---METADATA---
VENDOR: icagenda.com
PRODUCT: iCagenda extension for Joomla
AFFECTED_VERSIONS: 4.0.8-4.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The iCagenda extension for Joomla contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into web pages.

Executive Summary:
A critical cross-site scripting vulnerability in the iCagenda extension for Joomla allows authenticated attackers to execute arbitrary scripts in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2026-75948

Affected Software: icagenda.com iCagenda extension for Joomla

Affected Versions: 4.0.8-4.0.12

Vulnerability: This vulnerability is classified as CWE-79, improper neutralization of input during web page generation. It requires low privileges (an authenticated user) and user interaction to execute, potentially leading to session hijacking or unauthorized actions.

Business Impact

The vulnerability carries a CVSS score of 8.6, reflecting its potential for high impact on data integrity and confidentiality. Successful exploitation could allow an attacker to compromise user accounts, steal session tokens, or perform unauthorized administrative actions within the Joomla environment, leading to significant reputational damage and potential data loss.

Remediation Plan

Immediate Action: Update the iCagenda extension to the latest version provided by the vendor to remediate the vulnerability.

Proactive Monitoring: Review web application access logs for unusual patterns or attempts to inject script tags into input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by authenticated users who possess sufficient permissions to interact with the extension features.

Analyst Recommendation

Given the high CVSS score and the nature of cross-site scripting, organizations utilizing the iCagenda extension should prioritize patching immediately. Ensure that all administrative and user-facing accounts are protected by strong authentication to limit the impact of potential unauthorized access.

---METADATA---
VENDOR: HP
PRODUCT: OMEN Gaming Hub
AFFECTED_VERSIONS: 0 up to (excluding) 1101.2608.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the HP OMEN Gaming Hub allows for improper verification of cryptographic signatures, potentially leading to unauthorized system access.

Executive Summary:
HP OMEN Gaming Hub is vulnerable to a cryptographic signature bypass, which could allow a local attacker to achieve unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2026-75946

Affected Software: HP OMEN Gaming Hub

Affected Versions: 0 up to (excluding) 1101.2608.0.0

Vulnerability: This vulnerability, identified as CWE-347, involves the improper verification of cryptographic signatures. The attack requires local access and low privileges to exploit, and it does not require user interaction.

Business Impact

The CVSS score of 8.2 indicates a high severity risk that could lead to significant system compromise. Successful exploitation allows an attacker with local access to bypass security controls, potentially leading to unauthorized execution of code or access to sensitive system resources, which could disrupt business operations or compromise system integrity.

Remediation Plan

Immediate Action: Update the HP OMEN Gaming Hub software to version 1101.2608.0.0 or later immediately.

Proactive Monitoring: Monitor system access logs for unusual activity or unauthorized attempts to execute binaries associated with the OMEN Gaming Hub.

Compensating Controls: Ensure that endpoint security software is configured to monitor and block unauthorized modifications to system files and applications.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for local access, though the high CVSS score necessitates prompt patching.

Analyst Recommendation

Given the high severity of this vulnerability, it is imperative that all systems running the affected version of the HP OMEN Gaming Hub are updated to the latest version immediately. Failure to patch may expose local environments to unauthorized system access.

---METADATA---
VENDOR: Flux159
PRODUCT: mcp-game-asset-gen
AFFECTED_VERSIONS: Flux159 mcp-game-asset-gen: 0.1.0
CONFIDENCE: high
MISSING: patch
CREDITS: Eternity (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360547","name":"VDB-360547 | Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360547/cti","name":"VDB-360547 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/805508","name":"Submit #805508 | Flux159 mcp-game-asset-gen 0.1.0 Path Traversal","tags":["third-party-advisory"]},{"url":"https://github.com/Flux159/mcp-game-asset-gen/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://github.com/Flux159/mcp-game-asset-gen/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:52:59.749Z
---END_METADATA---

Description Summary:
An arbitrary file write vulnerability in Flux159 mcp-game-asset-gen allows unauthenticated remote attackers to create or overwrite files via the statusFile argument.

Executive Summary:
An unauthenticated arbitrary file write vulnerability in the Flux159 mcp-game-asset-gen MCP interface allows remote attackers to create or overwrite system files.

Vulnerability Details

CVE-ID: CVE-2026-7594

Affected Software: Flux159 mcp-game-asset-gen

Affected Versions: Flux159 mcp-game-asset-gen: 0.1.0

Vulnerability: This vulnerability is a path traversal and file write flaw located in the image_to_3d_async function of src/index.ts, where unauthenticated remote attackers can manipulate the statusFile argument without proper path validation.

Business Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to write arbitrary JSON data to writable filesystem locations, leading to potential configuration tampering, log corruption, or application service disruption. While the CVSS score is 7.3, the ability to arbitrarily overwrite files poses a severe integrity and availability risk to the hosting environment if the application runs with elevated privileges.

Remediation Plan

Immediate Action: Restrict network access to the Model Context Protocol (MCP) server, ensure it is not exposed to untrusted clients, and disable the vulnerable image_to_3d_async tool until a vendor patch is released.

Proactive Monitoring: Monitor filesystem activity for unexpected file creation or modification events outside the intended asset output directory, and review server access logs for anomalous tool invocation patterns.

Compensating Controls: Run the MCP server process under a dedicated, low-privilege service account with a strictly restricted working directory to limit the blast radius of any potential file write operations.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub issue report.

Analyst Notes: As of May 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a detailed technical write-up confirms that unauthenticated invocation allows direct control over the file write destination.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency despite the lack of active in-the-wild exploitation reports. Administrators should immediately isolate the affected MCP interface behind trusted networks or firewalls and enforce strict privilege reduction on the host operating system.

---METADATA---
VENDOR: Jet
PRODUCT: Jet Admin
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Jet Admin allows an authenticated attacker to perform stored cross-site scripting via the sign-in page's scripts and styles configuration option.

Executive Summary:
A stored cross-site scripting vulnerability in Jet Admin allows authenticated attackers to execute arbitrary JavaScript in the browser context of other users.

Vulnerability Details

CVE-ID: CVE-2026-75933

Affected Software: Jet Jet Admin

Affected Versions: 0 and later

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) residing in the sign-in page configuration. An authenticated attacker with access to the scripts and styles option can inject malicious JavaScript that executes when other users visit the sign-in page.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a significant risk to organizational security. Successful exploitation allows an attacker to steal session cookies, hijack user accounts, or manipulate data within the victim's browser context, potentially leading to unauthorized access to sensitive administrative functions.

Remediation Plan

Immediate Action: Apply vendor security updates immediately as provided by Jet Admin.

Proactive Monitoring: Review application access logs for unusual activity on the sign-in page and monitor for anomalous script execution patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input strings.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for session hijacking in an administrative context.

Analyst Recommendation

This vulnerability requires prompt attention due to its potential for account takeover. Administrators should prioritize applying the latest security patches and ensure that administrative interfaces are restricted to authorized personnel only to limit the exposure of the vulnerable configuration options.

---METADATA---
VENDOR: Jet
PRODUCT: Jet Admin
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Jet Admin contains an authorization flaw that allows attackers to link malicious applications to custom user domains and reroute traffic by modifying authentication configurations.

Executive Summary:
Jet Admin is vulnerable to an authorization bypass that allows attackers to hijack traffic and redirect users to malicious, attacker-controlled applications.

Vulnerability Details

CVE-ID: CVE-2026-75932

Affected Software: Jet Jet Admin

Affected Versions: All versions

Vulnerability: This is a missing authorization vulnerability (CWE-862). It allows an unauthenticated attacker to manipulate the authentication configuration of a target user's custom domain to reroute traffic to a malicious application.

Business Impact

The CVSS score of 8.6 reflects the high potential for session hijacking, credential theft, and data interception. Successful exploitation could lead to significant reputational damage and the compromise of user-sensitive data flowing through the affected domain.

Remediation Plan

Immediate Action: Review vendor security bulletins for available patches or configuration changes to restrict domain application linking.

Proactive Monitoring: Monitor custom domain configurations and authentication settings for unauthorized modifications or unexpected application associations.

Compensating Controls: Implement strict monitoring of traffic patterns and ensure that any external integrations are validated against known, trusted application identifiers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's ability to facilitate traffic redirection makes it highly critical for environments relying on custom domain routing.

Analyst Recommendation

The ability for an attacker to hijack traffic via domain configuration manipulation necessitates urgent attention. Organizations should evaluate their exposure and monitor for any suspicious changes to their Jet Admin application settings while awaiting further vendor guidance.

---METADATA---
VENDOR: Sunwood-ai-labs
PRODUCT: command-executor-mcp-server
AFFECTED_VERSIONS: 0.1.0
CONFIDENCE: high
MISSING: patch
CREDITS: Eternity (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360546","name":"VDB-360546 | Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360546/cti","name":"VDB-360546 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/805507","name":"Submit #805507 | Sunwood-ai-labs command-executor-mcp-server 0.1.0 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/Sunwood-ai-labs/command-executor-mcp-server/issues/6","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://github.com/Sunwood-ai-labs/command-executor-mcp-server/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:53:07.409Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Sunwood-ai-labs command-executor-mcp-server version 0.1.0 allows unauthenticated remote attackers to execute arbitrary system commands via insufficient input validation in the execute_command function.

Executive Summary:
An OS command injection vulnerability in the Sunwood-ai-labs command-executor-mcp-server version 0.1.0 allows unauthenticated remote attackers to achieve full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-7593

Affected Software: Sunwood-ai-labs command-executor-mcp-server

Affected Versions: 0.1.0

Vulnerability: This is an OS command injection flaw caused by improper neutralization of special elements within the execute_command function in src/index.ts. The application performs an insufficient allowlist check by only evaluating the first space-delimited token of the input string before passing the entire unmitigated command to a shell, requiring no authentication.

Business Impact

A successful exploitation of this vulnerability can lead to a total compromise of the host system. Attackers can read sensitive files, modify system state, or terminate critical processes, resulting in severe data loss, operational downtime, and reputational damage. While the assigned CVSS score is 7.3, the severity is amplified by the remote unauthenticated vector and the presence of a public proof-of-concept, enabling full system control.

Remediation Plan

Immediate Action: Restrict network access to the MCP server immediately, and ensure it is not exposed to untrusted clients or the public internet until a vendor patch is released.

Proactive Monitoring: Monitor system and process logs for anomalous subprocess creation, unexpected shell commands, or unauthorized execution attempts originating from the MCP interface.

Compensating Controls: Deploy a Web Application Firewall or network segmentation rules to block inbound requests containing shell metacharacters, and run the MCP server under a dedicated, low-privilege service account.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists per the referenced GitHub issue.

Analyst Notes: As of May 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from unsafe shell execution following a flawed prefix validation check.

Analyst Recommendation

Organizations utilizing the Sunwood-ai-labs command-executor-mcp-server must treat this flaw with high urgency despite the lack of a formal vendor patch. Immediate risk mitigation requires isolating the server from untrusted networks, restricting allowed command configurations, and running the service with minimal user privileges to prevent total host takeover.

---METADATA---
VENDOR: itsourcecode
PRODUCT: Courier Management System
AFFECTED_VERSIONS: itsourcecode Courier Management System: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: A10710 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360545","name":"VDB-360545 | itsourcecode Courier Management System edit_staff.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360545/cti","name":"VDB-360545 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804453","name":"Submit #804453 | itsourcecode Courier Management System V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/ltranquility/submit/issues/11","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://itsourcecode.com/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:53:15.062Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in itsourcecode Courier Management System 1.0 via the id parameter in /edit_staff.php allows remote attackers to execute arbitrary database queries.

Executive Summary:
An SQL injection vulnerability in itsourcecode Courier Management System 1.0 exposes the underlying database to unauthorized manipulation by remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-7592

Affected Software: itsourcecode Courier Management System

Affected Versions: itsourcecode Courier Management System: 1.0

Vulnerability: This issue is an SQL injection flaw (CWE-89) located in the /edit_staff.php file, specifically within the GET parameter id, allowing unauthenticated remote attackers to execute arbitrary database commands.

Business Impact

A successful exploitation of this vulnerability can lead to sensitive data leakage, data tampering, and potential comprehensive system compromise. Given the CVSS score of 7.3, the risk is classified as high because an attacker can interact with the backend database without prior authentication, threatening operational integrity and data confidentiality.

Remediation Plan

Immediate Action: Review the source code of /edit_staff.php and refactor database queries to use prepared statements and parameter binding instead of concatenating user input.

Proactive Monitoring: Monitor web and database access logs for unusual error patterns, anomalous query structures, and unexpected execution times associated with the /edit_staff.php endpoint.

Compensating Controls: Deploy a Web Application Firewall rule to inspect GET requests targeting /edit_staff.php and block common SQL injection payloads.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/ltranquility/submit/issues/11).

Analyst Notes: As of May 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw allows remote attackers to perform blind and union-based SQL injection attacks against the application.

Analyst Recommendation

Organizations utilizing itsourcecode Courier Management System version 1.0 face significant risk due to available proof-of-concept code and lack of an official patch. Administrators must apply source code modifications to enforce strict input validation and parameter binding immediately to mitigate potential database compromise.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: 0 up to 4.1.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical authentication bypass and information exposure vulnerability in phpMyFAQ allows unauthenticated remote attackers to gain unauthorized access to sensitive data.

Executive Summary:
A high-severity authentication bypass vulnerability in phpMyFAQ allows unauthorized remote actors to access sensitive information, necessitating an immediate upgrade.

Vulnerability Details

CVE-ID: CVE-2026-75918

Affected Software: phpMyFAQ

Affected Versions: 0 up to 4.1.7

Vulnerability: This is an exposure of sensitive information (CWE-200) resulting from an authentication bypass vulnerability. The vulnerability allows an unauthenticated remote attacker to interact with the system and retrieve restricted information.

Business Impact

The ability for an unauthenticated user to bypass security controls and access sensitive information presents a severe risk to data confidentiality. With a CVSS score of 8.8, this vulnerability could lead to the exposure of proprietary knowledge bases, customer data, or internal system configurations.

Remediation Plan

Immediate Action: Upgrade your phpMyFAQ installation to version 4.1.7 or later to resolve the authentication bypass flaw.

Proactive Monitoring: Review application access logs for suspicious requests or unauthorized attempts to access sensitive endpoints, particularly those involving tracking files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious requests targeting the vulnerable tracking file parameters until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently confirmed as active, the ease of access via a remote, unauthenticated vector makes this a high-priority target for automated scanning.

Analyst Recommendation

This vulnerability is critical due to the lack of required authentication for exploitation. Administrators must prioritize updating to version 4.1.7 immediately to eliminate the exposure of sensitive system data to external actors.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan is susceptible to a Cross-site Scripting vulnerability that can lead to remote code execution.

Executive Summary:
A critical cross-site scripting vulnerability in SiYuan software allows for remote code execution, posing a significant risk to local system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75917

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This vulnerability is a Cross-site Scripting (CWE-79) flaw occurring during web page generation. An attacker can exploit this via a specially crafted request, requiring user interaction to execute arbitrary code with the privileges of the application.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host machine. Given the CVSS score of 8.6, this represents a high-severity risk that could lead to total system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later to apply the necessary security patches.

Proactive Monitoring: Review system and application logs for unusual request patterns, specifically those involving unexpected scripts or navigation to external resources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to filter out malicious scripts before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it bridges the gap between client-side script injection and full remote code execution.

Analyst Recommendation

The high severity of this vulnerability, combined with the existence of a proof-of-concept, necessitates immediate action. Administrators must prioritize updating to version 3.7.4 to eliminate the risk of remote code execution.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: through 3
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
SiYuan note-taking software is vulnerable to cross-site scripting (XSS) that can be escalated to remote code execution (RCE) via unescaped block metadata in hint popups.

Executive Summary:
A high-severity cross-site scripting vulnerability in SiYuan can be leveraged to achieve remote code execution, posing a critical risk to user systems.

Vulnerability Details

CVE-ID: CVE-2026-75916

Affected Software: SiYuan SiYuan

Affected Versions: through 3

Vulnerability: This is a cross-site scripting (XSS) vulnerability resulting from the improper neutralization of input during web page generation. The vulnerability is particularly dangerous as it can be chained to achieve remote code execution through unescaped block metadata.

Business Impact

The ability to escalate XSS to remote code execution represents a total compromise of the user's environment. With a CVSS score of 8.6, this vulnerability could allow an attacker to gain full control over the local system where SiYuan is installed, potentially leading to data exfiltration or malware installation.

Remediation Plan

Immediate Action: Apply all available vendor security updates immediately to address the underlying metadata handling flaws.

Proactive Monitoring: Monitor for suspicious file system modifications or unusual network traffic originating from the SiYuan application process.

Compensating Controls: Use endpoint security solutions to restrict the ability of the SiYuan process to execute shell commands or spawn child processes.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the chain from XSS to RCE suggests that while the impact is high, the attack vector requires specific conditions to trigger.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability should be handled with the highest priority. Users are strongly encouraged to monitor the vendor security advisories and apply patches as soon as they become available for their specific deployment.

---METADATA---
VENDOR: gneyal
PRODUCT: Branch Monkey MCP
AFFECTED_VERSIONS: eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373
CONFIDENCE: high
MISSING: patch
CREDITS: LargeW (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360543","name":"VDB-360543 | eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360543/cti","name":"VDB-360543 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804413","name":"Submit #804413 | eyal-gor p_69_branch_monkey_mcp d77e757 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/eyal-gor/p_69_branch_monkey_mcp/issues/8","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://github.com/eyal-gor/p_69_branch_monkey_mcp/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:53:23.066Z
---END_METADATA---

Description Summary:
An unauthenticated OS command injection vulnerability in Branch Monkey MCP via the dev_script argument allows remote attackers to execute arbitrary commands.

Executive Summary:
An OS command injection vulnerability in Branch Monkey MCP allows unauthenticated remote attackers to achieve arbitrary command execution via the preview endpoint.

Vulnerability Details

CVE-ID: CVE-2026-7590

Affected Software: gneyal Branch Monkey MCP

Affected Versions: eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability located in the branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py file. The vulnerability occurs because the dev_script request parameter is passed directly to the system shell using subprocess.Popen with shell=True without proper validation or sanitization, requiring no authentication by an attacker.

Business Impact

A successful exploit of this vulnerability grants an attacker full command execution capabilities on the underlying host operating system. This can lead to total confidentiality, integrity, and availability compromise, resulting in unauthorized access to sensitive local files, system modification, or complete service disruption. Although the CVSS score is listed as 7.3, the potential for remote code execution and the availability of a public proof-of-concept demand a high-urgency remediation approach.

Remediation Plan

Immediate Action: Since an official patch is not yet available from the vendor, restrict network access to the preview endpoint immediately and isolate the affected service.

Proactive Monitoring: Review web server and system access logs for anomalous requests targeting /api/local-claude/time-machine/preview, and monitor process creation logs for unexpected shell execution spawned by Python.

Compensating Controls: Deploy a Web Application Firewall rule or reverse proxy filter to inspect incoming JSON payloads on the preview endpoint, specifically blocking shell metacharacters such as semicolons, ampersands, backticks, and dollar signs within the dev_script parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub issue report.

Analyst Notes: As of May 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivially exploitable remotely due to the lack of input sanitization and authentication requirements.

Analyst Recommendation

Given the critical nature of remote code execution flaws, administrators should isolate vulnerable instances of Branch Monkey MCP immediately. Organizations must monitor for vendor updates and restrict network exposure until a permanent fix eliminating raw shell execution is released.

---METADATA---
VENDOR: TRENDnet
PRODUCT: TV-IP751WIC
AFFECTED_VERSIONS: 11.03.03
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The TRENDnet TV-IP751WIC contains a stack-based buffer overflow vulnerability in the alphapd component that can be triggered remotely by an authenticated user.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the TRENDnet TV-IP751WIC camera allows authenticated remote attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-75877

Affected Software: TRENDnet TV-IP751WIC

Affected Versions: 11.03.03

Vulnerability: The vulnerability exists within multiple functions of the alphapd component, where improper input validation during manipulation of network or system settings leads to a stack-based buffer overflow (CWE-121).

Business Impact

Exploitation of this vulnerability allows an attacker to overwrite memory, potentially leading to full system control or a persistent denial of service. With a CVSS score of 9.9, this vulnerability significantly threatens the security posture of the affected device and any network segments it occupies.

Remediation Plan

Immediate Action: Restrict access to the management interface of the device to trusted IP addresses only and monitor vendor support channels for a firmware update.

Proactive Monitoring: Monitor device traffic for anomalous payloads or repeated crashes of the alphapd service, which may indicate exploitation attempts.

Compensating Controls: Place the device on an isolated VLAN with strict firewall rules to prevent unauthorized access to the management functions.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept script has been published on GitHub.

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable due to the nature of stack-based overflows in exposed network services.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the critical nature of the flaw, immediate network-level isolation is required. Monitor the vendor website for firmware patches and apply them as soon as they become available.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: All versions prior to 154
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A sandbox escape vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Thunderbird, potentially allowing full system compromise.

Executive Summary:
A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird, rated 10.0, allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-75874

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: All versions prior to 154

Vulnerability: This is a sandbox escape flaw located within the Remote Settings Client component. The vulnerability allows an unauthenticated remote attacker to bypass browser security boundaries and execute arbitrary code with the privileges of the application.

Business Impact

Successful exploitation of this vulnerability grants an attacker total control over the affected system. Given the CVSS score of 10.0, this represents the highest level of risk, as it enables data theft, malware installation, and further lateral movement within the network. The ability for an unauthenticated attacker to trigger this remotely makes it an immediate threat to organizational security.

Remediation Plan

Immediate Action: Update Mozilla Firefox and Thunderbird to version 154 or later across all enterprise endpoints immediately.

Proactive Monitoring: Review endpoint security logs for unusual process execution patterns or unexpected network traffic originating from browser-related processes.

Compensating Controls: Ensure that endpoint detection and response (EDR) solutions are active to identify and block unauthorized code execution attempts.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently confirmed, the nature of the flaw as a sandbox escape makes it highly dangerous if a weaponized exploit were developed.

Analyst Recommendation

This vulnerability is critical and requires immediate patching. IT administrators should prioritize the deployment of version 154 to all systems to eliminate the risk of remote code execution and sandbox bypass.

---METADATA---
VENDOR: GitLab
PRODUCT: AI Gateway
AFFECTED_VERSIONS: 18.10 up to 19.0.12, 19.1 up to 19.1.7, 19.2 up to 19.2.2
CONFIDENCE: high
MISSING: none
CREDITS: Thanks kyyblin for reporting this vulnerability through our HackerOne bug bounty progra (finder)
SOURCES_JSON: [{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/616990","name":null,"tags":[]},{"url":"https://hackerone.com/reports/3945100","name":"HackerOne Bug Bounty Report #3945100","tags":["technical-description","exploit","permissions-required"]}]
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the GitLab AI Gateway allows authenticated users to redirect model requests and disclose sensitive Google Cloud Vertex credentials and signing keys.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in the GitLab AI Gateway could allow authenticated users to exfiltrate sensitive cloud service credentials and private signing keys.

Vulnerability Details

CVE-ID: CVE-2026-75871

Affected Software: GitLab AI Gateway

Affected Versions: 18.10 up to 19.0.12, 19.1 up to 19.1.7, 19.2 up to 19.2.2

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) flaw. It allows an authenticated user with Duo Agent Platform access to manipulate inline flow configurations to override the HTTP Host header, forcing the gateway to send requests to attacker-controlled endpoints.

Business Impact

The exposure of Google Cloud Vertex credentials and private signing keys represents a high-impact security failure. With a CVSS score of 8.2, this vulnerability allows for the potential compromise of sensitive infrastructure, unauthorized access to cloud resources, and the bypass of organizational security controls. Such a breach could lead to significant data exfiltration and long-term reputational damage.

Remediation Plan

Immediate Action: Upgrade the GitLab AI Gateway component to version 19.0.12, 19.1.7, 19.2.2, 19.3.0, or any subsequent release provided by the vendor.

Proactive Monitoring: Review outbound network traffic logs from the AI Gateway for connections to unrecognized or external domains, and monitor Google Cloud audit logs for anomalous usage of Vertex AI credentials.

Compensating Controls: Implement strict egress filtering rules at the network level to restrict the AI Gateway from communicating with unauthorized external IP addresses or domains.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on HackerOne.

Analyst Notes: As of August 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by any authenticated user who has access to the Duo Agent Platform.

Analyst Recommendation

Given the potential for total compromise of cloud service credentials, this vulnerability poses a substantial risk to the integrity of the environment. Organizations must prioritize the deployment of the vendor-provided patches. Until updates are applied, restrict access to the Duo Agent Platform to the minimum number of necessary users and implement robust egress controls to prevent data exfiltration.

---METADATA---
VENDOR: LNATION
PRODUCT: Punk
AFFECTED_VERSIONS: 0.17 and earlier
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://metacpan.org/release/LNATION/Punk-0.17/source/include/punk/punk_session.h","name":null,"tags":["technical-description"]},{"url":"https://metacpan.org/release/LNATION/Punk-0.17/view/lib/Punk.pm","name":null,"tags":["technical-description"]},{"url":"https://metacpan.org/release/LNATION/Punk-0.18/source/Changes","name":null,"tags":["release-notes"]}]
---END_METADATA---

Description Summary:
The Punk web framework for Perl allows unauthenticated session cookie forgery because it defaults to an empty HMAC key when a session secret is not explicitly configured.

Executive Summary:
The Punk web framework for Perl contains a critical session management vulnerability that allows unauthenticated attackers to forge session cookies and hijack user identities.

Vulnerability Details

CVE-ID: CVE-2026-75870

Affected Software: LNATION Punk

Affected Versions: 0 up to (excluding) 0.18

Vulnerability: The vulnerability stems from the framework defaulting to a zero-length HMAC-SHA256 key when no secret is defined for session management. This allows an unauthenticated attacker who understands the cookie format to craft valid session tokens offline, effectively granting them the ability to impersonate any user or administrative role.

Business Impact

Successful exploitation of this flaw allows attackers to achieve total compromise of user sessions, leading to unauthorized access to sensitive data, administrative functions, and account takeover. Given the CVSS score of 9.1, this vulnerability represents a critical risk to application integrity and data confidentiality. The inability of the framework to warn users about missing secrets significantly increases the likelihood of misconfiguration in production environments.

Remediation Plan

Immediate Action: Update the Punk framework to version 0.18 or later immediately to enforce proper HMAC key generation.

Proactive Monitoring: Review application logs for anomalous session activity, such as unexpected changes in user roles or session identifiers that do not correlate with legitimate login events.

Compensating Controls: Ensure that all deployments of the Punk framework are configured with a strong, cryptographically secure secret key, even if the application is currently being updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease with which an attacker can perform offline cookie crafting once the application's cookie format is understood.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized access. Administrators must verify their current version of the Punk framework and apply the update to 0.18 without delay. Furthermore, security teams should conduct an audit of all applications utilizing this framework to ensure that a robust session secret is explicitly defined in the configuration.

---METADATA---
VENDOR: wplegalpages
PRODUCT: WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
AFFECTED_VERSIONS: 0 through 4.4.1
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:02:17.474Z
CREDITS: Supakiad S. (m3ez) (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a2a552-e73f-4b27-88de-50eb63a8d131?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3674117/gdpr-cookie-consent","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The WPLP Cookie Consent plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the saas_upload_logo function, potentially leading to remote code execution.

Executive Summary:
A critical vulnerability in the WPLP Cookie Consent plugin for WordPress allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-75865

Affected Software: wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode

Affected Versions: 0 through 4.4.1

Vulnerability: The plugin suffers from an unrestricted file upload vulnerability (CWE-434) within the saas_upload_logo function, which is reachable due to an authorization bypass on REST endpoints. This flaw permits unauthenticated attackers to upload malicious files, such as web shells, to the server.

Business Impact

Successful exploitation of this vulnerability results in full server compromise, as the ability to upload arbitrary files typically leads to remote code execution. Given the CVSS score of 9.8, this represents a critical risk to data confidentiality, integrity, and availability. Compromised instances may be used to exfiltrate sensitive user data, host phishing campaigns, or serve as a beachhead for further attacks within the internal network.

Remediation Plan

Immediate Action: Update the WPLP Cookie Consent plugin to version 4.4.2 or later immediately to resolve the file validation and authorization bypass flaws.

Proactive Monitoring: Review server access logs for suspicious POST requests targeting REST API endpoints, particularly those associated with the plugin, and monitor for the creation of unexpected files in the upload directory.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected REST API endpoints or restrict file uploads for this directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While currently unexploited in the wild, the lack of authentication requirements makes this flaw highly attractive to automated scanning tools.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to remote code execution without requiring any user credentials. IT administrators must prioritize patching this plugin to version 4.4.2 across all WordPress installations. Failure to address this flaw leaves the entire web server environment exposed to total takeover by external attackers.

---METADATA---
VENDOR: ArcadeData
PRODUCT: arcadedb
AFFECTED_VERSIONS: 0 up to (excluding) 26.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege management flaw in ArcadeDB allows authenticated users to escalate privileges to administrator by exploiting asynchronous command worker threads.

Executive Summary:
An authenticated privilege escalation vulnerability in ArcadeDB allows attackers to gain full administrative control over the database server.

Vulnerability Details

CVE-ID: CVE-2026-75851

Affected Software: ArcadeData arcadedb

Affected Versions: 0 up to (excluding) 26.8.1

Vulnerability: The vulnerability stems from improper privilege management where authenticated sessions fail to propagate to asynchronous command worker threads. An attacker with low-level read access can submit a specially crafted asynchronous JavaScript command to execute unauthorized operations, effectively bypassing the authorization gate.

Business Impact

This vulnerability allows an attacker to escalate from a restricted user account to a full server-wide administrator. This level of access grants the attacker the ability to manipulate all data, create new administrative accounts, and potentially compromise the underlying host system. The CVSS score of 9.9 highlights the extreme severity of this privilege escalation.

Remediation Plan

Immediate Action: Upgrade to ArcadeDB version 26.8.1 or later to ensure proper thread context and authorization handling.

Proactive Monitoring: Monitor database audit logs for suspicious administrative actions or unauthorized attempts to create users by non-privileged accounts.

Compensating Controls: Restrict access to the /api/v1/command endpoint and implement strict network segmentation to limit the reach of compromised database instances.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for attackers who have already gained initial low-privileged access.

Analyst Recommendation

Organizations using ArcadeDB must treat this as a high-priority update. Upgrading to 26.8.1 is the only reliable way to prevent unauthorized privilege escalation and protect the integrity of the database environment.

---METADATA---
VENDOR: ArcadeData
PRODUCT: arcadedb
AFFECTED_VERSIONS: 0 up to (excluding) 26.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in ArcadeDB allows authenticated users to execute unauthorized JavaScript commands, leading to privilege escalation to administrator.

Executive Summary:
An authenticated privilege escalation vulnerability in ArcadeDB allows attackers to create unauthorized administrator accounts.

Vulnerability Details

CVE-ID: CVE-2026-75843

Affected Software: ArcadeData arcadedb

Affected Versions: 0 up to (excluding) 26.8.1

Vulnerability: The vulnerability arises because the system fails to bind the authenticated principal during gRPC transactions, allowing an authenticated reader to bypass scripting authorization checks and execute arbitrary JavaScript code.

Business Impact

The CVSS score of 9.9 highlights the severity of this privilege escalation, which grants an attacker full administrative control over the database. This allows for the manipulation of all stored data, creation of rogue accounts, and persistence within the environment, directly impacting the confidentiality and integrity of the database.

Remediation Plan

Immediate Action: Update ArcadeDB to version 26.8.1 or later to resolve the transaction executor thread binding issue.

Proactive Monitoring: Audit database logs for suspicious user activity, specifically looking for unauthorized administrative account creation or unusual JavaScript-based commands.

Compensating Controls: Strictly limit the number of users with database access and implement robust monitoring for all authenticated sessions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once a foothold as an authenticated reader is obtained.

Analyst Recommendation

This vulnerability poses a severe risk of administrative takeover for authenticated users. Organizations should prioritize updating to version 26.8.1 immediately to patch the authentication and authorization flaw in the gRPC transaction executor.

---METADATA---
VENDOR: Zurich Instruments
PRODUCT: LabOne Q
AFFECTED_VERSIONS: 2.41.0 up to (excluding) 26.1.2, 26.4.0b1 through 26.4.0b5
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.zhinst.com/support/security/2026/zi-sa-2026-002/","name":"ZI-SA-2026-002","tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.627Z
---END_METADATA---

Description Summary:
The LabOne Q serialization framework is vulnerable to arbitrary code execution due to insecure deserialization of untrusted experiment files.

Executive Summary:
Zurich Instruments LabOne Q contains a critical insecure deserialization vulnerability that allows attackers to execute arbitrary code via malicious experiment files.

Vulnerability Details

CVE-ID: CVE-2026-7584

Affected Software: Zurich Instruments LabOne Q

Affected Versions: 2.41.0 up to (excluding) 26.1.2, 26.4.0b1 through 26.4.0b5

Vulnerability: The software fails to validate class names during the deserialization of experiment files, allowing an attacker to instantiate arbitrary Python classes. This flaw requires user interaction, specifically the opening of a malicious file, but functions without authentication to trigger the underlying code execution.

Business Impact

Successful exploitation of this vulnerability leads to arbitrary code execution in the context of the user running the Python process, potentially resulting in full system compromise. Given the CVSS score of 7.8, this represents a high-severity risk to research integrity and data confidentiality, as malicious files shared in collaborative environments could be weaponized to compromise local workstations or analysis servers.

Remediation Plan

Immediate Action: Update the LabOne Q package immediately to version 26.1.2 or 26.4.0 or later using the command pip install --upgrade laboneq.

Proactive Monitoring: Monitor system logs for unexpected Python process behavior or unauthorized file system access originating from the LabOne Q application environment.

Compensating Controls: Restrict the sharing of experiment files to trusted sources only, and implement endpoint detection and response (EDR) solutions to identify and block suspicious child processes spawned by the Python interpreter.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its reliance on insecure deserialization, which is a common vector for achieving remote code execution when handling untrusted data.

Analyst Recommendation

The vulnerability in LabOne Q poses a significant risk to laboratory infrastructure and research data. Administrators should prioritize the deployment of the provided security updates across all affected systems. Until patching is completed, users must exercise extreme caution when importing experiment files from external or untrusted collaborators.

---METADATA---
VENDOR: Ebyte
PRODUCT: NE2-D11 Firmware
AFFECTED_VERSIONS: FW-9167-0-11
CONFIDENCE: high
MISSING: patch
CREDITS: Jithin Nambiar reported this vulnerability to CISA. (finder)
SOURCES_JSON: [{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06","name":null,"tags":[]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The Ebyte NE2-D11 web management interface is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to trigger unauthorized configuration changes or service disruptions.

Executive Summary:
A critical CSRF vulnerability in Ebyte NE2-D11 firmware allows remote attackers to force administrative actions, potentially leading to total device compromise.

Vulnerability Details

CVE-ID: CVE-2026-75814

Affected Software: Ebyte NE2-D11 Firmware

Affected Versions: FW-9167-0-11

Vulnerability: This is a Cross-Site Request Forgery (CWE-352) vulnerability where the web management interface fails to verify the authenticity of requests. By luring an authenticated administrator to a malicious page, an unauthenticated attacker can execute unauthorized commands.

Business Impact

The CVSS score of 8.8 reflects the high risk of unauthorized administrative control. Exploitation can result in the modification of critical device settings, session hijacking, and service disruption, which may lead to significant operational impairment for industrial or networked environments using this hardware.

Remediation Plan

Immediate Action: As no patch is yet available, ensure that administrative sessions are closed immediately after use and avoid browsing untrusted websites while logged into the device management interface.

Proactive Monitoring: Monitor device logs for unauthorized configuration changes and review network traffic for suspicious requests originating from the management interface.

Compensating Controls: Implement strict browser-based security policies and use a dedicated, isolated management network to prevent external entities from interacting with the web interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CSRF attacks against administrative interfaces are a common vector for gaining unauthorized control over networked devices.

Analyst Recommendation

Organizations utilizing the Ebyte NE2-D11 should mitigate risk by strictly limiting administrative access to trusted internal segments. Administrators must remain vigilant regarding their browsing habits during active sessions, as the integrity of the device relies on preventing the execution of forged requests by the authenticated user.

---METADATA---
VENDOR: miniOrange
PRODUCT: SAML Single Sign On – SSO Login
AFFECTED_VERSIONS: 0 through 5.4.6
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-30T09:02:51.862Z
CREDITS: Tanishq Shah (finder); Thatchapol Booranatanit (AliceZz) (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9baea072-2c07-40b6-8410-2ebe752b0874?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php#L236","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php#L292","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-utilities.php#L739","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/mo-saml-settings-page.php#L141","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The SAML Single Sign On plugin for WordPress fails to validate SAML signatures before updating certificates, allowing unauthenticated attackers to forge authentication assertions for any user account.

Executive Summary:
The SAML Single Sign On – SSO Login plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated attackers to hijack administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-75807

Affected Software: miniOrange SAML Single Sign On – SSO Login

Affected Versions: 0 through 5.4.6

Vulnerability: The vulnerability exists in the mo_saml_login_validate() function, which improperly persists untrusted X.509 certificates from incoming SAML responses. An unauthenticated attacker can overwrite the configured identity provider certificate and forge assertions to gain full administrative access.

Business Impact

A successful exploitation of this vulnerability results in a complete compromise of the WordPress environment, as attackers can impersonate any user, including high-privilege administrators. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data exfiltration, unauthorized system configuration changes, and total loss of site integrity.

Remediation Plan

Immediate Action: Monitor the vendor for the release of a security patch and update the plugin immediately upon availability. If an update is not yet available, consider disabling the plugin until a secure version is deployed.

Proactive Monitoring: Review WordPress administrative user logs for unexpected login events or unauthorized account creations. Monitor plugin settings for modifications to the identity provider certificate configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and filter suspicious SAML response traffic. Ensure that administrative access to the WordPress dashboard is restricted to trusted IP addresses where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires a specific sequence of events involving administrator interaction, the ability to achieve full privilege escalation makes this a high-priority concern.

Analyst Recommendation

This vulnerability represents a critical risk to the security of the WordPress platform. Administrators should prioritize identifying instances of this plugin in their environment and maintain high vigilance for vendor updates. Immediate remediation is required to prevent potential unauthorized access and complete site takeover.

---METADATA---
VENDOR: AstrBotDevs
PRODUCT: AstrBot
AFFECTED_VERSIONS: AstrBotDevs AstrBot up to 4.16.0
CONFIDENCE: high
MISSING: patch
CREDITS: davidgilmore (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360420","name":"VDB-360420 | AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/360420/cti","name":"VDB-360420 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/793437","name":"Submit #793437 | AstrBotDevs AstrBot 4.16.0 Hard-coded Credentials","tags":["third-party-advisory"]},{"url":"https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AstrBot-Security-Advisory","name":null,"tags":["exploit"]},{"url":"https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-vrqm-xcfv-286r","name":null,"tags":["broken-link"]},{"url":"https://github.com/AstrBotDevs/AstrBot/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:53:30.486Z
---END_METADATA---

Description Summary:
A hard-coded credentials vulnerability in AstrBot allows remote unauthenticated attackers to compromise dashboard authentication.

Executive Summary:
A hard-coded credentials vulnerability in the AstrBot dashboard allows remote, unauthenticated attackers to compromise system security, presenting a high risk to availability and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-7579

Affected Software: AstrBotDevs AstrBot

Affected Versions: AstrBotDevs AstrBot up to 4.16.0

Vulnerability: This flaw involves the use of hard-coded credentials within the dashboard routing component, specifically inside the file astrbot/dashboard/routes/auth.py, and can be exploited remotely by unauthenticated attackers.

Business Impact

The presence of hard-coded credentials introduces a significant risk of unauthorized administrative access, potentially leading to data exposure, unauthorized configuration changes, and system downtime. Given the CVSS score of 7.3, this high-severity vulnerability must be prioritized to prevent attackers from bypassing standard authentication mechanisms.

Remediation Plan

Immediate Action: Review vendor advisories and repository updates for patch availability, and immediately restrict network access to the AstrBot dashboard if updates are absent.

Proactive Monitoring: Monitor authentication logs and dashboard traffic for unusual login attempts, unexpected session creations, or anomalous remote access patterns.

Compensating Controls: Deploy a Web Application Firewall or network segmentation rules to restrict access to the dashboard routes file and administrative endpoints to trusted management networks only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as evidenced by the referenced security advisory and exploit references.

Analyst Notes: As of May 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from hard-coded secrets that permit trivial remote bypassing of authentication checks.

Analyst Recommendation

Security teams must treat CVE-2026-7579 with high urgency due to the presence of public exploit details and the lack of immediate vendor fixes. Administrators should implement strict network-level perimeter controls around the dashboard interface until a fully patched version is released by the vendor.

---METADATA---
VENDOR: TRENDnet
PRODUCT: TEW-WLC100
AFFECTED_VERSIONS: 1v2.07b01
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TRENDnet TEW-WLC100 HTTP Header Handler allows remote unauthenticated attackers to execute arbitrary code.

Executive Summary:
A critical, remotely exploitable stack-based buffer overflow in the TRENDnet TEW-WLC100 wireless controller could lead to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-75784

Affected Software: TRENDnet TEW-WLC100

Affected Versions: 1v2.07b01

Vulnerability: The flaw resides in the HTTP Header Handler function within the Nginx component of the device. By manipulating the Server argument in an HTTP request, an unauthenticated attacker can trigger a stack-based buffer overflow, resulting in memory corruption and potential code execution.

Business Impact

This vulnerability allows for unauthenticated remote code execution on the wireless controller, which is a critical infrastructure component. Exploitation could lead to total loss of control over the wireless network, enabling man-in-the-middle attacks or the exfiltration of sensitive traffic. Given the CVSS score of 10.0, this represents a severe threat to network availability and security.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by TRENDnet to address the buffer overflow in the Nginx component.

Proactive Monitoring: Inspect network traffic for malformed HTTP headers and monitor the device for unexpected crashes or reboots.

Compensating Controls: Use a Web Application Firewall or network access control list to restrict management interface access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept script is available on GitHub.

Analyst Notes: As of August 18, 2026, there is no information indicating active exploitation in the wild, but a public proof-of-concept exists and is easily accessible. The vulnerability is inherently dangerous due to the ease of triggering a buffer overflow via remote HTTP requests.

Analyst Recommendation

Due to the availability of a public exploit and the critical nature of this device in network operations, administrators should prioritize patching immediately. If a patch is not currently available, isolate the device management interface from all untrusted networks.

---METADATA---
VENDOR: ash-project
PRODUCT: ash_ai
AFFECTED_VERSIONS: 0.1.0 up to (excluding) 1.0.0
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:07:55.490Z
CREDITS: Peter Ullrich (finder); Peter Ullrich (reporter); Zach Daniel / Ash Project (remediation developer); Jonatan Männchen / EEF (coordinator)
SOURCES_JSON: [{"url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-p5cr-mmmf-6w39","name":null,"tags":["vendor-advisory","related"]},{"url":"https://cna.erlef.org/cves/CVE-2026-75760.html","name":null,"tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-75760","name":null,"tags":["related"]},{"url":"https://github.com/ash-project/ash_ai/commit/088a2562e16d65f36cec178070de683636479f58","name":null,"tags":["patch"]}]
---END_METADATA---

Description Summary:
The ash_ai library improperly handles embedding provider errors, leading to the exposure of sensitive credentials and request state in user-facing validation messages.

Executive Summary:
A high-severity information disclosure vulnerability in ash_ai allows authenticated users to capture sensitive API credentials via crafted error messages.

Vulnerability Details

CVE-ID: CVE-2026-75760

Affected Software: ash-project ash_ai

Affected Versions: 0.1.0 up to (excluding) 1.0.0

Vulnerability: This vulnerability involves the generation of error messages containing sensitive information (CWE-209). By submitting malformed or oversized content that triggers an embedding provider failure, an authenticated user can force the application to return raw error terms, including outbound Authorization headers and API keys, directly to the caller.

Business Impact

The exposure of API keys and provider request details poses a significant risk to organizational security, as it grants attackers the potential to hijack third-party AI services or perform unauthorized actions on behalf of the application. With a CVSS score of 7.1, this vulnerability is considered High, as it enables the compromise of sensitive authentication material that could lead to further downstream attacks or service abuse.

Remediation Plan

Immediate Action: Update the ash_ai dependency to version 1.0.0 or later, which implements sanitized error logging to prevent the leakage of raw provider error terms.

Proactive Monitoring: Review application logs for unusual spikes in validation errors or repeated attempts to submit malformed input that triggers embedding processes.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected endpoints and ensure that API keys used by the embedding service have the minimum necessary scope and are regularly rotated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user who can reach the vectorization endpoint.

Analyst Recommendation

Given the ease of exploitation and the severity of credential exposure, organizations should prioritize the update to version 1.0.0. Failure to patch allows authenticated users to potentially exfiltrate production API credentials, creating a substantial risk to both the integrity of the application and the security of third-party AI integrations.

---METADATA---
VENDOR: erlef
PRODUCT: oidcc
AFFECTED_VERSIONS: 3.2.0-beta.1 up to 3.9.0
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-30T09:05:12.686Z
CREDITS: EQSTLab (reporter); Jonatan Männchen / EEF (remediation developer); Jonatan Männchen / EEF (coordinator)
SOURCES_JSON: [{"url":"https://github.com/erlef/oidcc/security/advisories/GHSA-533g-4vf3-xwrj","name":null,"tags":["related","vendor-advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-75759.html","name":null,"tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-75759","name":null,"tags":["related"]},{"url":"https://github.com/erlef/oidcc/commit/5f62fbccdae8526ff62653b8901657a6c1400fd9","name":null,"tags":["patch"]}]
---END_METADATA---

Description Summary:
The erlef oidcc library improperly verifies cryptographic signatures, allowing unauthenticated attackers to impersonate arbitrary users via crafted encrypted ID tokens or JARM responses.

Executive Summary:
A critical cryptographic verification flaw in the erlef oidcc library enables unauthenticated attackers to perform full identity impersonation, posing a severe risk to authentication integrity.

Vulnerability Details

CVE-ID: CVE-2026-75759

Affected Software: erlef oidcc

Affected Versions: 3.2.0-beta.1 up to 3.9.0

Vulnerability: This vulnerability occurs because the library fails to enforce mandatory signature checks for encrypted ID tokens and JARM responses. An unauthenticated attacker can bypass validation logic in the oidcc_jwt_util and oidcc_token modules to craft tokens that the application erroneously accepts as fully validated.

Business Impact

Successful exploitation allows an attacker to impersonate any user, including administrative accounts, by minting arbitrary tokens. Given the High CVSS score of 7.6, the potential for unauthorized access to sensitive user data and account takeover is significant, which could lead to severe reputational damage and widespread unauthorized system activity.

Remediation Plan

Immediate Action: Update the erlef oidcc library to version 3.9.0 or later immediately to incorporate the necessary cryptographic validation logic.

Proactive Monitoring: Review authentication and access logs for suspicious token issuance patterns or unexpected identity claims that do not correlate with known user sessions.

Compensating Controls: Ensure that all OIDC flows utilize strict transport security and consider implementing additional secondary validation checks on identity claims at the application gateway level if immediate patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically profound, as it stems from a fundamental failure to verify the authenticity of incoming JWT structures, making it highly susceptible to exploitation by any actor possessing the relying party's public encryption key.

Analyst Recommendation

This vulnerability represents a critical failure in the identity verification chain of the oidcc library. Organizations relying on this library for OpenID Connect integration must prioritize updating to version 3.9.0 as soon as possible to prevent potential unauthorized access. Failure to address this flaw leaves authentication mechanisms completely open to impersonation attacks.

---METADATA---
VENDOR: ash-project
PRODUCT: ash_admin
AFFECTED_VERSIONS: 0.9.1 up to (excluding) 1.3.1
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:04:00.690Z
CREDITS: Peter Ullrich (finder); Peter Ullrich (reporter); Zach Daniel / Ash Project (remediation developer); Jonatan Männchen / EEF (coordinator)
SOURCES_JSON: [{"url":"https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j","name":null,"tags":["vendor-advisory","related"]},{"url":"https://cna.erlef.org/cves/CVE-2026-75757.html","name":null,"tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-75757","name":null,"tags":["related"]},{"url":"https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56","name":null,"tags":["patch"]}]
---END_METADATA---

Description Summary:
A cookie validation flaw in ash_admin allows an attacker controlling a sibling subdomain to hijack an administrator session by injecting shadowing cookies.

Executive Summary:
The ash_admin library is vulnerable to a critical session hijacking flaw that permits attackers to impersonate administrators or alter authorization modes by exploiting improper cookie name matching.

Vulnerability Details

CVE-ID: CVE-2026-75757

Affected Software: ash-project ash_admin

Affected Versions: 0.9.1 up to (excluding) 1.3.1

Vulnerability: This is a reliance on cookies without validation and integrity checking (CWE-565). The client-side JavaScript uses an unanchored regular expression to parse cookies, allowing an attacker to override sensitive session state via a malicious cookie set on a shared registrable domain.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high level of risk. A successful exploit allows unauthorized actors to rebind an administrator session to a different tenant or actor, potentially leading to full administrative account takeover, unauthorized data access, and the bypass of critical security controls within the application.

Remediation Plan

Immediate Action: Update the ash_admin dependency to version 1.3.1 or later, which implements exact equality matching for cookie names to prevent shadowing.

Proactive Monitoring: Review application logs for unusual session activity or authentication requests originating from unexpected subdomains.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that cookies are scoped to the narrowest possible domain, preventing cross-subdomain cookie leakage.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease with which a compromised sibling domain can influence the primary application state.

Analyst Recommendation

Given the potential for complete administrative session compromise, organizations utilizing ash_admin must prioritize this update. The ease of exploitation via sibling domain control necessitates immediate patching to ensure the integrity of the administration interface and its associated actor permissions.

---METADATA---
VENDOR: ASUS
PRODUCT: Control Center Enterprise (ACC)
AFFECTED_VERSIONS: 0 through 4.0.0.2
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-04T09:03:09.640Z
CREDITS: Niels Teusink - Eye Security (finder)
SOURCES_JSON: [{"url":"https://www.asus.com/security-advisory","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A critical flaw in ASUS Control Center Enterprise allows unauthenticated attackers to obtain encryption keys, enable SSH, and gain root access via hardcoded credentials.

Executive Summary:
An unauthenticated remote code execution vulnerability in ASUS Control Center Enterprise poses a catastrophic risk to the entire managed network infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-75754

Affected Software: ASUS Control Center Enterprise (ACC)

Affected Versions: 0 through 4.0.0.2

Vulnerability: This vulnerability combines missing authentication for critical functions, Server-Side Request Forgery, and the use of hardcoded credentials. An unauthenticated attacker can exploit these flaws to extract encryption keys, enable SSH access, and ultimately execute commands as root on the target system.

Business Impact

The potential impact of this vulnerability is total system compromise. Because ASUS Control Center is designed for centralized management, a successful exploit grants an attacker full administrative control over all connected servers, workstations, and PCs within the organization. With a CVSS score of 10.0, this represents the highest level of risk, leading to potential data exfiltration, permanent data loss, and complete loss of integrity across the managed IT environment.

Remediation Plan

Immediate Action: Update ASUS Control Center Enterprise (ACC) to the latest available version provided by the vendor. Consult the official ASUS security advisory for specific patch installation instructions.

Proactive Monitoring: Monitor network traffic for unauthorized HTTP requests directed at the Control Center and investigate any unexpected creation of SSH sessions on port 2222.

Compensating Controls: Restrict network access to the Control Center interface to trusted administrative subnets only. Implement a Web Application Firewall to block suspicious requests that may attempt to trigger the SSRF or authentication bypass mechanisms.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the combination of multiple critical weaknesses, including hardcoded credentials, which provide a trivial path to full system compromise.

Analyst Recommendation

This vulnerability is classified as critical due to the ease of exploitation and the absolute control it grants an attacker over the managed infrastructure. Organizations must prioritize immediate patching or isolate the affected software from the network until a secure version is deployed. Failure to address this flaw leaves the entire managed device fleet vulnerable to full remote takeover.

---METADATA---
VENDOR: Anthropic
PRODUCT: Claude Desktop Cowork
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in Anthropic’s Claude Desktop Cowork handling of VM images may allow for unauthorized operations or system interference.

Executive Summary:
A high-severity vulnerability in Anthropic's Claude Desktop Cowork concerning VM image handling exposes users to potential security risks during virtual environment interactions.

Vulnerability Details

CVE-ID: CVE-2026-7574

Affected Software: Anthropic Claude Desktop Cowork

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the insecure handling of VM images within the Claude Desktop Cowork environment. The flaw potentially allows for improper processing of image data, which could be leveraged to affect the integrity or operation of the virtualized environment.

Business Impact

Successful exploitation could lead to unauthorized code execution or escape from the virtual environment, compromising the confidentiality and integrity of the local system. With a CVSS score of 8.7, this vulnerability poses a significant threat to users, particularly in environments where Claude Desktop Cowork is integrated into secure or sensitive workflows.

Remediation Plan

Immediate Action: Apply all available security updates provided by Anthropic for the Claude Desktop Cowork application to address the image handling flaw.

Proactive Monitoring: Monitor system logs for suspicious process spawning or unexpected file system modifications associated with the Claude Desktop application.

Compensating Controls: Restrict the application's ability to process external or untrusted VM image files until a verified patch has been applied to the host environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security flaws related to virtual image handling require immediate attention due to the potential for host-level impact. Users should prioritize updating their Claude Desktop Cowork installation and maintain vigilance regarding the source of any VM images processed by the platform until the remediation is confirmed.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.4, 26.4.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Red Hat build of Keycloak allows for the external control of assumed-immutable web parameters, potentially leading to unauthorized configuration changes or security bypasses.

Executive Summary:
An external control of immutable web parameters in Red Hat build of Keycloak (v26.4/26.4.12) allows authenticated users to manipulate system parameters, impacting overall security posture.

Vulnerability Details

CVE-ID: CVE-2026-7571

Affected Software: Red Hat build of Keycloak

Affected Versions: 26.4, 26.4.12

Vulnerability: The vulnerability involves the external control of assumed-immutable web parameters (CWE-472). An authenticated attacker can influence these parameters, which were intended to be immutable, potentially leading to an escalation of privileges or security configuration bypass.

Business Impact

As an identity and access management (IAM) solution, Keycloak is a high-value target. A CVSS score of 7.1 highlights the severity of this flaw, which could allow an authenticated user to alter authentication flows or security policies. The potential for unauthorized access to integrated downstream applications makes this a high-priority remediation item.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to version 26.4.12-1 or 26.4-17, depending on the specific deployment branch, as specified in the vendor advisory.

Proactive Monitoring: Audit Keycloak administrative logs for unauthorized changes to security realms or authentication policies that deviate from established baselines.

Compensating Controls: Limit access to the Keycloak administrative console to trusted IP ranges and enforce Multi-Factor Authentication (MFA) for all administrative accounts to minimize the risk of malicious authenticated activity.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for prior authentication mitigates the risk, but the impact within an IAM context remains significant.

Analyst Recommendation

Identity providers serve as the backbone of organizational security; therefore, any vulnerability affecting Keycloak must be treated as a priority. Administrators should apply the provided Red Hat security updates immediately to ensure the integrity of the authentication and authorization services.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Quest NetVault Backup’s NVBUDashboard component poses a severe risk of remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7570

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the NVBUDashboard component, where improper neutralization of special elements used in an SQL command allows an attacker to execute arbitrary code. Based on the functional scope of dashboard utilities, this typically requires authenticated access, though the severity is elevated due to the potential for administrative account compromise.

Business Impact

The ability to execute remote code on a backup server carries catastrophic business risk, including the potential for unauthorized data exfiltration, the destruction of backup archives, and the total compromise of the backup infrastructure. With a CVSS score of 8.8, this flaw represents a high-severity threat that could lead to widespread service disruption and loss of data integrity.

Remediation Plan

Immediate Action: Identify and apply the latest security patches provided by Quest for NetVault Backup immediately.

Proactive Monitoring: Review system access logs for anomalous database queries or unexpected execution of administrative commands originating from the dashboard interface.

Compensating Controls: Restrict network access to the NetVault Dashboard interface to authorized management subnets only and employ a Web Application Firewall (WAF) to filter malicious SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the critical role of backup infrastructure, organizations must prioritize the mitigation of this vulnerability. Administrators are advised to verify their current version against the vendor's security bulletin and apply the necessary updates to prevent potential unauthorized system access and remote code execution.

---METADATA---
VENDOR: Quest
PRODUCT: NetVault Backup
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Quest NetVault Backup is vulnerable to a cross-site scripting (XSS) flaw in the viewclient component that facilitates authentication bypass.

Executive Summary:
A high-severity authentication bypass vulnerability in Quest NetVault Backup allows unauthorized actors to compromise system integrity via cross-site scripting.

Vulnerability Details

CVE-ID: CVE-2026-7569

Affected Software: Quest NetVault Backup

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the viewclient component, where an XSS flaw enables an attacker to bypass authentication mechanisms. The lack of proper input sanitization allows the execution of malicious scripts in the context of an administrative session.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of unauthorized access to backup infrastructure. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the deletion of critical backups, significantly impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Identify and apply the latest security patches provided by Quest to address the viewclient vulnerability.

Proactive Monitoring: Review web server logs for suspicious URL patterns or unexpected script execution attempts originating from the viewclient module.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious XSS payloads targeting the NetVault interface until a patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability poses a significant risk to the security posture of the backup environment. Administrators should prioritize the installation of vendor-supplied updates as soon as they become available to mitigate the risk of authentication bypass and potential lateral movement.

---METADATA---
VENDOR: WordPress
PRODUCT: Temporary Login plugin
AFFECTED_VERSIONS: up to and including 1.0.0
---END_METADATA---

Description Summary:
The Temporary Login plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to log in as any temporary user.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Temporary Login WordPress plugin allows attackers to compromise user accounts.

Vulnerability Details

CVE-ID: CVE-2026-7567

Affected Software: WordPress Temporary Login plugin

Affected Versions: up to and including 1.0.0

Vulnerability: The maybe_login_temporary_user() function improperly handles the temp-login-token parameter, allowing an array input to bypass security checks and return all users associated with the temporary login meta key.

Business Impact

With a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to gain unauthorized access to the WordPress environment. This could lead to full site takeover, data exfiltration, or the modification of site content.

Remediation Plan

Immediate Action: Update the Temporary Login plugin to the latest version available from the vendor.

Proactive Monitoring: Review WordPress user access logs for unusual login activity or spikes in authentication attempts using temporary login tokens.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing array-based inputs for the temp-login-token parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Site administrators should update the affected plugin immediately. Given the ease of exploitation, this vulnerability poses a significant risk to the security and integrity of the affected WordPress site.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: < 4.1.137.Final, >= 4.2.0.Final, < 4.2.17.Final
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netty is susceptible to an inefficient algorithmic complexity vulnerability that may allow for denial of service.

Executive Summary:
A high severity algorithmic complexity vulnerability in the Netty network application framework poses a significant risk of denial of service attacks.

Vulnerability Details

CVE-ID: CVE-2026-75596

Affected Software: Netty Netty

Affected Versions: < 4.1.137.Final, >= 4.2.0.Final, < 4.2.17.Final

Vulnerability: The software contains an inefficient algorithmic complexity flaw (CWE-407) that can be triggered by unauthenticated remote attackers to cause excessive resource consumption and service unavailability.

Business Impact

Successful exploitation of this vulnerability could lead to significant system downtime, as the framework may become unresponsive under the load generated by the algorithmic exploit. Given the CVSS score of 8.7, this represents a high risk to business continuity for any services relying on Netty for network communications.

Remediation Plan

Immediate Action: Upgrade to Netty version 4.1.137.Final or 4.2.17.Final to implement the necessary algorithmic optimizations.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for unusual spikes that may indicate an attempt to trigger algorithmic resource exhaustion.

Compensating Controls: Deploy rate limiting and request size restrictions at the edge or load balancer level to mitigate the impact of malicious traffic patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the way the framework processes specific network payloads, making it susceptible to remote triggering.

Analyst Recommendation

This vulnerability is serious due to its potential to disrupt core network services without requiring authentication. Organizations should prioritize patching their Netty dependencies to the specified versions immediately to ensure continued service stability and resilience.

---METADATA---
VENDOR: getkirby
PRODUCT: kirby
AFFECTED_VERSIONS: < 4.9.5, >= 5.0.0, < 5.5.2
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:07:43.599Z
SOURCES_JSON: [{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w","name":"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9","name":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20","name":"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e","name":"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c","name":"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/releases/tag/4.9.5","name":"https://github.com/getkirby/kirby/releases/tag/4.9.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/releases/tag/5.5.2","name":"https://github.com/getkirby/kirby/releases/tag/5.5.2","tags":["x_refsource_MISC"]}]
---END_METADATA---

Description Summary:
Kirby CMS is vulnerable to path traversal via the media handler and file versioning components, allowing unauthenticated remote attackers to read arbitrary files and delete job files.

Executive Summary:
An unauthenticated path traversal vulnerability in Kirby CMS allows remote attackers to perform unauthorized file operations, posing a significant risk to data confidentiality and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75594

Affected Software: getkirby kirby

Affected Versions: < 4.9.5, >= 5.0.0, < 5.5.2

Vulnerability: This is a path traversal vulnerability (CWE-22) located in the media handler (src/Cms/Media.php) and file versioning (src/Filesystem/Asset.php) components. By supplying encoded slash characters or directory traversal sequences, an unauthenticated remote attacker can bypass intended directory restrictions to access arbitrary files or trigger unauthorized file deletions.

Business Impact

Successful exploitation allows an attacker to confirm the existence of sensitive files and potentially delete critical system job files, leading to unauthorized information disclosure and denial of service. With a CVSS score of 8.2, this vulnerability is considered high severity, as it requires no authentication and can be triggered remotely by an attacker to compromise the integrity and availability of the content management system.

Remediation Plan

Immediate Action: Update Kirby to version 4.9.5 or 5.5.2 immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review web server access logs for requests containing encoded characters like %2f or directory traversal sequences such as ../ directed toward media or asset endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests that contain directory traversal patterns or suspicious encoded slashes in URLs associated with media and asset processing.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of unauthenticated access and the ability to perform both file disclosure and deletion, necessitating prompt patching.

Analyst Recommendation

Given the high CVSS score and the potential for both information disclosure and service disruption, administrators should prioritize applying the security updates to version 4.9.5 or 5.5.2. Testing the update in a staging environment is recommended, but the urgency of this fix warrants an expedited deployment schedule to secure the application against potential exploitation.

---METADATA---
VENDOR: getgrav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to (excluding) 4.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav Email plugin is susceptible to a template injection vulnerability, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A template injection flaw within the Grav Email plugin enables authenticated attackers to perform remote code execution, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-75574

Affected Software: getgrav Grav Email plugin

Affected Versions: 0 up to (excluding) 4.2.2

Vulnerability: This vulnerability (CWE-1336) involves improper neutralization of special elements within the Twig template engine. An attacker with low-level privileges (PR:L) can manipulate template processing to execute unauthorized commands on the server.

Business Impact

The ability to execute arbitrary code on the server represents a critical security failure, potentially leading to full system compromise, data theft, or complete service disruption. With a CVSS score of 8.8, this high-severity vulnerability allows an authenticated attacker to move beyond application-level access to the underlying operating system environment.

Remediation Plan

Immediate Action: Update the Grav Email plugin to version 4.2.2 or later to address the template injection flaw.

Proactive Monitoring: Inspect server logs for anomalous execution patterns or unexpected system calls originating from the web application process.

Compensating Controls: Ensure that the application is running with the principle of least privilege, limiting the permissions of the web server user to minimize the potential impact of a successful code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of template injection makes the application highly susceptible to payload delivery if the input is not strictly sanitized.

Analyst Recommendation

Given the potential for remote code execution, this issue requires immediate attention from security teams. Organizations should verify their current version of the Grav Email plugin and apply the 4.2.2 update to prevent unauthorized code execution.

---METADATA---
VENDOR: itsourcecode
PRODUCT: Electronic Judging System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: baiqiuran (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360363","name":"VDB-360363 | itsourcecode Electronic Judging System login.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360363/cti","name":"VDB-360363 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/805852","name":"Submit #805852 | itsourcecode Electronic Judging System V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/nidieaaa/test/issues/9","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://itsourcecode.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.627Z
---END_METADATA---

Description Summary:
The Electronic Judging System 1.0 is vulnerable to unauthenticated SQL injection via the username parameter in the /intrams/login.php file, allowing potential unauthorized database access.

Executive Summary:
A critical SQL injection vulnerability exists in the itsourcecode Electronic Judging System 1.0, which allows unauthenticated remote attackers to compromise the backend database.

Vulnerability Details

CVE-ID: CVE-2026-7555

Affected Software: itsourcecode Electronic Judging System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /intrams/login.php file. An unauthenticated attacker can supply malicious input via the username parameter to manipulate backend SQL queries.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive data, modify database records, or potentially gain full control of the application. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which could lead to severe operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /intrams/login.php endpoint via network controls or disable the application entirely until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically looking for SQL syntax or time-based sleep commands targeting the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's GitHub issue report.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication to execute.

Analyst Recommendation

Due to the lack of a vendor-provided patch and the availability of public proof-of-concept code, this vulnerability poses an immediate threat to any exposed instance of the Electronic Judging System. Organizations should prioritize isolating this software from public networks and implementing strict WAF filtering to prevent unauthorized database access.

---METADATA---
VENDOR: hexpm
PRODUCT: hexpm
AFFECTED_VERSIONS: 2025-10-18 up to (excluding) 2026-08-24; commit range 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b up to (excluding) bf0fb9d208f0acfabf7a2f7467c8231659e322a8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OAuth token endpoint in hexpm contains an authorization flaw allowing API keys with repository permissions to access private packages belonging to other organizations.

Executive Summary:
An incorrect authorization vulnerability in the hexpm OAuth token endpoint allows unauthorized access to private packages, threatening the confidentiality of proprietary code and data.

Vulnerability Details

CVE-ID: CVE-2026-75542

Affected Software: hexpm hexpm

Affected Versions: 2025-10-18 through 2026-08-24; specifically commits leading up to bf0fb9d208f0acfabf7a2f7467c8231659e322a8.

Vulnerability: The issue is an incorrect authorization flaw (CWE-863) where the system fails to properly validate the scope of an API key. An authenticated user holding valid repository permissions can leverage this weakness to read private packages owned by different organizations.

Business Impact

The ability to access another organization's private packages can lead to the exposure of sensitive proprietary information, intellectual property theft, and potential supply chain compromise. With a CVSS score of 8.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Update the hexpm instance to the patched version that includes commit bf0fb9d208f0acfabf7a2f7467c8231659e322a8.

Proactive Monitoring: Audit API key usage logs to identify any anomalous access requests or unauthorized attempts to pull private packages from unfamiliar organizations.

Compensating Controls: Temporarily revoke highly privileged API keys until the update is applied, and enforce strict organizational scoping for all API access tokens.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily contained to environments hosting multi-tenant package repositories.

Analyst Recommendation

Security teams managing hexpm installations must apply the provided patch immediately to close the authorization gap. Ensuring that API keys are restricted to their intended scope is critical to maintaining the security and privacy of the package repository ecosystem.

---METADATA---
VENDOR: HKUDS
PRODUCT: OpenHarness
AFFECTED_VERSIONS: 0 up to (excluding) 438e373
CONFIDENCE: high
MISSING: patch
CREDITS: Chia Min Jun Lennon (finder)
SOURCES_JSON: [{"url":"https://github.com/HKUDS/OpenHarness/pull/208","name":null,"tags":["issue-tracking"]},{"url":"https://github.com/HKUDS/OpenHarness/commit/438e37309778e19060dfe7b172eb142e543c4cd6","name":null,"tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/hkuds-openharness-remote-command-execution-via-bridge-slash-command","name":null,"tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.627Z
---END_METADATA---

Description Summary:
HKUDS OpenHarness contains an OS command injection vulnerability in the /bridge slash command, allowing authenticated users to execute arbitrary commands on the host system.

Executive Summary:
A critical remote code execution vulnerability in HKUDS OpenHarness allows authenticated attackers to gain full system-level access through the /bridge command interface.

Vulnerability Details

CVE-ID: CVE-2026-7551

Affected Software: HKUDS OpenHarness

Affected Versions: 0 up to (excluding) 438e373

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability occurring within the /bridge slash command. Authenticated users can provide malicious command text that is processed by the bridge session manager and executed via a shared shell subprocess, resulting in unauthorized command execution with the privileges of the OpenHarness process user.

Business Impact

The ability to execute arbitrary OS commands poses a severe risk to organizational security, as it allows attackers to compromise sensitive local files, extract credentials, and access internal repository contents. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to full system compromise and significant data exfiltration, directly impacting the confidentiality, integrity, and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of OpenHarness beyond commit hash 438e373 or apply the vendor-provided patch immediately.

Proactive Monitoring: Monitor system logs for unusual shell subprocess activity, unexpected child processes spawned by the OpenHarness service, and unauthorized access attempts to sensitive configuration or credential files.

Compensating Controls: Implement strict network segmentation to limit access to the OpenHarness interface and utilize a Web Application Firewall (WAF) to inspect and block suspicious input patterns within slash commands.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its direct interaction with the underlying operating system, making it a prime candidate for exploitation if exposed to untrusted users.

Analyst Recommendation

Given the potential for remote code execution and the high CVSS severity rating, this vulnerability must be treated as a priority for remediation. Administrators should verify their current deployment version against the identified safe commit hash and apply updates immediately to prevent unauthorized system access.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360360","name":"VDB-360360 | SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360360/cti","name":"VDB-360360 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/805539","name":"Submit #805539 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/khairulazly760530-cell/cves/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.627Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System 1.0 via the ID parameter in ajax.php, allowing remote attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-7550

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) triggered by improper input validation of the ID argument within the ajax.php endpoint. The attack can be performed by an unauthenticated remote user.

Business Impact

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exposure, modification, or deletion. Given the CVSS score of 7.3, this represents a high risk to organizational data confidentiality and system integrity, particularly for environments relying on this system for sensitive inventory and sales records.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable ajax.php endpoint until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or unauthorized attempts to access customer tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter in HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the affected endpoint.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently utilizing SourceCodester Pharmacy Sales and Inventory System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and restrict exposure of the application to the public internet to prevent unauthorized database access.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360359","name":"VDB-360359 | SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360359/cti","name":"VDB-360359 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/805538","name":"Submit #805538 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/khairulazly760530-cell/cves/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.631Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Pharmacy Sales and Inventory System allows remote attackers to manipulate database queries via the ajax.php endpoint.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows for unauthenticated remote exploitation, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-7549

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection within the ajax.php file, specifically via the action=delete_customer parameter. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive pharmacy records, modification of inventory data, or potential exfiltration of customer information. Given the CVSS score of 7.3, this high-severity vulnerability represents a substantial threat to the confidentiality and integrity of the pharmacy management environment.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, users should immediately restrict access to the affected system by placing it behind a secure VPN or firewall, or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting ajax.php, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing SourceCodester Pharmacy Sales and Inventory System version 1.0 must treat this as a high-priority issue and implement compensating controls immediately to prevent unauthorized database manipulation while awaiting a formal vendor security update.

---METADATA---
VENDOR: Snyk
PRODUCT: sweater-comb
AFFECTED_VERSIONS: 0 up to (excluding) 3.8.8
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-30T09:08:00.358Z
CREDITS: Jashn Wahi (finder); VulnCheck (coordinator)
SOURCES_JSON: [{"url":"https://github.com/snyk/sweater-comb/releases/tag/v3.8.8","name":"Sweater Comb v3.8.8 Release Notes","tags":["release-notes"]},{"url":"https://github.com/snyk/sweater-comb/pull/743","name":"Pull Request","tags":["issue-tracking","patch"]},{"url":"https://github.com/snyk/sweater-comb/commit/05a0eec4f2acb9ce6d4814016b475504fc64eab2","name":"Patch Commit","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/synk-sweater-comb-command-injection-via-vervet-yaml-branch-name","name":null,"tags":["third-party-advisory"]}]
---END_METADATA---

Description Summary:
Snyk sweater-comb before 3.8.8 is vulnerable to OS command injection via a malicious branch name field in the .vervet.yaml configuration file.

Executive Summary:
A command injection vulnerability in Snyk sweater-comb allows authenticated users to execute arbitrary OS commands, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75486

Affected Software: Snyk sweater-comb

Affected Versions: 0 up to (excluding) 3.8.8

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) triggered when the expectGitBranch() function in src/lint.ts processes unsanitized input from the .vervet.yaml file. An attacker with low privileges who can control this configuration file can execute arbitrary commands on the underlying host when the linting process is executed.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution on the host machine. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the development environment.

Remediation Plan

Immediate Action: Update the Snyk sweater-comb package to version 3.8.8 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Monitor CI/CD pipeline logs for unexpected process execution or abnormal command-line arguments originating from the linting tool.

Compensating Controls: Restrict access to repository configuration files, such as .vervet.yaml, to trusted personnel to prevent unauthorized injection of malicious branch names.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it bridges configuration control directly to system shell execution.

Analyst Recommendation

The severity of this command injection vulnerability necessitates prompt action. Development teams using Snyk sweater-comb should verify their current version and apply the 3.8.8 update across all environments to eliminate the risk of arbitrary code execution.

---METADATA---
VENDOR: SWE-agent
PRODUCT: SWE-agent
AFFECTED_VERSIONS: 0 through 1.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SWE-agent trajectory inspector component is vulnerable to a path traversal attack, which could allow an unauthenticated attacker to read arbitrary files from the underlying server.

Executive Summary:
A path traversal vulnerability in the SWE-agent trajectory inspector allows unauthenticated remote attackers to perform unauthorized file disclosure, potentially leading to the exposure of sensitive system data.

Vulnerability Details

CVE-ID: CVE-2026-75482

Affected Software: SWE-agent

Affected Versions: 0 through 1.1.0

Vulnerability: The vulnerability is a Path Traversal (CWE-22) issue within the sweagent inspector component. It occurs because the software fails to properly sanitize user-supplied input, allowing an attacker to navigate outside the intended directory and access sensitive files on the host filesystem.

Business Impact

The ability to perform unauthorized file reads presents a high risk of information disclosure, including the potential exposure of configuration files, credentials, or source code. With a CVSS score of 7.5, the impact is substantial, as it may provide attackers with the necessary intelligence to escalate privileges or conduct further attacks against the infrastructure.

Remediation Plan

Immediate Action: Update the SWE-agent software to the latest available version that includes the security fix for the trajectory inspector.

Proactive Monitoring: Monitor system logs for file access attempts that contain directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Ensure the service runs with the principle of least privilege, restricting the filesystem access of the process to the minimum necessary directory scope.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's inherent exploitability remains high due to the nature of path traversal vulnerabilities, which are often easily weaponized once identified.

Analyst Recommendation

Organizations utilizing SWE-agent should prioritize upgrading their instances to address this path traversal vulnerability. Restricting network access to the trajectory inspector component is recommended until the patch is applied.

---METADATA---
VENDOR: skypilot-org
PRODUCT: skypilot
AFFECTED_VERSIONS: 0 through 0.13.1rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SkyPilot contains a privilege management vulnerability that allows authenticated users to improperly grant administrator roles when updating service account permissions.

Executive Summary:
A vulnerability in SkyPilot allows authenticated users to perform unauthorized privilege escalation, posing a significant risk to administrative control over service accounts.

Vulnerability Details

CVE-ID: CVE-2026-75481

Affected Software: skypilot-org skypilot

Affected Versions: 0 through 0.13.1rc1

Vulnerability: This is an improper privilege management flaw (CWE-269) where the application fails to validate if an authenticated user has the necessary authorization to elevate service account roles. The vulnerability is exploitable by an authenticated user with low privileges.

Business Impact

Successful exploitation allows an attacker to gain unauthorized administrative control over service accounts, which could lead to full system compromise or unauthorized access to sensitive cloud resources managed by SkyPilot. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could facilitate lateral movement and data exfiltration within an organization.

Remediation Plan

Immediate Action: Upgrade to the latest version of SkyPilot where the validation logic for service account permissions has been corrected.

Proactive Monitoring: Review audit logs for suspicious modifications to service account permissions or unexpected role grants to non-administrative users.

Compensating Controls: Implement strict identity and access management policies that limit the number of users capable of modifying service account configurations.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete control over service account privileges.

Analyst Recommendation

The severity of this privilege escalation vulnerability necessitates immediate attention. Administrators should verify the current version of their SkyPilot deployment and prioritize upgrading to a secure version to prevent potential unauthorized administrative access.

---METADATA---
VENDOR: Totolink
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6279_B20210910
CONFIDENCE: high
MISSING: patch
CREDITS: NEWYM (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360358","name":"VDB-360358 | Totolink NR1800X cstecgi.cgi sub_41A68C command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360358/cti","name":"VDB-360358 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804417","name":"Submit #804417 | Totolink C834FR-1C NR1800X command injection","tags":["third-party-advisory"]},{"url":"https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.631Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Totolink NR1800X router allows authenticated attackers to execute arbitrary system commands via the setUssd function in cstecgi.cgi.

Executive Summary:
A critical command injection vulnerability in the Totolink NR1800X router allows authenticated attackers to gain unauthorized remote code execution on the affected device.

Vulnerability Details

CVE-ID: CVE-2026-7548

Affected Software: Totolink NR1800X

Affected Versions: 9.1.0u.6279_B20210910

Vulnerability: The vulnerability exists within the sub_41A68C function of the cstecgi.cgi script, where the ussd parameter is improperly sanitized before being concatenated into a command string passed to the system shell. An attacker with valid user credentials can trigger this flaw by sending a crafted JSON request to the setUssd endpoint.

Business Impact

Successful exploitation of this vulnerability results in full remote code execution on the network gateway. This allows an attacker to intercept traffic, pivot into internal network segments, or permanently disable the device, leading to significant service disruption and potential compromise of sensitive internal data. With a CVSS score of 8.8, this flaw represents a high risk to organizational security posture.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware release, as no public patch is currently confirmed. Until a fix is applied, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at cstecgi.cgi that contain suspicious characters or shell command syntax within the ussd parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or local firewall rules to block access to the management interface for all unauthorized users.

Exploitation Status

Public Exploit Available: Yes — a functional proof of concept is available via the researcher's GitHub repository.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the CGI handler.

Analyst Recommendation

Given the availability of a public proof of concept and the high potential for full system compromise, administrators must treat this as a high-priority issue. If firmware updates are not immediately available, ensure the router management interface is not exposed to the public internet and enforce strict authentication controls to minimize the attack surface.

---METADATA---
VENDOR: JeecgBoot
PRODUCT: JimuReport
AFFECTED_VERSIONS: 0 through 2.3.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated access to report data and share tokens.

Executive Summary:
An authentication bypass vulnerability in JimuReport allows unauthenticated attackers to enumerate reports and retrieve sensitive share tokens, posing a high risk to information security.

Vulnerability Details

CVE-ID: CVE-2026-75479

Affected Software: JeecgBoot JimuReport

Affected Versions: 0 through 2.3.4

Vulnerability: This vulnerability (CWE-306) stems from a missing authentication check on the report folder template listing endpoint, which permits unauthenticated users to interact with critical reporting functions.

Business Impact

The ability to enumerate reports and steal share tokens can lead to unauthorized access to sensitive business intelligence data. With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality, potentially exposing proprietary reports to unauthorized parties.

Remediation Plan

Immediate Action: Check for available updates from the vendor and apply them immediately; if no patch is available, restrict access to the affected endpoint via network-level controls.

Proactive Monitoring: Audit application access logs for unauthorized access attempts directed at the report folder listing endpoint.

Compensating Controls: Use a Web Application Firewall to restrict access to the reporting interface, ensuring only authorized IP addresses or authenticated sessions can reach the vulnerable endpoint.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized code in the available data).

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the complete lack of authentication requirements on the target endpoint.

Analyst Recommendation

Organizations should immediately investigate their JimuReport deployment and implement access restrictions to the report listing functionality. Until a vendor patch is confirmed and applied, limiting network exposure is the most effective way to mitigate the risk of unauthorized data disclosure.

---METADATA---
VENDOR: Totolink
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6279_B20210910
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Totolink NR1800X lighttpd component, allowing remote attackers to trigger a crash or execute code via the Host header.

Executive Summary:
A critical stack-based buffer overflow in the Totolink NR1800X router allows remote, unauthenticated attackers to compromise device integrity.

Vulnerability Details

CVE-ID: CVE-2026-7546

Affected Software: Totolink NR1800X

Affected Versions: 9.1.0u.6279_B20210910

Vulnerability: The vulnerability exists in the find_host_ip function of the lighttpd component. By sending a crafted Host header, an unauthenticated remote attacker can trigger a buffer overflow.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. Successful exploitation allows remote code execution, which could lead to unauthorized access to the local network, interception of traffic, or the use of the device as a pivot point for further lateral movement within the business environment.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to address the buffer overflow in the web server component.

Proactive Monitoring: Monitor device traffic for anomalous HTTP headers and inspect system logs for service crashes or unexpected restarts of the lighttpd process.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering to block requests containing abnormally large or malformed Host headers.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 1, 2026, there is public disclosure of an exploit for this vulnerability. Given the ease of remote exploitation, immediate patching is mandatory to prevent unauthorized device control.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploits, poses an imminent risk to network security. Organizations utilizing the affected Totolink hardware must prioritize firmware updates or restrict management interface access to trusted internal segments immediately.

---METADATA---
VENDOR: XueZhiSi
PRODUCT: Open Source Exam System
AFFECTED_VERSIONS: <= 3.9.0
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:03:32.850Z
SOURCES_JSON: [{"url":"https://github.com/mindskip/xzs/compare/master...1258129581:xzs:patch-2","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The XueZhiSi Open Source Exam System allows authenticated teachers to delete administrator accounts due to a lack of authorization checks in the user deletion API.

Executive Summary:
A vertical privilege escalation vulnerability in the XueZhiSi Open Source Exam System permits lower-privileged teacher accounts to delete administrator accounts, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75458

Affected Software: XueZhiSi Open Source Exam System

Affected Versions: <= 3.9.0

Vulnerability: The vulnerability exists in the teacher-end interface at POST /api/teacher/user/delete/{id}. The application fails to perform necessary authorization checks, allowing an authenticated teacher to perform administrative actions, specifically deleting accounts with higher privilege levels.

Business Impact

Successful exploitation of this flaw allows an attacker to delete administrative accounts, leading to a complete loss of administrative control over the examination platform. Given the CVSS score of 8.1, this represents a high-severity risk that could result in unauthorized system disruption and potential data loss, as the integrity of the user management system is compromised.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict access to the teacher-end API endpoints via network segmentation or authentication proxy rules.

Proactive Monitoring: Audit application logs for suspicious POST requests to the /api/teacher/user/delete/ endpoint, specifically filtering for teacher-role accounts attempting to delete accounts with higher role identifiers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or inspect traffic directed at the identified vulnerable API path to prevent unauthorized deletion requests from reaching the backend.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Sep 01, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the API lacks any validation regarding the authority of the requesting user.

Analyst Recommendation

This vulnerability requires immediate attention due to the high severity of potential privilege escalation. Organizations using the XueZhiSi Open Source Exam System must prioritize restricting access to the affected API endpoints and monitor user deletion logs until a vendor-supplied update is verified and deployed.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Advanced School Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: sqlmap961 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360356","name":"VDB-360356 | SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/360356/cti","name":"VDB-360356 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804340","name":"Submit #804340 | SourceCodester Advanced School Management System with Complete Features V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/eqwerwq/CVE/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.631Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the commonController.php file of SourceCodester Advanced School Management System 1.0, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Advanced School Management System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-7545

Affected Software: SourceCodester Advanced School Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the commonController.php file. The application fails to sanitize the val parameter before incorporating it into database queries, allowing an unauthenticated attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of sensitive student or administrative records. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, which may lead to significant operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected endpoint or disable the vulnerable component if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious URL patterns containing SQL syntax or unusual characters, particularly requests targeting the commonController/checkEmail endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious input patterns targeting the val parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the referenced GitHub issue.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk. Organizations utilizing this software must prioritize restricting external access to the affected system immediately and should implement robust input validation or transition to a more secure management solution as soon as possible.

---METADATA---
VENDOR: GoWind
PRODUCT: go-wind-cms
AFFECTED_VERSIONS: Before 1.0.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/tx7do/go-wind-cms/issues/23","name":null,"tags":[]},{"url":"https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75419","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A missing authorization vulnerability in go-wind-cms before 1.0.0 allows any authenticated user to perform administrative actions such as deleting users or resetting passwords.

Executive Summary:
The go-wind-cms platform contains a critical authorization bypass flaw that enables any authenticated user to perform administrative operations, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75419

Affected Software: GoWind go-wind-cms

Affected Versions: Before 1.0.0

Vulnerability: The application utilizes a no-op authorization engine within the NewAuthorizer function, which causes the authorization middleware to fail and permit all requests. Any authenticated user, regardless of their assigned role or tenant, can successfully invoke sensitive administrative APIs.

Business Impact

This vulnerability carries a high CVSS score of 8.8, reflecting the significant potential for unauthorized administrative access. A successful exploit could lead to complete account takeovers, unauthorized data deletion, and full compromise of the application environment, resulting in significant operational disruption and loss of confidentiality and integrity.

Remediation Plan

Immediate Action: Update go-wind-cms to version 1.0.0 or later immediately to resolve the authorization middleware defect.

Proactive Monitoring: Review system and application logs for suspicious administrative API calls originating from non-administrative user accounts.

Compensating Controls: Implement strict network-level access controls to limit access to administrative endpoints, or utilize a Web Application Firewall to block unauthorized attempts to invoke sensitive administrative functions.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the TKar0-CvePoc repository.

Analyst Notes: As of August 28, 2026, there is no confirmed active exploitation in the wild, but the availability of a public proof-of-concept makes this vulnerability highly actionable for attackers. The flaw is fundamentally inherent to the application architecture, as the authorization logic is explicitly disabled in the source code.

Analyst Recommendation

Given the high severity of this authorization bypass and the public availability of exploit material, organizations must prioritize upgrading to version 1.0.0. Failure to patch this vulnerability leaves the environment exposed to trivial escalation of privilege attacks by any user with valid system credentials.

---METADATA---
VENDOR: YzmCMS
PRODUCT: YzmCMS
AFFECTED_VERSIONS: 7.5
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T14:01:30.254Z
SOURCES_JSON: [{"url":"https://github.com/yzmcms/yzmcms","name":null,"tags":[]},{"url":"https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75417","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
YzmCMS 7.5 contains a SQL injection vulnerability in the get_arrchildid function, allowing authenticated administrators to execute arbitrary SQL queries.

Executive Summary:
An authenticated SQL injection vulnerability in YzmCMS 7.5 poses a significant risk of total database compromise for affected installations.

Vulnerability Details

CVE-ID: CVE-2026-75417

Affected Software: YzmCMS YzmCMS

Affected Versions: 7.5

Vulnerability: This vulnerability is a SQL injection flaw located in the get_arrchildid function within the category controller, where the parentid parameter is not sanitized. An authenticated administrator can leverage this weakness to perform boolean-based blind SQL injection.

Business Impact

The ability to execute arbitrary SQL queries allows an attacker with administrative access to bypass data integrity controls, extract sensitive information, or modify database contents. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational data confidentiality and system integrity, as it provides a path for full database compromise.

Remediation Plan

Immediate Action: Monitor official YzmCMS release channels for a security patch addressing this SQL injection flaw and apply it as soon as it becomes available.

Proactive Monitoring: Review web server and database logs for anomalous queries originating from administrative accounts, specifically targeting the category controller endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious SQL patterns in incoming requests to the administrative interface.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the provided reference repository.

Analyst Notes: As of Aug 26, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable due to the lack of input sanitization on a critical administrative function.

Analyst Recommendation

Organizations currently running YzmCMS 7.5 should treat this vulnerability with high priority. While the attack requires administrative authentication, the potential for total database compromise necessitates immediate defensive measures, including the restriction of administrative access and the implementation of strict WAF filtering until a vendor-supplied patch is deployed.