---METADATA---
VENDOR: Zimbra
PRODUCT: Collaboration Suite (ZCS)
AFFECTED_VERSIONS: 8.8.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in Zimbra Collaboration Suite's PostJournal service allows unauthenticated attackers to execute arbitrary system commands via SMTP injection.

Executive Summary:
A critical command injection flaw in Zimbra Collaboration Suite enables remote, unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-71275

Affected Software: Zimbra, Collaboration Suite (ZCS)

Affected Versions: 8.8.15

Vulnerability: The PostJournal service contains a command injection flaw due to improper sanitization of the RCPT TO parameter in SMTP traffic. Unauthenticated attackers can inject shell expansion syntax to execute commands within the Zimbra service context.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. Successful exploitation allows an attacker to achieve remote code execution, granting them the ability to steal sensitive email data, pivot into internal network segments, or deploy ransomware within the organization.

Remediation Plan

Immediate Action: Consult the official Zimbra security portal for specific version updates or emergency hotfixes to address the PostJournal service vulnerability.

Proactive Monitoring: Inspect SMTP logs for anomalous characters or shell syntax within the RCPT TO fields and monitor for suspicious child processes spawning from the Zimbra service.

Compensating Controls: Restrict access to the Zimbra SMTP service at the network perimeter, ensuring only trusted mail relays can communicate with the PostJournal service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical remote code execution vulnerability that demands immediate attention. Administrators must restrict network access to the affected service and apply vendor-provided patches as soon as they are made available to protect the integrity of the collaboration infrastructure.

---METADATA---
VENDOR: SUSE
PRODUCT: Harvester
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A network-level vulnerability exists in SUSE Harvester that affects the communication between SUSE Virtualization and the Rancher Manager.

Executive Summary:
A high-severity security vulnerability in SUSE Harvester creates a significant risk for environments utilizing SUSE Virtualization and Rancher Manager.

Vulnerability Details

CVE-ID: CVE-2025-71261

Affected Software: SUSE Harvester

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the network-level interaction between SUSE Virtualization and the Rancher Manager. It allows an attacker with network access between these components to potentially disrupt or compromise the management plane.

Business Impact

With a CVSS score of 8.6, this vulnerability is classified as High. Successful exploitation could lead to unauthorized access to management functions, potentially resulting in the compromise of virtualized infrastructure or service disruption, which poses a severe risk to operational continuity.

Remediation Plan

Immediate Action: Apply all available security updates provided by SUSE immediately to the affected Harvester, Virtualization, and Rancher components.

Proactive Monitoring: Monitor network traffic for anomalous communication patterns between the Rancher Manager and the virtualization layer.

Compensating Controls: Implement strict network segmentation to restrict access to the management plane to authorized administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the Rancher Manager in orchestrating containerized workloads and virtualization, this update should be treated as a priority. Administrators must verify their current versioning against the latest SUSE security bulletins and apply patches immediately to mitigate the risk of unauthorized management access.

---METADATA---
VENDOR: NR
PRODUCT: Modem
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the NR modem component allows for improper input validation, which may lead to system instability or unauthorized behavior.

Executive Summary:
An improper input validation vulnerability in the NR modem component presents a high-risk security threat that demands immediate vendor-provided remediation.

Vulnerability Details

CVE-ID: CVE-2025-71256

Affected Software: NR Modem

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw consists of improper input validation within the NR modem firmware. This type of vulnerability typically allows an attacker to exploit the interface by sending specifically crafted input to trigger memory corruption or logic errors.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity of communication infrastructure. Successful exploitation could lead to unauthorized access or persistent denial-of-service, negatively impacting critical business communications.

Remediation Plan

Immediate Action: Update the firmware of all NR modem devices to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor device logs for signs of unexpected reboots or service failures that may indicate an attempt to exploit the input validation flaw.

Compensating Controls: Implement strict network access controls to limit communication with the modem interface to trusted endpoints only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Firmware security is critical for hardware-level components. Organizations should prioritize updating all NR modem devices to ensure they are protected against this input validation vulnerability.

---METADATA---
VENDOR: Modem
PRODUCT: IMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Modem IMS component allows for improper input validation, which may lead to system instability or unauthorized behavior.

Executive Summary:
A high-severity input validation vulnerability in the Modem IMS component requires immediate attention to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-71255

Affected Software: Modem IMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an improper input validation vulnerability within the Modem IMS. Such flaws often allow attackers to supply crafted data that the system fails to sanitize, potentially resulting in memory corruption or arbitrary command execution.

Business Impact

Assigned a CVSS score of 7.5, this issue poses a substantial risk to service availability and data integrity. Organizations should consider the potential for operational disruption if systems are targeted via this vulnerability.

Remediation Plan

Immediate Action: Monitor vendor support channels for the release of security patches and apply them immediately to all affected hardware.

Proactive Monitoring: Inspect traffic patterns entering the modem interface for malformed packets or unusual data sequences.

Compensating Controls: Where applicable, apply rate-limiting to input interfaces to mitigate the impact of potential automated exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is necessary to mitigate the risk posed by this vulnerability. Security teams should ensure that all firmware updates are validated and deployed across the enterprise environment without delay.

---METADATA---
VENDOR: Modem
PRODUCT: IMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Modem IMS component allows for improper input validation, which may lead to system instability or unauthorized behavior.

Executive Summary:
An improper input validation vulnerability in the Modem IMS component creates a high-risk security exposure that requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2025-71254

Affected Software: Modem IMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in how the Modem IMS component handles input. Improper validation can lead to buffer overflows or logic errors, potentially allowing an attacker to manipulate system processes.

Business Impact

The CVSS score of 7.5 indicates a significant risk of compromise. Successful exploitation could lead to denial-of-service conditions or unauthorized access, impacting the reliability and integrity of the affected communication systems.

Remediation Plan

Immediate Action: Apply all relevant security updates provided by the hardware or software vendor as soon as they become available.

Proactive Monitoring: Review system diagnostic logs for signs of input-related errors or unexpected modem resets.

Compensating Controls: Use network segmentation to isolate modem communication channels from untrusted networks to reduce the surface area for potential attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this as a high-priority update. Ensure that all hardware using the affected IMS component is registered for security notifications to facilitate the rapid application of patches once released.

---METADATA---
VENDOR: Modem
PRODUCT: IMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Modem IMS component allows for improper input validation, which may lead to system instability or unauthorized behavior.

Executive Summary:
Improper input validation within the Modem IMS component presents a high risk of potential exploitation, necessitating immediate vendor-provided updates.

Vulnerability Details

CVE-ID: CVE-2025-71253

Affected Software: Modem IMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from improper input validation within the Modem IMS framework. It is currently unclear if this requires authentication; however, input validation flaws in low-level communication software often allow for unauthenticated remote or local triggering.

Business Impact

With a CVSS score of 7.5, this high-severity vulnerability could lead to service disruption or potential code execution depending on the specific input vector. Organizations utilizing affected modem infrastructure face potential operational downtime if this vulnerability is successfully leveraged by an attacker.

Remediation Plan

Immediate Action: Identify systems utilizing the affected Modem IMS software and apply the latest security patches released by the vendor.

Proactive Monitoring: Monitor system logs for unexpected crashes or error messages related to modem communication processes.

Compensating Controls: Restrict network access to management interfaces and ensure that input to the modem interface is strictly sanitized by upstream firewalls or proxy services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of modem communication in network operations, organizations should prioritize vendor communication to verify patch availability. Maintaining updated firmware is essential to preventing potential exploitation of this input validation flaw.

---METADATA---
VENDOR: Unknown
PRODUCT: Modem IMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Modem IMS component allows for potential exploitation due to improper input validation.

Executive Summary:
An input validation flaw in the Modem IMS stack could lead to system instability or service degradation in affected mobile or network devices.

Vulnerability Details

CVE-ID: CVE-2025-71252

Affected Software: Modem IMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the failure of the Modem IMS component to properly validate incoming data. An unauthenticated attacker capable of communicating with the modem could trigger unexpected behavior, potentially leading to a device crash or loss of signal.

Business Impact

With a CVSS score of 7.5, this vulnerability is a high-priority concern for mobile and embedded device security. Exploitation could lead to loss of device functionality, disrupting user access to mobile networks and critical communication services.

Remediation Plan

Immediate Action: Apply the latest firmware or software updates provided by the device manufacturer or service provider.

Proactive Monitoring: Track device performance and connectivity metrics for patterns that suggest service interruptions or repeated modem resets.

Compensating Controls: Restrict unnecessary network exposure of device management interfaces to prevent unauthorized remote access to the vulnerable modem components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the difficulty of patching embedded modem firmware, security teams should work closely with hardware vendors to ensure updates are tested and deployed across the fleet as quickly as possible.

---METADATA---
VENDOR: Unknown
PRODUCT: IMS (IP Multimedia Subsystem)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the IP Multimedia Subsystem (IMS) allows for potential system crashes due to improper input validation.

Executive Summary:
Improper input validation in the IMS framework presents a high risk of service disruption through system crashes.

Vulnerability Details

CVE-ID: CVE-2025-71251

Affected Software: IMS (IP Multimedia Subsystem)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from insufficient validation of input processed by the IMS stack. An unauthenticated attacker could send malformed packets or messages to the service, triggering a crash and resulting in a denial-of-service state.

Business Impact

The CVSS score of 7.5 highlights the potential for significant disruption to communication services. Since IMS is often critical for voice and multimedia traffic, a successful exploit could lead to widespread service outages and loss of connectivity for users.

Remediation Plan

Immediate Action: Deploy vendor-supplied patches or firmware updates that address the identified input validation flaws within the IMS stack.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual spikes in service restart events.

Compensating Controls: Use network intrusion detection systems (NIDS) to identify and block traffic patterns indicative of malformed protocol exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations operating IMS infrastructure must prioritize this update, as the protocol is a critical component of telecommunications and enterprise communication services.

---METADATA---
VENDOR: SPIP
PRODUCT: Saisies pour formulaire (Saisies) plugin
AFFECTED_VERSIONS: 5.4.0 through 5.11.0
---END_METADATA---

Description Summary:
The 'Saisies' plugin for SPIP contains a critical Remote Code Execution (RCE) vulnerability that allows attackers to run arbitrary code on the host server.

Executive Summary:
A critical RCE vulnerability in the SPIP 'Saisies' plugin allows unauthenticated attackers to execute arbitrary code and gain full control over the affected web server.

Vulnerability Details

CVE-ID: CVE-2025-71243

Affected Software: SPIP Saisies Plugin

Affected Versions: 5.4.0 through 5.11.0

Vulnerability: This vulnerability is a Remote Code Execution (RCE) flaw within the form processing logic of the 'Saisies' plugin. It allows an unauthenticated attacker to inject and execute arbitrary code on the server hosting the SPIP CMS.

Business Impact

A successful exploit would result in a total loss of confidentiality, integrity, and availability. Attackers could install backdoors, steal sensitive site data, or use the server for further attacks. The CVSS score of 9.8 underscores the extreme risk and the ease with which an attacker could take over the server.

Remediation Plan

Immediate Action: Immediately update the 'Saisies pour formulaire' plugin to version 5.11.1 or later.

Proactive Monitoring: Monitor server logs for unusual PHP execution patterns or suspicious files uploaded to the web directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block malicious payloads targeting SPIP plugin endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, RCE vulnerabilities in popular CMS plugins are frequently targeted by automated exploit kits.

Analyst Recommendation

Due to the critical nature of RCE flaws, this update should be performed during the next available maintenance window or sooner. Failure to patch leaves the underlying infrastructure vulnerable to complete takeover by unauthenticated remote actors.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An origin validation error in the Trend Micro Apex One (Mac) agent self-protection mechanism may allow a local authenticated attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in Trend Micro Apex One (Mac) poses a significant risk to endpoint integrity by allowing attackers to bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2025-71217

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: This is an origin validation error within the agent's self-protection mechanism. The CVSS vector (AV:L/PR:L/UI:N) confirms that a local user with low privileges can exploit this flaw to gain elevated access.

Business Impact

Successful exploitation allows a local attacker to escalate their privileges, potentially gaining full control over the affected endpoint. Given the CVSS score of 7.8, this represents a High severity risk, as it undermines the security posture of the endpoint protection agent itself, which is intended to prevent such unauthorized actions.

Remediation Plan

Immediate Action: Review the Trend Micro security advisory (KA-0022458) to identify the specific patched version and apply the update to all affected Mac endpoints immediately.

Proactive Monitoring: Audit local system logs for unusual process execution patterns or unauthorized attempts to interact with the Apex One agent service.

Compensating Controls: Ensure that local user accounts on managed endpoints follow the principle of least privilege to minimize the potential for local exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it targets the self-protection mechanism of security software, providing a path for attackers to neutralize endpoint defenses.

Analyst Recommendation

This vulnerability is categorized as High severity due to the potential for privilege escalation on managed endpoints. IT administrators should prioritize identifying affected versions via the provided Trend Micro knowledge base article and apply the necessary patches as soon as they become available to maintain the integrity of their security infrastructure.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
A time-of-check time-of-use (TOCTOU) vulnerability in the Trend Micro Apex One (Mac) agent cache mechanism can be leveraged by a local attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in Trend Micro Apex One (Mac) enables attackers to compromise system security by exploiting a race condition in the agent cache.

Vulnerability Details

CVE-ID: CVE-2025-71216

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: This is a time-of-check time-of-use (TOCTOU) race condition within the agent cache mechanism. An attacker with low privileges (PR:L) on the local system can exploit this timing window to execute unauthorized code with elevated privileges.

Business Impact

This vulnerability carries a CVSS score of 7.8, indicating a high risk to business operations. By escalating privileges, an attacker could bypass endpoint security controls, leading to potential data exfiltration, malware persistence, or total system compromise of the affected workstation.

Remediation Plan

Immediate Action: Consult the Trend Micro security advisory (KA-0022458) to determine the fixed version and deploy the update across your fleet.

Proactive Monitoring: Monitor system performance and logs for signs of unexpected cache access or race condition exploitation attempts.

Compensating Controls: Restrict local administrative rights where possible to reduce the surface area for local exploitation of system services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TOCTOU vulnerabilities are often complex to exploit but provide a reliable path for privilege escalation once a stable exploit is developed.

Analyst Recommendation

Given the High severity of this privilege escalation flaw, immediate action is required. Organizations should track the official vendor release notes for the patch and prioritize the deployment of the update to ensure that the Apex One agent's cache mechanism is properly secured against race conditions.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: Trend Micro Apex One 2019 (On-prem) for Windows, and Apex One as a Service / Trend Vision One Endpoint - Standard Endpoint Protection (SaaS) for Windows and Mac.
---END_METADATA---

Description Summary:
A time-of-check time-of-use (TOCTOU) vulnerability in the Trend Micro Apex One agent iCore service signature verification allows for local privilege escalation.

Executive Summary:
A high-severity local privilege escalation vulnerability in Trend Micro Apex One could allow a local attacker to gain elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2025-71215

Affected Software: Trend Micro Apex One

Affected Versions: Trend Micro Apex One 2019 (On-prem) for Windows, and Apex One as a Service / Trend Vision One Endpoint - Standard Endpoint Protection (SaaS) for Windows and Mac.

Vulnerability: This is a time-of-check time-of-use (TOCTOU) vulnerability within the iCore service's signature verification process. An authenticated local attacker must first achieve low-privileged code execution on the target system to exploit this flaw and elevate their privileges.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to bypass standard security restrictions, resulting in unauthorized administrative access to the host. Given the CVSS score of 7.0, this represents a significant risk to endpoint integrity, potentially enabling persistent malware installation or data exfiltration on compromised systems.

Remediation Plan

Immediate Action: For on-premises Windows, apply Critical Patch Build 14136. For Windows SaaS, apply Security Agent Build 14.0.20315; Mac SaaS users should ensure they are on the latest updates (SaaS 2507 & 2005).

Proactive Monitoring: Monitor system logs for unauthorized service execution or suspicious modifications to agent files that might indicate an attempt to exploit the iCore service.

Compensating Controls: Ensure that local access controls are strictly enforced to minimize the ability for unauthorized users to execute arbitrary code on endpoints where the Apex One agent is deployed.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the deployment of the provided patches for their respective Apex One environments. Because this vulnerability facilitates local privilege escalation, mitigating the initial entry point for low-privileged users is essential to reducing the overall risk profile.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An origin validation error in the Trend Micro Apex One (Mac) agent iCore service may allow a local authenticated attacker to achieve privilege escalation.

Executive Summary:
A local privilege escalation flaw in the Trend Micro Apex One (Mac) iCore service allows authenticated users to gain elevated rights, necessitating immediate remediation.

Vulnerability Details

CVE-ID: CVE-2025-71214

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an origin validation error within the agent's iCore service. An attacker with low-level local access (PR:L) can exploit this service to perform operations outside of their intended permission level.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational security. Successful exploitation grants an attacker elevated privileges, which could be used to disable security monitoring, exfiltrate sensitive data, or establish a permanent foothold on the compromised macOS system.

Remediation Plan

Immediate Action: Refer to the Trend Micro security advisory (KA-0022458) to identify and install the required security patch for the iCore service.

Proactive Monitoring: Review system logs for unusual interaction with the iCore service or unexpected service restarts that may indicate an exploitation attempt.

Compensating Controls: Implement endpoint monitoring to detect unauthorized privilege changes or anomalous service behavior on Mac environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. As this affects a core service, it is critical to address this flaw to prevent unauthorized access to the underlying OS through the security agent.

Analyst Recommendation

The severity of this issue demands prompt attention. Security teams should prioritize patching the Trend Micro Apex One (Mac) agent to eliminate this privilege escalation risk. Ensure that all updates are verified via the official Trend Micro support portal to maintain system integrity.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local origin validation error in Trend Micro Apex One allows authenticated local attackers to escalate privileges on affected systems.

Executive Summary:
A vulnerability in Trend Micro Apex One allows local attackers to achieve privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-71213

Affected Software: Trend Micro Apex One

Affected Versions: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315

Vulnerability: This is an origin validation error (CWE-346) that can be exploited by a local attacker with low privileges to escalate their authority on the host machine.

Business Impact

The ability for a local attacker to escalate privileges could lead to a full compromise of the affected endpoint, enabling the execution of arbitrary code with administrative rights. With a CVSS score of 7.8 (High), this vulnerability represents a significant risk to organizational security, as it facilitates lateral movement and persistent access for malicious actors.

Remediation Plan

Immediate Action: Update Trend Micro Apex One to version 14.0.0.14136 or higher, or update the SaaS instance to at least 14.0.20315.

Proactive Monitoring: Review system access logs for unauthorized attempts to invoke management functions or unexpected privilege changes.

Compensating Controls: Restrict local system access to authorized personnel only to minimize the potential attack surface for local privilege escalation exploits.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already have local access to the target system.

Analyst Recommendation

Given the potential for privilege escalation and the high CVSS severity rating, administrators should prioritize applying the provided security updates. Patching the affected software is the only reliable method to mitigate the underlying origin validation flaw.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A link following vulnerability in the Trend Micro Apex One scan engine allows local attackers to escalate privileges on affected installations.

Executive Summary:
A link-following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges, leading to unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2025-71212

Affected Software: Trend Micro Apex One

Affected Versions: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315

Vulnerability: This is an improper link resolution vulnerability (CWE-59) that permits a local attacker with low privileges to manipulate file access paths to gain elevated permissions.

Business Impact

Successful exploitation allows a local attacker to bypass security constraints, potentially gaining administrative access to the host. This high-severity issue (CVSS 7.8) could result in the total compromise of the affected machine, facilitating data theft or further malicious activity within the network.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates, upgrading to version 14.0.0.14136 or the equivalent SaaS version 14.0.20315.

Proactive Monitoring: Monitor for unusual file system activity or attempts to create symbolic links in directories used by the security agent.

Compensating Controls: Implement strict file system permissions to limit the ability of non-privileged users to interact with scan engine directories.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The attack requires local access to the system.

Analyst Recommendation

Immediate patching is required to address this privilege escalation risk. Organizations should ensure all endpoints running the affected versions are updated to the latest security baseline provided by Trend Micro.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One Management Console
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A secondary vulnerability in the Trend Micro Apex One management console allows remote attackers to upload malicious code and execute commands.

Executive Summary:
A critical remote code execution vulnerability in the Trend Micro Apex One management console permits unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2025-71211

Affected Software: Trend Micro Apex One Management Console

Affected Versions: See vendor advisory

Vulnerability: Similar to CVE-2025-71210, this flaw affects a different executable within the management console, enabling remote code execution via malicious file uploads. It requires network access to the console to exploit.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for full system compromise. If exploited, an attacker could manipulate security policies, exfiltrate sensitive data, or deploy malware, effectively nullifying the protection provided by the security software itself.

Remediation Plan

Immediate Action: Apply the latest vendor-supplied patches for all on-premises Apex One installations.

Proactive Monitoring: Audit access logs for the management console and investigate any suspicious file upload activities.

Compensating Controls: Restrict access to the management console to authorized administrative subnets and consider using a VPN to tunnel management traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability must be addressed immediately alongside CVE-2025-71210. Organizations should verify their security posture by ensuring all management consoles are isolated from untrusted networks.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One Management Console
AFFECTED_VERSIONS: Apex One 2019 (On-Prem)
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the Trend Micro Apex One management console allows remote code execution through malicious file uploads.

Executive Summary:
A critical directory traversal vulnerability in the Trend Micro Apex One management console allows for remote code execution by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-71210

Affected Software: Trend Micro, Apex One Management Console

Affected Versions: Apex One 2019 (On-Prem)

Vulnerability: This is a Console Directory Traversal Remote Code Execution issue. While the vulnerability allows for command execution, it requires the attacker to have access to the management console to initiate the upload of malicious code.

Business Impact

The CVSS score of 9.8 reflects the high severity of this flaw. Compromise of the Apex One management console grants an attacker control over the endpoint security environment, enabling them to disable security agents, deploy malware, or exfiltrate data from across the entire corporate network.

Remediation Plan

Immediate Action: Apply Critical Patch Build 14136 for on-premise Windows installations of Apex One 2019. SaaS versions have been mitigated automatically by the vendor.

Proactive Monitoring: Audit administrative access logs for the management console and investigate any unauthorized file upload or configuration change activities.

Compensating Controls: If the console is externally exposed, restrict access to trusted source IP addresses and ensure the console is not accessible via the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, Trend Micro is not aware of in-the-wild exploitation for this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Securing the management console is paramount to maintaining organizational security. Administrators should apply the specified Critical Patch immediately and review network exposure to prevent potential exploitation of this high-risk vulnerability.

Executive Summary:
A critical vulnerability has been discovered in multiple Errands products that could allow a remote, unauthenticated attacker to execute arbitrary code on affected systems. Successful exploitation could lead to a complete system compromise, resulting in data theft, service disruption, or further intrusion into the network. Organizations are urged to apply the vendor-provided security patches immediately to mitigate this high-severity risk.

Vulnerability Details

CVE-ID: CVE-2025-71063

Affected Software: Errands Multiple Products

Affected Versions: All versions before 46

Vulnerability:
The vulnerability is an unauthenticated remote code execution (RCE) flaw within a core service component of multiple Errands products. The issue stems from the improper validation of user-supplied input when processing API requests. An attacker can craft a malicious request containing specially formatted data that, when processed by the application, triggers a buffer overflow, allowing for the execution of arbitrary code with the privileges of the application's service account. This attack can be performed remotely over the network without requiring any prior authentication or user interaction.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. A successful exploit would have a significant negative impact on the business, granting an attacker complete control over the affected systems. This could lead to the exfiltration of sensitive corporate or customer data, disruption of critical business services, reputational damage, and financial loss. Furthermore, a compromised system could be used as an entry point to launch further attacks against the internal network, escalating the security incident.

Remediation Plan

Immediate Action:
Organizations must prioritize the immediate application of security updates provided by Errands to patch all affected products to version 46 or later. System administrators should follow the vendor's patching guidelines, verify the successful installation of the update, and restart services as required.

Proactive Monitoring:
Security teams should actively monitor for signs of exploitation. This includes reviewing web server and application access logs for unusual or malformed requests targeting the affected services. Monitor network traffic for anomalous outbound connections from servers running Errands products, which could indicate a successful compromise and command-and-control (C2) communication.

Compensating Controls:
If immediate patching is not feasible, implement compensating controls to reduce the risk. Restrict network access to the vulnerable services to only trusted IP addresses using a web application firewall (WAF) or network firewall rules. If possible, enable any available security features within the product that may limit exposure of the vulnerable component.

Exploitation Status

Public Exploit Available: false

Analyst Notes:
As of the publication date, January 13, 2026, there are no known public proof-of-concept (PoC) exploits available for this vulnerability. However, given the critical nature of the flaw (unauthenticated RCE), it is highly probable that threat actors will reverse-engineer the patch to develop exploits. Active scanning for vulnerable systems is anticipated to begin shortly.

Analyst Recommendation

This vulnerability represents a critical risk to the organization due to its high severity (CVSS 8.2) and the potential for unauthenticated remote code execution. Although this CVE is not yet listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its characteristics make it a prime target for future exploitation. We strongly recommend that all system owners identify affected Errands products within their environment and apply the vendor-supplied security update to version 46 or newer with the highest priority to prevent potential system compromise.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 810 / nv810v4 router firmware
AFFECTED_VERSIONS: v1.5.0-140603
---END_METADATA---

Description Summary:
Insecure default credentials in the Telnet service of UTT HiPER routers allow remote attackers to gain root access via automated scripts.

Executive Summary:
The use of default credentials in UTT HiPER 810 and nv810v4 routers exposes the devices to full remote takeover by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-70998

Affected Software: UTT HiPER 810 / nv810v4 router firmware

Affected Versions: v1.5.0-140603

Vulnerability: The firmware contains hardcoded or insecure default credentials for the Telnet management service. An unauthenticated remote attacker can exploit this by using a crafted script to log in and gain root-level privileges.

Business Impact

Unauthorized root access to a core networking device allows attackers to intercept traffic, redirect data, or use the router as a foothold for lateral movement within the corporate network. The CVSS score of 9.8 reflects the ease of exploitation and the critical impact on network infrastructure security.

Remediation Plan

Immediate Action: Update the router firmware to the latest version and immediately change all default administrative passwords to strong, unique credentials.

Proactive Monitoring: Review Telnet access logs for successful logins from unrecognized IP addresses and monitor for unusual configuration changes on the router.

Compensating Controls: Disable Telnet entirely in favor of SSH and implement access control lists (ACLs) to restrict management interface access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, default credential vulnerabilities are frequently targeted by botnets and automated scanning tools.

Analyst Recommendation

Default credentials are a primary target for automated attacks. Administrators must treat this as a high-priority item, ensuring that firmware is updated and that management services are secured behind strong authentication and network-level restrictions.

---METADATA---
VENDOR: RuoYi
PRODUCT: RuoYi
AFFECTED_VERSIONS: v4.8.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the RuoYi update function allows unauthorized attackers to modify data outside of their intended scope.

Executive Summary:
A critical access control vulnerability in RuoYi v4.8.2 enables unauthorized users to perform arbitrary data modification, threatening the integrity of the application.

Vulnerability Details

CVE-ID: CVE-2025-70985

Affected Software: RuoYi

Affected Versions: v4.8.2

Vulnerability: The vulnerability stems from improper access control logic within the application's update function. This flaw allows an attacker to bypass intended security boundaries and perform unauthorized data modification.

Business Impact

The CVSS score of 9.1 highlights the severity of this flaw, as it permits unauthorized manipulation of sensitive data. Exploitation could lead to significant data corruption, loss of business logic integrity, and unauthorized state changes within the application, severely impacting operational reliability.

Remediation Plan

Immediate Action: Update RuoYi to the latest available version provided by the vendor to remediate the access control flaw.

Proactive Monitoring: Review application audit logs for unauthorized update attempts or modifications to records that should be restricted to administrative users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to intercept and block suspicious POST or PUT requests targeting the identified update functions.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jan 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk to data integrity. Administrators must prioritize updating affected RuoYi installations to the latest version to prevent unauthorized data manipulation by malicious actors.

---METADATA---
VENDOR: SpringBlade
PRODUCT: SpringBlade
AFFECTED_VERSIONS: v4.5.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the SpringBlade authRoutes function allows low-privileged users to escalate their privileges.

Executive Summary:
A critical privilege escalation vulnerability in SpringBlade v4.5.0 allows low-level users to gain unauthorized administrative access, posing a severe threat to system security.

Vulnerability Details

CVE-ID: CVE-2025-70983

Affected Software: SpringBlade

Affected Versions: v4.5.0

Vulnerability: The flaw resides in the authRoutes function, which fails to properly enforce capability checks. This allows an attacker with low-level privileges to escalate their access level to that of an administrator.

Business Impact

With a CVSS score of 9.9, this is a critical vulnerability that facilitates full system compromise via privilege escalation. Unauthorized administrative access can lead to total loss of confidentiality, integrity, and availability, as the attacker can perform any action available to a legitimate administrator.

Remediation Plan

Immediate Action: Apply the latest vendor patch or update to SpringBlade v4.5.0 to enforce correct access control checks.

Proactive Monitoring: Monitor system logs for unusual administrative activities or unexpected privilege changes assigned to standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and restrict access to sensitive routing functions at the application gateway level.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jan 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw, immediate remediation is essential. Organizations should update their SpringBlade deployment immediately to prevent unauthorized users from gaining elevated administrative control.

Executive Summary:
A critical vulnerability has been identified in the SpringBlade framework, which could impact multiple products within the organization. This flaw, designated CVE-2025-70982, allows a low-privileged user to improperly access a user import function, enabling them to create or modify user accounts, potentially granting themselves full administrative control. Successful exploitation could lead to a complete system compromise, resulting in significant data breaches and operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-70982

Affected Software: SpringBlade Framework and dependent products

Affected Versions: Version 4.5.0. See vendor advisory for a complete list of affected versions and products.

Vulnerability: The importUser function within the SpringBlade framework fails to properly enforce access control checks. This allows any authenticated user, regardless of their privilege level, to invoke this function. An attacker with low-level user credentials can craft a malicious data file (e.g., CSV or Excel) and use the import feature to add new users with elevated privileges or overwrite the details of existing users, including administrators. This effectively provides a direct path for a low-privilege attacker to escalate their privileges to the highest level within the application.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9. Exploitation of this flaw could have a severe and direct impact on the business. An attacker gaining administrative access could lead to a catastrophic data breach, involving the theft of sensitive customer information, intellectual property, and internal corporate data. This could result in significant financial losses from regulatory fines (e.g., GDPR, CCPA), loss of customer trust, and severe reputational damage. Furthermore, an attacker could disrupt business operations by maliciously altering or deleting data, causing service outages and impacting business continuity.

Remediation Plan

Immediate Action: The primary remediation is to immediately update all instances of SpringBlade and affected products to the latest version as recommended by the vendor. Before and after applying the patch, security teams must thoroughly review application and audit logs for any suspicious activity related to the importUser function, looking for unauthorized user creation or modification events.

Proactive Monitoring: Implement continuous monitoring of application logs, specifically focusing on API calls to the importUser endpoint. Create alerts for any user import events initiated by non-administrative accounts or from untrusted IP addresses. Monitor for the creation of new user accounts with high privileges and validate their legitimacy with system owners.

Compensating Controls: If immediate patching is not feasible, consider these temporary measures:

• Disable the user import functionality entirely if it is not critical for business operations.
• Implement a Web Application Firewall (WAF) rule to block or restrict access to the specific API endpoint for the importUser function, allowing access only from a small whitelist of administrative IP addresses.
• Enforce multi-factor authentication (MFA) for all privileged accounts to add another layer of security against unauthorized access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 26, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the straightforward nature of an access control flaw, it is highly probable that exploit code will be developed and published in the near future. Organizations should assume that attackers will begin scanning for vulnerable systems imminently.

Analyst Recommendation

This vulnerability presents a critical and immediate threat to the organization. Given the CVSS score of 9.9, the risk of a full system compromise is extremely high. All system owners must prioritize the immediate application of the vendor-supplied security patches across all affected assets. Although this vulnerability is not yet listed on the CISA KEV catalog, its severity makes it a prime candidate for future inclusion. We strongly recommend treating this with the highest urgency to prevent potential data breaches and system takeovers.

---METADATA---
VENDOR: CordysCRM
PRODUCT: CordysCRM
AFFECTED_VERSIONS: 1.4.1
---END_METADATA---

Description Summary:
CordysCRM 1.4.1 contains an SQL Injection vulnerability in the employee list query interface (/user/list) via the 'departmentIds' parameter.

Executive Summary:
CordysCRM 1.4.1 is affected by a critical SQL Injection vulnerability that allows attackers to manipulate database queries and gain unauthorized access to sensitive employee information.

Vulnerability Details

CVE-ID: CVE-2025-70981

Affected Software: CordysCRM

Affected Versions: 1.4.1

Vulnerability: The vulnerability exists in the /user/list endpoint where the departmentIds parameter is not properly sanitized before being used in an SQL query. This allows an attacker to inject malicious SQL commands to bypass authentication or extract data from the CRM database.

Business Impact

The exposure of employee data and CRM records poses a significant privacy risk and potential compliance violation (e.g., GDPR). With a CVSS score of 9.8, this critical flaw could allow an attacker to gain administrative access to the CRM, leading to the total compromise of corporate human resources and client relationship data.

Remediation Plan

Immediate Action: Update CordysCRM to the latest version immediately to address the insecure handling of the departmentIds parameter.

Proactive Monitoring: Review web server and database logs for suspicious activity targeting the /user/list path, specifically looking for SQL keywords in URL parameters.

Compensating Controls: Implement strict input validation and use a Web Application Firewall (WAF) to detect and block SQL injection patterns in incoming HTTP requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. Because CRM systems house highly sensitive internal data, they are high-value targets for corporate espionage and data theft.

Analyst Recommendation

Immediate remediation is required to protect sensitive corporate data. Administrators should prioritize patching CordysCRM and conduct a thorough audit of database access logs to ensure that no unauthorized data extraction has occurred prior to the update.

Executive Summary:
A critical remote code execution vulnerability, identified as CVE-2025-70974, exists in older versions of the Fastjson library. This flaw allows an unauthenticated attacker to take complete control of an affected server by sending a specially crafted data request, potentially leading to data theft, service disruption, and further network compromise. Due to its critical severity and history of active exploitation, immediate remediation is strongly advised.

Vulnerability Details

CVE-ID: CVE-2025-70974

Affected Software: Multiple products using the Fastjson library

Affected Versions: All versions of Fastjson prior to 1.2.48

Vulnerability:
This vulnerability is an insecure deserialization flaw rooted in Fastjson's "autoType" feature. When autoType is enabled, an attacker can submit a malicious JSON payload containing an @type key. This key specifies the name of a Java class on the server's classpath that Fastjson will then instantiate.

An attacker can leverage "gadget chains" by pointing the @type key to a class with specific public methods (e.g., setters or constructors) that are automatically invoked during deserialization. By providing an attacker-controlled value elsewhere in the JSON, such as a JNDI lookup URL (e.g., ldap://attacker.com/a), the gadget class can be tricked into connecting to an attacker's server. This server then responds with a malicious serialized Java object, which is executed on the victim's machine, resulting in unauthenticated Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10.0, reflecting the highest possible risk. Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the permissions of the application server. This can lead to a complete system compromise, enabling the attacker to steal sensitive corporate or customer data, install ransomware, deploy cryptocurrency miners, or use the compromised server as a pivot point to attack other systems within the internal network. The potential consequences include severe financial loss, significant reputational damage, and potential regulatory fines.

Remediation Plan

Immediate Action:
The primary remediation is to upgrade the Fastjson library in all affected applications to version 1.2.48 or a later, secure version. After patching, administrators must monitor for any ongoing exploitation attempts by reviewing application, web server, and system access logs for suspicious JSON payloads or unusual outbound network activity.

Proactive Monitoring:

• Log Analysis: Scrutinize application and web server logs for inbound JSON requests containing the @type keyword followed by suspicious class names (e.g., com.sun.rowset.JdbcRowSetImpl, org.apache.xbean.propertyeditor.JndiConverter).
• Network Traffic Analysis: Monitor for unusual outbound connections from application servers, particularly over ports associated with JNDI protocols like LDAP (389, 1389) and RMI (1099).
• Endpoint Detection: Monitor for unexpected child processes being spawned by the Java application process (e.g., sh, bash, cmd.exe, powershell.exe).

Compensating Controls:
If immediate patching is not feasible, the following controls can help mitigate risk:

• Disable autoType: Explicitly disable the autoType feature in the Fastjson configuration. This is the most effective compensating control.
• Web Application Firewall (WAF): Implement WAF rules to inspect and block JSON payloads containing known malicious patterns associated with this exploit.
• Egress Filtering: Restrict outbound network connections from application servers to only known and trusted destinations, blocking protocols like LDAP and RMI to the public internet.

Exploitation Status

Public Exploit Available: true

Analyst Notes:
As of January 9, 2026, this vulnerability has a documented history of being actively exploited in the wild from 2023 through 2025, prior to its official public disclosure. This indicates that threat actors have been leveraging this flaw for an extended period, and many systems may already be compromised. The exploit is a bypass of a previous patch (CVE-2017-18349), and threat actors are highly proficient at weaponizing Fastjson vulnerabilities due to their prevalence and impact.

Analyst Recommendation

Given the critical CVSS score of 10.0 and confirmed long-term exploitation by threat actors, this vulnerability represents an extreme and immediate threat. All organizations must prioritize identifying and patching affected applications by upgrading the Fastjson library to version 1.2.48 or later without delay. While this CVE is not yet on the CISA KEV list as of its publication, its exploit history makes it a prime candidate for future inclusion. Due to the pre-disclosure exploitation, organizations should assume compromise and initiate incident response procedures, including hunting for indicators of compromise described in the Proactive Monitoring section.

Executive Summary:
A critical Use-After-Free vulnerability has been identified in the FreeImage library, a widely used open-source component for image processing. An attacker can exploit this flaw by tricking a user or an automated process into opening a specially crafted TARGA (TGA) image file, which could lead to arbitrary code execution and a complete compromise of the affected system.

Vulnerability Details

CVE-ID: CVE-2025-70968

Affected Software: FreeImage Multiple Products

Affected Versions: Version 3.18.0 is confirmed vulnerable. See vendor advisory for a complete list of affected products and versions.

Vulnerability: The vulnerability is a Use-After-Free error within the loadRLE() function of the PluginTARGA.cpp component. This function is responsible for parsing Run-Length Encoded (RLE) data in TARGA image files. An attacker can create a malicious TGA image that, when processed by the vulnerable library, causes the application to deallocate a memory region and then attempt to use (read from or write to) that same freed memory. This memory corruption can be leveraged by the attacker to hijack the application's control flow, leading to arbitrary code execution in the security context of the user or service running the application.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation could have a severe impact on the business, leading to a full system compromise. An attacker could execute malicious code to steal sensitive data, install ransomware or other malware, disrupt operations, or use the compromised system as a pivot point to move laterally within the network. Given that the FreeImage library is embedded in numerous third-party applications (e.g., content management systems, graphic design tools, server-side image processors), the attack surface could be extensive and difficult to identify, posing a significant risk to confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Immediately identify all applications and systems utilizing the vulnerable FreeImage library and update them to the latest patched version as recommended by the vendor. After patching, monitor for any signs of exploitation attempts by reviewing application and system access logs for unusual activity related to image file processing.

Proactive Monitoring: Implement enhanced monitoring for applications that process image files, particularly TGA files from untrusted sources. Look for signs of compromise such as unexpected application crashes, suspicious child processes being spawned by image-processing applications, or unauthorized outbound network connections from affected systems. Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) systems should be configured with rules to detect anomalies associated with this type of exploit.

Compensating Controls: If immediate patching is not feasible, implement the following controls to mitigate risk:

• Restrict or block the processing of TGA image files from untrusted external sources.
• Run applications that use the FreeImage library in a sandboxed or containerized environment to limit the impact of a potential compromise.
• Utilize Endpoint Detection and Response (EDR) solutions to detect and block memory exploitation techniques.
• Apply strict file-type validation to ensure that only legitimate, non-malicious files are processed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Jan 14, 2026), there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the common nature of this vulnerability class in image parsing libraries, it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability poses a severe and immediate threat. We strongly recommend that organizations prioritize the patching of this vulnerability across all affected systems. A comprehensive inventory should be conducted to identify all instances of the FreeImage library, including those embedded within third-party software. Although this CVE is not currently listed on the CISA KEV list, its high impact score makes it a prime candidate for future inclusion and a high-value target for attackers. Remediate immediately to prevent potential system compromise.

---METADATA---
VENDOR: gohttp
PRODUCT: gohttp
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
The gohttp library contains a directory traversal vulnerability that allows attackers to access files outside the intended web root via crafted requests.

Executive Summary:
A directory traversal vulnerability in the gohttp library permits unauthenticated attackers to read arbitrary files from the server's filesystem.

Vulnerability Details

CVE-ID: CVE-2025-70950

Affected Software: gohttp

Affected Versions: See vendor advisory

Vulnerability: The library fails to properly sanitize requests, allowing for directory traversal. The vulnerability is unauthenticated (PR:N) and accessible over the network (AV:N), making it highly reachable for remote attackers.

Business Impact

This vulnerability could result in the unauthorized disclosure of sensitive configuration files, source code, or internal system data. The CVSS score of 7.3 reflects the significant risk posed by unauthenticated access to the underlying filesystem, which could serve as a precursor to further system compromise.

Remediation Plan

Immediate Action: Check the project repository for updates or patches addressing the directory traversal flaw. If no patch is available, consider switching to a more secure, maintained HTTP library.

Proactive Monitoring: Review web server access logs for requests containing path traversal sequences (e.g., "../") and monitor for unusual file read requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal patterns and normalize URI paths before they reach the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the flaw makes it highly susceptible to automated scanning.

Analyst Recommendation

Given the existence of a proof-of-concept, this vulnerability should be treated with high urgency. Developers using the gohttp library should prioritize verifying their version against the latest commits or migrating to a secure alternative to eliminate this exposure.

Executive Summary:
A high-severity vulnerability has been identified in the PHPGurukul Cyber Cafe Management System, which could allow an unauthenticated attacker to steal sensitive information from the underlying database. Successful exploitation of this flaw could lead to a complete data breach, exposing customer records, credentials, and other confidential data. Organizations are urged to apply the vendor-supplied patch immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2025-70893

Affected Software: PHPGurukul Cyber Cafe Management System

Affected Versions: v1

Vulnerability: The vulnerability is a time-based blind SQL Injection. An attacker can exploit this by sending specially crafted input to the application, which is then passed to a database query without proper sanitization. The crafted input includes SQL commands that instruct the database to pause or delay its response for a specific amount of time if a certain condition is true. By measuring the server's response time, the attacker can infer the result of the condition, allowing them to exfiltrate data from the database one character at a time, bypass authentication, or potentially gain control over the database server.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful attack could have significant business consequences, including unauthorized access to and exfiltration of sensitive data such as customer personal information, user credentials, and transaction history. This could lead to a major data breach, resulting in severe reputational damage, financial loss, and potential regulatory fines for non-compliance with data protection standards. If the database service account has excessive privileges, the attacker could also modify or delete data, or even escalate their privileges to compromise the underlying server.

Remediation Plan

Immediate Action: The primary and most effective remediation is to apply the security patches provided by the vendor immediately. In addition, conduct a thorough review of all database user accounts and access controls to ensure the application is operating with the principle of least privilege. It is also recommended to enable detailed database query logging to create an audit trail for detecting and investigating potential exploitation attempts.

Proactive Monitoring: Monitor web application and database logs for suspicious queries, particularly those containing SQL keywords like SLEEP, BENCHMARK, or other time-delay functions. Network traffic should be monitored for unusually long response times from the web server, which is a key indicator of time-based blind SQL injection exploitation.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with a strict ruleset designed to detect and block common SQL injection patterns. This can serve as a temporary mitigation by filtering malicious requests before they reach the vulnerable application. However, a WAF should be considered a temporary measure and not a substitute for patching the underlying vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 16, 2026, there are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability presents a critical risk to the organization. We strongly recommend that the vendor-provided patch for CVE-2025-70893 be applied as a top priority across all affected systems. While there is no current evidence of active exploitation, the nature of SQL injection vulnerabilities makes them a prime target for attackers. In addition to patching, the recommended actions for reviewing access controls and enabling logging should be implemented to strengthen the overall security posture and improve detection capabilities.

Executive Summary:
A critical SQL Injection vulnerability, identified as CVE-2025-70892, has been discovered in Phpgurukul Cyber Cafe Management System v1.0. This flaw allows an unauthenticated attacker to execute arbitrary commands on the backend database by sending malicious input to the user management module. Successful exploitation could lead to a complete compromise of the system, resulting in data theft, data corruption, and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2025-70892

Affected Software: Phpgurukul Cyber Cafe Management System Multiple Products

Affected Versions: Version 1.0 is confirmed to be vulnerable. See vendor advisory for a complete list of affected products and versions.

Vulnerability: The vulnerability is a classic SQL Injection that exists within the user management module, specifically in the add-users.php endpoint. The application fails to properly sanitize or validate the username parameter before incorporating it into a database query. An attacker can craft a malicious username value containing SQL syntax, which will then be executed by the database, allowing them to bypass security controls, exfiltrate sensitive data, modify database records, or potentially gain remote code execution on the server.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. Successful exploitation could lead to a severe data breach, exposing sensitive user information, administrative credentials, and financial records managed by the cyber cafe system. An attacker could gain full control over the application and its underlying database, leading to service disruption, reputational damage, financial loss, and potential legal or regulatory penalties. The ability for an unauthenticated attacker to achieve this level of compromise makes it a high-priority threat.

Remediation Plan

Immediate Action: Organizations must immediately update all instances of Phpgurukul Cyber Cafe Management System to the latest patched version as recommended by the vendor. After patching, review system and database access logs for any signs of compromise or suspicious activity related to the add-users.php endpoint.

Proactive Monitoring: Implement enhanced monitoring on web server and database logs. Specifically, look for requests to add-users.php containing SQL keywords (e.g., SELECT, UNION, DROP, SLEEP) or special characters (', --, ;) within the username parameter. Monitor for unusual database queries, unauthorized user account creation, or unexpected system behavior.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL Injection attacks. Enforce the principle of least privilege for the database user account connected to the application to limit the potential impact of an exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, January 15, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, due to the ease of exploitation and high impact, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the potential for complete system compromise, it is strongly recommended that organizations prioritize the immediate application of the vendor-supplied patch. Although this vulnerability is not currently listed in the CISA KEV catalog, its high score indicates a significant risk. If patching is delayed, the implementation of compensating controls like a WAF is essential to mitigate the immediate threat. All internet-facing instances of this software should be considered at extreme risk and must be addressed without delay.

---METADATA---
VENDOR: Dokans
PRODUCT: Multi-Tenancy Based eCommerce Platform SaaS
AFFECTED_VERSIONS: 3.9.2
---END_METADATA---

Description Summary:
Dokans SaaS platform allows unauthenticated attackers to download the .env file, exposing encryption keys, database credentials, and API keys, leading to total multi-tenant system compromise.

Executive Summary:
A critical information disclosure vulnerability in Dokans eCommerce SaaS allows unauthenticated attackers to steal sensitive configuration files, resulting in full compromise of all tenant data.

Vulnerability Details

CVE-ID: CVE-2025-70841

Affected Software: Dokans Multi-Tenancy Based eCommerce Platform SaaS

Affected Versions: 3.9.2

Vulnerability: The application permits unauthenticated remote attackers to access the /script/.env file directly. This file contains the Laravel APP_KEY, database credentials, and SMTP/SendGrid API keys.

Business Impact

The CVSS score of 10.0 reflects the absolute severity of this leak. Exposure of the APP_KEY allows for session token forgery and authentication bypass, while database credentials grant direct access to sensitive tenant information. Furthermore, the theft of API keys allows attackers to hijack email infrastructure, causing massive financial and reputational harm across the entire SaaS ecosystem.

Remediation Plan

Immediate Action: Update the platform to the latest version and immediately rotate all secrets, including the APP_KEY, database passwords, and API keys.

Proactive Monitoring: Inspect web server logs for any GET requests to the /script/.env path and monitor for unauthorized database logins.

Compensating Controls: Configure the web server (Nginx/Apache) to explicitly deny access to all hidden files and files starting with a dot (.) globally.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. However, .env file exposure is a well-known and highly sought-after vulnerability by automated exploit scripts.

Analyst Recommendation

This is a "scorched earth" scenario; simply patching is insufficient. Administrators must rotate every single credential found in the .env file immediately after updating the software to prevent attackers who may have already harvested the data from maintaining access.

---METADATA---
VENDOR: Datart
PRODUCT: Datart (using Freemarker engine)
AFFECTED_VERSIONS: v1.0.0-rc.3
---END_METADATA---

Description Summary:
Datart v1.0.0-rc.3 is vulnerable to Server-Side Template Injection (SSTI) in its Freemarker engine, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
Datart is susceptible to a critical Server-Side Template Injection vulnerability that allows authenticated users to execute remote code through the SQL script field.

Vulnerability Details

CVE-ID: CVE-2025-70830

Affected Software: Datart

Affected Versions: v1.0.0-rc.3

Vulnerability: An authenticated attacker can inject malicious Freemarker template syntax into the SQL script field of the application. Because the engine does not properly sanitize this input, it executes the injected code on the server hosting the Datart application.

Business Impact

A successful SSTI attack allows an attacker to execute arbitrary code with the permissions of the application server. With a CVSS score of 9.9, this vulnerability poses a catastrophic risk to data confidentiality and system integrity, potentially leading to a full database or server breach.

Remediation Plan

Immediate Action: Update Datart to the latest available version that includes patches for Freemarker template injection.

Proactive Monitoring: Inspect SQL script logs for unusual template syntax (e.g., ${...}) and monitor the server for unauthorized outbound network connections or shell activity.

Compensating Controls: Implement strict input validation and use a security manager to restrict the capabilities of the Freemarker template engine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score and the potential for remote code execution make this a top-priority fix. Organizations using Datart must apply the necessary updates immediately to protect their data visualization environments from compromise.