---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to bypass security policies via CDP discovery.

Executive Summary:
A Server-Side Request Forgery (SSRF) vulnerability in OpenClaw allows authenticated users to bypass security policies, potentially leading to unauthorized internal network interactions.

Vulnerability Details

CVE-ID: CVE-2026-62197

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that occurs during CDP discovery. The vulnerability requires the attacker to have low-level privileges (authenticated access) to trigger the flaw.

Business Impact

SSRF vulnerabilities can allow an attacker to make requests to internal services that are not typically accessible from the outside, potentially leading to information disclosure or unauthorized actions within the internal network. With a CVSS score of 8.5, this high-severity vulnerability could be leveraged to gain further access into the infrastructure, undermining the security posture of the host environment.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.6 or later to remediate the SSRF vulnerability.

Proactive Monitoring: Monitor internal network traffic originating from the server hosting OpenClaw for unusual outbound requests, especially those targeting internal-only infrastructure or services.

Compensating Controls: Implement strict egress filtering on the server to prevent it from making unauthorized requests to sensitive internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is technically significant, but requires an authenticated user to initiate the request.

Analyst Recommendation

Given the potential for SSRF to be used as a pivot point for further internal network attacks, administrators should prioritize updating to the patched version, 2026.6.6. Ensure that the update is tested in a staging environment before deployment to production systems.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.22 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to an authorization bypass flaw involving WhatsApp group IDs, which may allow authenticated users to perform unauthorized actions.

Executive Summary:
An authorization flaw in OpenClaw versions 2026.3.22 to 2026.6.5 permits authenticated users to bypass security controls by manipulating group identifiers.

Vulnerability Details

CVE-ID: CVE-2026-62196

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.3.22 up to (excluding) 2026.6.6

Vulnerability: This vulnerability is identified as Incorrect Authorization (CWE-863). It occurs when the application fails to properly validate the user's authorization level relative to WhatsApp group IDs, allowing authenticated users to interact with groups they should not have access to.

Business Impact

This vulnerability enables unauthorized access to group-specific data or functions, potentially leading to unauthorized information disclosure or administrative actions within the application. The CVSS score of 8.3 reflects the significant impact on confidentiality and integrity, which could result in a serious violation of organizational access control policies.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or later, which contains the fix for the authorization validation logic.

Proactive Monitoring: Audit logs for unauthorized access attempts to group-specific data and monitor for unusual activity related to group identifier manipulation.

Compensating Controls: Restrict access to the application to only authorized personnel and implement granular access controls at the application layer to enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a logic-based flaw that requires a specific understanding of the application's group management system to exploit.

Analyst Recommendation

Due to the high-severity nature of this authorization bypass, organizations must treat this update with high priority. Apply the provided patch (version 2026.6.6) immediately to ensure that authorization checks are correctly enforced and to secure sensitive application data.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authorization bypass vulnerability via MCP loopback, allowing authenticated users to perform unauthorized actions with elevated privileges.

Executive Summary:
An authorization bypass flaw in OpenClaw versions 2026.5.20 to 2026.6.5 enables authenticated users to gain unauthorized access to critical resources.

Vulnerability Details

CVE-ID: CVE-2026-62195

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.6

Vulnerability: The vulnerability is categorized as an Incorrect Permission Assignment for Critical Resource (CWE-732). It allows an authenticated user to bypass authorization checks via an MCP loopback mechanism, leading to potential unauthorized data access or modification.

Business Impact

Successful exploitation results in unauthorized access to sensitive data or critical system functions, posing a high risk to data integrity and confidentiality. Given the CVSS score of 8.3, this flaw enables a low-privileged user to escalate their capabilities, which could lead to severe organizational data breaches or unauthorized system control.

Remediation Plan

Immediate Action: Upgrade the OpenClaw instance to version 2026.6.6 or later to ensure the proper authorization logic is enforced.

Proactive Monitoring: Review application and system access logs for anomalous patterns or unexpected privileged actions performed by standard users.

Compensating Controls: Ensure that the application is not exposed to untrusted networks and utilize strict identity and access management (IAM) policies to limit the potential blast radius of compromised accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's technical nature suggests it is a logical flaw that can be reliably triggered by authenticated users.

Analyst Recommendation

This is a high-severity authorization bypass issue that requires immediate attention. Security teams must verify their current version of OpenClaw and apply the 2026.6.6 update as soon as possible to prevent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to privilege escalation due to incorrect permission assignments and missing authorization checks during plugin installation.

Executive Summary:
A vulnerability in OpenClaw allows authenticated users to perform unauthorized privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62194

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.9

Vulnerability: This vulnerability involves CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization). An attacker with low privileges (PR:L) can leverage these flaws to bypass security controls and escalate their access level.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the application's administrative functions. With a CVSS score of 8.8, this high-severity flaw enables unauthorized actors to install malicious plugins, potentially leading to full system takeover and unauthorized data modification.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review administrative access logs for unusual plugin installation activity or unexpected user privilege elevation events.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for unauthorized attempts to access the plugin installation interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it impacts critical authorization logic required to maintain the separation of privileges.

Analyst Recommendation

Given the high CVSS score of 8.8, organizations should prioritize updating their OpenClaw instances to version 2026.6.9. Failure to patch may allow malicious actors to gain unauthorized elevated privileges, resulting in severe operational and security degradation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.6.6 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw platform contains an incorrect authorization vulnerability that allows authenticated users to trigger unauthorized state changes.

Executive Summary:
An incorrect authorization flaw in OpenClaw allows authenticated attackers to perform unauthorized operations, potentially leading to critical system impacts.

Vulnerability Details

CVE-ID: CVE-2026-62192

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.6.6 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where an authenticated user can bypass intended security constraints to perform unauthorized write or administrative actions.

Business Impact

The ability for an authenticated user to bypass authorization logic can lead to severe operational disruptions or unauthorized system changes. With a CVSS score of 8.1, this vulnerability poses a high risk to the stability and security of the affected environment.

Remediation Plan

Immediate Action: Upgrade the OpenClaw software to version 2026.6.9 or later.

Proactive Monitoring: Review audit logs for suspicious activity originating from authenticated user accounts, specifically focusing on unauthorized configuration or data modification attempts.

Compensating Controls: Restrict access to the application via network-level controls or WAF rules to limit exposure while the update is being prepared.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any authenticated user, making timely patching essential.

Analyst Recommendation

Organizations utilizing OpenClaw must treat this vulnerability with high urgency. Applying the provided update to version 2026.6.9 is the only effective way to remediate the underlying authorization bypass and secure the application against authenticated attackers.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.6.9 are vulnerable to authorization bypass due to incorrect name resolution and improper handling of security references.

Executive Summary:
An authorization bypass vulnerability in OpenClaw allows authenticated users to escalate privileges or perform unauthorized actions by exploiting name resolution flaws.

Vulnerability Details

CVE-ID: CVE-2026-62190

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: The software exhibits incorrect authorization (CWE-863) and issues with incorrectly resolved references (CWE-706). An authenticated attacker can leverage these flaws to bypass intended security constraints and execute privileged operations.

Business Impact

This vulnerability allows authenticated users to exceed their authorized access levels, which could lead to unauthorized data modification, system configuration changes, or full administrative takeover. With a CVSS score of 8.8, the potential for lateral movement and system-wide impact is substantial, particularly in multi-user or shared environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later immediately to resolve the identified authorization flaws.

Proactive Monitoring: Review audit logs for unusual activities performed by standard users, particularly those involving administrative functions or sensitive system references.

Compensating Controls: Implement the principle of least privilege by restricting user access to only the minimum necessary functions required for their role until the update is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for authenticated users, making it a critical risk for internal security.

Analyst Recommendation

The urgency of this update is high. System administrators should verify the current version of OpenClaw and apply the 2026.6.9 patch to close the authorization bypass gap and prevent privilege escalation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @openclaw/feishu package contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in the OpenClaw feishu package allows authenticated attackers to bypass security controls, posing a high risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-62188

Affected Software: OpenClaw feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This vulnerability is categorized as CWE-863 (Incorrect Authorization). It permits an authenticated user with low privileges to perform unauthorized actions, potentially leading to unauthorized data modification or access.

Business Impact

Successful exploitation of this vulnerability could lead to significant data compromise or unauthorized administrative actions within the application. Given the CVSS score of 8.1, this represents a high-severity risk that could undermine the integrity and confidentiality of business processes supported by the feishu component.

Remediation Plan

Immediate Action: Update the @openclaw/feishu package to version 2026.6.9 or later.

Proactive Monitoring: Monitor application logs for unusual API calls or unauthorized attempts to access restricted functions by standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and review existing user permissions to ensure the principle of least privilege is enforced until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the low complexity required for an authenticated attacker to bypass authorization checks.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the potential for unauthorized data manipulation. Security teams should prioritize updating the feishu package to version 2026.6.9 immediately to remediate the authorization bypass and prevent potential exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw Feishu npm package contains an authorization bypass vulnerability, allowing authenticated users to perform unauthorized operations.

Executive Summary:
An authorization bypass vulnerability in the OpenClaw Feishu npm package allows authenticated users to exceed their intended permissions, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-62187

Affected Software: OpenClaw Feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863). The vulnerability requires the attacker to have low-level privileges (PR:L) to exploit, allowing them to perform unauthorized actions at a higher privilege level.

Business Impact

The ability for a low-privileged user to bypass authorization controls can lead to unauthorized data modification, privilege escalation, or access to restricted administrative functions. With a CVSS score of 8.1, the potential for internal system compromise is high, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the @openclaw/feishu npm package to version 2026.6.9 or later immediately.

Proactive Monitoring: Review application logs for unusual activity performed by low-privileged user accounts that typically should not have access to specific Feishu tools or functions.

Compensating Controls: Audit and restrict user permissions within the application environment to ensure that the principle of least privilege is enforced until the update is deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a failure to properly verify authorization levels during function execution.

Analyst Recommendation

All users of the @openclaw/feishu package must update to version 2026.6.9 immediately. Failure to patch this vulnerability leaves the application susceptible to privilege escalation and unauthorized administrative actions by existing users.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to authorization bypass vulnerabilities due to missing or incorrect checks, allowing authenticated users to perform unauthorized actions.

Executive Summary:
A missing authorization vulnerability in OpenClaw allows authenticated users to bypass security controls, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-62186

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.8

Vulnerability: This flaw involves CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). An attacker with low privileges (PR:L) can leverage this via a network-based attack vector to override HTTP models and potentially access sensitive data.

Business Impact

The vulnerability carries a CVSS score of 7.6, indicating a high severity risk. Successful exploitation may result in unauthorized access to sensitive information or unauthorized modification of system settings, potentially leading to a breach of data confidentiality.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.8 or later to resolve the authorization logic flaws.

Proactive Monitoring: Review application access logs for unusual patterns, specifically focusing on requests that involve HTTP model overrides or unexpected administrative actions by low-privileged accounts.

Compensating Controls: Implement strict network segmentation and ensure that the application is not exposed to untrusted networks; consider applying WAF rules to detect and block suspicious HTTP request structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is moderate, requiring the attacker to have an existing low-privileged account on the system.

Analyst Recommendation

Given the high CVSS score and the nature of authorization bypass flaws, immediate remediation is required. Security teams should prioritize updating all instances of OpenClaw to version 2026.6.8 to effectively close the authorization gap and prevent unauthorized access.

---METADATA---
VENDOR: Argoproj
PRODUCT: argo-helm
AFFECTED_VERSIONS: 0 up to (excluding) 10.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Argoproj argo-helm chart uses insecure default configurations for network policies, potentially allowing unauthorized network access.

Executive Summary:
Insecure default network policies in the Argoproj argo-helm chart create a high-risk scenario for unauthorized network access within Kubernetes environments.

Vulnerability Details

CVE-ID: CVE-2026-62185

Affected Software: Argoproj argo-helm

Affected Versions: 0 up to (excluding) 10.0.0

Vulnerability: This vulnerability involves the initialization of resources with insecure default network policies (CWE-1188). This allows an attacker with adjacent network access to potentially bypass network segmentation controls.

Business Impact

A failure to enforce network policies can lead to lateral movement within a Kubernetes cluster, facilitating unauthorized access to sensitive services. The CVSS score of 7.6 indicates a high risk to the overall network security posture of the containerized infrastructure.

Remediation Plan

Immediate Action: Update the argo-helm chart to version 10.0.0 or later to ensure secure network policy defaults are applied.

Proactive Monitoring: Audit existing Kubernetes network policies to identify any services that are improperly exposed due to these insecure defaults.

Compensating Controls: Use Kubernetes NetworkPolicies to manually restrict traffic to and from Argo CD components if an immediate chart update is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw represents an inherent risk in environments that rely on default chart configurations without hardening.

Analyst Recommendation

Security teams should prioritize updating the argo-helm chart to version 10.0.0. Given the nature of this vulnerability, it is critical to verify that updated network policies are correctly applied to the cluster to prevent potential unauthorized lateral movement.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: 0 through 0.11.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The luci-app-banip component in OpenWrt is vulnerable to log injection, where an attacker can influence log parsing to inject arbitrary IP addresses.

Executive Summary:
A log parsing vulnerability in the OpenWrt luci-app-banip plugin allows unauthenticated attackers to manipulate IP blacklists, potentially causing a denial-of-service or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-62184

Affected Software: OpenWrt LuCI (specifically luci-app-banip)

Affected Versions: 0 through 0.11.1

Vulnerability: The application utilizes an awk-based parser that fails to properly sanitize or validate log fields (CWE-116). An unauthenticated attacker can inject arbitrary IP addresses via controlled fields like usernames, which the parser then incorrectly extracts and processes.

Business Impact

By injecting arbitrary IP addresses into the ban list, an attacker can cause legitimate traffic to be blocked, resulting in a denial-of-service (DoS) condition. With a CVSS score of 7.5, this vulnerability is significant for network infrastructure integrity, potentially allowing attackers to disrupt network security enforcement mechanisms.

Remediation Plan

Immediate Action: Update the luci-app-banip package to the version containing the fix for commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c.

Proactive Monitoring: Monitor firewall logs and banip activity for unexpected or suspicious IP addresses appearing in the blocklist that do not correlate with actual malicious behavior.

Compensating Controls: If immediate patching is not feasible, consider disabling the automated log-parsing features of the banip application to prevent unauthorized manipulation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently susceptible to manipulation due to the lack of input sanitization in the parsing logic.

Analyst Recommendation

The integrity of network security controls is paramount. Organizations utilizing the OpenWrt luci-app-banip plugin should apply the provided fix immediately to ensure that log parsing remains secure and resistant to malicious injection.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Syncope
AFFECTED_VERSIONS: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in Apache Syncope allows unauthenticated users to gain administrative roles via REST API calls under specific workflow configurations.

Executive Summary:
A critical privilege escalation vulnerability in Apache Syncope allows unauthenticated attackers to gain administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-62183

Affected Software: Apache Software Foundation Apache Syncope

Affected Versions: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1

Vulnerability: This is a privilege management flaw that occurs when the Java or Flowable user workflow adapters are configured without requiring admin approval for self-registration or updates. An unauthenticated attacker can exploit this via the REST API to grant themselves administrative privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical risk to organizational security. An attacker gaining administrative access can compromise the entire identity management platform, leading to complete data exposure, unauthorized account creation, and full system control.

Remediation Plan

Immediate Action: Upgrade Apache Syncope to version 4.0.7 or 4.1.2 immediately.

Proactive Monitoring: Review audit logs for suspicious REST API activity, specifically focusing on user self-registration requests or unauthorized role assignments.

Compensating Controls: If patching is delayed, disable self-registration features or reconfigure workflow adapters to mandate administrator approval for all user-related requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub (NicPWNs/CVE-2026-62183).

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept means the exploitation risk should be treated as credible.

Analyst Recommendation

Given the critical CVSS score and the presence of a public proof-of-concept, this vulnerability is highly dangerous. Organizations must verify their workflow adapter configurations and apply the necessary patches to block unauthorized privilege escalation.

---METADATA---
VENDOR: MISP
PRODUCT: misp-modules
AFFECTED_VERSIONS: 0 through v3.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) protection bypass exists in the html_to_markdown expansion module of misp-modules, allowing authenticated users to perform unauthorized network requests.

Executive Summary:
An SSRF vulnerability in the misp-modules expansion component allows authenticated attackers to bypass security controls and potentially probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-62143

Affected Software: MISP misp-modules

Affected Versions: 0 through v3.0.8

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) within the html_to_markdown module. The application fails to adequately sanitize input, allowing an authenticated user with low privileges to force the server to make unauthorized requests to internal or external infrastructure.

Business Impact

With a CVSS score of 8.3, this flaw enables attackers to bypass network perimeters, potentially exposing sensitive internal services or data that are not intended for public access. In a security platform like MISP, this could lead to the exposure of threat intelligence feeds or internal API credentials.

Remediation Plan

Immediate Action: Upgrade misp-modules to a version beyond v3.0.8 or apply the fix provided in the referenced GitHub commit (3bae4108a3ba1e507727d5264697fd7303ba0b89).

Proactive Monitoring: Audit application logs for unusual outbound connection requests originating from the MISP server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the MISP server to prevent it from initiating connections to unauthorized internal or sensitive external endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically straightforward to exploit once an attacker has authenticated access to the MISP instance.

Analyst Recommendation

Administrators must prioritize this update as it involves the core threat-sharing infrastructure. Ensure that all module dependencies are updated and verify the integrity of the html_to_markdown module configuration post-patch.

---METADATA---
VENDOR: Teracity Software
PRODUCT: TeraMIS
AFFECTED_VERSIONS: V03.26.01.14 through 30.04.2026
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Teracity Software TeraMIS is impacted by an authorization bypass vulnerability, allowing authenticated users to manipulate user-controlled keys for unauthorized access.

Executive Summary:
Teracity Software TeraMIS is vulnerable to an authorization bypass flaw that permits authenticated attackers to access or modify restricted system resources.

Vulnerability Details

CVE-ID: CVE-2026-6212

Affected Software: Teracity Software TeraMIS

Affected Versions: V03.26.01.14 through 30.04.2026

Vulnerability: This is an instance of CWE-639 (Authorization bypass through User-Controlled key). An authenticated attacker can bypass authorization checks by modifying specific parameters in the application request, granting them unauthorized access to data or functions intended for other users or administrative roles.

Business Impact

The CVSS score of 8.8 underscores the severity of this vulnerability, which threatens the confidentiality and integrity of critical management data. Unauthorized access via this flaw could lead to the exposure of sensitive corporate information or the unauthorized modification of system configurations, potentially resulting in operational disruption and loss of trust in the platform's security controls.

Remediation Plan

Immediate Action: Monitor official communication channels from Teracity Software and apply the necessary security patches immediately upon release.

Proactive Monitoring: Review system audit logs for anomalous access patterns where users are accessing data objects that do not correlate with their assigned permissions.

Compensating Controls: Where possible, restrict access to the TeraMIS instance to trusted internal networks and utilize WAF rules to validate that user-supplied keys match the expected session context.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity of the TeraMIS platform. Security teams should ensure that all instances are updated to a non-vulnerable version as soon as the vendor provides a remediation, and maintain heightened awareness of account activity until the patch is applied.

---METADATA---
VENDOR: Global IT Informatics Services Inc
PRODUCT: WEOLL
AFFECTED_VERSIONS: WEOLL from 2.0.9 before 3.2.45.33
---END_METADATA---

Description Summary:
The WEOLL platform contains an unrestricted file upload vulnerability and fails to properly constrain access to functionality via ACLs.

Executive Summary:
A high-severity file upload vulnerability in Global IT Informatics Services Inc's WEOLL platform poses a significant risk of unauthorized system access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6211

Affected Software: Global IT Informatics Services Inc WEOLL

Affected Versions: WEOLL from 2.0.9 before 3.2.45.33

Vulnerability: This vulnerability involves the unrestricted upload of files with dangerous types, allowing attackers to bypass security filters. Additionally, the application fails to properly enforce Access Control Lists (ACLs), potentially allowing unauthenticated or low-privileged users to access restricted administrative functions.

Business Impact

The exploitation of this flaw could lead to full system compromise, data exfiltration, or the deployment of malicious payloads within the network environment. With a CVSS score of 8.7, this vulnerability is classified as High, indicating a substantial risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Upgrade WEOLL to version 3.2.45.33 or later immediately to resolve the file upload and ACL enforcement flaws.

Proactive Monitoring: Review web server and application logs for suspicious file upload patterns, particularly those involving executable extensions (.php, .exe, .sh) or unexpected directory traversal attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious file uploads and restrict access to administrative interfaces based on IP allowlisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability and the potential for complete system takeover, administrators should prioritize patching WEOLL instances. Ensure that all upload directories have execution permissions disabled to mitigate the risk of uploaded malicious files being executed.

---METADATA---
VENDOR: Hannan
PRODUCT: گرویتی فرم فارسی (Persian Gravity Forms)
AFFECTED_VERSIONS: 0 through 3.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Persian Gravity Forms plugin for WordPress contains a blind SQL injection vulnerability that allows authenticated attackers with administrative privileges to compromise the database.

Executive Summary:
An authenticated SQL injection vulnerability in the Persian Gravity Forms plugin poses a significant risk to database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-61955

Affected Software: Hannan گرویتی فرم فارسی

Affected Versions: 0 through 3.0.2

Vulnerability: This vulnerability involves improper neutralization of special elements in SQL commands, allowing for blind SQL injection. The attack requires the attacker to hold high privileges (PR:H), such as an administrative account.

Business Impact

An attacker who successfully exploits this vulnerability can perform blind SQL injection to extract sensitive information from the WordPress database. The CVSS score of 7.6 indicates high severity, as unauthorized database access can lead to significant data breaches or the alteration of critical site configurations.

Remediation Plan

Immediate Action: Check the vendor’s repository for a security update and apply it immediately; if no patch is available, consider disabling the plugin until a fix is released.

Proactive Monitoring: Review database access logs for suspicious query activity and monitor for unauthorized changes to form data or user configurations.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the plugin's endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is significant, but restricted by the requirement for administrative privileges.

Analyst Recommendation

Security teams should audit all administrative accounts to ensure no unauthorized access is being used to leverage this flaw. Update the plugin as soon as the vendor provides a remediation version to eliminate the underlying vulnerability.

---METADATA---
VENDOR: QuantumCloud
PRODUCT: Simple Link Directory Pro
AFFECTED_VERSIONS: n/a through 15.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server Side Request Forgery (SSRF) vulnerability exists in the Simple Link Directory Pro WordPress plugin, allowing unauthenticated attackers to perform unauthorized requests.

Executive Summary:
The Simple Link Directory Pro plugin for WordPress contains an SSRF vulnerability that could allow an unauthenticated attacker to force the server to make unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-61953

Affected Software: QuantumCloud Simple Link Directory Pro

Affected Versions: n/a through 15.0.6

Vulnerability: The plugin is susceptible to Server Side Request Forgery (CWE-918) via unauthenticated inputs. This allows the server to be manipulated into interacting with internal or external resources, as indicated by the CVSS scope change (S:C).

Business Impact

Successful exploitation allows an attacker to probe internal network services, bypass firewalls, or interact with external services while appearing to originate from the web server. With a CVSS score of 7.2, this vulnerability poses a significant risk to the security of the internal network infrastructure.

Remediation Plan

Immediate Action: Update the Simple Link Directory Pro plugin to version 15.0.7 or later to sanitize input and prevent unauthorized requests.

Proactive Monitoring: Monitor server egress traffic and logs for unexpected outbound connections, particularly those targeting internal IP addresses or sensitive network services.

Compensating Controls: Restrict server network access to only necessary external endpoints via egress filtering, and deploy a WAF to block malformed requests containing external URLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF flaws are often used as a stepping stone for deeper network penetration.

Analyst Recommendation

Given the potential for internal network discovery and abuse, immediate remediation is required. Administrators must ensure the plugin is updated to the latest version to prevent the server from being leveraged as a proxy for malicious activity.

---METADATA---
VENDOR: themetechmount
PRODUCT: TrueBooker
AFFECTED_VERSIONS: up to and including 1.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TrueBooker for WordPress is vulnerable to an unauthenticated privilege escalation, allowing unauthorized users to gain elevated access.

Executive Summary:
The TrueBooker plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative control over the affected site.

Vulnerability Details

CVE-ID: CVE-2026-61951

Affected Software: themetechmount TrueBooker

Affected Versions: up to and including 1.2.3

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) that permits an unauthenticated attacker to manipulate plugin functions to escalate their account permissions.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature. A successful exploit could lead to a full site takeover, unauthorized data access, and the potential for persistent backdoors to be installed by the attacker, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the TrueBooker plugin to version 1.2.4 or later immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected administrative role changes or newly created administrator accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at plugin-specific API endpoints until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the affected function.

Analyst Recommendation

Given the critical severity and the ease of exploitation (unauthenticated), administrators must prioritize patching this plugin immediately. Failure to update to version 1.2.4 leaves the entire WordPress environment susceptible to compromise.

---METADATA---
VENDOR: themetechmount
PRODUCT: TrueBooker
AFFECTED_VERSIONS: <= 1.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The TrueBooker plugin for WordPress is vulnerable to an unauthenticated SQL injection, allowing remote attackers to extract sensitive data via crafted SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in the TrueBooker plugin for WordPress poses a critical risk of database information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-61950

Affected Software: themetechmount TrueBooker

Affected Versions: <= 1.2.3

Vulnerability: This is an SQL injection vulnerability occurring due to improper neutralization of special elements in database queries. It allows an unauthenticated attacker to manipulate backend queries without requiring any user interaction or privileges.

Business Impact

Successful exploitation allows unauthorized parties to access, modify, or delete sensitive information stored in the WordPress database. Given the CVSS score of 9.3, this vulnerability represents a severe risk that could lead to full database compromise, potentially exposing customer PII or administrative credentials.

Remediation Plan

Immediate Action: Update the TrueBooker WordPress plugin to version 1.2.4 or higher immediately to apply the vendor-supplied security fix.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high impact of SQL injection on web applications.

Analyst Recommendation

The critical nature of this vulnerability necessitates immediate patching. Organizations utilizing the TrueBooker plugin must verify their current version and upgrade to 1.2.4 or later as a priority to prevent potential data breaches.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Totolink A7100RU router contains an OS command injection vulnerability in the setPasswordCfg function, allowing remote unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU router enables remote unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6195

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability exists in the /cgi-bin/cstecgi.cgi file within the CGI handler, where the admpass argument is improperly sanitized. Unauthenticated remote attackers can leverage this flaw to inject and execute system-level commands via the setPasswordCfg function.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for full remote system compromise without authentication. Successful exploitation could lead to total loss of device integrity, unauthorized access to network traffic, and the potential use of the device as a pivot point for lateral movement within the internal network.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware release or consider isolating the affected device from the public internet immediately.

Proactive Monitoring: Review web access logs for suspicious requests directed at /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 13, 2026, public exploit code is available for this vulnerability. Organizations should treat this as an active threat and restrict network access to the affected hardware immediately.

Analyst Recommendation

Due to the critical severity and the existence of public exploit code, this vulnerability represents an imminent threat. Administrators must prioritize updating the firmware or, if no patch is available, moving the device behind a secure VPN or firewall to prevent unauthorized remote access.

---METADATA---
VENDOR: Bookly
PRODUCT: Bookly
AFFECTED_VERSIONS: up to and including 27.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Bookly WordPress plugin contains an unauthenticated SQL injection vulnerability in versions 27.7 and prior, enabling attackers to execute arbitrary SQL commands.

Executive Summary:
The Bookly appointment scheduling plugin is affected by a critical unauthenticated SQL injection flaw that could allow attackers to gain unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2026-61949

Affected Software: Bookly Bookly

Affected Versions: up to and including 27.7

Vulnerability: This is an SQL injection vulnerability (CWE-89) arising from insufficient input sanitization, which can be triggered by unauthenticated users to interact with the database.

Business Impact

The exploitation of this vulnerability allows for unauthorized database queries, which may lead to the disclosure of sensitive booking data, customer information, or administrative credentials. With a CVSS score of 9.3, this flaw is considered critical and requires urgent attention to prevent full database compromise.

Remediation Plan

Immediate Action: Update the Bookly plugin to version 27.8 or later immediately.

Proactive Monitoring: Monitor database query logs for suspicious or malformed SQL statements and review application logs for unauthorized access attempts.

Compensating Controls: Implement a WAF to filter malicious request parameters that match known SQL injection signatures.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly susceptible to automated exploitation efforts.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest version of the Bookly plugin. Security teams should prioritize this remediation to ensure that the site remains protected against potential database exploitation attempts.

---METADATA---
VENDOR: Shahjada
PRODUCT: WPDM – Premium Packages
AFFECTED_VERSIONS: up to and including 6.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WPDM Premium Packages WordPress plugin contains an unauthenticated SQL injection vulnerability in versions 6.2.0 and prior, permitting remote database query execution.

Executive Summary:
The WPDM Premium Packages plugin is susceptible to an unauthenticated SQL injection, creating a critical path for attackers to compromise database security.

Vulnerability Details

CVE-ID: CVE-2026-61948

Affected Software: Shahjada WPDM – Premium Packages

Affected Versions: up to and including 6.2.0

Vulnerability: The plugin fails to properly neutralize special elements in SQL commands (CWE-89), enabling unauthenticated attackers to perform malicious database operations.

Business Impact

Successful exploitation allows an attacker to bypass authentication and manipulate or extract data from the database. A CVSS score of 9.3 underscores the critical severity, which could result in significant data breaches or unauthorized access to sensitive digital assets managed by the plugin.

Remediation Plan

Immediate Action: Update the WPDM – Premium Packages plugin to version 7.0.0 or higher.

Proactive Monitoring: Analyze application server logs for anomalous database interactions and monitor for unexpected administrative account activity.

Compensating Controls: Utilize a WAF to inspect incoming traffic for SQL injection payloads, which can provide an interim layer of protection if patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable due to the lack of required authentication.

Analyst Recommendation

This vulnerability represents a significant security risk to the integrity of the WordPress site. Administrators must upgrade to version 7.0.0 immediately to remediate the flaw and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: dj-extensions.com
PRODUCT: jDownloads extension for Joomla
AFFECTED_VERSIONS: 4.1.0-4.1.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The jDownloads extension for Joomla contains an unauthenticated file upload vulnerability that allows a remote attacker to achieve full remote code execution on the server.

Executive Summary:
The jDownloads extension for Joomla is vulnerable to unauthenticated file uploads, which can lead to complete server compromise through remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-61900

Affected Software: dj-extensions.com jDownloads extension for Joomla

Affected Versions: 4.1.0-4.1.5

Vulnerability: This is an unrestricted file upload flaw (CWE-434) that allows an unauthenticated attacker to upload malicious files. By successfully executing this, the attacker gains full remote code execution (RCE) on the underlying Joomla host.

Business Impact

Exploitation of this vulnerability grants the attacker full control over the Joomla application and the underlying server environment. Given the CVSS score of 10, the impact is severe, potentially leading to the theft of site data, long-term persistence in the network, and significant reputational damage.

Remediation Plan

Immediate Action: Update the jDownloads extension for Joomla to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor server logs for HTTP requests involving suspicious file uploads or access to newly created files in document directories.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict file upload capabilities and block known malicious payloads targeting the jDownloads component.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit available).

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of unauthenticated access and file upload functionality makes this a high-priority target for automated scanning.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to patch the jDownloads extension. Security teams should ensure that all instances are updated to the latest supported version to eliminate the risk of remote code execution and unauthorized system access.

---METADATA---
VENDOR: Weintek
PRODUCT: cMT3092X firmware
AFFECTED_VERSIONS: cMT3092X firmware: 0 up to (excluding) 20210218; EasyWeb: 0 up to (excluding) v2.1.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Weintek cMT3092X HMI devices are vulnerable to privilege escalation due to improper token modification by authenticated users.

Executive Summary:
A critical privilege escalation vulnerability in Weintek cMT3092X HMI firmware allows an authenticated, non-privileged user to gain unauthorized elevated access.

Vulnerability Details

CVE-ID: CVE-2026-61892

Affected Software: Weintek cMT3092X firmware

Affected Versions: cMT3092X firmware: 0 up to (excluding) 20210218; EasyWeb: 0 up to (excluding) v2.1.20

Vulnerability: The device suffers from improper restriction of operations within the bounds of a memory buffer or object (CWE-732), allowing a low-privileged authenticated user to modify tokens and perform administrative actions.

Business Impact

Successful exploitation allows an attacker to bypass standard authorization controls, potentially leading to full control over the industrial HMI system. Given the CVSS score of 8.8, this poses a high risk to operational technology environments where unauthorized configuration changes could result in safety hazards, process disruption, or permanent equipment damage.

Remediation Plan

Immediate Action: Obtain and apply the patch package cmt_typeB_20260316_007, which updates EasyWeb to version 2.3.17-typeb, by contacting Weintek support or your local distributor.

Proactive Monitoring: Audit device access logs for unusual administrative activity or unauthorized attempts to modify system tokens.

Compensating Controls: Restrict network access to the HMI device to known, trusted IP addresses using internal firewalls or VLAN segmentation to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an authorization oversight that requires initial low-level access to the device.

Analyst Recommendation

This vulnerability represents a significant security risk to industrial control systems. Administrators must prioritize the acquisition and application of the provided patch from Weintek to prevent unauthorized privilege escalation and ensure the integrity of the HMI environment.

---METADATA---
VENDOR: Tycon Systems
PRODUCT: TPDIN-Monitor-WEB2
AFFECTED_VERSIONS: 2.3.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The web interface of Tycon Systems TPDIN-Monitor-WEB2 fails to validate credentials, allowing unauthenticated remote attackers to bypass login and obtain administrative access.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web interface allows full administrative control over power and network settings.

Vulnerability Details

CVE-ID: CVE-2026-61884

Affected Software: Tycon Systems TPDIN-Monitor-WEB2

Affected Versions: 2.3.9

Vulnerability: This vulnerability stems from a lack of server-side credential validation (CWE-288) during the login process. By submitting empty values, an attacker can bypass authentication entirely and establish an administrative session, granting them unrestricted control over the device.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for trivial, unauthenticated remote control of critical infrastructure. An attacker could remotely reboot equipment, modify network settings, or disable power relays, potentially causing physical damage or operational outages in the environments where these devices are deployed.

Remediation Plan

Immediate Action: Contact Tycon Systems for the latest security updates and apply them immediately. In the absence of a direct patch, consider isolating the device management interface from all external networks.

Proactive Monitoring: Review web access logs for unusual login patterns or multiple requests with empty credentials, which may indicate an attempt to exploit this flaw.

Compensating Controls: Deploy a Web Application Firewall (WAF) or place the device behind a secure VPN to prevent direct access to the management interface by unauthorized entities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of any required authentication, making it a high priority for mitigation.

Analyst Recommendation

Due to the critical severity and the ease of exploitation, this device should be removed from public-facing networks immediately. Ensure that the device management interface is only accessible via trusted internal networks until a formal firmware update is applied.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: LuCI to 3.0.0 (exclusive)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored XSS vulnerability in OpenWrt LuCI allows adjacent network attackers to inject malicious HTML via DHCPv6 lease hostnames.

Executive Summary:
A stored cross-site scripting vulnerability in OpenWrt LuCI allows adjacent network attackers to execute malicious scripts in the browser of an administrator.

Vulnerability Details

CVE-ID: CVE-2026-61876

Affected Software: OpenWrt LuCI

Affected Versions: LuCI to 3.0.0 (exclusive)

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability caused by the failure to properly encode DHCPv6 lease hostnames. An attacker on the local network can inject malicious HTML/JavaScript tags into the hostname, which will be executed in the administrator's browser when the status table is viewed.

Business Impact

This vulnerability carries a CVSS score of 8.8, representing a High severity risk. By exploiting this, an adjacent attacker can perform malicious actions in the context of the administrator’s session, such as stealing session cookies, redirecting the user to malicious sites, or performing unauthorized administrative actions, which could ultimately lead to full network compromise.

Remediation Plan

Immediate Action: Update the LuCI web interface to version 3.0.0 or later as indicated in the vendor advisory at https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh.

Proactive Monitoring: Review DHCPv6 lease tables and web access logs for any evidence of malformed hostnames or unusual administrative activity.

Compensating Controls: Restrict access to the administrative web interface by limiting the networks or specific IP addresses allowed to reach the management console.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable by any device capable of communicating on the local network segment.

Analyst Recommendation

Administrators should update the LuCI interface immediately to version 3.0.0 or newer to remediate this flaw. Given the ease with which adjacent attackers can inject malicious payloads, ensuring that the management interface is not exposed to untrusted clients is a critical defensive measure.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: All versions of luci-app-upnp are affected.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the OpenWrt luci-app-upnp package allows unauthenticated LAN attackers to execute malicious JavaScript via UPnP IGD AddPortMapping requests.

Executive Summary:
A critical stored XSS vulnerability in OpenWrt's luci-app-upnp component allows unauthenticated attackers to execute arbitrary code in the context of an administrator session.

Vulnerability Details

CVE-ID: CVE-2026-61875

Affected Software: OpenWrt LuCI

Affected Versions: All versions of luci-app-upnp are affected.

Vulnerability: This is a stored cross-site scripting (XSS) flaw occurring when the application fails to sanitize input within the NewPortMappingDescription field. An unauthenticated attacker on the local network can inject malicious payloads that execute when an administrator views the affected UPnP or Status pages.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an authenticated administrator. This can lead to unauthorized configuration changes, session hijacking, or further compromise of the network gateway. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and security of the administrative interface.

Remediation Plan

Immediate Action: Update your OpenWrt firmware to the latest available version, which includes a patched luci-app-upnp package.

Proactive Monitoring: Review web interface access logs for unusual activity or requests containing unexpected script tags in UPnP-related parameters.

Compensating Controls: If immediate patching is not feasible, restrict network access to the LuCI administrative interface and disable the UPnP service if it is not required for network operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger the payload storage.

Analyst Recommendation

Given the ease of exploitation and the potential for full administrative compromise, organizations should prioritize updating their OpenWrt instances. Administrators must ensure that the luci-app-upnp package is patched to the latest version to prevent potential session hijacking and unauthorized gateway manipulation.

---METADATA---
VENDOR: Directus
PRODUCT: Directus
AFFECTED_VERSIONS: < 12.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Directus is vulnerable to unauthorized information disclosure and authorization bypass due to improper handling of sensitive cached data and user-controlled keys.

Executive Summary:
Directus versions prior to 12.0.0 contain a critical vulnerability that allows unauthenticated attackers to bypass authorization controls and access sensitive cached information.

Vulnerability Details

CVE-ID: CVE-2026-61836

Affected Software: Directus

Affected Versions: < 12.0.0

Vulnerability: This vulnerability involves the use of a cache containing sensitive information and an authorization bypass through user-controlled keys. The flaw is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated attacker to bypass authorization and access sensitive data poses a severe risk to organizational confidentiality. Because Directus manages SQL database content, this vulnerability could lead to the unauthorized exposure of proprietary business data, customer information, or administrative credentials. The CVSS score of 8.6 reflects the high potential for significant data compromise.

Remediation Plan

Immediate Action: Upgrade to Directus version 12.0.0 or later immediately.

Proactive Monitoring: Review application logs for unusual access patterns or unauthorized API requests that deviate from established user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious requests targeting the API dashboard.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to its automatable nature and lack of required authentication.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for unauthorized access to sensitive database content, administrators should prioritize patching immediately. Upgrading to version 12.0.0 is the only effective way to remediate the underlying authorization and cache-handling flaws.

---METADATA---
VENDOR: NixOS
PRODUCT: nixpkgs
AFFECTED_VERSIONS: < 25.11, >= 26.05-beta, < 26.05
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nixpkgs contains an incorrect default permissions vulnerability that may expose sensitive files or system components to unauthorized access.

Executive Summary:
Nixpkgs versions within the specified ranges suffer from incorrect default permissions, which could lead to unauthorized access to sensitive system information.

Vulnerability Details

CVE-ID: CVE-2026-61828

Affected Software: NixOS nixpkgs

Affected Versions: < 25.11, >= 26.05-beta, < 26.05

Vulnerability: The vulnerability stems from incorrect default permissions assigned to software packages. This issue can be exploited by an authenticated local user to gain unauthorized access to system files or escalate privileges.

Business Impact

Successful exploitation could result in a total compromise of the affected system's security posture. With a CVSS score of 8.5, this vulnerability represents a severe risk to environments relying on Nixpkgs for software deployment, as local users could potentially bypass system restrictions.

Remediation Plan

Immediate Action: Update the Nixpkgs collection to a secure version as directed by the official NixOS security advisory.

Proactive Monitoring: Regularly audit file system permissions for critical packages and monitor for unauthorized attempts to access restricted directories by non-privileged users.

Compensating Controls: Employ system-level hardening and the principle of least privilege to ensure that local users have restricted access to sensitive software environments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for privilege escalation on the host system.

Analyst Recommendation

Given the potential for system-wide impact, it is imperative that administrators using Nixpkgs apply the relevant security updates immediately. Ensure all package channels are synchronized with the latest secure versions to prevent exploitation of these permission flaws.

---METADATA---
VENDOR: HKUDS
PRODUCT: LightRAG
AFFECTED_VERSIONS: < 1.5.5rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
LightRAG versions through 1.5.4 expose an unauthenticated API server, allowing remote attackers to manipulate knowledge graphs, access documents, and consume LLM resources.

Executive Summary:
The LightRAG API server is vulnerable to unauthenticated access, allowing remote attackers to read, modify, or delete sensitive data and consume infrastructure resources.

Vulnerability Details

CVE-ID: CVE-2026-61808

Affected Software: HKUDS LightRAG

Affected Versions: < 1.5.5rc1

Vulnerability: The application binds its API server to all network interfaces with authentication disabled by default. This missing authentication vulnerability allows any unauthenticated network attacker to perform administrative actions, including data manipulation and resource exhaustion.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to data confidentiality and availability. Unauthorized access to RAG-based systems can lead to the exposure of sensitive indexed documents, corruption of the underlying knowledge base, and significant financial loss due to the unauthorized consumption of LLM API resources.

Remediation Plan

Immediate Action: Update HKUDS LightRAG to version 1.5.5rc1 or later to enforce mandatory authentication on the API server.

Proactive Monitoring: Audit network configurations to ensure the API server is not exposed to untrusted networks and monitor logs for unauthorized API calls.

Compensating Controls: Implement strict network-level access controls or VPN requirements to restrict access to the LightRAG API to authorized internal entities only.

Exploitation Status

Public Exploit Available: Unknown — there is no confirmed public exploit in the available data.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the default configuration of disabling authentication on a critical network service.

Analyst Recommendation

Organizations utilizing LightRAG must treat this as a high-priority remediation task. Ensure that the software is updated to the fixed version and verify that the API is not exposed to the public internet until authentication controls are properly implemented and validated.

---METADATA---
VENDOR: Labring
PRODUCT: FastGPT
AFFECTED_VERSIONS: 4.15.0-beta4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FastGPT contains hard-coded credentials, which may allow an unauthenticated attacker to gain unauthorized access to sensitive information.

Executive Summary:
Hard-coded credentials within FastGPT expose the platform to potential unauthorized access by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-61684

Affected Software: Labring FastGPT

Affected Versions: 4.15.0-beta4

Vulnerability: The application utilizes hard-coded credentials (CWE-798), which can be leveraged by an unauthenticated attacker to gain unauthorized access. This vulnerability simplifies the attack path, as no complex exploitation is required to bypass authentication.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality of knowledge-based AI platforms. Unauthorized access to the platform could lead to the theft of proprietary data, sensitive AI training sets, or the manipulation of application logic, causing substantial business disruption.

Remediation Plan

Immediate Action: Update FastGPT to version 4.15.0-beta5 or later to eliminate the hard-coded credentials.

Proactive Monitoring: Monitor authentication logs for suspicious login attempts and inspect configuration files for signs of credential tampering.

Compensating Controls: Ensure the instance is not exposed to the public internet and use a Web Application Firewall to filter out requests that attempt to exploit known credential patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of hard-coded credentials makes the system inherently easy to compromise if reachable.

Analyst Recommendation

The reliance on hard-coded credentials represents a fundamental security flaw that must be addressed immediately. Organizations currently running FastGPT version 4.15.0-beta4 must upgrade to version 4.15.0-beta5 to secure the platform against unauthorized access.