---METADATA---
VENDOR: Lantronix
PRODUCT: EDS3000PS
AFFECTED_VERSIONS: v3.1.0.0R2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Lantronix EDS3000PS ltrx_evo component allows unauthenticated attackers to execute arbitrary code and retrieve sensitive information.

Executive Summary:
A critical remote code execution vulnerability in the Lantronix EDS3000PS allows unauthenticated attackers to execute arbitrary commands and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-70082

Affected Software: Lantronix EDS3000PS

Affected Versions: v3.1.0.0R2

Vulnerability: The flaw exists within the ltrx_evo component and permits unauthenticated remote attackers to execute arbitrary system code. This vulnerability allows for a complete compromise of the device's security posture.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code presents a catastrophic risk, including the potential for full system takeover, lateral movement within the network, and the theft of sensitive operational data. The 9.8 CVSS score reflects the high severity of a remote, unauthenticated RCE condition.

Remediation Plan

Immediate Action: Users should consult the vendor's security advisory (ICSA-26-069-02) to verify the availability of a firmware update and apply it immediately.

Proactive Monitoring: Continuously monitor device performance and system logs for unexpected processes or unauthorized connections originating from the device.

Compensating Controls: If a patch is not yet available, isolate the device from external networks using a segmented VLAN and ensure it is not accessible via the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, this device must be treated as a high-risk asset. Administrators must prioritize applying vendor-issued patches as soon as they are made available to prevent exploitation of this RCE vulnerability.

---METADATA---
VENDOR: Gen Digital
PRODUCT: Avast Antivirus
AFFECTED_VERSIONS: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.
---END_METADATA---

Description Summary:
A heap buffer out-of-bounds read vulnerability in Avast Antivirus during the scanning of malformed Windows PE files with .NET metadata may cause local code execution or denial-of-service.

Executive Summary:
A heap-based buffer over-read vulnerability in Gen Digital security software could be leveraged by an attacker to crash the antivirus service or potentially execute unauthorized code.

Vulnerability Details

CVE-ID: CVE-2025-7008

Affected Software: Gen Digital Avast Antivirus

Affected Versions: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.

Vulnerability: This vulnerability involves a heap buffer out-of-bounds read occurring when the antivirus engine scans malformed Windows PE files containing .NET metadata. The flaw is present within the shared virus definition scanning logic.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk. An attacker can exploit this flaw to induce a denial-of-service by crashing the security agent, effectively blinding the host to further threats, or potentially gain unauthorized code execution. The impact is significant as it undermines the integrity of the primary security defense on the affected endpoints.

Remediation Plan

Immediate Action: Deploy virus definition update VPS 25021310 or newer to all affected systems.

Proactive Monitoring: Review security agent logs for recurring process failures or unexpected service restarts.

Compensating Controls: Utilize application allow-listing and EDR monitoring to detect and block the execution of malformed or suspicious PE files while updates are being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should ensure that the update cycle for virus definitions is strictly enforced. Because this vulnerability exists within the scanning engine itself, standard security posture is insufficient without the specific patch provided in the latest virus definition build.

Executive Summary:
A high-severity vulnerability has been identified in Avast Antivirus for MacOS and Linux. An attacker can exploit this flaw by sending a specially crafted file to a target system, causing the antivirus software to crash and creating a temporary gap in security protection. This denial-of-service condition leaves the system vulnerable to other malware until the antivirus service is restarted.

Vulnerability Details

CVE-ID: CVE-2025-7007

Affected Software: Avast Antivirus on Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a NULL Pointer Dereference that occurs within the antivirus scanning engine on MacOS and Linux platforms. When the antivirus software attempts to scan a malformed Windows Portable Executable (PE) file, the engine tries to access a memory address that has not been properly initialized (a NULL pointer). This illegal memory access causes an unhandled exception, leading to the immediate termination and crash of the antivirus process. An attacker can trigger this vulnerability by delivering the malformed PE file to a target system via email, web download, or other vectors, resulting in a denial of service of the security software.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. The primary business impact is a denial of service for a critical security control. Exploitation of this flaw will crash the antivirus service, leaving endpoints temporarily without active malware scanning and real-time protection. This creates a window of opportunity for attackers to deploy secondary payloads, such as ransomware, spyware, or remote access trojans, which would otherwise be detected and blocked. Repeated attacks could cause system instability and require manual intervention to restore protection, impacting user productivity and increasing the organization's risk of a more significant security breach.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor across all affected MacOS and Linux endpoints immediately to patch the vulnerability. After deployment, verify that the antivirus service is running and stable. Review system and application logs for evidence of recent antivirus process crashes which may indicate prior exploitation attempts.

Proactive Monitoring: Monitor endpoint security logs for unexpected crashes or restarts of the Avast antivirus service. Configure Endpoint Detection and Response (EDR) or Security Information and Event Management (SIEM) systems to generate alerts for repeated termination of the antivirus process. Network security monitoring can be used to inspect for an unusual influx of PE files targeting non-Windows systems.

Compensating Controls: If immediate patching is not feasible, implement stricter filtering at email gateways and web proxies to block or quarantine executable files (PE files) from untrusted sources. Ensure other security layers, such as host-based firewalls and EDR solutions, are enabled and fully updated to provide defense-in-depth and potentially detect follow-on malicious activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 1, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, denial-of-service vulnerabilities in security products are attractive to attackers as a method to disable defenses before launching a more sophisticated attack. Organizations should assume that an exploit could be developed with minimal effort.

Analyst Recommendation

Given the High severity rating (CVSS 7.5) and the critical role of antivirus software in an organization's defense-in-depth strategy, we recommend immediate action. The primary risk is the temporary disabling of endpoint protection, which could serve as a gateway for more damaging attacks. Although this vulnerability is not currently listed on the CISA KEV list, its potential impact on security posture warrants prioritizing the deployment of the vendor-provided patches to all affected systems.

---METADATA---
VENDOR: JXcore
PRODUCT: JXM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Improper certificate validation (CWE-295) in JXcore JXM master allows for potential Man-in-the-Middle (MitM) attacks and data interception.

Executive Summary:
JXcore JXM master contains an improper certificate validation flaw that enables attackers to intercept and manipulate encrypted communications between system components.

Vulnerability Details

CVE-ID: CVE-2025-70045

Affected Software: JXcore JXM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: An issue pertaining to CWE-295 (Improper Certificate Validation) was discovered in the JXM master component of JXcore. This vulnerability allows an unauthenticated attacker to bypass SSL/TLS protections because the software fails to adequately verify the authenticity of digital certificates.

Business Impact

A successful Man-in-the-Middle (MitM) attack could allow an adversary to intercept sensitive data, such as credentials or proprietary code, transmitted through the JXM master. The CVSS score of 7.4 reflects a High severity, as it undermines the fundamental trust and encryption protocols required for secure distributed computing.

Remediation Plan

Immediate Action: Update JXcore and the JXM component to a version that correctly implements certificate validation logic.

Proactive Monitoring: Inspect network traffic for suspicious certificate signatures and monitor for unusual administrative activities originating from the JXM master node.

Compensating Controls: Use VPNs or encrypted tunnels at the network layer to provide an additional level of security for communications that rely on JXcore until the software-level patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, certificate validation flaws are well-understood and easily exploited by attackers positioned on the local network or along the communication path.

Analyst Recommendation

The failure to validate certificates is a critical security oversight that must be corrected immediately. We recommend that organizations using JXcore JXM prioritize this update to ensure the confidentiality of their data-in-transit. Without a patch, all encrypted communications handled by the affected component should be considered insecure.

---METADATA---
VENDOR: Ayms
PRODUCT: node-To master
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Ayms node-To master application disables TLS/SSL certificate validation by setting 'rejectUnauthorized' to false, facilitating Man-in-the-Middle (MitM) attacks.

Executive Summary:
A critical improper certificate validation vulnerability in Ayms node-To master allows attackers to intercept and modify sensitive encrypted traffic via Man-in-the-Middle attacks.

Vulnerability Details

CVE-ID: CVE-2025-70043

Affected Software: Ayms node-To master

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability (CWE-295) occurs because the application explicitly disables TLS certificate validation. By setting the rejectUnauthorized option to false in TLS socket configurations, the software will accept any certificate, including self-signed or fraudulent ones.

Business Impact

The failure to validate certificates renders encrypted communications useless against an active interceptor. This can lead to the theft of credentials, session tokens, and sensitive data transmitted by the application. The CVSS score of 9.1 reflects the high risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Update node-To master to a version that correctly enforces TLS certificate validation by enabling rejectUnauthorized.

Proactive Monitoring: Inspect network traffic for unusual certificate chains and monitor for unauthorized access to accounts linked to this application.

Compensating Controls: Use network-level security measures, such as VPNs or dedicated encrypted tunnels, to protect traffic if the application cannot be immediately updated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 23, 2026, there is no public information indicating active exploitation. However, this is a fundamental security failure that is easily exploited by any actor with network-level access.

Analyst Recommendation

Disabling certificate validation is a dangerous practice that exposes all user data to interception. It is imperative to update the software immediately and ensure that all production environments enforce strict SSL/TLS validation.

---METADATA---
VENDOR: Gen Digital
PRODUCT: Avast Antivirus
AFFECTED_VERSIONS: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.
---END_METADATA---

Description Summary:
A heap buffer out-of-bounds write vulnerability in Avast Antivirus scanning logic for malformed Windows PE files may allow local code execution or denial-of-service.

Executive Summary:
A heap-based buffer overflow vulnerability in Gen Digital antivirus products poses a significant risk of local code execution or system instability when processing malicious files.

Vulnerability Details

CVE-ID: CVE-2025-7004

Affected Software: Gen Digital Avast Antivirus

Affected Versions: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.

Vulnerability: This is a heap buffer out-of-bounds write vulnerability triggered during the scanning of a malformed Windows PE file. The vulnerability resides in the shared virus definition update stream, which is processed by the local antivirus engine.

Business Impact

With a CVSS score of 7.8, this vulnerability is classified as High. Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the antivirus process, which often operates with high system-level permissions. This could lead to full host compromise, data exfiltration, or a persistent denial-of-service condition that renders the security software ineffective.

Remediation Plan

Immediate Action: Update virus definitions to version VPS 25040308 or later immediately across all managed endpoints.

Proactive Monitoring: Monitor system logs for anomalous crashes of the antivirus service or unexpected process behavior associated with the scanning engine.

Compensating Controls: Ensure endpoint protection policies are configured to block suspicious file execution and restrict access to sensitive system directories where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the widespread nature of the affected Gen Digital products, organizations must prioritize the deployment of the updated virus definitions. Administrators should verify that all endpoints, including remote and mobile assets, have successfully synchronized with the updated definition stream to mitigate this high-severity risk.

---METADATA---
VENDOR: Avira
PRODUCT: Antivirus
AFFECTED_VERSIONS: Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
---END_METADATA---

Description Summary:
The Avira Antivirus engine is susceptible to a heap buffer out-of-bounds read when parsing malformed PDF files, leading to potential denial of service or local code execution.

Executive Summary:
A high-severity heap buffer out-of-bounds read flaw in the Avira Antivirus engine permits local code execution or service disruption via malformed PDF files.

Vulnerability Details

CVE-ID: CVE-2025-7003

Affected Software: Avira Antivirus

Affected Versions: Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.

Vulnerability: This is a heap buffer out-of-bounds read (CWE-125) occurring during the scanning of a malformed PDF. An attacker can exploit this to crash the antivirus engine process or execute arbitrary code locally on the system.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a substantial risk to endpoint security. By targeting the security software directly, an attacker can neutralize defenses or gain elevated access to the system. The impact extends to both business continuity, through service disruption, and system integrity, through potential unauthorized code execution.

Remediation Plan

Immediate Action: Update the Avira scan engine to build 8.3.70.56 or later immediately.

Proactive Monitoring: Monitor endpoint performance and antivirus service status for unexpected terminations or recurring crashes during file scanning.

Compensating Controls: Use file-type filtering and restrict the execution of untrusted PDF files until the antivirus engine is confirmed to be patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. The likely attack vector is local, requiring an adversary to supply a specially crafted PDF to the Avira engine.

Analyst Recommendation

Organizations should treat this vulnerability as an urgent priority. Because the flaw resides within a core security component, it is essential to verify that the automated update mechanism for the Avira scan engine has successfully reached the minimum required version across all endpoints.

---METADATA---
VENDOR: Avira
PRODUCT: Antivirus
AFFECTED_VERSIONS: Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.
---END_METADATA---

Description Summary:
A heap buffer out-of-bounds read vulnerability in the Avira Antivirus engine occurs when scanning malformed PDF files, potentially causing a crash or local code execution.

Executive Summary:
A heap buffer out-of-bounds read vulnerability in the Avira Antivirus engine could allow an attacker to execute code locally or crash the security software.

Vulnerability Details

CVE-ID: CVE-2025-7002

Affected Software: Avira Antivirus

Affected Versions: Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.

Vulnerability: This is a heap buffer out-of-bounds read vulnerability triggered when the Avira scan engine processes a specially crafted, malformed PDF file. An attacker can leverage this to trigger a Denial of Service (DoS) of the antivirus engine or, under specific conditions, achieve local execution of code.

Business Impact

With a CVSS score of 7.8, this vulnerability is considered a high-risk issue. Because the vulnerability exists within the antivirus engine itself, a successful exploit could disable security protections on the host system, leaving it vulnerable to other threats, or lead to unauthorized code execution with the privileges of the scanning process.

Remediation Plan

Immediate Action: Update the Avira scan engine to build 8.3.70.68 or later immediately.

Proactive Monitoring: Review antivirus logs for engine crashes or errors during file scanning processes, which may indicate an attempt to exploit this flaw.

Compensating Controls: Employ secondary endpoint detection and response (EDR) solutions to monitor for suspicious process execution patterns originating from the antivirus engine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for code execution makes it a critical item for remediation.

Analyst Recommendation

Security teams should ensure that all Avira Antivirus installations are updated to the latest engine build. Failure to patch allows for a bypass of security controls, significantly increasing the risk of subsequent malicious activity on the endpoint.

---METADATA---
VENDOR: LSC
PRODUCT: Indoor Camera V7
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of the LSC Indoor Camera V7, allowing for potential remote code execution.

Executive Summary:
The LSC Indoor Camera V7 is vulnerable to a high-severity buffer overflow that could allow an unauthenticated attacker to compromise the device remotely.

Vulnerability Details

CVE-ID: CVE-2025-69986

Affected Software: LSC Indoor Camera V7

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A buffer overflow vulnerability exists within the GetStreamUri function of the ONVIF implementation. An unauthenticated attacker can exploit this by sending a specially crafted ONVIF request to the device, leading to memory corruption.

Business Impact

The impact of a buffer overflow on an IoT device is severe, often leading to full device takeover or persistent unauthorized access to video streams. With a CVSS score of 7.2, this vulnerability poses a high risk to physical security and privacy, potentially allowing attackers to pivot from the camera into the wider corporate or home network.

Remediation Plan

Immediate Action: Update the camera firmware to the latest version provided by LSC immediately to patch the vulnerable ONVIF function.

Proactive Monitoring: Monitor network traffic for anomalous ONVIF traffic originating from untrusted internal or external IP addresses.

Compensating Controls: Isolate IoT devices like the LSC Indoor Camera on a dedicated VLAN and restrict access to the ONVIF port (typically 80 or 8080) using network firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, buffer overflows in network-facing IoT services are frequent targets for automated botnets.

Analyst Recommendation

This vulnerability represents a significant privacy and security risk. It is strongly recommended to apply the firmware update immediately. If an update is unavailable, the device should be disconnected from the network or strictly firewalled to prevent unauthorized access to the vulnerable service.

---METADATA---
VENDOR: SRK Powertech Pvt Ltd
PRODUCT: Pebble Prism Ultra
AFFECTED_VERSIONS: v2.9.2
---END_METADATA---

Description Summary:
A lack of authentication in the BLE protocol of Pebble Prism Ultra v2.9.2 allows adjacent attackers to execute arbitrary commands, intercept data, and hijack firmware.

Executive Summary:
The Pebble Prism Ultra smartwatch is subject to complete unauthenticated compromise by attackers in Bluetooth range due to a total lack of authentication and authorization in its communication protocol.

Vulnerability Details

CVE-ID: CVE-2025-69969

Affected Software: SRK Powertech Pvt Ltd Pebble Prism Ultra

Affected Versions: v2.9.2

Vulnerability: This vulnerability involves a complete absence of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) protocol. An unauthenticated attacker in physical proximity (adjacent) can reverse engineer the protocol to execute arbitrary commands, intercept cleartext data, and perform unauthorized firmware hijacking via Over-the-Air (OTA) services.

Business Impact

The CVSS score of 9.6 reflects the extreme risk to user privacy and device integrity. An attacker can steal sensitive personal data or turn the device into a tool for further surveillance. For enterprises issuing these devices, this represents a significant data breach risk and a total loss of trust in the device's security posture.

Remediation Plan

Immediate Action: Users should update the device firmware to a version that implements BLE pairing and encryption immediately.

Proactive Monitoring: Users should be wary of unexpected pairing requests or unusual device behavior when in public spaces.

Compensating Controls: Disable Bluetooth on the device when not in use and avoid connecting the device to corporate assets until a patch is verified.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of basic security controls makes this device an easy target for nearby attackers.

Analyst Recommendation

The absence of authentication in a modern BLE device is a critical failure. We recommend that organizations suspend the use of affected Pebble Prism Ultra devices for sensitive operations until the vendor provides a firmware update that enforces encrypted and authenticated communication.

Executive Summary:
A critical privilege escalation vulnerability, identified as CVE-2025-6994, has been discovered in the Reveal Listing plugin for WordPress. This flaw allows a low-privileged user, such as a new registrant, to gain administrative access to the affected WordPress site during the registration process. Successful exploitation could result in a complete compromise of the website, leading to data theft, defacement, or further attacks originating from the compromised server.

Vulnerability Details

CVE-ID: CVE-2025-6994

Affected Software: The Reveal Listing plugin by smartdatasoft for WordPress

Affected Versions: All versions up to, and including, 3.3

Vulnerability: The vulnerability exists within the user registration functionality of the Reveal Listing plugin. The registration process fails to properly sanitize or validate the user role parameter submitted by a new user. An unauthenticated attacker can craft a special registration request, injecting a parameter to assign their new account the 'administrator' role, bypassing the default 'subscriber' role assignment. This grants the attacker full administrative privileges upon account creation.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit would grant an attacker complete control over the affected WordPress website. This could lead to severe business consequences, including the theft of sensitive customer data and intellectual property, reputational damage from website defacement, financial loss if the site is used for e-commerce, and legal or regulatory penalties. The compromised website could also be used to host malware, launch phishing campaigns against customers, or act as a pivot point for further attacks into the corporate network.

Remediation Plan

Immediate Action: Immediately update the Reveal Listing plugin to the latest patched version provided by the vendor, smartdatasoft. After patching, it is crucial to review all existing user accounts, especially those with high privileges, to identify and remove any unauthorized accounts that may have been created by exploiting this vulnerability.

Proactive Monitoring: System administrators should actively monitor web server access logs for suspicious POST requests to user registration endpoints. Specifically, look for registration attempts that contain unexpected parameters related to user roles (e.g., role=administrator). Additionally, implement alerts for the creation of any new user account with administrative-level privileges.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Temporarily disable user registration functionality on the website if it is not a critical feature.
• Implement a Web Application Firewall (WAF) with custom rules to inspect and block registration requests containing user role parameters.
• Enforce a manual review and approval process for all new user registrations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of August 6, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical CVSS score and the simplicity of exploitation, it is highly probable that threat actors will develop and deploy exploits rapidly.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that organizations using the affected plugin apply the vendor-supplied patch immediately. The risk of a full website compromise is high. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion and widespread exploitation. Prioritize patching this vulnerability across all relevant assets without delay and conduct a thorough audit for signs of compromise.

Executive Summary:
A high-severity vulnerability exists within the Ultimate WP Mail plugin for WordPress, allowing for privilege escalation. An attacker with low-level access to a WordPress site could exploit this flaw to view sensitive email logs, potentially exposing confidential user data, password reset links, or other private communications. This poses a significant risk of a data breach and could lead to further unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2025-6993

Affected Software: WordPress Multiple Products

Affected Versions: See vendor advisory for specific affected versions. The vulnerability is confirmed in versions within the 1.x branch.

Vulnerability: The vulnerability is an improper authorization flaw within the get_email_log_details() function, which is handled via an AJAX action. The function fails to properly verify that the user making the request has sufficient permissions to view email logs. An authenticated attacker, even with low-level privileges (e.g., a subscriber), can send a specially crafted AJAX request directly to this handler to retrieve the contents of email logs, which should be restricted to administrators.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could lead to a significant data breach by exposing sensitive information transmitted via email, such as user registration details, password reset tokens, private messages, and order confirmations. The specific risks to the organization include reputational damage, loss of customer trust, non-compliance with data protection regulations (like GDPR), and the potential for attackers to leverage the exposed information to gain further access to user accounts or other systems.

Remediation Plan

Immediate Action: Immediately update the Ultimate WP Mail plugin to the latest available version, which contains a patch for this vulnerability. If the plugin is not critical to business operations, consider deactivating and removing it to eliminate the attack surface. Always back up your site before performing updates.

Proactive Monitoring: Monitor web server and WordPress audit logs for suspicious AJAX requests to wp-admin/admin-ajax.php, specifically looking for calls to the get_email_log_details action from non-administrative users. A sudden increase in such requests could indicate attempted or successful exploitation.

Compensating Controls: If patching cannot be performed immediately, implement a Web Application Firewall (WAF) rule to block or limit access to the vulnerable AJAX action (get_email_log_details) for users who are not administrators. Additionally, enforce the principle of least privilege by regularly reviewing user roles and capabilities to ensure they only have the access necessary for their function.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, July 16, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating it is not currently subject to widespread, active attacks.

Analyst Recommendation

Given the high severity rating (CVSS 7.5) and the direct risk of sensitive data exposure, we strongly recommend that all organizations using the Ultimate WP Mail plugin prioritize applying the security update immediately. Although there is no evidence of active exploitation at this time, the technical simplicity of the vulnerability means that exploits could be developed quickly. Proactive patching is the most effective defense to prevent potential data breaches and protect organizational and user data.

Executive Summary:
A high-severity vulnerability has been identified in the kallyas theme for WordPress. This flaw, a Local File Inclusion (LFI), allows an unauthenticated attacker to access and read sensitive files on the web server. Successful exploitation could lead to the exposure of confidential data, such as database credentials and system configuration files, potentially enabling a complete compromise of the affected website.

Vulnerability Details

CVE-ID: CVE-2025-6991

Affected Software: kallyas theme for WordPress

Affected Versions: All versions up to, and including, 4

Vulnerability: The kallyas theme for WordPress is vulnerable to Local File Inclusion (LFI). This type of vulnerability occurs when the application uses user-supplied input to construct a path to a file that is then included or executed. An attacker can exploit this by manipulating the input to include path traversal characters (e.g., ../) to navigate the server's file system and access files outside of the intended directory, such as wp-config.php or /etc/passwd.

Business Impact

This vulnerability presents a High severity risk with a CVSS score of 7.5. Exploitation can directly lead to a data breach by exposing sensitive information stored on the server, including database credentials, application source code, and system user data. This could result in a complete website takeover, defacement, customer data theft, reputational damage, and potential regulatory fines. The ease of exploitation for LFI vulnerabilities means that any publicly accessible site using the vulnerable theme is at significant risk.

Remediation Plan

Immediate Action: Immediately update the kallyas theme to the latest patched version (greater than version 4). If the theme is installed but not active or no longer needed, it should be completely uninstalled and removed from the WordPress installation to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for suspicious GET requests containing path traversal sequences (e.g., ../, ..%2f) targeting theme files. Implement a Web Application Firewall (WAF) to detect and block LFI attempts. Monitor for unusual file access patterns on the server, especially from the web server's user account.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with strict rules to block path traversal and LFI attack patterns. Additionally, harden server file permissions to restrict the web server process from reading files outside of the web root directory, limiting the impact of a potential LFI exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 27, 2025, proof-of-concept (PoC) exploits for Local File Inclusion vulnerabilities are common and easily adaptable for this specific case. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, LFI flaws are frequently targeted by opportunistic attackers scanning for vulnerable WordPress sites. The low complexity of the attack increases the likelihood of widespread exploitation attempts.

Analyst Recommendation
Given the high severity (CVSS 7.5) and the simplicity of exploitation, we strongly recommend that organizations immediately apply the vendor-supplied patch. All internet-facing websites using the kallyas WordPress theme should be considered at high risk. A full inventory should be conducted to identify all instances of the vulnerable theme, and the update should be prioritized. Do not wait for this CVE to appear on the CISA KEV list to take action.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the vendor "accessible," specifically impacting the Newgen OmniApp component. This flaw allows an unauthenticated attacker to remotely discover valid, privileged usernames by accessing a publicly available JavaScript file. This information disclosure significantly aids attackers in conducting targeted follow-on attacks, such as password spraying or brute-forcing, to compromise high-value accounts.

Vulnerability Details

CVE-ID: CVE-2025-69908

Affected Software: accessible Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within a client-side JavaScript resource associated with the Newgen OmniApp functionality. This file is accessible without authentication and contains data or logic that allows an attacker to enumerate valid usernames, with a focus on those holding elevated privileges. An attacker can exploit this by simply browsing to the specific JavaScript file, analyzing its contents, and extracting the list of usernames, requiring no special tools or privileges.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. While it does not directly lead to a system compromise, it provides attackers with the critical first step for a targeted attack: a list of valid, high-privilege usernames. This exposure dramatically increases the risk of successful account takeover through password spraying, credential stuffing, or brute-force attacks. A compromised privileged account could lead to a significant data breach, unauthorized system configuration changes, denial of service, or full administrative control over affected applications.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, organizations should review web server and application access logs for any anomalous or repeated requests to the vulnerable JavaScript resource, which could indicate past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should implement monitoring rules to detect and alert on multiple failed login attempts from a single source, especially against the privileged accounts that may have been exposed. Monitor network traffic for unusual patterns of access to client-side script files. SIEM (Security Information and Event Management) platforms should be configured to correlate access to the vulnerable resource with subsequent login failures.

Compensating Controls: If immediate patching is not feasible, organizations should implement compensating controls. Use a Web Application Firewall (WAF) or web server access controls to block or restrict external access to the specific vulnerable JavaScript file. Enforce Multi-Factor Authentication (MFA) and a strong, complex password policy for all administrative and privileged accounts to mitigate the risk of account compromise even if usernames are known.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 24, 2026, there are no known public proof-of-concept exploits or observed in-the-wild attacks leveraging this vulnerability. However, due to the simplicity of exploitation (requiring only a web browser), it is highly likely that threat actors will develop exploits quickly.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the critical reconnaissance advantage this vulnerability provides to attackers, we strongly recommend that organizations prioritize the immediate application of the vendor-supplied security patches. Although this CVE is not currently on the CISA KEV list, its nature as a precursor to more severe attacks on privileged accounts warrants urgent attention. Implementing compensating controls like MFA and access restrictions should be considered a temporary measure until patching is complete.

Executive Summary:
A high-severity information disclosure vulnerability has been identified in Newgen OmniDocs. This flaw allows an unauthenticated attacker to remotely access a list of data repositories, known as "cabinets," by exploiting a missing security check on a specific API endpoint. Successful exploitation could provide an attacker with valuable reconnaissance information to facilitate further, more targeted attacks against the organization's data.

Vulnerability Details

CVE-ID: CVE-2025-69907

Affected Software: Newgen OmniDocs

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to a lack of authentication and authorization on the /omnidocs/GetListofCabinet API endpoint. An unauthenticated remote attacker can send a direct request to this endpoint without providing any credentials. The server will improperly process this request and respond with a complete list of all configured "cabinets," which are high-level containers for documents and data within the OmniDocs platform. This exposes the internal data structure and naming conventions, which can be leveraged for reconnaissance and planning subsequent attacks.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. While it does not allow for direct data exfiltration or system modification, the information disclosed is highly valuable for an attacker. By obtaining the list of cabinets, an attacker can map the organization's data layout, identify potentially high-value targets (e.g., cabinets named "Finance," "HR," or "Legal"), and refine social engineering or other targeted attacks. This exposure increases the risk of a future data breach and can reveal sensitive information about the organization's structure and operations.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected Newgen OmniDocs instances immediately. After patching, administrators should review web server and application access logs for any evidence of unauthorized access to the vulnerable API endpoint prior to the patch being applied.

Proactive Monitoring: Implement monitoring and alerting for anomalous access patterns to the /omnidocs/GetListofCabinet API endpoint. Security teams should look for multiple requests from unknown or external IP addresses, which could indicate scanning or exploitation attempts. Monitor for any follow-on suspicious activity originating from IPs that accessed this endpoint.

Compensating Controls: If immediate patching is not feasible, implement the following controls to mitigate risk:

• Use a Web Application Firewall (WAF) or reverse proxy to create a rule that blocks external access to the /omnidocs/GetListofCabinet URL.
• Enforce network segmentation to restrict access to the Newgen OmniDocs application server, allowing connections only from trusted internal networks.
• If possible, enforce authentication at a network level (e.g., via a reverse proxy or API gateway) before traffic is passed to the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 25, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the simplicity of exploitation (a single unauthenticated web request), it is highly likely that threat actors will develop exploits and begin scanning for vulnerable systems in the near future.

Analyst Recommendation

Given the High severity rating (CVSS 7.5) and the ease of exploitation, it is strongly recommended that organizations prioritize applying the vendor-supplied security patches to all vulnerable Newgen OmniDocs systems without delay. Although this vulnerability is not currently listed on the CISA KEV catalog, its reconnaissance value makes it an attractive target for attackers. If patching cannot be performed immediately, implement the suggested compensating controls, such as WAF rules, to block access to the vulnerable endpoint and reduce the attack surface.

Executive Summary:
A critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-6990, has been discovered in the Kallyas theme for WordPress. This flaw allows an unauthenticated attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the affected website, data theft, and further network intrusion.

Vulnerability Details

CVE-ID: CVE-2025-6990

Affected Software: WordPress Kallyas Theme

Affected Versions: All versions up to, and including, 4.0

Vulnerability: The Kallyas theme contains a flaw that fails to properly sanitize user-supplied input. An unauthenticated remote attacker can exploit this by sending a specially crafted request to a vulnerable component within the theme. Successful exploitation allows the attacker to execute arbitrary commands on the underlying server with the privileges of the web server process, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit would grant an attacker complete control over the affected website and potentially the underlying server. The consequences include, but are not limited to, theft of sensitive data (customer information, payment details, intellectual property), website defacement, service disruption, and the use of the compromised server to launch further attacks or host malicious content. Such an incident could result in significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action:

• Immediately update the Kallyas theme to the latest patched version (greater than 4.0) as recommended by the vendor.
• If the theme is not essential or no longer in use, it should be completely uninstalled and removed from the WordPress installation to eliminate the attack surface.
• Review WordPress user accounts and file permissions for any unauthorized changes.

Proactive Monitoring:

• Monitor web server access logs for unusual or malformed POST requests targeting theme-specific files or AJAX actions.
• Implement File Integrity Monitoring (FIM) to detect unauthorized changes to core WordPress, theme, and plugin files.
• Watch for unexpected outbound network connections or processes being spawned by the web server user (e.g., www-data, apache).

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules designed to block common RCE attack patterns and payloads.
• Harden the server environment by disabling potentially dangerous PHP functions (e.g., exec, shell_exec, passthru, system) in the php.ini configuration file if they are not required for legitimate application functionality.
• Enforce strict file permissions to prevent the web server process from writing to non-essential directories.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of November 1, 2025, there are no known public exploits or active attacks targeting this vulnerability. However, due to the high severity (CVSS 8.8) and the relative ease of exploitation for RCE vulnerabilities, it is highly probable that threat actors will develop and deploy exploits in the near future.

Analyst Recommendation
Given the high severity of this vulnerability, immediate patching is strongly recommended for all organizations using the affected Kallyas theme. While this vulnerability is not currently on CISA's Known Exploited Vulnerabilities (KEV) catalog, its critical nature makes it a prime candidate for future inclusion. Organizations must prioritize applying the vendor-supplied update to prevent a full system compromise. If patching is not immediately feasible, apply the recommended compensating controls and actively monitor for signs of exploitation.

Executive Summary:
A high-severity vulnerability has been identified in the Kallyas theme for WordPress, designated CVE-2025-6989. This flaw allows a remote attacker to delete arbitrary folders on the web server, which could lead to a complete website outage, data loss, and denial of service. Organizations using the affected theme are at significant risk of operational disruption and should take immediate action to mitigate this threat.

Vulnerability Details

CVE-ID: CVE-2025-6989

Affected Software: Kallyas theme for WordPress

Affected Versions: All versions up to, and including, 4

Vulnerability: The vulnerability exists within the delete_font() function of the Kallyas theme. This function fails to properly sanitize or validate user-supplied input for file paths. An attacker can exploit this by crafting a malicious request containing path traversal sequences (e.g., ../). This allows the attacker to navigate outside the intended font directory and target any other folder on the server that the web server process has write/delete permissions for, leading to arbitrary folder deletion. Exploitation likely requires an authenticated user role with access to the theme's font management features, but could result in the deletion of critical WordPress core files, plugin directories, or user-uploaded content.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1, primarily impacting system integrity and availability. Successful exploitation can lead to a complete denial of service by deleting core application directories, rendering the website inoperable. The deletion of content folders (e.g., wp-content/uploads) would result in irreversible data loss if backups are not available. The business consequences include significant website downtime, loss of customer trust, reputational damage, and financial costs associated with incident response, data recovery, and site restoration.

Remediation Plan

Immediate Action: Immediately update the Kallyas theme to the latest patched version (greater than version 4) as recommended by the vendor. If the theme is not actively used or is no longer required for business operations, it should be deactivated and completely removed from the WordPress installation to eliminate the vulnerable code.

Proactive Monitoring: Monitor web server access logs and Web Application Firewall (WAF) logs for requests targeting the theme's delete_font() function or any requests containing path traversal payloads (../). Implement File Integrity Monitoring (FIM) to generate alerts for any unauthorized or unexpected file and folder deletions within the web root, particularly in the wp-includes, wp-admin, and wp-content directories.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Deploy a Web Application Firewall (WAF) with strict rules to block path traversal attack patterns.
• Harden file system permissions to ensure the web server user account has read-only access to all non-essential directories and cannot delete critical application files.
• Temporarily disable the affected theme and activate a default WordPress theme until a patch can be safely applied.
• Ensure regular, automated, and verified backups of the entire WordPress site (files and database) are being performed and stored off-site.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 27, 2025, there are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. However, vulnerabilities in popular WordPress components are frequently targeted by threat actors shortly after disclosure. The simplicity of this flaw increases the likelihood that an exploit will be developed and integrated into automated scanning tools.

Analyst Recommendation
Given the high severity (CVSS 8.1) and the potential for catastrophic impact on website availability and data integrity, we strongly recommend that organizations using the Kallyas theme for WordPress apply the security update immediately. This vulnerability presents a significant and direct risk to business operations. Although it is not currently listed in the CISA KEV catalog, its potential for widespread disruption warrants treating this as a critical priority for remediation.

---METADATA---
VENDOR: Quick Heal
PRODUCT: Total Security
AFFECTED_VERSIONS: Version 23; see vendor advisory for specific builds
---END_METADATA---

Description Summary:
Quick Heal Total Security 23 contains a vulnerability that could allow an attacker to interfere with security operations or escalate privileges on the host system.

Executive Summary:
Quick Heal Total Security 23 is affected by a high-severity vulnerability that could permit a local attacker to compromise the security software's integrity.

Vulnerability Details

CVE-ID: CVE-2025-69875

Affected Software: Quick Heal Total Security

Affected Versions: Version 23

Vulnerability: A flaw exists in the core components of Quick Heal Total Security 23. An authenticated local user can leverage this vulnerability to bypass self-protection mechanisms or perform unauthorized modifications to the system’s security posture.

Business Impact

The compromise of antivirus software represents a significant business risk, as it can be used to disable real-time protection and facilitate the deployment of ransomware or spyware. With a CVSS score of 7.8, the severity is High because the vulnerability allows an attacker to neutralize the primary defense mechanism of the endpoint. This could result in widespread data loss and prolonged system downtime.

Remediation Plan

Immediate Action: Update Quick Heal Total Security to the latest version immediately via the built-in update utility or the vendor's website.

Proactive Monitoring: Monitor systems for disabled security services or unexpected changes to antivirus exclusion lists.

Compensating Controls: Utilize a multi-vendor security strategy and ensure that centralized logging (SIEM) is capturing events from all endpoints to detect if local security agents stop reporting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in security software are often utilized in multi-stage attacks to ensure malware remains undetected.

Analyst Recommendation

We recommend immediate remediation due to the critical role Quick Heal plays in protecting the environment. Administrators should verify that all managed instances of Total Security 23 have successfully received and applied the latest security patches.

Executive Summary:
A high-severity XML External Entity (XXE) vulnerability in the Langchain project's EverNoteLoader component allows an attacker to read local files or conduct server-side request forgery (SSRF) attacks.

Vulnerability Details

CVE-ID: CVE-2025-6984

Affected Software: The Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The EverNoteLoader component in the langchain-ai/langchain project is vulnerable to XXE attacks due to insecure XML parsing. An attacker who can supply a specially crafted XML file to be processed by this component can force the application to parse external entities, leading to the disclosure of local file contents or interaction with internal or external network resources.

Business Impact

This vulnerability is rated high with a CVSS score of 7.5. Successful exploitation could lead to the exfiltration of sensitive data from the server, including source code, configuration files, and credentials. The SSRF aspect of XXE could allow an attacker to scan the internal network, interact with internal services, and potentially pivot to other systems, significantly expanding the scope of a compromise.

Remediation Plan

Immediate Action: Update the langchain library to a patched version where the XML parser has been configured to disable external entity processing.

Proactive Monitoring: Monitor application logs for errors related to XML parsing. Check network logs for unexpected outbound connections from the application server to internal or external addresses, which could indicate an SSRF attempt.

Compensating Controls: If immediate patching is not possible, use a Web Application Firewall (WAF) to inspect and block XML payloads containing external entity declarations. Egress filtering at the network firewall can also help prevent SSRF callbacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 4, 2025, there is no public information indicating active exploitation of this vulnerability. XXE is a well-understood vulnerability class, and public exploits are often developed quickly once a flaw is disclosed.

Analyst Recommendation

XXE vulnerabilities pose a severe risk of data exfiltration and internal network compromise. It is imperative that developers and administrators update their langchain installations to a patched version immediately. This remediation should be treated as a high priority for any application utilizing the vulnerable component.

---METADATA---
VENDOR: TMS Global Software
PRODUCT: TMS Management Console
AFFECTED_VERSIONS: 6.3.7.27386.20250818
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unauthenticated remote file upload vulnerability in the TMS Management Console allows attackers to execute arbitrary code via the Logo upload function.

Executive Summary:
A critical remote code execution vulnerability in the TMS Global Software TMS Management Console poses an extreme risk due to the potential for full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-69828

Affected Software: TMS Global Software TMS Management Console

Affected Versions: 6.3.7.27386.20250818

Vulnerability: The application fails to properly validate file uploads within the /Customer/AddEdit endpoint, allowing an unauthenticated remote attacker to upload malicious files and achieve arbitrary code execution.

Business Impact

Successful exploitation grants an attacker full control over the affected management console, leading to potential data exfiltration, unauthorized administrative actions, and complete system takeover. With a CVSS score of 10.0, this represents the highest level of severity, necessitating immediate attention to prevent catastrophic operational impact.

Remediation Plan

Immediate Action: Contact TMS Global Software support to obtain the necessary security patch or configuration update to disable the vulnerable file upload functionality.

Proactive Monitoring: Review web server and application access logs for suspicious file upload patterns or requests directed at the /Customer/AddEdit endpoint.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to block file uploads to the management console and restrict network access to the console to known, trusted management IP ranges.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of Jan 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable and provides a direct path to total system impact.

Analyst Recommendation

Given the critical CVSS severity and the presence of a proof-of-concept, this vulnerability must be treated as a high-priority incident. Administrators should isolate the management console from the public internet immediately and coordinate with the vendor to apply the required security updates as soon as they are available.

---METADATA---
VENDOR: p2r3
PRODUCT: Bareiron
AFFECTED_VERSIONS: commit 8e4d40
---END_METADATA---

Description Summary:
A write-what-where condition in p2r3 Bareiron allows unauthenticated attackers to execute arbitrary code by sending a crafted packet that writes arbitrary values to memory.

Executive Summary:
A critical memory corruption vulnerability in p2r3 Bareiron allows unauthenticated remote attackers to execute arbitrary code via malicious network packets.

Vulnerability Details

CVE-ID: CVE-2025-69809

Affected Software: p2r3 Bareiron

Affected Versions: commit 8e4d40

Vulnerability: This is a "write-what-where" memory corruption flaw. An unauthenticated attacker can send a specially crafted network packet that triggers an out-of-bounds write, allowing them to overwrite critical memory addresses with arbitrary values.

Business Impact

The impact is Critical (CVSS 9.8) as it provides a direct path to unauthenticated Remote Code Execution (RCE). An attacker can gain full control over the affected system, leading to data theft, system destruction, or persistent access within the environment. This is particularly dangerous for low-level or "bare iron" software where security boundaries are minimal.

Remediation Plan

Immediate Action: Update to the latest commit or version of Bareiron that includes the fix for this memory corruption issue.

Proactive Monitoring: Use network intrusion detection systems (IDS) to look for malformed or unusual packets targeting the Bareiron service ports.

Compensating Controls: Implement network segmentation to isolate the Bareiron service and limit its exposure to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 16, 2026, there is no public information indicating active exploitation. However, memory corruption vulnerabilities are highly reliable for RCE and are often targeted by sophisticated actors.

Analyst Recommendation

The ability for an unauthenticated attacker to execute code via the network makes this a top-priority remediation item. Ensure the software is updated to a patched version immediately to close this critical security gap.

---METADATA---
VENDOR: Bareiron
PRODUCT: p2r3
AFFECTED_VERSIONS: Commit 8e4d40
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The p2r3 Bareiron component is vulnerable to an out-of-bounds memory access error, potentially leading to information disclosure or service disruption.

Executive Summary:
An unauthenticated out-of-bounds memory access vulnerability in Bareiron p2r3 allows remote attackers to trigger a Denial of Service or access sensitive memory regions.

Vulnerability Details

CVE-ID: CVE-2025-69808

Affected Software: Bareiron p2r3

Affected Versions: Commit 8e4d40

Vulnerability: The vulnerability exists as an out-of-bounds memory access issue triggered by the processing of a specially crafted network packet. Because the flaw is reachable by unauthenticated attackers, it presents a significant remote attack vector.

Business Impact

Successful exploitation allows an attacker to crash the service, resulting in operational downtime, or potentially leak sensitive information stored in memory. With a CVSS score of 9.1, this vulnerability represents a major risk to service availability and data confidentiality, particularly for systems exposed to untrusted networks.

Remediation Plan

Immediate Action: Identify systems running the affected commit (8e4d40) and restrict network access to these components until a vendor-supplied patch is available.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual traffic patterns targeting the p2r3 component.

Compensating Controls: Deploy a network-level firewall or Intrusion Prevention System (IPS) to filter suspicious traffic and block malformed packets before they reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its unauthenticated nature and the potential for memory corruption. Organizations should prioritize isolating affected systems and tracking the vendor's security disclosures for the release of an official patch.

---METADATA---
VENDOR: MojoPortal
PRODUCT: MojoPortal CMS
AFFECTED_VERSIONS: v2.9.0.1
---END_METADATA---

Description Summary:
MojoPortal CMS is vulnerable to a "Zip Slip" exploit in the SkinList.aspx endpoint, allowing attackers to execute arbitrary commands via a specially crafted zip file upload.

Executive Summary:
MojoPortal CMS version 2.9.0.1 is vulnerable to a critical Zip Slip flaw that enables attackers to achieve remote code execution by uploading malicious archives.

Vulnerability Details

CVE-ID: CVE-2025-69770

Affected Software: MojoPortal CMS

Affected Versions: v2.9.0.1

Vulnerability: This is a directory traversal vulnerability (Zip Slip) occurring during the extraction of zip files via the /DesignTools/SkinList.aspx endpoint. By crafting a zip file with ".." sequences in filenames, an attacker can write files to arbitrary locations on the server filesystem.

Business Impact

A successful exploit allows for arbitrary file writes, which typically leads to Remote Code Execution (RCE) by overwriting system files or uploading web shells. This results in a total compromise of the server, potential data exfiltration, and significant downtime. The CVSS score of 10 represents the maximum possible risk level.

Remediation Plan

Immediate Action: Update MojoPortal CMS to the latest secure version and restrict access to the DesignTools directory to trusted administrative IP addresses only.

Proactive Monitoring: Audit the filesystem for unexpected files in the web root and monitor for any suspicious process execution originating from the web server user.

Compensating Controls: Implement file integrity monitoring (FIM) and ensure the web server service runs with the least privilege possible to limit the impact of a file write.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 13, 2026, active exploitation has not been reported. However, Zip Slip vulnerabilities are highly critical and frequently targeted due to their high impact and relative ease of exploitation.

Analyst Recommendation

With a CVSS score of 10, this vulnerability requires an emergency response. Organizations must patch MojoPortal immediately to prevent attackers from gaining full system-level access through the skin upload functionality.

Executive Summary:
A critical vulnerability has been identified in multiple Tenda networking products, including the Tenda AX3 router. This flaw, a stack-based buffer overflow, can be exploited by a remote attacker to execute arbitrary code, effectively granting them complete control over the affected device. Successful exploitation could lead to network traffic interception, data theft, or the compromise of other devices on the internal network.

Vulnerability Details

CVE-ID: CVE-2025-69764

Affected Software: Tenda Multiple Products

Affected Versions: Tenda AX3 firmware v16.03.12.11 is confirmed to be vulnerable. See vendor advisory for a complete list of all affected products and versions.

Vulnerability: The vulnerability is a stack-based buffer overflow within the formGetIptv function of the device's firmware. The function fails to properly validate the size of user-supplied input before copying it into a fixed-size stack buffer named stbpvid. An unauthenticated remote attacker can exploit this by sending a specially crafted request containing an overly long value for the associated parameter, causing the buffer to overflow. This overflow can overwrite critical data on the stack, including the function's return address, allowing the attacker to redirect the program's execution flow to malicious shellcode and achieve remote code execution with the privileges of the device's web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. A successful exploit would result in a complete compromise of the network device, which often serves as the gateway to the internet and the primary firewall for a network segment. The business impact includes a high risk of data breaches through traffic interception (e.g., capturing credentials and sensitive information), loss of network availability, and the potential for attackers to use the compromised device as a pivot point to attack other internal systems. Furthermore, the compromised router could be conscripted into a botnet for use in larger-scale attacks against other organizations, causing significant reputational damage.

Remediation Plan

Immediate Action: Immediately apply the latest firmware updates provided by Tenda to all affected devices. After patching, it is crucial to monitor for any signs of post-remediation exploitation attempts and review device access logs for any anomalous activity that occurred prior to the update.

Proactive Monitoring: Implement network monitoring to detect suspicious traffic patterns originating from or directed to the Tenda devices. System and web server logs on the devices should be reviewed for unusually long or malformed requests, particularly those targeting IPTV-related functionalities. Configure Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) with signatures to detect and block common buffer overflow attack patterns.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Ensure the device's administrative web interface is not exposed to the public internet (WAN).
• Restrict access to the administrative interface to trusted IP addresses or a dedicated management VLAN.
• Implement network segmentation to limit the potential impact of a compromised router on critical internal assets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of January 22, 2026, there is no known public proof-of-concept exploit code, and there are no reports of this vulnerability being actively exploited in the wild. However, due to the critical severity and the nature of the flaw, it is highly likely that security researchers and threat actors will develop exploit code in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability represents a severe risk to the security of the network perimeter. Although it is not currently listed on the CISA KEV catalog and is not under active exploitation, the potential for complete device takeover warrants immediate action. We strongly recommend that all organizations using affected Tenda products prioritize the deployment of the vendor-supplied firmware updates to mitigate the risk of compromise.

Executive Summary:
A high-severity SQL Injection vulnerability in the Events Manager WordPress plugin allows an unauthenticated attacker to exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-6970

Affected Software: WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability allows an unauthenticated attacker to execute time-based SQL injection attacks. The flaw exists due to insufficient sanitization of user-supplied input to the 'orderby' parameter, enabling the attacker to manipulate database queries and infer database content.

Business Impact

A successful exploit could allow an attacker to exfiltrate sensitive information from the underlying WordPress database, including user credentials, personal data, and other confidential site content. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to data confidentiality and integrity, potentially leading to reputational damage and regulatory penalties.

Remediation Plan

Immediate Action:
Immediately update the Events Manager plugin to the latest patched version provided by the vendor. If the plugin is no longer required, it should be deactivated and removed entirely.

Proactive Monitoring:
Monitor web server and database logs for unusually long query execution times or suspicious SQL syntax targeting the affected plugin's functionality, particularly involving the 'orderby' parameter.

Compensating Controls:
Implement and configure a Web Application Firewall (WAF) with rules designed to detect and block common SQL injection patterns as a virtual patch pending the update.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of SQL injection flaws, the potential for future exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for complete database compromise by an unauthenticated attacker, immediate action is required. We strongly recommend prioritizing the application of the vendor-supplied update to the Events Manager plugin to prevent potential data breaches and unauthorized access.