Plan

Immediate Action: Review the official ASUSTOR security advisory and apply the provided updates or configuration changes as soon as they become available.

Proactive Monitoring: Monitor for unexpected file modifications in the directories used for IPC and watch for processes spawning from the background services with elevated privileges.

Compensating Controls: Ensure the principle of least privilege is strictly enforced for all local user accounts to prevent initial access that could be used to trigger this flaw.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high-privilege context of the vulnerable services.

Analyst Recommendation

This vulnerability presents a severe risk of local privilege escalation. Security teams must monitor the ASUSTOR security portal for patch releases and apply them to all affected installations of ABP and AES to prevent total system compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-AS1620 (GV-Cloud)
AFFECTED_VERSIONS: V1.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The GeoVision GV-AS1620 GV-Cloud firmware contains a hard-coded RSA private key, which allows attackers to decrypt HTTPS traffic and spoof the server.

Executive Summary:
A critical security flaw in GeoVision GV-AS1620 GV-Cloud firmware exposes a static RSA private key, facilitating traffic decryption and server impersonation.

Vulnerability Details

CVE-ID: CVE-2026-18754

Affected Software: GeoVision GV-AS1620 (GV-Cloud)

Affected Versions: V1.16

Vulnerability: The firmware utilizes an embedded, static RSA private key for Lighttpd web server TLS termination (CWE-321). This allows unauthenticated attackers to intercept and decrypt encrypted communications or perform man-in-the-middle attacks to spoof the server.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the confidentiality and integrity of management communications. Compromise of the private key enables attackers to capture sensitive credentials or configuration data in transit, effectively neutralizing the protection offered by HTTPS.

Remediation Plan

Immediate Action: Update the GeoVision GV-AS1620 (GV-Cloud) firmware to version V1.17 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual TLS handshake patterns or unauthorized certificate usage that might indicate an active man-in-the-middle attempt.

Compensating Controls: Isolate the management interface of the GV-AS1620 to a restricted management VLAN, ensuring that it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of a hard-coded cryptographic key is a significant security failure that facilitates large scale interception of encrypted traffic.

Analyst Recommendation

The reliance on a static, hard-coded key renders the current firmware version insecure. Administrators must upgrade to version V1.17 immediately to rotate the keys and restore the confidentiality of administrative sessions.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-AS1620 (AS-Manager)
AFFECTED_VERSIONS: V2.07
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The GeoVision GV-AS1620 AS-Manager firmware contains a hard-coded RSA private key, allowing attackers to decrypt HTTPS traffic and spoof the server.

Executive Summary:
A critical security flaw in GeoVision GV-AS1620 AS-Manager firmware exposes a static RSA private key, facilitating traffic decryption and server impersonation.

Vulnerability Details

CVE-ID: CVE-2026-18753

Affected Software: GeoVision GV-AS1620 (AS-Manager)

Affected Versions: V2.07

Vulnerability: The firmware utilizes an embedded, static RSA private key for Lighttpd web server TLS termination (CWE-321). This allows unauthenticated attackers to intercept and decrypt encrypted communications or perform man-in-the-middle attacks to spoof the server.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the confidentiality and integrity of management communications. Compromise of the private key enables attackers to capture sensitive credentials or configuration data in transit, effectively neutralizing the protection offered by HTTPS.

Remediation Plan

Immediate Action: Update the GeoVision GV-AS1620 (AS-Manager) firmware to version V2.08 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual TLS handshake patterns or unauthorized certificate usage that might indicate an active man-in-the-middle attempt.

Compensating Controls: Isolate the management interface of the GV-AS1620 to a restricted management VLAN, ensuring that it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of a hard-coded cryptographic key is a significant security failure that facilitates large scale interception of encrypted traffic.

Analyst Recommendation

The reliance on a static, hard-coded key renders the current firmware version insecure. Administrators must upgrade to version V2.08 immediately to rotate the keys and restore the confidentiality of administrative sessions.

---METADATA---
VENDOR: Amazon
PRODUCT: Strands Agents Tools
AFFECTED_VERSIONS: 0 up to (excluding) 0.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A prompt injection vulnerability in the shell tool of Amazon Strands Agents Tools allows unauthorized manipulation of LLM interactions.

Executive Summary:
A prompt injection vulnerability in Amazon Strands Agents Tools poses a significant risk of unauthorized command execution and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-18733

Affected Software: Amazon Strands Agents Tools

Affected Versions: 0 up to (excluding) 0.8.0

Vulnerability: The software is susceptible to a prompt injection vulnerability due to improper neutralization of input used for LLM prompting (CWE-1427). This issue permits an unauthenticated attacker to influence the model behavior through malicious input.

Business Impact

Successful exploitation could allow an attacker to bypass intended constraints, potentially leading to unauthorized system access or the execution of arbitrary commands within the agent environment. With a CVSS score of 8.8, this high-severity flaw represents a substantial threat to the integrity and confidentiality of data processed by the affected LLM-integrated tools.

Remediation Plan

Immediate Action: Update the Amazon Strands Agents Tools package to version 0.8.0 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Monitor application logs for unusual prompt patterns or unexpected shell commands originating from the LLM agent.

Compensating Controls: Implement strict input validation and output filtering layers for all LLM-bound prompts to reduce the efficacy of injection attempts.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it targets the trust boundary between user input and Large Language Model processing.

Analyst Recommendation

Given the high CVSS score and the nature of prompt injection vulnerabilities, organizations should treat this update with high priority. Users are urged to upgrade to version 0.8.0 immediately to prevent potential exploitation of the shell tool interface.

---METADATA---
VENDOR: IBM
PRODUCT: Langflow OSS
AFFECTED_VERSIONS: 1.0.0 through 1.11.1
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.ibm.com/support/pages/node/7284733","name":null,"tags":["vendor-advisory","patch"]}]
---END_METADATA---

Description Summary:
IBM Langflow OSS versions 1.0.0 through 1.11.1 are vulnerable to remote code execution due to improper control of code generation.

Executive Summary:
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical code injection vulnerability that allows authenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-18729

Affected Software: IBM Langflow OSS

Affected Versions: 1.0.0 through 1.11.1

Vulnerability: This vulnerability is classified as CWE-94, which involves the improper control of code generation. A remote attacker with authenticated access can leverage this flaw to inject and execute arbitrary code within the application environment.

Business Impact

The ability for an authenticated user to perform remote code execution poses a severe risk to the confidentiality, integrity, and availability of the affected system. With a CVSS score of 8.8, this high severity vulnerability could lead to a complete system compromise, unauthorized data access, and potential lateral movement within the network. Organizations relying on Langflow OSS for workflow automation should consider this a priority security concern.

Remediation Plan

Immediate Action: Upgrade IBM Langflow OSS to version 1.11.2 or later as provided in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual command execution patterns or anomalous user activity originating from authenticated accounts.

Compensating Controls: Implement strict network segmentation and apply the principle of least privilege to limit the impact of a compromised account.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of August 29, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is not currently confirmed in the wild, the nature of the flaw makes it a significant target for attackers who have gained initial access to the application.

Analyst Recommendation

Given the high CVSS score and the potential for full remote code execution, it is imperative that administrators prioritize the update to version 1.11.2 immediately. Ensure that all instances of Langflow OSS are accounted for in the update cycle to eliminate this vector for unauthorized system control.

---METADATA---
VENDOR: IBM
PRODUCT: i
AFFECTED_VERSIONS: 7.3, 7.4, 7.5, 7.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM i 7.3 through 7.6 contains an improper privilege management vulnerability that could allow an authenticated user to gain unauthorized elevated access.

Executive Summary:
An improper privilege management vulnerability in IBM i versions 7.3 through 7.6 poses a significant risk of unauthorized privilege escalation for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-18713

Affected Software: IBM i

Affected Versions: 7.3, 7.4, 7.5, 7.6

Vulnerability: This vulnerability is an improper privilege management flaw (CWE-269) that permits an authenticated attacker with low privileges to manipulate system permissions. The attack vector is network based and requires the attacker to be authenticated to the system to execute the exploit.

Business Impact

Successful exploitation of this flaw allows an attacker to gain unauthorized elevated privileges, potentially resulting in full system compromise. Given the CVSS score of 8.8, the risk to data confidentiality, integrity, and availability is high, which could lead to severe operational disruption or unauthorized access to sensitive corporate information.

Remediation Plan

Immediate Action: Apply the relevant Program Temporary Fix (PTF) for your specific IBM i release as detailed in the IBM support bulletin. Specifically, install PTF SJ10887 for 7.6, SJ10888 for 7.5, SJ10890 for 7.4, or SJ10891 for 7.3.

Proactive Monitoring: Review system access logs for anomalous behavior related to user permission changes or unexpected command executions by standard user accounts.

Compensating Controls: Ensure that access to the system is restricted to authorized personnel only and enforce the principle of least privilege to minimize the potential impact of an account compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires prior authentication, which serves as a primary barrier to entry for external attackers.

Analyst Recommendation

The severity of this privilege escalation vulnerability necessitates prompt attention from system administrators. Organizations should prioritize the deployment of the vendor provided patches to prevent potential internal threats or lateral movement by malicious actors.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 8.3.0 up to (excluding) 8.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use after free vulnerability in the timeseries bucket lifecycle management of MongoDB Server allows authenticated users with write access to potentially corrupt memory and execute arbitrary code.

Executive Summary:
A high severity use after free vulnerability in MongoDB Server could allow an authenticated user with write privileges to trigger memory corruption, posing a significant risk to system stability and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-18692

Affected Software: MongoDB Server

Affected Versions: 8.3.0 up to (excluding) 8.3.8

Vulnerability: This vulnerability is a use after free condition (CWE-416) occurring within the timeseries bucket lifecycle management. It requires the attacker to be authenticated with write privileges to trigger the flaw.

Business Impact

Successful exploitation of this memory corruption vulnerability can lead to unauthorized code execution or service crashes. Given the CVSS score of 8.8, this represents a high risk to database environments, potentially leading to total system compromise or prolonged operational downtime.

Remediation Plan

Immediate Action: Upgrade all instances of MongoDB Server to version 8.3.8 or later to resolve the memory management defect.

Proactive Monitoring: Review database access logs for unusual write activity or unexpected service restarts that may indicate attempted exploitation.

Compensating Controls: Implement strict role based access control (RBAC) to limit write privileges to only necessary accounts, reducing the attack surface for this vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex, requiring specific conditions within the timeseries processing logic to trigger.

Analyst Recommendation

The high severity of this vulnerability necessitates prompt action. Organizations should prioritize updating their MongoDB Server deployments to the patched version, 8.3.8, to prevent potential memory-based attacks that could lead to full system compromise.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 8.3.0-8.3.7, 8.0.0-8.0.28, 7.0.0-7.0.39
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
MongoDB Server is affected by an algorithm downgrade vulnerability in intra-cluster communication that allows unauthorized influence over authentication mechanism selection.

Executive Summary:
An algorithm downgrade vulnerability in MongoDB intra-cluster communication allows a network-adjacent attacker to force the use of weaker authentication mechanisms, endangering cluster security.

Vulnerability Details

CVE-ID: CVE-2026-18691

Affected Software: MongoDB MongoDB Server

Affected Versions: 8.3.0 up to 8.3.8 (exclusive), 8.0 up to 8.0.29 (exclusive), 7.0 up to 7.0.40 (exclusive)

Vulnerability: This is an algorithm downgrade vulnerability (CWE-757) occurring during intra-cluster connection setup. It allows an attacker with network access to influence the authentication negotiation process between replica set members.

Business Impact

Successful exploitation could permit an attacker to downgrade the security of cluster communications, potentially facilitating unauthorized access to data or control of the database infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to the confidentiality and integrity of distributed database clusters.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to the MongoDB Server versions 8.3.8, 8.0.29, or 7.0.40 as applicable to your environment.

Proactive Monitoring: Monitor intra-cluster traffic for anomalous connection attempts or authentication failures that may indicate an attempt to influence negotiation.

Compensating Controls: Ensure that network segmentation is strictly enforced to limit access to the internal cluster communication ports to authorized replica set members only.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the technical impact is high.

Analyst Recommendation

This vulnerability impacts the foundational security of MongoDB clusters. Administrators should prioritize patching their database instances to the specified fixed versions to ensure the integrity of authentication negotiations across the cluster.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the nas-web component of GL.iNet GL-MT3000 allows remote, unauthenticated attackers to execute arbitrary system commands via the add_user function.

Executive Summary:
A critical command injection vulnerability in GL.iNet GL-MT3000 routers enables remote, unauthenticated attackers to execute arbitrary commands, posing a severe risk of device compromise.

Vulnerability Details

CVE-ID: CVE-2026-18686

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The nas-web RPC wrapper function, specifically add_user, fails to sanitize user inputs, resulting in a command injection vulnerability (CWE-77). This allows unauthenticated remote attackers to execute system-level commands on the router.

Business Impact

An attacker gaining command execution on a router can intercept network traffic, redirect DNS queries, or use the device as a pivot point to attack internal network resources. With a CVSS score of 9.8, this flaw represents a severe threat to network security and data privacy for all users relying on the affected hardware.

Remediation Plan

Immediate Action: Update the firmware of GL-MT3000 devices to the latest available version provided by the vendor.

Proactive Monitoring: Monitor device logs for unusual system activity, unauthorized user creation, or unexpected outbound connections from the router management interface.

Compensating Controls: Restrict access to the router web management interface (nas-web) to trusted internal IP addresses only, and disable remote management features if not required.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation in the wild. However, a public proof-of-concept is available, which significantly lowers the barrier for potential attackers.

Analyst Recommendation

The presence of a public proof-of-concept necessitates an urgent response. All GL-MT3000 devices must be patched immediately to prevent exploitation. If a patch cannot be applied, ensure the device management interface is not exposed to the public internet.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the set_upgrade function of the GL.iNet GL-MT3000 modem.so component allows remote, unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
The GL.iNet GL-MT3000 device is vulnerable to remote command injection, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18685

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the set_upgrade function within the /cgi-bin/glc binary. It allows an unauthenticated remote attacker to inject malicious commands due to improper input validation.

Business Impact

A successful exploit allows an attacker to execute arbitrary commands with the privileges of the web service, leading to full system takeover. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could result in complete loss of device confidentiality, integrity, and availability, potentially facilitating lateral movement within the network.

Remediation Plan

Immediate Action: Update the GL.iNet GL-MT3000 firmware to the latest available version provided by the vendor to remediate the injection flaw.

Proactive Monitoring: Monitor device logs for unusual shell execution patterns or unauthorized requests directed at the /cgi-bin/glc endpoint.

Compensating Controls: Implement strict network access controls or a Web Application Firewall to block unauthorized access to the web interface from untrusted networks until the device is patched.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository is available, which significantly lowers the barrier for exploitation. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators should prioritize firmware updates for all affected GL-MT3000 devices to prevent potential remote code execution.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the remove_profile function of the GL.iNet GL-MT3000 modem.so component allows remote, unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
The GL.iNet GL-MT3000 device is susceptible to remote command injection, which enables unauthenticated attackers to execute arbitrary code on the system.

Vulnerability Details

CVE-ID: CVE-2026-18684

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability originates in the remove_profile function of the /cgi-bin/glc file. It allows an unauthenticated attacker to inject and execute system commands via the web interface.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation provides an attacker with complete control over the affected device, potentially allowing them to pivot into internal networks, intercept traffic, or exfiltrate sensitive configuration data.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by GL.iNet to address the command injection vulnerability.

Proactive Monitoring: Review system and access logs for suspicious input strings or anomalous activity originating from the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted IP addresses only, and utilize firewall rules to drop unexpected traffic directed at the /cgi-bin/glc path.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept makes this a high-priority threat. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the presence of public exploit material, it is imperative that organizations update their GL.iNet hardware immediately. Failure to patch these devices leaves them open to total compromise by remote actors.

---METADATA---
VENDOR: IBM
PRODUCT: i
AFFECTED_VERSIONS: 7.3, 7.4, 7.5, 7.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM i 7.3 through 7.6 is susceptible to OS command injection, which may allow an authenticated attacker to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in IBM i versions 7.3 through 7.6 allows an authenticated attacker to execute arbitrary commands, creating a risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18683

Affected Software: IBM i

Affected Versions: 7.3, 7.4, 7.5, 7.6

Vulnerability: This is an OS command injection flaw (CWE-78) where improper neutralization of special elements allows an attacker to inject and execute unauthorized commands. The vulnerability is accessible over the network and requires the attacker to have low privileges on the system.

Business Impact

This vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. An attacker who successfully executes arbitrary commands can manipulate the underlying operating system, potentially leading to unauthorized data access, system disruption, or the installation of persistent malicious software.

Remediation Plan

Immediate Action: Apply the necessary PTF updates provided by IBM: SJ10887 for version 7.6, SJ10888 for 7.5, SJ10890 for 7.4, and SJ10891 for 7.3.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized process spawning that deviates from normal administrative activity.

Compensating Controls: Implement strict network segmentation and ensure that administrative interfaces are not reachable from untrusted network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, it is constrained by the requirement for a valid authenticated session.

Analyst Recommendation

The ability to execute arbitrary OS commands represents a critical security failure that should be addressed immediately. System administrators must schedule and apply the provided patches to eliminate the risk of command injection and maintain the security posture of their IBM i environments.

---METADATA---
VENDOR: GitLab
PRODUCT: AI Gateway (Duo Workflow Service)
AFFECTED_VERSIONS: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0
---END_METADATA---

Description Summary:
Insecure template expansion in GitLab AI Gateway allows attackers to cause a denial-of-service or execute arbitrary code via crafted Duo Agent definitions.

Executive Summary:
A critical vulnerability in the GitLab AI Gateway Duo Workflow Service permits remote code execution or denial-of-service via insecure template expansion.

Vulnerability Details

CVE-ID: CVE-2026-1868

Affected Software: GitLab AI Gateway

Affected Versions: 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0

Vulnerability: The AI Gateway component is vulnerable to insecure template expansion of user-supplied data through crafted Duo Agent Platform Flow definitions. An attacker can leverage this flaw to inject malicious code that the Gateway processes, leading to either a total system crash or arbitrary code execution.

Business Impact

A successful exploit could lead to the complete compromise of the AI Gateway, potentially exposing sensitive AI training data or integration secrets. The CVSS score of 9.9 indicates a near-maximum severity, reflecting the catastrophic potential for service downtime and unauthorized access to the underlying infrastructure.

Remediation Plan

Immediate Action: Update the GitLab AI Gateway to versions 18.6.2, 18.7.1, or 18.8.1 immediately.

Proactive Monitoring: Monitor the AI Gateway logs for unusual Duo Agent Platform Flow definitions or unexpected service restarts.

Compensating Controls: Ensure that the AI Gateway is deployed within a segmented network environment to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 9, 2026, there is no public information indicating active exploitation. GitLab has proactively released patches, and the high CVSS score necessitates urgent attention from security teams.

Analyst Recommendation

Because this vulnerability allows for remote code execution on a high-value AI component, remediation should be the highest priority. Administrators must update to the fixed versions (18.6.2, 18.7.1, or 18.8.1) immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: IBM
PRODUCT: AIX and PowerVM VIOS
AFFECTED_VERSIONS: IBM AIX 7.2, 7.3; IBM PowerVM VIOS 4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow vulnerability in IBM AIX and PowerVM VIOS allows unauthenticated attackers to potentially cause a denial of service.

Executive Summary:
An integer overflow vulnerability in IBM AIX and PowerVM VIOS poses a high risk of service disruption due to its unauthenticated attack vector.

Vulnerability Details

CVE-ID: CVE-2026-18670

Affected Software: IBM AIX and PowerVM VIOS

Affected Versions: IBM AIX 7.2, 7.3; IBM PowerVM VIOS 4.1

Vulnerability: This is an integer overflow or wraparound vulnerability (CWE-190). The vulnerability is exploitable by an unauthenticated attacker over the network with low complexity requirements, potentially leading to a denial of service condition.

Business Impact

The ability for an unauthenticated remote attacker to trigger a denial of service against core infrastructure components like AIX and PowerVM VIOS presents a significant threat to operational continuity. With a CVSS score of 8.2, this vulnerability is classified as high severity, as it could lead to critical system outages, resulting in loss of productivity and potential impact on dependent business services.

Remediation Plan

Immediate Action: Apply the specific APAR fixes provided by IBM for your respective AIX or VIOS version, as detailed in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual error patterns or unexpected service crashes that may indicate an attempt to trigger an overflow condition.

Compensating Controls: Ensure that network traffic to critical AIX management interfaces is restricted via firewalls or access control lists to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Integer overflows are common targets for exploitation, and the remote, unauthenticated nature of this flaw makes it a priority for patching.

Analyst Recommendation

Given the high CVSS score and the potential for unauthenticated remote impact, organizations should prioritize the deployment of the vendor-supplied patches. Please review the IBM support documentation to identify the correct APAR for your specific environment and apply the updates during the next maintenance window.

---METADATA---
VENDOR: IBM
PRODUCT: i
AFFECTED_VERSIONS: 7.3, 7.4, 7.5, 7.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
IBM i 7 contains a vulnerability involving execution with unnecessary privileges, potentially allowing authenticated users to perform unauthorized operations.

Executive Summary:
An execution with unnecessary privileges vulnerability in IBM i 7.3 through 7.6 allows an authenticated attacker to perform unauthorized actions, posing a high risk to system security.

Vulnerability Details

CVE-ID: CVE-2026-18669

Affected Software: IBM i

Affected Versions: 7.3, 7.4, 7.5, 7.6

Vulnerability: This vulnerability involves execution with unnecessary privileges (CWE-250), where the software performs sensitive operations using higher-than-required authorization. An authenticated attacker can exploit this discrepancy to bypass intended security boundaries and perform actions that should be restricted.

Business Impact

The CVSS score of 8.8 indicates a critical threat to organizational security. Successful exploitation could result in the compromise of sensitive data, unauthorized configuration changes, or the disruption of critical business processes, directly impacting the confidentiality, integrity, and availability of the IBM i platform.

Remediation Plan

Immediate Action: Apply the corresponding PTF for your release: SJ11009 (7.6), SJ10978 (7.5), SJ10977 (7.4), or SJ10976 (7.3).

Proactive Monitoring: Audit logs should be reviewed regularly for suspicious activity, specifically looking for users attempting to access objects or functions that are outside their normal scope of operation.

Compensating Controls: While patching is the primary remedy, organizations can enforce strict account monitoring and limit the number of users with access to critical system components as a temporary measure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw represents a significant risk for environments where internal security controls rely heavily on user privilege separation.

Analyst Recommendation

Administrators must treat this vulnerability as high priority and apply the necessary patches provided by IBM. Ensuring the system is updated is essential to closing the privilege gap and protecting the environment against unauthorized access and potential data compromise.

---METADATA---
VENDOR: Tenable
PRODUCT: Sensor Proxy
AFFECTED_VERSIONS: 0 up to (excluding) 1.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Tenable Sensor Proxy is vulnerable to remote code execution, allowing an unauthenticated attacker to gain elevated privileges if an operator connects the sensor to a malicious host.

Executive Summary:
A critical remote code execution vulnerability in Tenable Sensor Proxy permits attackers to gain elevated privileges through operator-assisted connection to malicious hosts.

Vulnerability Details

CVE-ID: CVE-2026-18667

Affected Software: Tenable Sensor Proxy

Affected Versions: 0 up to (excluding) 1.4.2

Vulnerability: This is a remote code execution vulnerability (CWE-94) that allows an unauthenticated attacker to execute code with elevated privileges. The attack vector relies on social engineering or deception, where an operator is induced to connect the sensor to an attacker-controlled host.

Business Impact

With a CVSS score of 9.6, this vulnerability represents a high-impact risk to organizational security infrastructure. Successful exploitation allows attackers to gain full administrative control over the sensor proxy, potentially facilitating lateral movement and unauthorized access to sensitive security telemetry.

Remediation Plan

Immediate Action: Update Tenable Sensor Proxy to version 1.4.2 immediately by downloading the installer from the official Tenable Downloads Portal.

Proactive Monitoring: Audit sensor configuration logs and connection endpoints to ensure sensors are only communicating with verified and trusted Tenable infrastructure.

Compensating Controls: Implement strict egress filtering on the network to prevent the sensor from establishing unauthorized connections to external or untrusted hosts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily associated with the potential for an attacker to compromise the supply chain or perform man-in-the-middle attacks on the sensor connection process.

Analyst Recommendation

Organizations utilizing Tenable Sensor Proxy must prioritize the upgrade to version 1.4.2. Additionally, educate security personnel on the risks associated with connecting security appliances to untrusted or unverified network endpoints to prevent the exploitation of this vector.

---METADATA---
VENDOR: IBM
PRODUCT: Operational Decision Manager
AFFECTED_VERSIONS: 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, 9.0.0.1
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-05T09:01:23.499Z
SOURCES_JSON: [{"url":"https://www.ibm.com/support/pages/node/7286196","name":null,"tags":["vendor-advisory","patch"]}]
---END_METADATA---

Description Summary:
IBM Operational Decision Manager is vulnerable to unauthenticated SQL injection, allowing attackers to execute arbitrary commands and potentially achieve remote code execution.

Executive Summary:
This critical vulnerability in IBM Operational Decision Manager allows unauthenticated remote code execution via SQL injection, posing a severe risk to system integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-18658

Affected Software: IBM Operational Decision Manager

Affected Versions: 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, 9.0.0.1

Vulnerability: The application is susceptible to SQL injection (CWE-89) due to improper neutralization of special elements in SQL commands. This flaw allows an unauthenticated attacker to inject malicious queries, manipulate database contents, and write a web shell to the application root to gain remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to the organization. Successful exploitation grants an attacker full control over the application server, leading to potential data exfiltration, complete system compromise, and significant operational downtime.

Remediation Plan

Immediate Action: Apply the relevant interim fixes or upgrades provided by IBM for your specific version, as detailed in the official vendor security advisory.

Proactive Monitoring: Inspect web server logs for suspicious URL patterns or database error strings that indicate injection attempts and monitor for the creation of unauthorized files in the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 4, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication requirements and the ability to pivot from database access to full remote code execution.

Analyst Recommendation

Given the critical severity and the potential for full system compromise, organizations should prioritize the deployment of the vendor-supplied patches immediately. Organizations unable to patch instantly should isolate the affected systems or implement strict network-level access controls to limit exposure to this unauthenticated vector.

---METADATA---
VENDOR: Amazon
PRODUCT: Kiro CLI
AFFECTED_VERSIONS: 0 up to 2.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Amazon Kiro CLI contains an uncontrolled search path element vulnerability that may allow local attackers to escalate privileges or execute arbitrary commands.

Executive Summary:
An uncontrolled search path vulnerability in Amazon Kiro CLI could allow a local attacker to execute arbitrary code with the privileges of the executing user.

Vulnerability Details

CVE-ID: CVE-2026-18657

Affected Software: Amazon Kiro CLI

Affected Versions: 0 up to 2.10.0

Vulnerability: This vulnerability (CWE-427) is caused by an uncontrolled search path, where the CLI tool searches for dependencies or executables in insecure locations. An unauthenticated local attacker can manipulate the environment to force the application to load malicious libraries or binaries.

Business Impact

The CVSS score of 7.8 reflects a significant risk, particularly for automated build systems or CI/CD pipelines that utilize the Kiro CLI. A successful exploit could lead to complete system compromise or the injection of malicious code into build processes.

Remediation Plan

Immediate Action: Update Amazon Kiro CLI to version 2.10.0 or later immediately.

Proactive Monitoring: Monitor system logs for unusual CLI execution patterns or unexpected binary loading events.

Compensating Controls: Enforce strict path management and environment variable sanitization when executing the CLI tool, especially in automated pipeline environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dependent on the local configuration and user environment.

Analyst Recommendation

Organizations using Kiro CLI for automation or development tasks must prioritize this update. Update all CLI installations and review environmental security configurations to prevent future exploitation of search path vulnerabilities.

---METADATA---
VENDOR: Amazon
PRODUCT: Kiro IDE
AFFECTED_VERSIONS: 1.0.0 through 1.0.212
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Amazon Kiro IDE is susceptible to an uncontrolled search path element vulnerability, potentially allowing local privilege escalation or arbitrary code execution.

Executive Summary:
An uncontrolled search path vulnerability in Amazon Kiro IDE could allow a local attacker to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-18656

Affected Software: Amazon Kiro IDE

Affected Versions: 1.0.0 through 1.0.212

Vulnerability: This vulnerability (CWE-427) involves an uncontrolled search path element, where the application improperly manages the location from which it loads executable resources. An unauthenticated local attacker can leverage this by placing malicious files in the search path to influence the application's execution flow.

Business Impact

With a CVSS score of 7.8, this vulnerability presents a high risk for local environments. Exploitation could lead to full compromise of the user account running the IDE, resulting in unauthorized access to source code, project credentials, or other sensitive development data.

Remediation Plan

Immediate Action: Update Amazon Kiro IDE to version 1.0.228 or later immediately.

Proactive Monitoring: Review file system integrity and monitor for unauthorized file modifications in directories accessible to the IDE application.

Compensating Controls: Restrict write permissions on the directory search paths used by the IDE to ensure that only authorized users can modify files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which mitigates the threat profile compared to remote exploits.

Analyst Recommendation

Development teams should treat this update with high priority to protect their codebase and environment. Ensure all instances of Kiro IDE are updated to the patched version, and verify that appropriate access controls are in place for development workstations.

---METADATA---
VENDOR: WP Directory Kit
PRODUCT: WP Directory Kit
AFFECTED_VERSIONS: All versions before 1.5.7
CONFIDENCE: high
MISSING: none
CREDITS: Erwan LR (WPScan) (finder); WPScan (coordinator)
SOURCES_JSON: [{"url":"https://wpscan.com/vulnerability/e064c261-bc7b-4605-8da7-c7036fc396fc/","name":null,"tags":["exploit","vdb-entry","technical-description"]}]
---END_METADATA---

Description Summary:
The WP Directory Kit plugin for WordPress fails to sanitize input, enabling authenticated administrators to perform SQL injection attacks that may compromise data across a multisite network.

Executive Summary:
The WP Directory Kit WordPress plugin contains a SQL injection vulnerability that allows an authenticated administrator to potentially access unauthorized data, representing a high-severity security risk.

Vulnerability Details

CVE-ID: CVE-2026-18653

Affected Software: WP Directory Kit (WordPress Plugin)

Affected Versions: All versions before 1.5.7

Vulnerability: This vulnerability is a SQL Injection (CWE-89) arising from improper input sanitization in the plugin, which requires high privileges (authenticated administrator) to execute.

Business Impact

Successful exploitation allows an attacker to manipulate SQL queries, potentially leading to unauthorized data exfiltration or modification within the WordPress database. On multisite installations, this impact is amplified as an attacker can access information belonging to the entire network, posing a significant risk to data confidentiality and integrity. While the base CVSS score reflects a high severity, the requirement for administrative privileges limits the immediate attack surface to existing internal users.

Remediation Plan

Immediate Action: Update the WP Directory Kit plugin to version 1.5.7 or later to implement the necessary input sanitization fixes.

Proactive Monitoring: Review database error logs and query logs for unusual SQL syntax or unexpected execution patterns that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide a layer of protection if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable because it allows direct manipulation of database queries by an authenticated user.

Analyst Recommendation

Given the potential for unauthorized data access across a multisite environment, administrators should prioritize updating the WP Directory Kit plugin to version 1.5.7 immediately. Do not delay these updates, as the existence of a proof-of-concept increases the likelihood of opportunistic exploitation by malicious actors targeting administrative accounts.

---METADATA---
VENDOR: HAVELSAN
PRODUCT: Liman MYS
AFFECTED_VERSIONS: 2.2.3 up to (excluding) 2.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability exists in HAVELSAN Liman MYS that allows an authenticated user to perform unauthorized actions.

Executive Summary:
A high-severity missing authorization vulnerability in HAVELSAN Liman MYS could allow an authenticated attacker to compromise system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-18650

Affected Software: HAVELSAN Liman MYS

Affected Versions: 2.2.3 up to (excluding) 2.3.1

Vulnerability: This is a missing authorization flaw (CWE-862) that occurs when the software does not perform a sufficient authorization check. The vulnerability requires the attacker to be authenticated with low privileges to trigger the flaw.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to perform unauthorized administrative operations, potentially leading to full system compromise, data exfiltration, or the disruption of critical business services managed by the Liman MYS platform.

Remediation Plan

Immediate Action: Update HAVELSAN Liman MYS to version 2.3.1 or later to resolve the authorization check deficiency.

Proactive Monitoring: Review system access logs for unusual user activity, specifically focusing on administrative functions being executed by unauthorized accounts.

Compensating Controls: Implement strict network segmentation and ensure that access to the Liman MYS interface is restricted to trusted internal networks via VPN or firewall rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of access control, which allows for privilege escalation within the application.

Analyst Recommendation

Given the high CVSS score and the critical nature of the affected software, administrators should prioritize this update. Applying the vendor-supplied patch is the only effective way to remediate this authorization defect and prevent potential unauthorized access to sensitive management functions.

---METADATA---
VENDOR: TUBITAK BILGEM
PRODUCT: eta-otp-lock
AFFECTED_VERSIONS: 0 up to 1.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in TUBITAK BILGEM eta-otp-lock allows for potential object injection attacks.

Executive Summary:
An object injection vulnerability in TUBITAK BILGEM eta-otp-lock could allow an attacker to achieve full system compromise via deserialization of untrusted data.

Vulnerability Details

CVE-ID: CVE-2026-18642

Affected Software: TUBITAK BILGEM eta-otp-lock

Affected Versions: 0 up to 1.0.4

Vulnerability: This is a CWE-502 vulnerability involving the deserialization of untrusted data. The attack vector requires local access and user interaction, but successful exploitation results in full system impact.

Business Impact

The ability to perform object injection through deserialization can lead to remote code execution or total system compromise. With a CVSS score of 7.8, this vulnerability represents a severe threat to the confidentiality, integrity, and availability of the host system.

Remediation Plan

Immediate Action: Update the eta-otp-lock software to version 1.0.4 or higher to resolve the deserialization flaw.

Proactive Monitoring: Review system logs for unauthorized changes or unexpected execution patterns that may indicate an attempt to leverage object injection for escalation.

Compensating Controls: Ensure that the application is running with the principle of least privilege to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access and user interaction, which reduces the likelihood of widespread opportunistic exploitation.

Analyst Recommendation

Administrators should apply the vendor-provided patch immediately to eliminate the risk of object injection. Given the high technical impact, patching is essential to prevent potential unauthorized access or system takeover.

---METADATA---
VENDOR: SonicWall
PRODUCT: GMS
AFFECTED_VERSIONS: 9.5.1 and earlier versions
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
A deserialization vulnerability in SonicWall GMS allows a local attacker to execute unauthorized actions due to insecure handling of serialized objects.

Executive Summary:
A high severity deserialization vulnerability in SonicWall GMS could allow a local attacker to achieve unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-18634

Affected Software: SonicWall GMS

Affected Versions: 9.5.1 and earlier versions

Vulnerability: The application is susceptible to CWE-502, which involves the insecure deserialization of untrusted data within a service component. The vulnerability allows a local attacker to perform unauthorized actions without requiring authentication.

Business Impact

The exploitation of this deserialization flaw could lead to full compromise of the affected GMS instance, resulting in unauthorized data access, system manipulation, or service disruption. With a CVSS score of 8.4, this vulnerability represents a high risk to organizational infrastructure, particularly given that GMS is typically used for centralized management of security appliances.

Remediation Plan

Immediate Action: Prioritize updating SonicWall GMS to the latest available version provided by the vendor. Consult the official SonicWall PSIRT advisory (SNWLID-2026-0011) to identify the specific patched build.

Proactive Monitoring: Monitor system logs for unusual process execution or service instability that may indicate attempts to exploit deserialization routines. Review local access controls to ensure that only authorized personnel can interact with the underlying service.

Compensating Controls: Restrict local access to the server hosting the GMS application to the smallest possible group of administrative users. Utilize endpoint detection and response (EDR) tools to identify and block suspicious local command execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on local access limits the immediate attack surface, but the high impact of deserialization vulnerabilities necessitates prompt patching.

Analyst Recommendation

Given the potential for complete system compromise, administrators should treat this vulnerability with high urgency. While the attack vector requires local access, the risk remains significant for enterprise environments. Apply the vendor-supplied patch as soon as it is released and restrict access to the GMS console to trusted users only.

---METADATA---
VENDOR: TMT Machine Industry and Trade Ltd. Co.
PRODUCT: Talassoft Industrial Management Software
AFFECTED_VERSIONS: V.4 up to (excluding) V.16
CONFIDENCE: high
MISSING: none
PROFILE: grounded@2cca291e317a
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T09:16:47.307Z
CREDITS: Efe Özel (finder); Cemil Sefa Özcan (analyst); FORDEFENCE (sponsor)
SOURCES_JSON: [{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0965","name":null,"tags":["government-resource"]}]
---END_METADATA---

Description Summary:
Talassoft Industrial Management Software is susceptible to SQL injection due to improper neutralization of special elements in SQL commands, allowing unauthorized database interactions.

Executive Summary:
An SQL injection vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows authenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-18630

Affected Software: TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software

Affected Versions: V.4 up to (excluding) V.16

Vulnerability: The application fails to properly sanitize user-supplied input before passing it to database queries. This SQL injection flaw can be triggered by an authenticated user with low privileges to execute arbitrary database commands.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total compromise regarding data confidentiality, integrity, and availability. Successful exploitation allows an attacker to bypass access controls, potentially leading to the unauthorized exfiltration of sensitive industrial data, modification of critical records, or complete disruption of management services.

Remediation Plan

Immediate Action: Update Talassoft Industrial Management Software to version V.16 or later to ensure the SQL injection flaw is mitigated.

Proactive Monitoring: Review database access logs for unusual query patterns, such as unexpected syntax characters or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: No (there is no confirmed public exploit in the available data).

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk of exploitation is elevated due to the nature of the flaw, no weaponized code has been identified.

Analyst Recommendation

Given the high CVSS severity and the potential for total impact on database integrity, administrators should prioritize patching the affected software immediately. Organizations must ensure that any instance of Talassoft Industrial Management Software within the environment is upgraded to version V.16 or later to prevent potential unauthorized database access.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in Red Hat OpenShift AI Data Science Pipelines (DSP) allows authenticated users to gain elevated privileges due to incorrect privilege assignment.

Executive Summary:
A high-severity privilege assignment vulnerability in Red Hat OpenShift AI 3.3 could allow authenticated users to perform unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-18621

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is categorized as CWE-266, involving incorrect privilege assignment within the Data Science Pipelines component. It requires the attacker to have low-level authenticated access to the system to exploit the flaw.

Business Impact

Successful exploitation of this flaw could allow an authenticated user to gain access or permissions beyond their intended scope, potentially leading to unauthorized data modification or system impact. Given the CVSS score of 7.6, this represents a significant risk to the integrity and confidentiality of the AI pipeline environment.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785187920 or later.

Proactive Monitoring: Monitor system logs for unusual permission changes or unauthorized attempts to access pipeline configurations.

Compensating Controls: Restrict access to the Data Science Pipelines interface to only necessary personnel to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization logic error that requires an existing user session to exploit.

Analyst Recommendation

The vulnerability presents a clear risk of privilege escalation within the OpenShift AI environment. Administrators should prioritize the deployment of the provided update to ensure that role-based access controls remain enforced and to prevent potential unauthorized escalation of privileges.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Versions prior to 144
---END_METADATA---

Description Summary:
A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 144, which could allow a remote attacker to potentially exploit heap corruption via a crafted page.

Executive Summary:
A high-severity type confusion vulnerability in the Google Chrome V8 engine allows unauthenticated remote attackers to execute arbitrary code or cause system instability.

Vulnerability Details

CVE-ID: CVE-2026-1862

Affected Software: Google Chrome

Affected Versions: Versions prior to 144

Vulnerability: This vulnerability is a type confusion flaw within the V8 JavaScript engine. An unauthenticated remote attacker can trigger this condition by convincing a user to visit a specially crafted website, leading to memory corruption and potential arbitrary code execution within the browser's sandbox.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized code execution on the user's workstation, potentially compromising sensitive data or serving as an entry point for further lateral movement within the corporate network. With a CVSS score of 8.8, this High-severity flaw poses a significant risk to organizational productivity and data integrity if users interact with malicious web content.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 144 or later immediately to mitigate the risk of exploitation.

Proactive Monitoring: Organizations should monitor endpoint logs for unusual browser crashes or unexpected outbound connections from browser processes.

Compensating Controls: Implement robust web filtering and EDR solutions to block access to known malicious domains and detect post-exploitation behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of V8 type confusion flaws, the potential for weaponization by sophisticated threat actors is high.

Analyst Recommendation

The high CVSS score and the ubiquitous nature of the Chrome browser necessitate an immediate patching cycle. Security teams should prioritize the deployment of version 144 across all managed endpoints to prevent potential remote code execution attacks.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A resource allocation flaw in the ml-metadata component of Red Hat OpenShift AI 3.3 may allow an unauthenticated attacker to cause a denial-of-service condition.

Executive Summary:
A high-severity denial-of-service vulnerability in Red Hat OpenShift AI 3.3 could allow remote attackers to exhaust system resources.

Vulnerability Details

CVE-ID: CVE-2026-18618

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is identified as CWE-770, which involves the allocation of resources without proper limits or throttling. The flaw is remotely exploitable without requiring authentication.

Business Impact

An attacker can exploit this vulnerability to trigger a denial-of-service, potentially rendering the ml-metadata service unavailable and disrupting critical machine learning workflows. With a CVSS score of 7.5, this poses a substantial risk to service availability and business continuity for teams relying on OpenShift AI.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785262015 or later.

Proactive Monitoring: Monitor system resource usage, such as CPU and memory consumption, for sudden spikes or exhaustion patterns indicative of a denial-of-service attempt.

Compensating Controls: Implement rate limiting at the network or API gateway level to prevent excessive requests from reaching the vulnerable component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of resource throttling makes this component susceptible to basic resource exhaustion attacks.

Analyst Recommendation

To maintain the availability of machine learning services, administrators must apply the security update provided by Red Hat. Implementing strict rate limiting and resource monitoring in the interim will help mitigate the risk of service disruption until the patch can be fully deployed.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A security flaw in the Data Science Pipelines Operator for Red Hat OpenShift AI 3.3 allows for improper control of object attributes.

Executive Summary:
Red Hat OpenShift AI 3.3 is vulnerable to a high-severity flaw in the Data Science Pipelines Operator that could lead to unauthorized attribute modification.

Vulnerability Details

CVE-ID: CVE-2026-18617

Affected Software: Red Hat OpenShift AI 3.3

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: The vulnerability relates to the improper control of dynamically determined object attributes (CWE-915) within the Data Science Pipelines Operator. It requires an authenticated user with low privileges to trigger the flaw.

Business Impact

An authenticated attacker could leverage this flaw to modify system attributes, potentially leading to unauthorized control over pipeline execution or data access. With a CVSS score of 8.8, this represents a significant risk to the integrity and reliability of the data science workflows running on the OpenShift platform.

Remediation Plan

Immediate Action: Update to the fixed version of Red Hat OpenShift AI, which includes the necessary security fixes for the Data Science Pipelines Operator.

Proactive Monitoring: Review pipeline configuration changes and audit logs for the Data Science Pipelines Operator to detect any unauthorized modifications to object attributes.

Compensating Controls: Restrict access to pipeline management interfaces to only necessary personnel and implement strict validation for any dynamic configuration inputs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw requires specific knowledge of how the operator manages object attributes.

Analyst Recommendation

Given the high CVSS score, it is imperative to apply the provided vendor updates for Red Hat OpenShift AI 3.3 immediately. Failure to patch may expose pipeline operations to unauthorized manipulation and system-level risks.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the server.set_peer function of the GL-iNet GL-MT3000 wg-server.so plugin allows remote, unauthenticated attackers to execute arbitrary commands.

Executive Summary:
Remote command injection in the GL-iNet GL-MT3000 WireGuard server component exposes the device to unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-18616

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw exists in the server.set_peer function within the /cgi-bin/glc file. By manipulating the public_key argument, an unauthenticated remote attacker can trigger command injection.

Business Impact

The CVSS score of 9.8 reflects the severity of this remote code execution vulnerability. Successful exploitation permits full device takeover, which could lead to network-wide compromise, data interception, and total loss of device integrity.

Remediation Plan

Immediate Action: Update the GL-iNet GL-MT3000 device to the latest firmware version. Consult the vendor security advisory for the specific release that addresses this vulnerability.

Proactive Monitoring: Monitor for anomalous traffic or unexpected execution of system commands, particularly those related to WireGuard peer management.

Compensating Controls: Use firewall rules to isolate management interfaces and WireGuard configuration endpoints from the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept is available for this vulnerability. The lack of authentication requirements makes this an attractive target for remote attackers.

Analyst Recommendation

This vulnerability presents a severe risk to network infrastructure. IT administrators must prioritize updating all affected GL-MT3000 units to the latest firmware version to eliminate the risk of remote code execution.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unauthenticated remote command injection vulnerability in the GL-iNet GL-MT3000 allows attackers to execute arbitrary commands via the wg-server.generate_publickey function.

Executive Summary:
A critical command injection flaw in the GL-iNet GL-MT3000 router enables remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-18615

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability resides in the wg-server.generate_publickey function within the /cgi-bin/glc interface. An attacker can manipulate the private_key argument to inject and execute arbitrary commands on the underlying operating system.

Business Impact

Exploitation of this vulnerability grants the attacker full administrative control over the affected network device. This facilitates unauthorized access to sensitive internal network traffic, potential credential theft, and total compromise of the network gateway, warranting a critical severity classification based on its 9.8 CVSS score.

Remediation Plan

Immediate Action: Update all GL-MT3000 devices to the latest firmware version released by GL-iNet to patch the vulnerable wg-server.so plugin.

Proactive Monitoring: Monitor firewall logs for unauthorized connection attempts to the router's web management interface and look for anomalous execution of system commands.

Compensating Controls: Disable remote management access on the device until a firmware update can be applied to ensure the device is not reachable from the public internet.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the existence of public exploit code, administrators must act immediately to secure their infrastructure. Apply the vendor-provided firmware update as the primary defense and verify device integrity post-update.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the s2s.so plugin of the GL-iNet GL-MT3000 allows unauthenticated remote attackers to execute arbitrary commands via the s2s.enable_echo_server function.

Executive Summary:
A critical command injection vulnerability in the GL-iNet GL-MT3000 router allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18614

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the s2s.enable_echo_server function within the /cgi-bin/glc interface. By manipulating the port argument, an unauthenticated attacker can inject and execute arbitrary system commands.

Business Impact

Successful exploitation allows an attacker to gain full control over the router, leading to potential data theft, network interception, or the use of the device as a pivot point for further lateral movement within the internal network. Given the CVSS score of 9.8, this vulnerability represents a maximum severity threat to organizational security and infrastructure integrity.

Remediation Plan

Immediate Action: Identify all GL-MT3000 devices running affected firmware and update them to the latest available version provided by the vendor.

Proactive Monitoring: Review device access logs for suspicious requests directed at /cgi-bin/glc or unusual traffic patterns originating from the router.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the device management interface from untrusted or external networks.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its reachability over the network without requiring authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate patching. Organizations should prioritize updating all affected GL-iNet devices and restrict administrative access to mitigate the risk of remote code execution.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A remote injection vulnerability exists in the plugins.set_config function of the GL-iNet GL-MT3000 router firmware, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
A critical injection vulnerability in the GL-iNet GL-MT3000 router firmware allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18613

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw resides in the plugins.set_config function within the /cgi-bin/glc file of the plugins.so native plugin. This vulnerability permits unauthenticated remote attackers to inject malicious input, leading to potential full system control.

Business Impact

Successful exploitation of this vulnerability grants an attacker total administrative control over the affected router. This could lead to complete network interception, unauthorized access to internal resources, and significant data exfiltration. Given the CVSS score of 9.8, this risk is classified as critical, as it requires no authentication and can be triggered remotely.

Remediation Plan

Immediate Action: Check the official GL-iNet support portal for firmware updates addressing this vulnerability and apply the latest available version immediately.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /cgi-bin/glc endpoint and review device access logs for unexpected configuration changes.

Compensating Controls: If a patch is not immediately available, restrict management access to the router interface to trusted internal IP addresses only, and disable remote web administration if not strictly required.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of proof-of-concept code, immediate action is required. Organizations using the GL-MT3000 should verify their firmware version and prioritize the application of vendor patches to prevent potential remote code execution and full device takeover.

---METADATA---
VENDOR: GL-iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the plugins.so component of the GL-iNet GL-MT3000 allows unauthenticated remote attackers to execute arbitrary commands via the package management functions.

Executive Summary:
A critical command injection vulnerability in the GL-iNet GL-MT3000 router permits unauthenticated remote attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-18612

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw exists in the plugins.remove_package and plugins.install_package functions within the /cgi-bin/glc file. Attackers can leverage this to perform command injection, leading to unauthenticated remote code execution.

Business Impact

Successful exploitation poses a severe risk, as it allows attackers to bypass authentication and execute commands with elevated privileges. This can result in complete loss of confidentiality, integrity, and availability for the affected network segment, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Apply the latest firmware update for the GL-MT3000 provided by GL-iNet to resolve the vulnerability in the plugins.so module.

Proactive Monitoring: Inspect system logs for unexpected package management activities or unauthorized command execution events.

Compensating Controls: Restrict access to the web-based management interface by using network segmentation or firewall rules that limit access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the ease of invocation via the web interface.

Analyst Recommendation

The presence of exploit code and the critical nature of this vulnerability make it a high priority for remediation. Administrators should verify their device firmware version immediately and apply the necessary patches to protect against potential remote exploitation.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Data Science Pipelines Operator in Red Hat OpenShift AI 3.3 contains a flaw where a cryptographically weak pseudo-random number generator is utilized.

Executive Summary:
A high-severity cryptographic flaw in the Red Hat OpenShift AI Data Science Pipelines Operator could allow unauthenticated attackers to compromise system security.

Vulnerability Details

CVE-ID: CVE-2026-18611

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This vulnerability is categorized as CWE-338, which involves the use of a cryptographically weak pseudo-random number generator. The attack vector is network-based and does not require prior authentication.

Business Impact

The use of weak randomness in security-sensitive operations can lead to the predictability of tokens or keys, potentially allowing an attacker to bypass authentication or decrypt sensitive communications. With a CVSS score of 7.5, this vulnerability poses a serious threat to the overall security posture of the platform.

Remediation Plan

Immediate Action: Update Red Hat OpenShift AI 3.3 to the version containing the fix, identified as build 1785187936 or later.

Proactive Monitoring: Review security logs for anomalous authentication patterns or unexpected cryptographic errors.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns and ensure that all network communication is handled via secure, encrypted channels.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it inherently dangerous, as it may facilitate further attacks that rely on predictable security values.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability and its potential to weaken critical security controls, immediate patching is required. Organizations should apply the vendor-provided update to replace the weak PRNG and restore the integrity of the cryptographic operations within the Data Science Pipelines Operator.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to version 144
---END_METADATA---

Description Summary:
A heap buffer overflow in the libvpx library within Google Chrome allows for potential remote code execution when processing malicious media content. This is resolved in version 144.

Executive Summary:
A high-severity heap buffer overflow in Google Chrome's libvpx component allows unauthenticated attackers to execute arbitrary code or cause a denial of service via specially crafted web content.

Vulnerability Details

CVE-ID: CVE-2026-1861

Affected Software: Google Chrome

Affected Versions: Prior to version 144

Vulnerability: A heap buffer overflow exists in the libvpx video codec library. An unauthenticated remote attacker can exploit this by enticing a user to visit a malicious website or view a malicious video, leading to memory corruption and potential code execution within the browser's context.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant threat to corporate endpoints. Successful exploitation could lead to the compromise of user workstations, theft of session cookies, or the installation of malware, bypassing standard browser security boundaries.

Remediation Plan

Immediate Action: Update Google Chrome to version 144 or later across all enterprise endpoints immediately to patch the vulnerable libvpx library.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual browser child processes or unexpected memory allocation patterns.

Compensating Controls: Implement web filtering to block known malicious domains and ensure that browser sandboxing features are strictly enforced via Group Policy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, heap overflows in media libraries are historically common targets for "zero-click" or "one-click" exploit chains.

Analyst Recommendation

Browser vulnerabilities are a primary entry point for modern cyberattacks. It is critical that organizations automate the update process for Google Chrome to ensure that version 144 is deployed rapidly across the entire fleet.

---METADATA---
VENDOR: Red Hat
PRODUCT: OpenShift AI
AFFECTED_VERSIONS: Red Hat OpenShift AI 3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Data Science Pipelines Operator for Red Hat OpenShift AI allows for execution with unnecessary privileges.

Executive Summary:
The Data Science Pipelines Operator in Red Hat OpenShift AI is susceptible to a privilege escalation flaw that could lead to unauthorized system-wide impact.

Vulnerability Details

CVE-ID: CVE-2026-18608

Affected Software: Red Hat OpenShift AI

Affected Versions: Red Hat OpenShift AI 3.3

Vulnerability: This flaw stems from execution with unnecessary privileges (CWE-250) within the Data Science Pipelines Operator (DSPO). The CVSS vector confirms that an authenticated attacker with high privileges can exploit this via network access to cause a scope change and compromise system integrity and confidentiality.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a severe risk to the entire OpenShift cluster environment. Successful exploitation could allow an attacker to bypass security boundaries, potentially leading to cross-namespace data access or unauthorized modification of critical pipeline configurations.

Remediation Plan

Immediate Action: Apply the vendor security update to Red Hat OpenShift AI 3.3, ensuring the Data Science Pipelines Operator is updated to version 1785187936 or later per RHSA-2026:53263.

Proactive Monitoring: Monitor for anomalous pipeline activity or unexpected changes to cluster-wide settings and operator configurations.

Compensating Controls: Enforce tight security context constraints and limit access to the Data Science Pipelines Operator to only authorized administrative personnel.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The necessity of high privileges to trigger this flaw suggests that insider threats or compromised administrative accounts are the primary vectors of concern.

Analyst Recommendation

Given the potential for a scope-changing impact on the OpenShift cluster, this issue must be addressed with high urgency. Administrators should verify their current version of the Data Science Pipelines Operator and apply the necessary patches provided by Red Hat without delay.

---METADATA---
VENDOR: Wavlink
PRODUCT: WN572, WN570H, WN573, WN529, WN530, WN531
AFFECTED_VERSIONS: 20260609
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple Wavlink networking devices are vulnerable to stack-based buffer overflows and memory corruption, potentially allowing remote code execution.

Executive Summary:
A critical memory corruption vulnerability in various Wavlink network devices could allow an authenticated attacker to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-18607

Affected Software: Wavlink WN572, WN570H, WN573, WN529, WN530, WN531

Affected Versions: 20260609

Vulnerability: The affected devices are prone to stack-based buffer overflows (CWE-121) and general memory corruption (CWE-119). These flaws require the attacker to have low-level privileges to successfully trigger the vulnerable memory condition.

Business Impact

Exploitation of these vulnerabilities may result in a complete system compromise, enabling an attacker to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this flaw poses a severe risk to network security, as compromised devices can be used as pivot points for further lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Wavlink for the affected device models.

Proactive Monitoring: Review device access logs for signs of unauthorized configuration changes or anomalous traffic patterns indicative of memory corruption attempts.

Compensating Controls: Restrict management interface access to trusted IP addresses only and disable unnecessary services to minimize the attack surface.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. These memory corruption vulnerabilities are historically common targets for weaponized exploits.

Analyst Recommendation

The presence of a proof-of-concept necessitates immediate action. Administrators must verify the firmware version of all deployed Wavlink hardware and apply updates to prevent the potential for remote code execution.

---METADATA---
VENDOR: Razer
PRODUCT: RzUpdateService
AFFECTED_VERSIONS: 1.10.14.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in the Razer RzUpdateService allows local authenticated users to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in the Razer RzUpdateService allows an attacker with low privileges to gain elevated control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-18606

Affected Software: Razer RzUpdateService

Affected Versions: 1.10.14.0

Vulnerability: The vulnerability involves incorrect privilege assignment (CWE-269, CWE-266) within the service's named pipe communication. An attacker with local access (AV:L) and low privileges (PR:L) can exploit this flaw to execute operations with higher permissions than intended.

Business Impact

Successful exploitation of this privilege escalation flaw allows an attacker to bypass security controls on the local host. This could result in the installation of unauthorized software, persistence mechanisms, or the theft of sensitive user credentials, significantly increasing the impact of a compromised workstation.

Remediation Plan

Immediate Action: Apply the latest software updates for Razer Synapse or the RzUpdateService. If no update is available, restrict user permissions to prevent unauthorized service interaction.

Proactive Monitoring: Audit system logs for suspicious process spawning or unauthorized attempts to access named pipes associated with the Razer update service.

Compensating Controls: Implement endpoint protection solutions that monitor for lateral movement or privilege escalation attempts originating from legitimate background services.

Exploitation Status

Public Exploit Available: Yes (Technical proof-of-concept documentation)

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for users already present on the local machine.

Analyst Recommendation

This vulnerability represents a significant risk to workstations running Razer software. Administrators should prioritize patching the RzUpdateService and ensure that local user accounts are configured with the principle of least privilege to limit the impact of potential local exploits.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the ovpn-client.get_recommend_config function of GL.iNet GL-MT3000 routers allows unauthenticated remote attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in the GL.iNet GL-MT3000 firmware permits unauthenticated remote attackers to execute arbitrary commands with high privileges.

Vulnerability Details

CVE-ID: CVE-2026-18602

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the ovpn-client.get_recommend_config function within the /cgi-bin/glc file. By manipulating the Hostname argument, an unauthenticated remote attacker can trigger command injection, enabling execution of arbitrary commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands remotely poses a severe threat to business operations. Attackers could gain full control over the router, facilitate lateral movement into the internal network, or deploy persistent malware. With a CVSS score of 9.8, the potential for total system compromise necessitates urgent remediation.

Remediation Plan

Immediate Action: Update the GL.iNet GL-MT3000 firmware to the latest version provided by the vendor to eliminate the command injection vector.

Proactive Monitoring: Review system logs for suspicious process execution and monitor for anomalous outbound traffic from the router that may indicate command-and-control communication.

Compensating Controls: Implement strict firewall rules to block unauthorized access to the web administration interface from external networks until the firmware is updated.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows direct OS command execution without prior authentication.

Analyst Recommendation

This vulnerability represents a critical security risk that can be exploited remotely by unauthenticated attackers. Security teams must ensure all affected GL.iNet devices are updated to the latest available firmware immediately to mitigate the risk of remote command execution and potential network-wide compromise.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 ovpn-client.so plugin allows unauthenticated remote attackers to execute arbitrary code via the filename argument in /cgi-bin/glc.

Executive Summary:
A critical command injection vulnerability in GL.iNet GL-MT3000 routers allows unauthenticated remote code execution, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-18601

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability is a command injection flaw (CWE-77) located in the ovpn-client.check_config function. It permits an unauthenticated remote attacker to execute system commands by manipulating the filename argument.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation grants attackers full control over the router, which can be leveraged to intercept network traffic, pivot into internal networks, or deploy persistent malware, leading to significant data breaches and operational downtime.

Remediation Plan

Immediate Action: Restrict management interface access to trusted networks only and monitor vendor channels for the release of a firmware patch addressing this specific component.

Proactive Monitoring: Review system logs for unusual process execution or modification attempts within the /cgi-bin/ directory.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the /cgi-bin/glc endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub.

Analyst Notes: As of Aug 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the critical severity and the public availability of exploit code, administrators must treat this vulnerability with the highest priority. If a patch is not yet available, implement strict network segmentation to isolate the affected devices from the internet until a secure update can be applied.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the GL.iNet GL-MT3000 router that allows authenticated users to execute arbitrary system commands via the network switch information RPC interface.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to achieve remote code execution on affected devices.

Vulnerability Details

CVE-ID: CVE-2026-18600

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This is a command injection vulnerability (CWE-77) triggered via the network switch information RPC. The vulnerability requires the attacker to have low-level authenticated access to the device to execute arbitrary commands.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary commands with system privileges. This can lead to full device compromise, potential lateral movement within the local network, and the exfiltration of sensitive configuration data. Given the CVSS score of 8.8, this poses a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Monitor official vendor communication channels for the release of a firmware update and apply it immediately upon availability.

Proactive Monitoring: Review device access logs for suspicious RPC calls or unauthorized attempts to access network configuration parameters.

Compensating Controls: Restrict administrative access to the router interface to trusted IP addresses only and disable remote management features if they are not required for business operations.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains low-level access to the management interface.

Analyst Recommendation

The severity of this command injection flaw necessitates immediate attention. Administrators should restrict access to the management interface to minimize the attack surface while awaiting a vendor-supplied firmware patch. Once a patch is released, prioritize its deployment to all managed GL-MT3000 units to prevent potential remote code execution.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows an authenticated attacker to gain full control over the affected device.

Vulnerability Details

CVE-ID: CVE-2026-18599

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability stems from improper input validation (CWE-77, CWE-74) in the device configuration logic. The attacker must possess low-level privileges (PR:L) on the local network (AV:A) to inject malicious commands into the system.

Business Impact

An attacker who successfully exploits this vulnerability can achieve full system compromise, leading to data exfiltration, interception of network traffic, or the use of the device as a pivot point for further network attacks. The CVSS score of 8.0 confirms a high-risk scenario that threatens the integrity and confidentiality of the entire local network segment.

Remediation Plan

Immediate Action: Update the GL-MT3000 firmware to the latest version provided by the manufacturer. If a patch is not yet available, restrict administrative access to the device.

Proactive Monitoring: Review system logs for unexpected command execution or modifications to configuration files that deviate from established baselines.

Compensating Controls: Disable remote administrative access and ensure that the web management interface is only accessible from trusted, segmented management VLANs.

Exploitation Status

Public Exploit Available: Yes (GitHub PoC repository)

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept increases the likelihood of opportunistic attacks.

Analyst Recommendation

Given the availability of proof-of-concept code and the high potential for total system compromise, users of the GL-MT3000 should treat this as a high-priority update. Ensure that all firmware updates are obtained directly from the vendor to maintain device security.

---METADATA---
VENDOR: GL.iNet
PRODUCT: GL-MT3000
AFFECTED_VERSIONS: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the GL.iNet GL-MT3000 router, allowing authenticated users to execute arbitrary commands through the system log retrieval RPC interface.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to execute arbitrary system commands via the log management interface.

Vulnerability Details

CVE-ID: CVE-2026-18598

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This is a command injection vulnerability (CWE-77) found within the logread system log retrieval RPC. An attacker must possess authenticated access to the device to leverage this flaw for command execution.

Business Impact

Exploitation of this vulnerability grants an authenticated attacker the ability to execute commands on the underlying operating system. This could lead to a total loss of confidentiality and integrity regarding the router's operation, potentially allowing for network traffic interception or total device takeover. The CVSS score of 8.8 reflects the high severity of such an impact on network infrastructure.

Remediation Plan

Immediate Action: Check the GL.iNet support portal for firmware updates and apply the latest version to all affected GL-MT3000 hardware as soon as it is provided.

Proactive Monitoring: Monitor system logs for unusual commands or unexpected spikes in traffic associated with the log retrieval RPC function.

Compensating Controls: Implement network segmentation to limit the exposure of the router management interface and enforce strong password policies for all authenticated users.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for arbitrary code execution.

Analyst Recommendation

This vulnerability presents a high risk to the security of the affected GL.iNet devices. Security teams should prioritize patching as soon as the vendor provides a fix. In the interim, ensure that access to the management interface is strictly limited to authorized personnel to mitigate the risk of authenticated exploitation.

---METADATA---
VENDOR: Foxit
PRODUCT: Foxit PDF Services API
AFFECTED_VERSIONS: Before 2026-07-27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability in the Foxit PDF Services API allows authenticated users to manipulate external file references during PDF creation.

Executive Summary:
A server-side request forgery vulnerability in the Foxit PDF Services API allows authenticated attackers to perform unauthorized requests to external files, potentially exposing sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-18597

Affected Software: Foxit PDF Services API

Affected Versions: Before 2026-07-27

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability. It occurs during the PDF creation process when the service processes external file references, and it requires the attacker to be authenticated.

Business Impact

The vulnerability is rated with a CVSS score of 8.5, reflecting its potential for significant impact on data confidentiality. An authenticated attacker could potentially use this service to force the application to fetch content from unauthorized locations or internal resources, leading to data exfiltration or internal network mapping.

Remediation Plan

Immediate Action: Update the Foxit PDF Services API to the version released on or after 2026-07-27 to address the identified SSRF flaw.

Proactive Monitoring: Audit logs for the PDF conversion service to identify anomalous file reference requests or attempts to access internal URLs.

Compensating Controls: Ensure the application is deployed in an environment with strict egress filtering to limit the destinations the service can communicate with.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is limited by the requirement for authenticated access.

Analyst Recommendation

Organizations should ensure they have updated their Foxit PDF Services API to the July 2026 patch level. Given the nature of SSRF, restricting the server's network access remains a vital defense-in-depth measure.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-NU516U1
AFFECTED_VERSIONS: 708c073-mt7628
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the nas.cgi component of Wavlink WL-NU516U1 allows remote unauthenticated attackers to execute arbitrary code via the User1Passwd argument.

Executive Summary:
A critical remote code execution vulnerability in Wavlink WL-NU516U1 firmware poses a severe risk of full system compromise for affected devices.

Vulnerability Details

CVE-ID: CVE-2026-18589

Affected Software: Wavlink WL-NU516U1

Affected Versions: 708c073-mt7628

Vulnerability: This is a stack-based buffer overflow vulnerability occurring in the change_password function within the nas.cgi file. The vulnerability is exploitable remotely by an unauthenticated attacker who can send a crafted request to the User1Passwd argument.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary code with elevated privileges on the affected networking device. This could lead to complete system takeover, unauthorized access to network traffic, and the potential for lateral movement into the internal network. Given the CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent unauthorized access.

Remediation Plan

Immediate Action: Update the Wavlink WL-NU516U1 firmware to the latest version provided by the vendor to patch the buffer overflow vulnerability.

Proactive Monitoring: Monitor network traffic and device logs for suspicious access requests to the nas.cgi file, specifically focusing on unusually long input strings in password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter malicious requests containing abnormally large payloads targeted at the nas.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept report is available via GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this memory corruption vulnerability makes it a high-value target for automated exploitation tools.

Analyst Recommendation

The critical severity of this vulnerability, combined with the availability of public technical details, necessitates an immediate patching cycle. Administrators should prioritize upgrading all affected Wavlink WL-NU516U1 devices to the vendor-supplied firmware release to eliminate the underlying memory corruption risk.