---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: Prior to 3.0
---END_METADATA---

Description Summary:
A path canonicalization flaw in the Cursor AI code editor allows malicious agents to bypass sandbox restrictions and write arbitrary files, facilitating Remote Code Execution.

Executive Summary:
Cursor AI contains a critical path canonicalization vulnerability that allows malicious agents to bypass sandbox protections and write files to arbitrary locations on the host system.

Vulnerability Details

CVE-ID: CVE-2026-50549

Affected Software: Cursor Cursor

Affected Versions: Prior to 3.0

Vulnerability: This vulnerability involves a failure in path canonicalization logic; when the check fails, the application incorrectly falls back to an unverified original path. This allows a malicious agent to use symlinks to write files outside the intended sandbox without user approval.

Business Impact

With a CVSS score of 9.3, this flaw poses a critical risk to organizational security. An attacker can achieve Remote Code Execution by overwriting critical system files or helper binaries, potentially leading to a total compromise of the host machine and unauthorized access to intellectual property or internal network resources.

Remediation Plan

Immediate Action: Update to Cursor version 3.0 or later to ensure proper path validation and sandbox enforcement.

Proactive Monitoring: Review file system integrity logs for the creation of unauthorized symlinks within project directories.

Compensating Controls: Implement endpoint detection and response (EDR) solutions to detect and block anomalous file write activities originating from the Cursor process.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on AI agents in development environments necessitates rigorous sandbox security. Given the critical severity of this flaw, administrators and developers must update to version 3.0 immediately to prevent unauthorized file system access and potential full system compromise.

---METADATA---
VENDOR: Cursor
PRODUCT: Cursor
AFFECTED_VERSIONS: Prior to 3.0
---END_METADATA---

Description Summary:
A sandbox escape vulnerability in the Cursor AI code editor allows malicious agents to write arbitrary files outside the workspace, leading to non-sandboxed Remote Code Execution.

Executive Summary:
The Cursor AI code editor is vulnerable to a sandbox escape that permits arbitrary file writes and Remote Code Execution under the user's privileges.

Vulnerability Details

CVE-ID: CVE-2026-50548

Affected Software: Cursor Cursor

Affected Versions: Prior to 3.0

Vulnerability: This is a sandbox escape vulnerability where the agent's working_directory parameter is improperly validated, allowing the agent to break out of the restricted sandbox environment. The vulnerability is exploitable by a malicious AI agent without further user interaction beyond an initial prompt.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the full privileges of the user running the Cursor editor. Given the CVSS score of 9.3, the impact is critical, as it facilitates complete system compromise, potential lateral movement within the development environment, and the exfiltration of sensitive source code or credentials.

Remediation Plan

Immediate Action: Upgrade the Cursor application to version 3.0 or later immediately to apply the necessary sandbox boundary constraints.

Proactive Monitoring: Monitor terminal output and file system logs for unexpected write operations occurring outside of established project directories.

Compensating Controls: Limit the permissions of the user account running the Cursor application to the minimum necessary to perform development tasks to reduce the impact of a potential sandbox breakout.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of development environments. Users and organizations utilizing Cursor should prioritize upgrading to version 3.0 immediately to remediate the sandbox escape flaw and prevent unauthorized remote code execution.

---METADATA---
VENDOR: Fission
PRODUCT: Fission Framework
AFFECTED_VERSIONS: Prior to version 1.24.0
---END_METADATA---

Description Summary:
A validation flaw in Fission’s pod specification handling allows for the propagation of dangerous fields, leading to unauthorized control over generated pods.

Executive Summary:
A critical security flaw in Fission prior to version 1.24.0 allows authenticated tenants to influence pod creation, leading to potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-50545

Affected Software: Fission Fission Framework

Affected Versions: Prior to version 1.24.0

Vulnerability: The framework fails to properly validate podSpec configurations, allowing MergePodSpec to propagate dangerous fields into generated pods. This creates an unintended sphere of control for authenticated users, categorized under MITRE ATT&CK technique T1068.

Business Impact

The CVSS score of 9.9 highlights the extreme risk associated with this vulnerability, as it allows for the subversion of container security boundaries. By injecting dangerous configurations into pod specs, an attacker can gain elevated privileges within the Kubernetes environment, potentially leading to a full cluster compromise.

Remediation Plan

Immediate Action: Upgrade the Fission framework to version 1.24.0 or later to implement necessary validation for pod specifications.

Proactive Monitoring: Review Kubernetes audit logs for unusual pod creation events or modifications to pod specifications that originate from the Fission controller or tenant-controlled environments.

Compensating Controls: Utilize Kubernetes Admission Controllers (e.g., OPA Gatekeeper or Kyverno) to enforce strict policies on pod security contexts and prevent the deployment of privileged containers.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the potential for deep cluster-level compromise, this update should be treated with high urgency. Patching to version 1.24.0 is essential to restrict the sphere of influence that authenticated tenants can exert over the underlying infrastructure.

---METADATA---
VENDOR: NoMachine
PRODUCT: NoMachine
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability in NoMachine allows attackers to perform external control of file paths.

Executive Summary:
A high-severity local privilege escalation vulnerability in NoMachine software could allow a local attacker to gain unauthorized elevated system access.

Vulnerability Details

CVE-ID: CVE-2026-5054

Affected Software: NoMachine NoMachine

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves improper control of file path input, which can be exploited by an authenticated local user to escalate privileges beyond their current authorization level.

Business Impact

Successful exploitation of this vulnerability could allow a malicious actor to gain full system control, leading to unauthorized data access, modification, or the installation of persistent backdoors. With a CVSS score of 7.8, this flaw represents a significant risk to the integrity and confidentiality of the host machine, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Update the NoMachine installation to the latest available patched version provided by the vendor.

Proactive Monitoring: Audit local system logs for unusual file access patterns or unexpected execution of administrative commands by non-privileged accounts.

Compensating Controls: Restrict local user access to the host server and enforce the principle of least privilege to minimize the potential impact of a local exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation, organizations must prioritize patching all affected NoMachine deployments. Ensure that all systems are updated immediately to mitigate the risk of local users gaining administrative control over the host environment.

---METADATA---
VENDOR: Microsoft
PRODUCT: Edge (Chromium-based)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an authorized attacker to execute arbitrary code over a network.

Executive Summary:
A use-after-free vulnerability in Microsoft Edge (Chromium-based) enables authorized attackers to perform remote code execution on vulnerable systems.

Vulnerability Details

CVE-ID: CVE-2026-50521

Affected Software: Microsoft Edge (Chromium-based)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free vulnerability within the browser's memory management, which can be triggered by an authenticated user. An attacker with authorized access can leverage this flaw to execute code within the context of the application over a network.

Business Impact

The ability for an authenticated attacker to perform remote code execution carries a high-severity risk, reflected by the CVSS score of 8.3. This vulnerability could facilitate lateral movement or privilege escalation within the network, potentially leading to unauthorized access to sensitive internal data or organizational resources.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft to the Edge browser to remediate the underlying memory management defect.

Proactive Monitoring: Review application-level logs and network traffic for suspicious patterns originating from authorized user sessions that could indicate exploitation attempts.

Compensating Controls: Utilize browser-based security policies and Group Policy Objects (GPOs) to restrict administrative execution privileges and limit the potential impact of successful exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability requires an authorized user to facilitate exploitation, organizations should enforce the principle of least privilege while ensuring that all browser instances are updated. Promptly applying vendor patches is the most effective way to eliminate this attack vector.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the Belkin F9K1122 router, potentially enabling attackers to gain unauthorized access or disrupt services.

Executive Summary:
A high-severity security vulnerability has been detected in the Belkin F9K1122 router, presenting a critical risk of unauthorized access and network disruption.

Vulnerability Details

CVE-ID: CVE-2026-5044

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Belkin F9K1122 router and is rated with a CVSS score of 8.8. While the specific vulnerability type (e.g., buffer overflow, logic error) is not detailed in the summary, the high score indicates that it could allow an attacker to bypass security measures or gain administrative rights on the device.

Business Impact

A successful exploit could lead to the total compromise of the router, allowing an attacker to monitor all unencrypted traffic passing through the device. This poses a significant threat to organizational data privacy and could lead to secondary attacks on connected devices within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Belkin for the F9K1122 router without delay.

Proactive Monitoring: Enable and monitor logging for administrative access and changes to the device's core configuration.

Compensating Controls: Ensure the router is placed behind an additional layer of security, such as a dedicated hardware firewall, and disable all unnecessary services (e.g., UPnP, WPS).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation. However, router vulnerabilities are frequently discovered and exploited by sophisticated threat actors to establish persistent network access.

Analyst Recommendation

The detection of a high-severity vulnerability in a core network component like the Belkin F9K1122 requires immediate attention. It is strongly recommended to apply the vendor's firmware updates immediately to mitigate the risk of unauthorized access and ensure the security of the broader network.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in the Belkin F9K1122 router that could be exploited to compromise the device's security posture.

Executive Summary:
The Belkin F9K1122 router contains a high-severity security weakness that poses a significant risk to network integrity and unauthorized device control.

Vulnerability Details

CVE-ID: CVE-2026-5043

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This identified weakness in the Belkin F9K1122 router is currently categorized as a high-severity issue. With a CVSS score of 8.8, the vulnerability likely permits an attacker to bypass authentication or execute unauthorized actions, though specific function-level details are currently restricted to vendor advisories.

Business Impact

The exploitation of this weakness could allow an attacker to intercept network traffic, redirect users to malicious sites, or use the router as a jumping-off point for further internal attacks. The risk to business continuity and data confidentiality is high, necessitating immediate remediation.

Remediation Plan

Immediate Action: Consult the Belkin support site and apply the recommended firmware patch for the F9K1122 router immediately.

Proactive Monitoring: Regularly review the router's security logs for failed login attempts and check for any unauthorized modifications to DNS settings or firewall rules.

Compensating Controls: Implement strong, unique passwords for all router accounts and ensure that WPA3 or the strongest available encryption is used for wireless communications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public details should not be mistaken for low risk, given the high severity rating.

Analyst Recommendation

Maintaining updated firmware on networking hardware is a critical security requirement. Administrators should treat this high-severity weakness with urgency and apply the necessary updates to the Belkin F9K1122 to protect the network environment from potential exploitation.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in the Belkin F9K1122 router, potentially allowing for unauthorized access or system interference.

Executive Summary:
The Belkin F9K1122 router is affected by a high-severity security flaw that could lead to unauthorized access and compromise of the network device.

Vulnerability Details

CVE-ID: CVE-2026-5042

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the initial report, this flaw in the Belkin F9K1122 router indicates a significant security weakness. Given the CVSS score of 8.8, it likely involves a high-impact issue such as unauthorized access or a bypass of security controls on the device.

Business Impact

A compromise of a perimeter router like the Belkin F9K1122 can result in network-wide eavesdropping, unauthorized access to internal resources, and total loss of internet connectivity. The CVSS score of 8.8 justifies an urgent response to prevent attackers from gaining a foothold in the local network infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Belkin immediately to address this security flaw.

Proactive Monitoring: Monitor the router for unauthorized configuration changes, unusual outbound traffic patterns, or unrecognized administrative logins.

Compensating Controls: Restrict access to the router's web management interface to trusted internal IP addresses only and disable remote management features.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, router vulnerabilities are frequently targeted by botnets and automated exploit kits.

Analyst Recommendation

Due to the high CVSS score and the critical role of the F9K1122 in network security, it is essential to apply vendor-provided patches immediately. Ensuring the router firmware is up to date is the primary defense against unauthorized access and network compromise.

---METADATA---
VENDOR: Unknown
PRODUCT: Unknown (API Service)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The 'POST /api/v2/files' endpoint fails to sanitize the 'filename' parameter, allowing unauthenticated path traversal and arbitrary file writes.

Executive Summary:
An unauthenticated path traversal vulnerability in the /api/v2/files endpoint allows attackers to write files to arbitrary locations on the filesystem, potentially leading to system takeover.

Vulnerability Details

CVE-ID: CVE-2026-5027

Affected Software: The affected software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application's file upload API does not sanitize the filename parameter within multipart form data. An unauthenticated attacker can use path traversal sequences (e.g., ../) to bypass the intended upload directory and write files anywhere the application has permissions.

Business Impact

This vulnerability is high-severity (CVSS 8.8) because it can be used to overwrite critical system files or upload a web shell into a web-accessible directory. This leads directly to remote code execution and full system compromise.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately. If no update is available, implement strict input validation on the filename parameter to strip path traversal sequences.

Proactive Monitoring: Monitor the filesystem for the creation of unexpected files, especially in system or web-root directories, and audit logs for POST requests to /api/v2/files containing ../ sequences.

Compensating Controls: Ensure the application process runs with the least privilege necessary, preventing it from writing to sensitive system directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, no public exploitation has been reported. Path traversal in upload endpoints is a common and highly reliable attack vector for gaining initial access.

Analyst Recommendation

The ability to write arbitrary files to a server is a critical security failure. Administrators must prioritize the application of patches for this API service and verify that the fix correctly handles all variants of path traversal characters.

---METADATA---
VENDOR: JetBrains
PRODUCT: Hub
AFFECTED_VERSIONS: Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
---END_METADATA---

Description Summary:
JetBrains Hub contains an authentication bypass vulnerability via direct database access that allows unauthorized administrative control.

Executive Summary:
A critical authentication bypass vulnerability in JetBrains Hub allows unauthenticated attackers to gain full administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-50242

Affected Software: JetBrains Hub

Affected Versions: Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429

Vulnerability: This vulnerability involves an authentication bypass flaw triggered by direct database access. It permits an unauthenticated attacker to assume administrative privileges within the application.

Business Impact

The potential for unauthorized administrative access poses a catastrophic risk to organizational data integrity and confidentiality. Given the CVSS score of 10.0, this vulnerability could lead to complete system compromise, allowing attackers to modify configurations, extract sensitive user data, or deploy malicious payloads across the enterprise environment.

Remediation Plan

Immediate Action: Upgrade all instances of JetBrains Hub to the specified patched versions or higher immediately.

Proactive Monitoring: Review database access logs for unusual queries or unauthorized connection attempts originating from non-standard internal assets.

Compensating Controls: Restrict network-level access to the underlying database port to authorized management hosts only as a temporary mitigation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents the highest level of risk to JetBrains Hub deployments. Administrators must prioritize patching this flaw immediately to prevent total administrative takeover. Failure to remediate will leave the identity and access management infrastructure exposed to full compromise.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: before 24.09.07
---END_METADATA---

Description Summary:
Apache OFBiz contains a template injection vulnerability that allows authenticated users with specific privileges to execute arbitrary code.

Executive Summary:
A high-severity template injection vulnerability in Apache OFBiz allows low-privileged users to achieve Remote Code Execution.

Vulnerability Details

CVE-ID: CVE-2026-50223

Affected Software: Apache OFBiz

Affected Versions: before 24.09.07

Vulnerability: This is an improper control of code generation vulnerability that enables a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks. This can be weaponized to achieve Remote Code Execution (RCE) on the server.

Business Impact

With a CVSS score of 8.8, this vulnerability is extremely dangerous. Successful exploitation grants an attacker the ability to execute arbitrary commands on the server, leading to total system compromise, exfiltration of sensitive data, and potential lateral movement within the corporate network.

Remediation Plan

Immediate Action: Upgrade Apache OFBiz to version 24.09.07 or later immediately to patch the template injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual template rendering requests or suspicious shell command executions originating from the OFBiz application process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious template injection payloads targeting Apache OFBiz.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve full code execution makes this a critical priority. Organizations running Apache OFBiz should verify their version and apply the 24.09.07 update without delay to prevent unauthorized system takeover.

---METADATA---
VENDOR: Acer
PRODUCT: Connect M6E 5G
AFFECTED_VERSIONS: Acer Connect M6E 5G firmware
---END_METADATA---

Description Summary:
Exposed diagnostic software on retail builds of Acer Connect M6E 5G allows malicious applications to write to internal NVRAM registers.

Executive Summary:
A critical security flaw in Acer Connect M6E 5G firmware leaves factory diagnostic interfaces exposed, enabling unauthorized write access to sensitive internal hardware registers.

Vulnerability Details

CVE-ID: CVE-2026-50211

Affected Software: Acer Connect M6E 5G

Affected Versions: Unknown; affects retail firmware builds.

Vulnerability: This vulnerability involves the improper exposure of engineering and factory-level diagnostic software in production environments. An attacker can leverage this exposure to perform out-of-bounds writes to internal NVRAM registers, potentially leading to persistent device compromise.

Business Impact

Rated at a CVSS score of 9.8, this vulnerability poses a severe threat to device integrity. An attacker could potentially bypass security controls, modify device configuration, or achieve persistent control over the hardware, leading to complete loss of device trust and potential network-wide lateral movement.

Remediation Plan

Immediate Action: Remove any remaining diagnostic software and apply firmware updates from the vendor to secure internal NVRAM registers.

Proactive Monitoring: Monitor device logs for anomalous configuration changes or unauthorized attempts to access diagnostic or management interfaces.

Compensating Controls: Isolate affected devices from public-facing networks and restrict administrative access to management interfaces to trusted internal segments only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant hardware-level security risk. Administrators must prioritize the removal of diagnostic tools and ensure that all firmware is patched to the latest version provided by Acer. Verify that no unauthorized diagnostic services are reachable from the network.

---METADATA---
VENDOR: Appsmith
PRODUCT: Appsmith
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Appsmith platform, used for building internal tools and admin panels, contains a critical security vulnerability requiring immediate attention.

Executive Summary:
A high-severity security vulnerability in the Appsmith platform risks the compromise of sensitive internal tools and administrative dashboards.

Vulnerability Details

CVE-ID: CVE-2026-50189

Affected Software: Appsmith

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core Appsmith platform architecture, which is frequently used to manage sensitive internal business logic. The nature of the flaw allows for potential unauthorized access to the administrative panels and connected data sources.

Business Impact

The CVSS score of 8.9 highlights the severe business risk, as Appsmith is often integrated with sensitive databases and internal APIs. A successful exploit could lead to full unauthorized access to corporate data, credential theft, or the manipulation of critical internal business processes, resulting in significant operational disruption.

Remediation Plan

Immediate Action: Upgrade all instances of the Appsmith platform to the latest stable release provided by the vendor.

Proactive Monitoring: Audit access logs and monitor for anomalous data requests or unauthorized administrative actions within the Appsmith dashboard.

Compensating Controls: Restrict network access to the Appsmith management interface to authorized internal networks or VPNs to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the role of Appsmith as a central hub for internal tool management, this vulnerability is critical. Organizations must prioritize patching and perform a thorough security review of all applications deployed via the platform to ensure no unauthorized persistence mechanisms have been established.

---METADATA---
VENDOR: Google
PRODUCT: Angular Language Service VS Code Extension
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Angular Language Service VS Code extension is susceptible to a high-severity flaw that could enable unauthorized access or execution within the development environment.

Executive Summary:
A critical security flaw identified in the Angular Language Service extension could lead to unauthorized system access, requiring immediate attention from security teams.

Vulnerability Details

CVE-ID: CVE-2026-50178

Affected Software: Google Angular Language Service

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the template parsing functionality of the extension. It potentially allows an attacker to manipulate the extension's behavior, leading to unauthorized actions within the context of the user's IDE.

Business Impact

The CVSS score of 8.7 highlights the severity of this issue, as it directly impacts the security of developer workstations. Compromise of these systems can result in the theft of proprietary intellectual property and serve as a beachhead for further attacks against the enterprise infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch for the Angular Language Service extension immediately.

Proactive Monitoring: Monitor developer workstations for anomalous network connections or unauthorized file system modifications occurring within the context of the VS Code process.

Compensating Controls: Implement strict endpoint detection and response (EDR) policies on developer machines to detect and block malicious child processes spawned by IDE extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must coordinate with development departments to ensure that all instances of the Angular Language Service extension are updated to the latest secure version. Prioritize this update to maintain the integrity of the software development lifecycle.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Angular development platform that may allow for unauthorized system interaction or data exposure.

Executive Summary:
The Angular development platform is affected by a high-severity vulnerability that poses a significant risk to the integrity and security of applications built upon this framework.

Vulnerability Details

CVE-ID: CVE-2026-50171

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in the Angular framework's processing logic, which could potentially be leveraged by an attacker to execute unauthorized operations. Based on the current disclosure, authentication requirements remain dependent on the specific implementation of the host application.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to application data or the compromise of client-side logic. Given the CVSS score of 8.2, this represents a high-risk scenario where attackers could manipulate application state, potentially leading to reputational damage and the loss of user trust.

Remediation Plan

Immediate Action: Audit your project dependencies and apply the latest security updates provided by the Angular team as soon as they become available.

Proactive Monitoring: Review application access logs and monitor for unusual traffic patterns or unexpected API calls originating from the client-side.

Compensating Controls: Implement strict Content Security Policies (CSP) to mitigate potential cross-site scripting or unauthorized code execution vectors while awaiting a formal patch.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the framework's widespread use, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize identifying all instances of Angular within their environment. Given the high-severity rating, it is imperative to monitor vendor communication channels for patch releases and apply updates immediately upon availability to minimize the window of exposure.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Angular development platform could potentially allow for unauthorized access or execution within the application environment.

Executive Summary:
A high-severity security vulnerability in Google’s Angular framework necessitates immediate attention to ensure the continued security and integrity of enterprise web applications.

Vulnerability Details

CVE-ID: CVE-2026-50170

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Angular development platform, presenting a risk to applications that utilize vulnerable components for data handling or user interaction. The flaw may allow an attacker to disrupt application functionality or gain unauthorized access to sensitive client-side data.

Business Impact

The potential for exploitation poses a significant risk to business operations, including the compromise of sensitive user information or the integrity of the web application. With a CVSS score of 8.2, this vulnerability is categorized as High, reflecting the need for prompt remediation to prevent potential data breaches and maintain organizational compliance.

Remediation Plan

Immediate Action: Upgrade to the latest version of Angular as identified in the official vendor advisory to resolve the underlying security weakness.

Proactive Monitoring: Conduct regular vulnerability scanning and review application logs for signs of unauthorized access attempts or suspicious activity related to client-side code execution.

Compensating Controls: Utilize a modern Web Application Firewall (WAF) to monitor and block traffic patterns that match the signature of known framework vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploit evidence, the vulnerability's high severity warrants immediate administrative action.

Analyst Recommendation

The high CVSS score underscores the urgency of addressing this vulnerability within the software development lifecycle. Organizations should immediately coordinate with their development teams to apply the necessary patches, ensuring that all applications are updated to a secure version to mitigate the risk of exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Angular contains a security vulnerability that may affect the integrity or security of mobile and desktop web applications built using the framework.

Executive Summary:
A High-severity security vulnerability in the Angular framework creates a significant risk of exploitation for applications developed on the platform.

Vulnerability Details

CVE-ID: CVE-2026-50168

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the core Angular framework, potentially allowing attackers to bypass security protections within the application's execution environment. Further analysis is required to determine if the vulnerability is exploitable by unauthenticated remote users.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of systemic compromise for applications relying on the Angular platform. Successful exploitation could lead to unauthorized access, data compromise, and the degradation of trust in applications utilized by both internal users and external customers.

Remediation Plan

Immediate Action: Update the Angular framework to the latest patched version to ensure that all known security vulnerabilities are mitigated.

Proactive Monitoring: Monitor application performance and security logs for signs of anomalous behavior, such as unauthorized script execution or suspicious input patterns.

Compensating Controls: Utilize input validation and sanitization libraries as a defense-in-depth measure to reduce the risk of exploitation until official patches are deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority due to the ubiquity of the Angular framework. Applying the vendor-provided security updates is the most effective way to eliminate the risk; ensure that all production and development environments are updated concurrently.

---METADATA---
VENDOR: Hoppscotch
PRODUCT: Hoppscotch
AFFECTED_VERSIONS: 2026.4.1 and earlier
---END_METADATA---

Description Summary:
An unauthenticated mass assignment vulnerability in the Hoppscotch backend allows attackers to overwrite critical configuration secrets and forge administrative JWT tokens.

Executive Summary:
A critical mass assignment vulnerability in Hoppscotch allows unauthenticated attackers to compromise the entire server by overwriting sensitive configuration secrets.

Vulnerability Details

CVE-ID: CVE-2026-50160

Affected Software: Hoppscotch Hoppscotch

Affected Versions: 2026.4.1 and earlier

Vulnerability: This vulnerability stems from an insecurely configured NestJS ValidationPipe that fails to whitelist request body properties. An unauthenticated attacker can manipulate the onboarding endpoint to inject and overwrite critical database entries, including JWT and SESSION secrets.

Business Impact

The exploitation of this flaw leads to a complete compromise of the Hoppscotch instance, granting the attacker the ability to forge tokens for any user, including administrative accounts. With a CVSS score of 10.0, this represents the highest level of risk, leading to total unauthorized control over the API development ecosystem, potential exfiltration of sensitive API keys, and full loss of system integrity.

Remediation Plan

Immediate Action: Upgrade the Hoppscotch backend to version 2026.5.0 or later immediately to apply the necessary validation whitelisting.

Proactive Monitoring: Monitor database audit logs for unauthorized changes to infrastructure configuration settings and review access logs for suspicious activity on the /v1/onboarding/config endpoint.

Compensating Controls: Implement strict network-level access controls to ensure the onboarding endpoint is not exposed to the public internet until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full server takeover, immediate patching is mandatory. Organizations must prioritize updating their Hoppscotch deployments to version 2026.5.0 and perform a security audit of current environment variables to ensure no secrets have already been tampered with.

---METADATA---
VENDOR: WithAstro
PRODUCT: Astro
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified within the Astro web framework. Users are advised to review the vendor's security disclosures for specific version impacts.

Executive Summary:
A vulnerability discovered in the Astro web framework presents a high-severity risk to applications utilizing the platform, requiring prompt attention from development teams.

Vulnerability Details

CVE-ID: CVE-2026-50146

Affected Software: WithAstro Astro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Astro web framework, potentially impacting how the framework handles requests or processes content. Given the lack of specific technical details, developers must assume that critical security boundaries could be bypassed.

Business Impact

The CVSS score of 7.1 underscores the High impact of this flaw, which could lead to unauthorized data exposure or malicious code execution within the context of applications built on the Astro framework. Such compromises can result in significant reputational damage and the loss of sensitive user data.

Remediation Plan

Immediate Action: Identify all applications utilizing the Astro framework and update them to the latest secure version recommended by the maintainers.

Proactive Monitoring: Monitor application error logs and request patterns for suspicious payloads or unexpected behavior indicative of exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common web framework vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency by coordinating with development staff to verify current Astro versions. Applying the recommended patches is the only effective way to neutralize this risk and ensure the continued security of your web infrastructure.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Budibase low-code platform may allow for unauthorized access or execution of administrative functions.

Executive Summary:
Budibase contains a high-severity vulnerability that could permit unauthorized access to the platform's core low-code development environment.

Vulnerability Details

CVE-ID: CVE-2026-50137

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Budibase low-code platform. It potentially allows an attacker to bypass security checks, which could lead to unauthorized access to applications or the underlying data connections managed by the platform.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a severe threat to organizations relying on Budibase for internal tooling. A successful exploit could result in the unauthorized viewing or modification of business data, or the total compromise of applications developed on the platform, leading to potential data breaches and operational disruption.

Remediation Plan

Immediate Action: Apply all security patches released by Budibase immediately and ensure the software is updated to the most current version.

Proactive Monitoring: Review system logs for unauthorized access attempts or unusual patterns in application data requests.

Compensating Controls: Ensure that the Budibase instance is not exposed to the public internet; utilize VPNs or IP whitelisting to restrict access to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a low-code platform, the potential for exploitation is high.

Analyst Recommendation

Given the potential for broad impact within low-code environments, immediate patching is required. Security teams should verify that their Budibase instances are updated and confirm that appropriate network-level access controls are in place to minimize the attack surface.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform architecture that requires immediate administrative review and patching.

Executive Summary:
A high-severity vulnerability in the Budibase low-code platform poses a significant risk of unauthorized system compromise and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2026-50136

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase platform that may allow for unauthorized access or execution within the application environment. Given the nature of low-code platforms, this likely impacts the integrity of business logic and underlying data structures, though specific authentication requirements depend on the vendor's forthcoming technical disclosure.

Business Impact

The vulnerability carries a CVSS score of 7.4, classifying it as a High-severity risk. Successful exploitation could lead to unauthorized access to sensitive business applications, potential data exfiltration, or the manipulation of critical automated workflows, resulting in significant operational disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: Review the official Budibase security advisory and apply the latest security patches or version updates immediately upon release.

Proactive Monitoring: Monitor application access logs for unusual patterns, unauthorized administrative attempts, or unexpected API calls originating from internal or external sources.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or robust Web Application Firewall (WAF) rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Budibase must prioritize this update as part of their standard patch management cycle. Given the platform's role in centralizing business logic, failing to address this vulnerability could grant attackers persistent access to internal business processes.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform that requires urgent review to prevent unauthorized system interaction.

Executive Summary:
A high-severity security vulnerability in the Budibase platform presents a significant risk of unauthorized access and potential compromise of integrated business applications.

Vulnerability Details

CVE-ID: CVE-2026-50132

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase framework that may facilitate unauthorized access or bypasses of standard platform security controls. Attackers could potentially leverage this to gain higher privileges or access data they are not authorized to view, depending on the specific configuration of the platform.

Business Impact

The CVSS score of 7.3 underscores the high severity of this vulnerability. Successful exploitation could result in the compromise of sensitive organizational data, unauthorized manipulation of low-code business processes, and significant reputational damage, necessitating immediate remediation to maintain system security posture.

Remediation Plan

Immediate Action: Review the official vendor documentation for Budibase and apply the latest security updates or patches as soon as they are made available.

Proactive Monitoring: Monitor application logs for anomalies, specifically focusing on unauthorized login attempts or irregular data access patterns within the Budibase environment.

Compensating Controls: Ensure that the Budibase instance is protected by robust identity and access management (IAM) policies and utilize a WAF to inspect incoming traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of low-code platforms in modern infrastructure, it is imperative to address this vulnerability immediately. Administrators should follow the vendor's guidance to patch the system and perform a routine audit of user permissions to ensure that the principle of least privilege is strictly enforced.

---METADATA---
VENDOR: Fedify
PRODUCT: Fedify (TypeScript library)
AFFECTED_VERSIONS: versions >=0.11.2 and <1.9.12, <1.10.11, <2.0.19, <2.1.15, and <2.2.4
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Fedify TypeScript library allows attackers to bypass IP validation and interact with internal or restricted network resources.

Executive Summary:
Incomplete IPv4 validation in the Fedify library enables Server-Side Request Forgery, allowing attackers to target internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-50131

Affected Software: Fedify

Affected Versions: versions >=0.11.2 and <1.9.12, <1.10.11, <2.0.19, <2.1.15, and <2.2.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability caused by flawed logic in the isValidPublicIPv4Address() function. The function fails to properly filter special-use, reserved, and internal IP ranges, allowing attackers to force the server to initiate requests to unauthorized internal destinations.

Business Impact

The CVSS score of 8.6 highlights the critical nature of this SSRF flaw. An attacker can use this vulnerability to probe internal network infrastructure, access sensitive internal metadata services, or interact with services not intended for public access, potentially leading to unauthorized data exposure.

Remediation Plan

Immediate Action: Update Fedify to the patched versions: 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4.

Proactive Monitoring: Monitor outgoing server traffic for requests directed toward internal or restricted IP ranges originating from the Fedify application.

Compensating Controls: Implement strict egress filtering at the network level to prevent the server from initiating connections to sensitive internal segments.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and administrators utilizing the Fedify library must apply the necessary updates to their project dependencies immediately. The ability to bypass SSRF protections poses a significant threat to internal network security and should be addressed without delay.

---METADATA---
VENDOR: StoneFly
PRODUCT: Storage Concentrator
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
StoneFly Storage Concentrator stores hardcoded, reversible credentials for internal services within a configuration file, enabling potential unauthorized access to interconnected systems.

Executive Summary:
The StoneFly Storage Concentrator contains hardcoded, reversible credentials that could grant an attacker full access to critical internal database and replication services.

Vulnerability Details

CVE-ID: CVE-2026-50110

Affected Software: StoneFly Storage Concentrator

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves the presence of hardcoded credentials stored in an encoded format within configuration files. An attacker can reverse the encoding to obtain plaintext credentials for database, licensing, and replication services, requiring no prior authentication to the underlying OS if the configuration file is accessible.

Business Impact

The exposure of administrative and service-level credentials presents a severe risk to data integrity and system availability. With a CVSS score of 9.2, this vulnerability allows for lateral movement and complete compromise of the storage infrastructure, potentially leading to unauthorized data exfiltration or total system shutdown.

Remediation Plan

Immediate Action: Apply the latest firmware or software update provided by StoneFly immediately to remove the hardcoded credentials.

Proactive Monitoring: Audit system access logs for any unauthorized attempts to access internal service ports or unusual configuration file read operations.

Compensating Controls: Restrict network access to the storage management interface to only authorized administrative subnets and implement strict file system permissions on configuration directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of hardcoded credentials, organizations must prioritize patching this vulnerability as soon as the vendor release becomes available. Administrators should also perform a credential rotation for all services managed by the Storage Concentrator immediately following the update to ensure any potentially leaked credentials are invalidated.

---METADATA---
VENDOR: Naxclow
PRODUCT: Smart Home Devices
AFFECTED_VERSIONS: Naxclow Smart Doorbell X3, Naxclow X Smart Home, Naxclow V720, Naxclow ix cam (all versions)
---END_METADATA---

Description Summary:
Naxclow smart devices utilize static, non-rotating relay credentials, allowing persistent unauthorized access to device relay channels.

Executive Summary:
Naxclow smart home devices are vulnerable to persistent unauthorized access due to the use of static, non-rotating relay credentials.

Vulnerability Details

CVE-ID: CVE-2026-50101

Affected Software: Naxclow Smart Home Devices

Affected Versions: Naxclow Smart Doorbell X3, Naxclow X Smart Home, Naxclow V720, Naxclow ix cam (all versions)

Vulnerability: The devices use a server-side, per-device relay credential that is never rotated and is re-issued upon boot. If these static credentials are obtained, an attacker can maintain persistent access to the device's relay channel, surviving even factory resets.

Business Impact

With a CVSS score of 8.1 (High), this represents a severe privacy and security risk for smart home environments. Unauthorized access to these devices allows an attacker to monitor live video/audio feeds and bypass typical security boundaries, leading to potential surveillance or further network infiltration.

Remediation Plan

Immediate Action: Check the vendor support page for available firmware updates and contact Naxclow support for guidance on mitigating persistent credential risk.

Proactive Monitoring: Monitor network traffic for unusual connections to the Naxclow relay servers and check for unexpected device behavior.

Compensating Controls: Isolate smart home devices on a dedicated VLAN with no access to the primary corporate or home network to contain potential compromises.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that the vulnerability survives factory resets, the risk remains persistent until a firmware-level fix is applied. Users should exercise extreme caution, isolate these devices from critical networks, and check frequently for manufacturer-provided security patches.

---METADATA---
VENDOR: Aqara
PRODUCT: Cloud OAuth
AFFECTED_VERSIONS: Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize)
---END_METADATA---

Description Summary:
A redirect bypass vulnerability in the Aqara Cloud OAuth endpoint allows attackers to perform credential theft and phishing by exploiting weak domain validation.

Executive Summary:
A critical OAuth redirect bypass in the Aqara Cloud Authorization Endpoint (CVSS 9.3) allows unauthenticated attackers to perform phishing and credential theft via improper domain validation.

Vulnerability Details

CVE-ID: CVE-2026-50090

Affected Software: Aqara Cloud OAuth

Affected Versions: Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize)

Vulnerability: The endpoint is vulnerable to a redirect bypass due to lax controls on domain matching (CWE-1289). This flaw allows unauthenticated attackers to manipulate the redirect destination, effectively bypassing intended security controls during the OAuth authorization flow.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a severe risk to user accounts. By redirecting users to attacker-controlled domains, adversaries can conduct effective phishing campaigns and steal sensitive authentication tokens, leading to unauthorized account access and potential data exfiltration from connected devices.

Remediation Plan

Immediate Action: Users should remain vigilant against suspicious login prompts and ensure they are only authenticating on verified domains. Contact the vendor for information on platform updates.

Proactive Monitoring: Review OAuth access logs for anomalous redirect patterns or attempts to redirect users to unauthorized external domains.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and monitor for any abnormal traffic patterns directed away from authorized Aqara domains during the login process.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a significant threat to user trust and account security. Organizations and users interacting with the Aqara Cloud OAuth service should exercise extreme caution and work with the vendor to confirm when a patch or configuration change is implemented to enforce strict domain validation.

---METADATA---
VENDOR: Aqara
PRODUCT: Aqara Developer Portal
AFFECTED_VERSIONS: Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) 2026-04-20 release
---END_METADATA---

Description Summary:
The Aqara Developer Portal exhibits a permissive cross-origin resource sharing (CORS) policy, allowing unauthorized cross-domain access.

Executive Summary:
A permissive CORS policy in the Aqara Developer Portal exposes developers and users to potential cross-site attacks and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-50088

Affected Software: Aqara Developer Portal

Affected Versions: Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) 2026-04-20 release

Vulnerability: The portal implements a permissive CORS policy (CWE-942), which fails to properly restrict cross-domain requests. This allows untrusted domains to interact with the portal, potentially leading to the leakage of sensitive information or unauthorized actions performed on behalf of an authenticated user.

Business Impact

This flaw carries a CVSS score of 8.2, posing a risk of unauthorized access to developer data and associated IoT infrastructure. The vulnerability could be leveraged to perform cross-site scripting or data exfiltration attacks, undermining the trust and security of the developer ecosystem.

Remediation Plan

Immediate Action: Update to the latest version of the portal software and ensure that CORS policies are strictly configured to whitelist only trusted domains.

Proactive Monitoring: Review web application traffic logs for suspicious cross-origin requests or attempts to access API endpoints from unauthorized domains.

Compensating Controls: Implement strict Content Security Policies (CSP) to restrict the origins from which scripts and resources can be loaded or executed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using the Aqara Developer Portal must ensure they are not running the vulnerable 2026-04-20 release. Security teams should verify that CORS configurations are correctly restricted to prevent unauthorized cross-domain interactions.

---METADATA---
VENDOR: Aqara
PRODUCT: IAM/SSO Gateway
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Aqara IAM/SSO gateway contains an overly permissive Cross-Origin Resource Sharing (CORS) policy, allowing unauthorized cross-origin requests.

Executive Summary:
An overly permissive CORS policy in the Aqara IAM/SSO gateway exposes user sessions and credentials to unauthorized cross-origin access.

Vulnerability Details

CVE-ID: CVE-2026-50087

Affected Software: Aqara IAM/SSO Gateway

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The gateway exhibits a cross-origin request sharing vulnerability (CWE-942) due to an overly permissive CORS configuration. This allows malicious actors to craft cross-origin requests that bypass standard security boundaries, potentially leading to the theft of user credentials and session information.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant risk to identity management and single sign-on security. If exploited, an attacker could hijack user sessions or gain unauthorized access to protected resources, leading to potential data breaches and widespread compromise of user accounts.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available to correct the CORS policy configuration.

Proactive Monitoring: Monitor gateway logs for suspicious cross-origin requests originating from unknown or unauthorized domains.

Compensating Controls: Configure Web Application Firewalls (WAF) or server-level policies to enforce strict CORS headers and block requests that do not originate from trusted, authorized origins.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw makes it an attractive target for session hijacking, necessitating proactive security measures.

Analyst Recommendation

Access control vulnerabilities in identity gateways are critical points of failure. Organizations should immediately review their CORS configurations and apply vendor-provided patches or mitigations to ensure that cross-origin access is restricted to legitimate, trusted domains only.

---METADATA---
VENDOR: Aqara
PRODUCT: IAM/SSO gateway
AFFECTED_VERSIONS: Aqara IAM/SSO gateway (gw-builder.aqara.com)
---END_METADATA---

Description Summary:
The Aqara IAM/SSO gateway contains a critical flaw that exposes cryptographic signing keys, allowing unauthenticated attackers to perform unauthorized operations.

Executive Summary:
The Aqara IAM/SSO gateway is vulnerable to an unauthenticated cryptographic bypass that could allow attackers to forge authentication tokens and gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-50086

Affected Software: Aqara IAM/SSO gateway

Affected Versions: Aqara IAM/SSO gateway (gw-builder.aqara.com)

Vulnerability: The gateway performs bidirectional AES round-trips against the platform’s signing key without requiring authentication. This allows an unauthenticated network attacker to leverage the signing key to forge authentication tokens.

Business Impact

The ability to forge authentication tokens effectively renders the Identity and Access Management system useless, allowing an attacker to masquerade as any user or administrator. This leads to a total compromise of the authentication boundary, potentially resulting in unauthorized access to sensitive user data and backend systems. While the base description suggests a lower severity, the ability to bypass core authentication warrants a critical response.

Remediation Plan

Immediate Action: Apply the patch provided in the official GitHub advisory (GHSA-3897-2crh-vgmr) immediately.

Proactive Monitoring: Monitor IAM/SSO logs for anomalous authentication requests or tokens that do not align with known user behavior patterns.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the gateway to authorized internal infrastructure only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypasses involving cryptographic signing keys are high-risk events. Security teams should treat this as a priority update to ensure the integrity of the platform’s identity services and prevent potential unauthorized access.

---METADATA---
VENDOR: Aqara
PRODUCT: Board service (op-test)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Aqara Board service (op-test) allows unauthenticated remote attackers to send arbitrary MQTT command payloads to the HiveMQ broker.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Aqara Board service allows attackers to hijack devices by sending arbitrary MQTT commands.

Vulnerability Details

CVE-ID: CVE-2026-50085

Affected Software: Aqara Board service (op-test)

Affected Versions: See vendor advisory

Vulnerability: The service lacks proper authentication for MQTT command payloads. It forwards these arbitrary commands directly to the platform's HiveMQ broker, enabling an unauthenticated attacker to take full control of affected devices.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a critical risk to IoT infrastructure. An attacker could remotely take over devices, potentially leading to unauthorized physical access or the creation of a massive botnet. The lack of authentication makes this an exceptionally dangerous flaw for any organization managing these devices at scale.

Remediation Plan

Immediate Action: Apply security updates provided by Aqara immediately, or disable the affected service if it is not business-critical.

Proactive Monitoring: Monitor MQTT broker traffic for unauthorized or anomalous command payloads that do not originate from authenticated sources.

Compensating Controls: Place the device management network behind a robust firewall or VPN to restrict access to the MQTT broker to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of authentication required for device control. Organizations must immediately secure their Aqara deployments and ensure all firmware is patched to the latest version to prevent unauthorized remote access.

---METADATA---
VENDOR: Aqara
PRODUCT: Cloud Production API
AFFECTED_VERSIONS: Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api)
---END_METADATA---

Description Summary:
The Aqara Cloud Production API suffers from a missing authorization vulnerability, allowing any valid developer token to access any user account.

Executive Summary:
A missing authorization vulnerability in the Aqara Cloud Production API allows any valid developer token to access arbitrary user accounts, potentially enabling full remote device takeover.

Vulnerability Details

CVE-ID: CVE-2026-50084

Affected Software: Aqara Cloud Production API

Affected Versions: Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api)

Vulnerability: This is a missing authorization flaw (CWE-862) where the API fails to validate if the developer token used in a request is authorized to access the requested account. This allows unauthorized access to data and, when chained with other vulnerabilities, leads to complete account and device takeover.

Business Impact

The CVSS score of 9.6 highlights the critical impact of this vulnerability. Because it allows unauthorized access to user accounts, it poses a direct risk of data exposure and, in combination with related vulnerabilities, the total compromise of smart home devices, leading to significant privacy violations.

Remediation Plan

Immediate Action: Review the vendor advisory for specific API configuration changes and ensure all developer tokens are audited and restricted.

Proactive Monitoring: Monitor API usage logs for unauthorized access patterns where a single token is attempting to access multiple disparate user accounts.

Compensating Controls: Implement strict API gateway-level authorization checks to validate the ownership of the account being accessed by any given developer token.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 12, 2026, there is public information confirming the vulnerability. The potential for large-scale account takeover is high due to the ease of chaining this with other identified flaws.

Analyst Recommendation

This missing authorization flaw is a critical security oversight. Developers and administrators must immediately implement stricter access controls and follow the vendor's guidance to prevent unauthorized access to user data and device control mechanisms.

---METADATA---
VENDOR: Seiko
PRODUCT: SkyBridge MB-A100/MB-A110
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Seiko SkyBridge MB-A100 and MB-A110 devices are vulnerable to OS command injection due to improper neutralization of special elements in input.

Executive Summary:
A critical OS command injection vulnerability in Seiko SkyBridge devices allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50043

Affected Software: Seiko SkyBridge MB-A100/MB-A110

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device fails to properly sanitize user-supplied input before passing it to a system shell, enabling OS command injection. While the specific authentication requirement is not explicitly defined in the advisory, command injection flaws in such network devices are typically reachable by unauthenticated remote attackers.

Business Impact

The ability to execute arbitrary OS commands grants an attacker full control over the affected hardware, potentially leading to unauthorized data access, network lateral movement, or complete denial of service. With a CVSS score of 8.6, this high-severity vulnerability represents a significant threat to operational continuity and the integrity of the local network environment.

Remediation Plan

Immediate Action: Identify all deployed SkyBridge units and apply vendor-supplied security patches as soon as they become available.

Proactive Monitoring: Monitor device access logs and system process activity for signs of unusual shell command execution or unexpected outbound network connections.

Compensating Controls: Place affected devices behind a robust firewall, restricting management interfaces to authorized IP addresses only until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for full system compromise, organizations should prioritize the identification of these devices within their infrastructure. Apply all vendor updates immediately upon release and enforce strict network segmentation for these components until remediation is verified.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-WN579X3-C
AFFECTED_VERSIONS: 231124
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Wavlink WL-WN579X3-C router, version 231124, which could allow for remote exploitation.

Executive Summary:
The Wavlink WL-WN579X3-C router contains a high-severity vulnerability that could compromise the security and integrity of the network device.

Vulnerability Details

CVE-ID: CVE-2026-5004

Affected Software: Wavlink WL-WN579X3-C

Affected Versions: 231124

Vulnerability: While specific technical details are limited in the initial disclosure, the vulnerability affects the Wavlink WL-WN579X3-C router. Based on the CVSS score of 8.8, it likely involves a remote, unauthenticated flaw such as command injection or an authentication bypass.

Business Impact

A compromise of a perimeter networking device like a router allows attackers to intercept traffic, launch man-in-the-middle (MitM) attacks, or gain a foothold in the internal network. The CVSS score of 8.8 indicates a significant risk to the organization's network perimeter.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Wavlink for the WL-WN579X3-C model immediately.

Proactive Monitoring: Monitor the router for unauthorized configuration changes, unusual outbound traffic, or unauthorized administrative logins.

Compensating Controls: Disable remote management interfaces on the WAN side of the router and ensure that strong, unique administrative credentials are in use.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation. Users of this hardware should remain vigilant as routers are frequent targets for botnets and advanced persistent threats.

Analyst Recommendation

Network hardware vulnerabilities must be treated with the highest urgency. Organizations should immediately verify the firmware version of any Wavlink WL-WN579X3-C devices in their inventory and apply all relevant security patches to prevent external exploitation.