---METADATA---
VENDOR: owen2345
PRODUCT: CamaleonCMS
AFFECTED_VERSIONS: 0 through 2.9.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin allows authenticated attackers to inject arbitrary HTML via the before_html field.

Executive Summary:
A stored cross-site scripting vulnerability in the CamaleonCMS contact form plugin enables authenticated attackers to inject malicious scripts, leading to potential account takeover.

Vulnerability Details

CVE-ID: CVE-2026-73332

Affected Software: owen2345 CamaleonCMS

Affected Versions: 0 through 2.9.1

Vulnerability: The cama_contact_form plugin fails to sanitize user input in the before_html field, allowing a low-privileged authenticated attacker to perform stored cross-site scripting (XSS) attacks.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a significant risk to user session security and data integrity. An attacker can execute malicious scripts in the context of other users, including administrators, which may result in unauthorized data access or complete compromise of the CMS administrative interface.

Remediation Plan

Immediate Action: Review vendor security advisories for a patch, and if unavailable, disable the cama_contact_form plugin until a fix is released.

Proactive Monitoring: Audit logs for suspicious activity within the contact form edit endpoint and monitor for anomalous HTML content within the application database.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block malicious script injection patterns directed at the contact form management endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of server-side input validation.

Analyst Recommendation

Security teams should immediately assess their exposure and consider disabling the vulnerable plugin. Until an official patch is published, restrict access to the contact form configuration to trusted administrative users only.

---METADATA---
VENDOR: owen2345
PRODUCT: CamaleonCMS
AFFECTED_VERSIONS: 0 through 2.9.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
CamaleonCMS contains a stored cross-site scripting vulnerability in the post title parameter, allowing authenticated users to execute arbitrary JavaScript in an administrator's browser.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in CamaleonCMS allows low-privileged users to compromise administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-73329

Affected Software: owen2345 CamaleonCMS

Affected Versions: 0 through 2.9.1

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered by injecting unsanitized HTML into the post title field during draft creation. It requires the attacker to have low-level authenticated access to the system.

Business Impact

An attacker can hijack administrative sessions, leading to full site compromise, unauthorized data access, or the creation of malicious administrative users. The CVSS score of 8.7 reflects the high risk of privilege escalation and persistent code execution within the administrative context.

Remediation Plan

Immediate Action: Restrict access to administrative and content creation interfaces until a vendor-supplied patch is applied.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to content, particularly from low-privileged user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS payloads directed at the post title input fields.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable once an attacker has authenticated access to the CMS.

Analyst Recommendation

Security teams should enforce strict input validation for all user-controllable fields. Organizations using CamaleonCMS should monitor vendor release channels for a security update and apply it immediately upon availability.

---METADATA---
VENDOR: LatePoint
PRODUCT: LatePoint - Calendar Booking Plugin for Appointments and Events
AFFECTED_VERSIONS: 0 through 5.5.0
CONFIDENCE: high
MISSING: patch, exploit_status
CREDITS: Ly Hoang (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03ddcf0-6955-4645-b311-c3833ca61455?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/activities_controller.php#L214","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/activities_controller.php#L214","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L260","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/stripe_connect_controller.php#L260","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/activities_helper.php#L83","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/activities_helper.php#L83","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/controllers/activities_controller.php#L214","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:44:24.702Z
---END_METADATA---

Description Summary:
The LatePoint plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via the booking_form_page_url parameter in versions up to 5.5.0.

Executive Summary:
An unauthenticated Stored Cross-Site Scripting vulnerability in the LatePoint plugin for WordPress allows remote attackers to inject arbitrary web scripts into pages accessed by users.

Vulnerability Details

CVE-ID: CVE-2026-7332

Affected Software: LatePoint LatePoint - Calendar Booking Plugin for Appointments and Events

Affected Versions: 0 through 5.5.0

Vulnerability: This flaw involves improper neutralization of input during web generation, specifically CWE-79, affecting the booking_form_page_url parameter via unauthenticated access due to insufficient sanitization and escaping.

Business Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary script code in the browser of users visiting the compromised pages. This can lead to unauthorized actions, session hijacking, or the theft of sensitive user data. The CVSS score of 7.2 places this issue in the high severity range, highlighting a substantial risk to web application integrity and user trust.

Remediation Plan

Immediate Action: Monitor the vendor advisory for a patched version release and update the LatePoint plugin immediately once available.

Proactive Monitoring: Review web server and application logs for anomalous parameter inputs targeting the booking_form_page_url parameter or suspicious script injections in database records.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block requests containing malicious script payloads targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: No — no confirmed public exploit or weaponized module is currently cataloged in available threat intelligence feeds.

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw presents a notable risk because it can be triggered by unauthenticated actors without requiring a functional Stripe integration.

Analyst Recommendation

Security teams must treat this high severity vulnerability with urgency, despite the current lack of a confirmed vendor patch or public exploit. Administrators should prepare to apply the update as soon as the vendor releases a fixed version, while utilizing Web Application Firewall rules to mitigate potential injection attempts in the interim.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: < 3.39.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is vulnerable to improper privilege management and authorization flaws, allowing authenticated users to perform unauthorized actions within the low-code platform.

Executive Summary:
A high-severity authorization vulnerability in Budibase allows authenticated attackers to bypass security controls and potentially gain unauthorized access to platform resources.

Vulnerability Details

CVE-ID: CVE-2026-73305

Affected Software: Budibase

Affected Versions: < 3.39.24

Vulnerability: This vulnerability involves improper privilege management and missing or incorrect authorization checks (CWE-269, CWE-862, CWE-863). An authenticated attacker can exploit these flaws to perform actions beyond their intended permission level.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data access, modification of business applications, or full compromise of the platform environment. Given the CVSS score of 8.8, this represents a significant risk to organizational integrity and data confidentiality, as low-code platforms often serve as central hubs for internal workflows and sensitive business logic.

Remediation Plan

Immediate Action: Update all Budibase instances to version 3.39.24 or later to apply the necessary authorization patches.

Proactive Monitoring: Review system access logs for unusual administrative actions or account privilege escalation patterns.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or VPN.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the authorization logic within the server-side components of the application.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Budibase platform to version 3.39.24 to resolve the underlying authorization defects and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Microsoft
PRODUCT: Prompty
AFFECTED_VERSIONS: < 0.1.5, >= 2.0.0-alpha.1, < 2.0.0-beta.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Microsoft Prompty is vulnerable to code injection due to improper template evaluation, allowing unauthenticated attackers to execute arbitrary JavaScript in the host Node.js process.

Executive Summary:
A critical code injection vulnerability in Microsoft Prompty allows unauthenticated remote attackers to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73299

Affected Software: Microsoft Prompty

Affected Versions: < 0.1.5, >= 2.0.0-alpha.1, < 2.0.0-beta.5

Vulnerability: The vulnerability stems from improper neutralization of template engine elements within the Nunjucks renderer, which permits unrestricted JavaScript member access. An unauthenticated attacker can supply a malicious template body to traverse object prototypes and execute code within the host Node.js environment.

Business Impact

Successful exploitation grants an attacker full control over the host Node.js process, potentially leading to unauthorized data access, system compromise, or lateral movement within the network. Given the CVSS score of 10.0, this represents a critical risk to infrastructure integrity and confidentiality, as the attack requires no authentication and can be performed remotely.

Remediation Plan

Immediate Action: Update the npm package @prompty/core to version 0.1.5 or 2.0.0-beta.5 immediately.

Proactive Monitoring: Review application logs for unusual template inputs or unexpected process execution patterns originating from Prompty services.

Compensating Controls: Implement strict input validation for all .prompty files and ensure the Node.js process runs with the least privilege necessary to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bypass standard template sandboxing.

Analyst Recommendation

This vulnerability poses a maximum-severity risk to any environment utilizing the Prompty library. Organizations must prioritize applying the provided updates immediately to prevent potential remote code execution, as the lack of authentication requirements makes this an ideal target for automated exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Container-Migration-Solution-Accelerator
AFFECTED_VERSIONS: <= 2.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass in the Microsoft Container Migration Solution Accelerator allows authenticated users to manipulate keys, potentially leading to unauthorized system access or data modification.

Executive Summary:
A vulnerability in the Microsoft Container Migration Solution Accelerator permits an authenticated attacker to perform unauthorized actions by bypassing authorization checks, posing a significant risk to migration integrity.

Vulnerability Details

CVE-ID: CVE-2026-73298

Affected Software: Microsoft Container Migration Solution Accelerator

Affected Versions: <= 2.1.2

Vulnerability: This vulnerability, identified as CWE-639 (Authorization Bypass Through User-Controlled Key), allows an authenticated user with low privileges to manipulate identifiers to access resources they are not authorized to view or modify.

Business Impact

Successful exploitation of this flaw could allow an attacker to hijack migration processes, leading to the compromise of sensitive container configurations or credentials during the transition to Azure Kubernetes Service. With a CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of migrated cloud infrastructure.

Remediation Plan

Immediate Action: Upgrade to a version beyond 2.1.2 as soon as the vendor patch is applied.

Proactive Monitoring: Audit access logs for unusual patterns in API calls that involve resource keys or unexpected shifts in administrative activity.

Compensating Controls: Implement strict access control lists (ACLs) and use a Web Application Firewall (WAF) to filter requests containing suspicious or malformed identifier parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for total technical impact on the migration environment.

Analyst Recommendation

Given the high severity score and the critical nature of migration tools, organizations should prioritize updating the Container Migration Solution Accelerator. Ensure that all users with access to the migration interface are strictly vetted and that logs are reviewed for any signs of unauthorized object access.

---METADATA---
VENDOR: semaphoreui
PRODUCT: semaphore
AFFECTED_VERSIONS: < 2.18.17, >= 2.19.0-alpha3, < 2.19.5-beta2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Semaphore UI is vulnerable to OS command injection via improper handling of git_url parameters in the API, allowing authenticated project managers or owners to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in Semaphore UI allows authenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-73294

Affected Software: semaphoreui semaphore

Affected Versions: < 2.18.17, >= 2.19.0-alpha3, < 2.19.5-beta2

Vulnerability: The application fails to properly sanitize the git_url input when interacting with the underlying Git client. This allows an authenticated user with Project Manager or Owner privileges to inject malicious arguments, resulting in remote code execution on the server.

Business Impact

Successful exploitation grants an attacker full control over the Semaphore server process. Given the 9.9 CVSS score, this represents a critical risk of complete system compromise, potential lateral movement into the DevOps environment, and unauthorized access to sensitive CI/CD secrets.

Remediation Plan

Immediate Action: Update Semaphore UI to version 2.18.17 or 2.19.5-beta2 immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual POST requests to the /api/project/{id}/repositories endpoint and monitor for suspicious child processes spawned by the semaphore service.

Compensating Controls: Restrict access to the Semaphore UI interface to trusted internal networks and implement strict role-based access control to limit the number of users with administrative project permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct nature of the command injection flaw.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity and confidentiality of the entire DevOps pipeline. Administrators must prioritize patching the Semaphore instance to the specified fixed versions to prevent potential full-system compromise by malicious actors.

---METADATA---
VENDOR: semaphoreui
PRODUCT: semaphore
AFFECTED_VERSIONS: < 2.18.19, >= 2.19.0-alpha3, < 2.19.5-beta5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Semaphore UI contains a privilege management vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An improper privilege management vulnerability in Semaphore UI permits authenticated attackers to escalate their permissions and potentially gain full control of the DevOps environment.

Vulnerability Details

CVE-ID: CVE-2026-73293

Affected Software: semaphoreui semaphore

Affected Versions: < 2.18.19, >= 2.19.0-alpha3, < 2.19.5-beta5

Vulnerability: This vulnerability (CWE-269) arises from improper privilege management, allowing a lower-privileged authenticated user to perform actions beyond their assigned scope.

Business Impact

The CVSS score of 8.8 highlights the critical risk to DevOps workflows. An attacker with standard access could manipulate deployment pipelines, access secrets, or modify infrastructure configurations, leading to a complete compromise of the development and production lifecycle.

Remediation Plan

Immediate Action: Update to version 2.18.19 or 2.19.5-beta5, depending on the current branch, to patch the privilege management logic.

Proactive Monitoring: Review audit logs for unexpected configuration changes or administrative actions performed by non-administrative user accounts.

Compensating Controls: Implement the principle of least privilege by strictly limiting the number of users with access to the Semaphore UI and isolating the management interface from public networks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

The existence of a proof-of-concept increases the urgency of this remediation. Organizations should immediately verify their version and apply the provided security updates to prevent unauthorized privilege escalation within their DevOps infrastructure.

---METADATA---
VENDOR: Progress Software
PRODUCT: MarkLogic Server
AFFECTED_VERSIONS: 11.0.0 up to 11.3.6, 12.0.0 up to 12.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Progress MarkLogic Server contains an improper privilege management vulnerability in its query interfaces allowing authenticated users with low-privileged roles to escalate to administrator.

Executive Summary:
A critical privilege escalation vulnerability in Progress MarkLogic Server allows low-privileged authenticated users to gain administrative control over the system.

Vulnerability Details

CVE-ID: CVE-2026-7329

Affected Software: Progress Software MarkLogic Server

Affected Versions: 11.0.0 up to (excluding) 11.3.6, 12.0.0 up to (excluding) 12.0.3

Vulnerability: This is an improper privilege management flaw (CWE-269) within the SQL, SPARQL, and Optic REST query interfaces. An attacker who has already authenticated as a low-privileged REST user can exploit this to perform unauthorized administrative actions and access sensitive data.

Business Impact

Successful exploitation allows an attacker to bypass security controls and gain full administrative access to the database server. Given the CVSS score of 9.9, this represents a critical risk of total system compromise, unauthorized data exfiltration, and potential disruption of business-critical operations.

Remediation Plan

Immediate Action: Upgrade to MarkLogic Server version 11.3.6, 12.0.3, or later as specified in the vendor security advisory.

Proactive Monitoring: Audit database access logs for unusual administrative activities or queries originating from accounts that typically do not perform such operations.

Compensating Controls: Restrict access to the REST query interfaces to authorized IP addresses via network-level controls or a Web Application Firewall to mitigate unauthorized access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high CVSS score is driven by the potential for full system compromise once the initial authentication threshold is met.

Analyst Recommendation

This vulnerability presents a severe risk to data integrity and system confidentiality. Organizations utilizing Progress MarkLogic Server should prioritize patching to the identified secure versions immediately to eliminate the privilege escalation path.

---METADATA---
VENDOR: rustfs
PRODUCT: rustfs
AFFECTED_VERSIONS: < 1.0.0-beta.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
RustFS contains an improper privilege management vulnerability that could allow an authenticated attacker to perform unauthorized actions.

Executive Summary:
A privilege management flaw in the RustFS distributed object storage system enables authenticated users to escalate privileges, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73284

Affected Software: rustfs rustfs

Affected Versions: < 1.0.0-beta.11

Vulnerability: The application suffers from improper privilege management (CWE-269), which permits an attacker with low privileges to perform unauthorized actions within the distributed storage environment.

Business Impact

Successful exploitation allows an attacker to bypass intended access controls, potentially resulting in the unauthorized modification, deletion, or exfiltration of sensitive stored data. With a CVSS score of 8.8, this high severity vulnerability poses a significant risk to data integrity and confidentiality for organizations relying on RustFS for critical storage operations.

Remediation Plan

Immediate Action: Update all instances of RustFS to version 1.0.0-beta.11 or later to resolve the privilege management flaw.

Proactive Monitoring: Review audit logs for unusual administrative activity or unauthorized access attempts from low-privileged user accounts.

Compensating Controls: Implement strict network segmentation and ensure that only authorized services have access to the RustFS API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to grant unauthorized administrative capabilities to standard users.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, organizations should prioritize patching their RustFS deployments. Failure to update the software exposes the entire distributed storage infrastructure to potential unauthorized control and data manipulation.

---METADATA---
VENDOR: Progress
PRODUCT: MarkLogic Server
AFFECTED_VERSIONS: 11.0.0 up to 11.3.6, 12.0.0 up to 12.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in the REST API document processing pipeline of MarkLogic Server allows authenticated users to escalate privileges.

Executive Summary:
MarkLogic Server contains an improper privilege management vulnerability that allows an authenticated user to perform unauthorized actions within the document processing pipeline.

Vulnerability Details

CVE-ID: CVE-2026-7327

Affected Software: Progress MarkLogic Server

Affected Versions: 11.0.0 up to 11.3.6, and 12.0.0 up to 12.0.3

Vulnerability: This is an improper privilege management vulnerability (CWE-269) within the REST API document processing pipeline. It requires the attacker to have high privileges (authenticated) to successfully exploit the flaw.

Business Impact

Successful exploitation allows an authenticated user to perform actions beyond their authorized scope, potentially leading to unauthorized data access or modification within the document processing pipeline. Given the CVSS score of 8.1, this represents a significant threat to data integrity and confidentiality, especially in environments where strict role-based access control is required.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Progress Software Corporation to upgrade to a non-vulnerable version (11.3.6 or 12.0.3 or higher).

Proactive Monitoring: Review access logs and audit trails for unauthorized attempts to access or modify documents via the REST API, particularly by users with restricted roles.

Compensating Controls: Limit access to the REST API endpoints to known, trusted IP addresses and enforce the principle of least privilege for all user accounts interacting with the database.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the vulnerability is not considered automatable.

Analyst Recommendation

While this vulnerability requires prior authentication, the potential for privilege escalation within a database environment remains a high-risk scenario. Organizations should prioritize updating their MarkLogic instances to the specified patched versions to ensure robust access control and maintain the security posture of their data.

---METADATA---
VENDOR: prowler-cloud
PRODUCT: prowler
AFFECTED_VERSIONS: < 5.36.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Prowler is vulnerable to OS command injection via the Kubernetes provider connection test, allowing authenticated users to execute arbitrary commands on the worker.

Executive Summary:
An OS command injection vulnerability in Prowler versions prior to 5.36.0 allows authenticated users to execute arbitrary commands, creating a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73263

Affected Software: prowler-cloud prowler

Affected Versions: < 5.36.0

Vulnerability: The vulnerability exists in the Kubernetes provider connection test, where attacker-supplied kubeconfig content containing legacy authentication providers is processed through a subprocess call without adequate neutralization. This requires authenticated access to the API to trigger the injection.

Business Impact

Successful exploitation allows an authenticated user to achieve command execution on the system running the Prowler worker, which could lead to full control of the underlying infrastructure. With a CVSS score of 9.9, the impact on the security of the cloud environment managed by Prowler is catastrophic, as it allows attackers to escalate privileges and move laterally within the cloud management plane.

Remediation Plan

Immediate Action: Update Prowler to version 5.36.0 or later to patch the command injection flaw in the Kubernetes provider connection logic.

Proactive Monitoring: Monitor API access logs for anomalous requests to the connection test endpoints and audit shell execution logs for unexpected processes spawned by the Prowler service.

Compensating Controls: Restrict access to the Prowler API to only authorized and trusted personnel to minimize the risk of exploitation by malicious insiders or compromised user accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any authenticated user with access to the API, necessitating prompt patching to mitigate the risk of internal or credential-based attacks.

Analyst Recommendation

Immediate update to version 5.36.0 is required for all Prowler deployments. Because this vulnerability allows for OS command injection, it represents a significant threat to the security of the infrastructure being managed by the Prowler platform, and the patch should be applied without delay.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: < 3.15.186
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the electerm terminal client allows authenticated users to execute arbitrary code due to improper control of dynamically managed code resources.

Executive Summary:
An authenticated remote code execution vulnerability in electerm poses a severe risk to host systems, potentially granting attackers full control over the application environment.

Vulnerability Details

CVE-ID: CVE-2026-73226

Affected Software: electerm electerm

Affected Versions: < 3.15.186

Vulnerability: The application suffers from improper control of dynamically managed code resources (CWE-913). This flaw allows an authenticated attacker to manipulate code execution, which can be leveraged to achieve remote code execution within the context of the application.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the electerm application. Given the CVSS score of 8.8, this represents a high risk to business operations, as it could lead to total compromise of the host machine, unauthorized access to stored credentials, and lateral movement within the network.

Remediation Plan

Immediate Action: Update electerm to version 3.15.186 or later immediately to incorporate the upstream fix.

Proactive Monitoring: Review application logs for suspicious shell commands or unexpected child processes initiated by the electerm binary.

Compensating Controls: Restrict access to the application to only trusted users and ensure the software is running in a segmented environment with limited network permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to hold valid, albeit low-level, user credentials to initiate the exploitation process.

Analyst Recommendation

This high-severity vulnerability requires immediate attention due to the potential for full system compromise. Administrators must prioritize updating all instances of electerm to the patched version 3.15.186 to eliminate the risk of remote code execution.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: < 3.15.120
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the electerm client allows attackers to execute arbitrary OS commands through improper neutralization of special elements.

Executive Summary:
An OS command injection vulnerability in the electerm client, rated at 8.8, allows an attacker to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73224

Affected Software: electerm electerm

Affected Versions: < 3.15.120

Vulnerability: The vulnerability is an OS command injection flaw arising from the improper handling of input. It is remotely exploitable and requires user interaction, but does not require authentication to trigger.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the electerm client. This could lead to a full compromise of the local machine, including the theft of SSH keys, stored credentials, and lateral movement within the network, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Update the electerm client to version 3.15.120 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor for unexpected child processes being spawned by the electerm application or unusual outbound network connections originating from the host.

Compensating Controls: Restrict the execution environment of the client by utilizing containerization or sandboxing, and ensure the host operating system is hardened against unauthorized command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, command injection flaws of this nature are frequently targeted by attackers once disclosed.

Analyst Recommendation

All users of the electerm client must upgrade to version 3.15.120 immediately to mitigate the risk of remote command execution. Given the potential for full system compromise, this update should be treated as a high-priority maintenance task for all workstations and servers running the affected software.

---METADATA---
VENDOR: davila7
PRODUCT: claude-code-templates
AFFECTED_VERSIONS: < 1.29.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The claude-code-templates CLI tool is vulnerable to OS command injection, missing authentication, and cross-site request forgery, potentially allowing unauthorized command execution.

Executive Summary:
A critical vulnerability in the davila7 claude-code-templates CLI tool allows unauthenticated attackers to execute arbitrary operating system commands.

Vulnerability Details

CVE-ID: CVE-2026-73222

Affected Software: davila7 claude-code-templates

Affected Versions: < 1.29.4

Vulnerability: This flaw encompasses OS command injection (CWE-78), missing authentication for critical functions (CWE-306), and cross-site request forgery (CWE-352). These vulnerabilities allow a remote attacker to execute arbitrary commands on the underlying host, as the application fails to properly neutralize special elements and lacks sufficient authentication controls.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk. A successful exploit could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the network. Because the tool is used for configuring and monitoring development workflows, its compromise directly threatens the integrity of the software development pipeline.

Remediation Plan

Immediate Action: Update the claude-code-templates CLI tool to version 1.29.4 or later immediately.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unusual CLI activity originating from the user account running the tool.

Compensating Controls: Restrict network access to the host running this tool using host-based firewalls to prevent unauthorized remote interaction until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of OS command injection and missing authentication makes this a high-value target for attackers seeking initial access to development environments.

Analyst Recommendation

Given the severity of potential OS command injection, immediate action is required. Organizations should prioritize updating all instances of claude-code-templates to version 1.29.4 to remediate the underlying flaws and prevent unauthorized system access.

---METADATA---
VENDOR: CVAT-AI
PRODUCT: CVAT
AFFECTED_VERSIONS: >= 2.68.0, < 2.70.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CVAT is affected by a Cross-Site Scripting (XSS) vulnerability that could allow an authenticated user to execute malicious scripts in the context of another user session.

Executive Summary:
A Cross-Site Scripting vulnerability in the CVAT computer vision annotation tool could allow an authenticated attacker to execute unauthorized scripts and potentially hijack user sessions.

Vulnerability Details

CVE-ID: CVE-2026-73220

Affected Software: CVAT-AI CVAT

Affected Versions: >= 2.68.0, < 2.70.0

Vulnerability: This is a basic Cross-Site Scripting (XSS) vulnerability, classified as CWE-80, resulting from the improper neutralization of script-related HTML tags. The attack requires the attacker to be authenticated and involves user interaction to trigger the execution of the payload.

Business Impact

A successful XSS attack on an annotation platform could lead to the compromise of administrative or user accounts, potentially resulting in the unauthorized manipulation of annotation datasets or the theft of sensitive session tokens. Given the CVSS score of 8.5, this vulnerability represents a significant threat to the security and integrity of the annotation workflow and the data managed within the system.

Remediation Plan

Immediate Action: Update the CVAT instance to version 2.70.0 or later to patch the XSS vulnerability.

Proactive Monitoring: Monitor for suspicious script injections or unusual behavior in the web interface, particularly within the annotation and project management modules.

Compensating Controls: Enforce strict Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting the sources from which scripts can be executed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While user interaction is required, the potential impact on data integrity makes this a priority for remediation.

Analyst Recommendation

Given the potential for session hijacking and unauthorized data manipulation, upgrading to version 2.70.0 is critical. Organizations should ensure that all users are operating on the patched version to maintain a secure annotation environment.

---METADATA---
VENDOR: Chocobozzz
PRODUCT: PeerTube
AFFECTED_VERSIONS: < 8.1.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the PeerTube ActorFollowModel allows unauthenticated remote servers to execute arbitrary database queries and take over administrator accounts.

Executive Summary:
An unauthenticated SQL injection in PeerTube allows remote attackers to compromise administrative accounts and read or modify sensitive database tables.

Vulnerability Details

CVE-ID: CVE-2026-73211

Affected Software: Chocobozzz PeerTube

Affected Versions: < 8.1.6

Vulnerability: The flaw resides in the ActorFollowModel.updateScore() function, where attacker-controlled input is improperly interpolated into an SQL query. This allows unauthenticated actors to perform unauthorized database operations, including the theft of OAuth access tokens.

Business Impact

The potential for administrative account takeover via SQL injection makes this a critical vulnerability. With a CVSS score of 9.8, the impact includes total loss of control over the video platform, potential exfiltration of sensitive user data, and the ability to manipulate platform content or settings.

Remediation Plan

Immediate Action: Update PeerTube to version 8.1.6 or later to include the fix for the SQL injection vulnerability.

Proactive Monitoring: Audit database access logs for unauthorized queries or unusual activity related to the ActorFollowModel or OAuth token tables.

Compensating Controls: Implement strict network-level egress filtering for federated services and utilize a WAF to inspect incoming ActivityPub payloads for malicious SQL patterns.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by remote, unauthenticated federated servers.

Analyst Recommendation

This vulnerability poses an extreme risk to the security and integrity of PeerTube instances. Administrators are urged to apply the 8.1.6 update immediately to prevent unauthorized administrative access and protect platform data.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Firefox < 150, Thunderbird < 150, Firefox ESR < 140.10.1
---END_METADATA---

Description Summary:
A sandbox escape vulnerability in the WebRTC networking component allows attackers to bypass security boundaries.

Executive Summary:
A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird allows for potential system-level compromise by bypassing security sandboxing.

Vulnerability Details

CVE-ID: CVE-2026-7321

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: Firefox < 150, Thunderbird < 150, Firefox ESR < 140.10.1

Vulnerability: This vulnerability is caused by incorrect boundary conditions within the WebRTC networking component, allowing an unauthenticated attacker to escape the browser sandbox.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe risk to organizational security. Successful exploitation could allow an attacker to execute arbitrary code outside the browser's sandbox, leading to full system compromise, data exfiltration, and lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade all instances of Firefox, Thunderbird, and Firefox ESR to the versions specified in the vendor advisory immediately.

Proactive Monitoring: Monitor endpoint detection logs for abnormal process execution or unexpected network traffic originating from browser-related processes.

Compensating Controls: Ensure endpoint protection software is updated to detect and block malicious code execution patterns associated with browser-based exploits.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate patching across all workstation and server environments. Organizations should prioritize updating their browser installations to prevent potential remote code execution and sandbox breakout scenarios.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Firefox < 150.0.1, Firefox ESR < 140.10.1, Firefox ESR < 115.35.1, Thunderbird < 150.0.1, Thunderbird < 140.10.1
CONFIDENCE: high
MISSING: none
CREDITS: Xuehao Guo (finder)
SOURCES_JSON: [{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2027433","name":null,"tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-35/","name":null,"tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-36/","name":null,"tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-37/","name":null,"tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-38/","name":null,"tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-39/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.671Z
---END_METADATA---

Description Summary:
An information disclosure vulnerability exists in the Audio/Video component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions.

Executive Summary:
A high-severity information disclosure vulnerability in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to potentially access sensitive memory data.

Vulnerability Details

CVE-ID: CVE-2026-7320

Affected Software: Mozilla Firefox and Mozilla Thunderbird

Affected Versions: Firefox before 150.0.1, Firefox ESR before 140.10.1, Firefox ESR before 115.35.1, Thunderbird before 150.0.1, and Thunderbird before 140.10.1

Vulnerability: The flaw is an information disclosure vulnerability stemming from incorrect boundary condition handling within the Audio/Video component. The CVSS vector of AV:N/AC:L/PR:N indicates that the vulnerability is exploitable by an unauthenticated remote attacker without requiring user interaction.

Business Impact

The vulnerability poses a significant risk to data confidentiality, as it allows attackers to read sensitive information processed by the browser or mail client. Given the CVSS score of 7.5, this is categorized as a high-severity issue that could lead to unauthorized access to private user data, potentially compromising credentials or session information stored in memory.

Remediation Plan

Immediate Action: Update all installations of Mozilla Firefox and Thunderbird to the fixed versions (150.0.1 or the corresponding ESR releases) as specified in the Mozilla security advisories.

Proactive Monitoring: Monitor network traffic for unusual patterns related to media processing and review system logs for anomalies in browser or email client behavior.

Compensating Controls: While no direct compensating control prevents this specific memory-level flaw, users should employ standard browser security practices, such as disabling unnecessary media auto-play features, to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated nature and the prevalence of the affected software.

Analyst Recommendation

The risk posed by this vulnerability is substantial due to the ease with which an unauthenticated remote actor could potentially exfiltrate sensitive memory contents. Organizations must prioritize the deployment of the Mozilla patches across all endpoints to ensure comprehensive protection against this information disclosure risk.

---METADATA---
VENDOR: MISP
PRODUCT: cti-transmute
AFFECTED_VERSIONS: 0 through 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The cti-transmute tool by MISP is vulnerable to Server-Side Request Forgery (SSRF) in its /fetch_misp_event and /misp_search_events endpoints.

Executive Summary:
A high-severity Server-Side Request Forgery (SSRF) vulnerability in cti-transmute allows unauthenticated attackers to potentially access internal resources and sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-73160

Affected Software: MISP cti-transmute

Affected Versions: 0 through 1.4.0

Vulnerability: This SSRF vulnerability (CWE-918) exists within the /fetch_misp_event and /misp_search_events endpoints, allowing an unauthenticated attacker to force the application to make unauthorized requests to internal or external systems.

Business Impact

An attacker can exploit this vulnerability to perform reconnaissance on internal networks, bypass firewall protections, or interact with services that are not exposed to the public internet. Given the CVSS score of 8.7, this issue poses a significant risk of internal network compromise and unauthorized information disclosure.

Remediation Plan

Immediate Action: Review the official MISP repository for security updates, as a patch is required to restrict the allowed targets of the affected endpoints.

Proactive Monitoring: Monitor network logs for unusual outbound requests originating from the server hosting cti-transmute, specifically targeting internal IP ranges or sensitive metadata services.

Compensating Controls: Implement strict network egress filtering on the host running cti-transmute to prevent it from reaching internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent nature of SSRF makes this a high-value target for attackers looking to pivot into internal network segments.

Analyst Recommendation

Due to the high severity and the unauthenticated nature of this SSRF vulnerability, organizations should prioritize restricting network access to the affected service until a vendor-supplied patch is applied. Monitor the MISP project documentation for release updates to address this flaw.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: Progress Sitefinity version from 8.0.5700 to 13.3.7652
---END_METADATA---

Description Summary:
Progress Sitefinity versions 8.0.5700 through 13.3.7652 contain a vulnerability allowing remote authenticated attackers to obtain plain-text credentials for the Sitefinity Insight service.

Executive Summary:
A high-severity credential exposure vulnerability in Progress Sitefinity allows authenticated attackers to access sensitive credentials used for integration with the Sitefinity Insight service.

Vulnerability Details

CVE-ID: CVE-2026-7313

Affected Software: Progress Sitefinity

Affected Versions: Progress Sitefinity version from 8.0.5700 to 13.3.7652

Vulnerability: This is an "Insufficiently Protected Credentials" (CWE-522) vulnerability within web services. Exploitation requires a remote authenticated attacker with valid back-end authorization, non-default site configuration, and an active integration with the Sitefinity Insight service.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk of data compromise. By obtaining plain-text credentials for the Sitefinity Insight service, an attacker could gain unauthorized access to secondary systems, potentially leading to further data breaches or service manipulation.

Remediation Plan

Immediate Action: Update Progress Sitefinity to a patched version beyond 13.3.7652 immediately.

Proactive Monitoring: Monitor access logs for unusual administrative activity and audit all integrations configured with the Sitefinity Insight service.

Compensating Controls: Rotate all credentials associated with the Sitefinity Insight service after applying the patch to ensure any previously exposed secrets are invalidated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations running affected versions of Sitefinity should treat this as a high-priority update. Because the vulnerability involves credential exposure, simply patching is insufficient; administrators must also rotate credentials to ensure full remediation.

---METADATA---
VENDOR: Ebyte
PRODUCT: NE2-D11 Firmware
AFFECTED_VERSIONS: FW-9167-0-11
CONFIDENCE: high
MISSING: patch
CREDITS: Jithin Nambiar reported this vulnerability to CISA. (finder)
SOURCES_JSON: [{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06","name":null,"tags":[]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The web management interface of Ebyte NE2-D11 firmware fails to enforce authentication, allowing unauthenticated remote attackers to modify device settings or disrupt availability.

Executive Summary:
The Ebyte NE2-D11 firmware contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to gain full control over device configurations.

Vulnerability Details

CVE-ID: CVE-2026-73125

Affected Software: Ebyte NE2-D11 Firmware

Affected Versions: FW-9167-0-11

Vulnerability: This is an authentication bypass vulnerability (CWE-306) occurring within the web management interface. The interface fails to consistently verify user credentials, enabling unauthenticated remote attackers to perform administrative actions.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to organizational infrastructure. Successful exploitation allows unauthorized parties to modify critical device settings, potentially leading to a total loss of confidentiality, integrity, and availability for the affected network segment. This could result in significant operational downtime or the facilitation of further lateral movement within the environment.

Remediation Plan

Immediate Action: Restrict network access to the web management interface of the Ebyte NE2-D11 device to authorized management subnets only until a firmware update is applied.

Proactive Monitoring: Review device access logs for unusual login patterns or administrative requests originating from unauthorized IP addresses.

Compensating Controls: Implement a Web Application Firewall or similar network security appliance to block unauthorized traffic directed at the web management interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this device highly susceptible to automated exploitation if exposed to the public internet.

Analyst Recommendation

Given the critical nature of this flaw, administrators must treat this as a high priority. Ensure that the vulnerable management interface is not accessible from untrusted networks and prepare to apply the vendor-supplied firmware update immediately upon its release to permanently remediate the authentication failure.

---METADATA---
VENDOR: Progress
PRODUCT: Sitefinity
AFFECTED_VERSIONS: 14.0.7700 to 14.4.8152, 15.0.8200 to 15.0.8234, 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, 15.4.8600 to 15.4.8630
---END_METADATA---

Description Summary:
Progress Sitefinity web services contain a vulnerability that allows unauthenticated remote attackers to retrieve plain-text credentials for the Sitefinity Insight service.

Executive Summary:
A critical credential disclosure vulnerability in Progress Sitefinity allows unauthenticated remote attackers to obtain sensitive plain-text credentials for integrated services.

Vulnerability Details

CVE-ID: CVE-2026-7312

Affected Software: Progress Sitefinity

Affected Versions: 14.0.7700 to 14.4.8152, 15.0.8200 to 15.0.8234, 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, 15.4.8600 to 15.4.8630

Vulnerability: The web services component fails to protect credentials, allowing an unauthenticated attacker to access plain-text credentials used for the Sitefinity Insight service, provided the installation has active integration and non-default configurations.

Business Impact

The exposure of plain-text credentials poses a significant risk of unauthorized access to the Sitefinity Insight service, potentially resulting in data exfiltration or manipulation of business analytics. Although the CVSS score is 10.0, the requirement for non-default site configurations acts as a limiting factor, though the impact remains severe for affected enterprise environments.

Remediation Plan

Immediate Action: Apply the vendor-provided patch corresponding to your specific version (e.g., 14.4.8152, 15.0.8234, etc.) immediately.

Proactive Monitoring: Review access logs for anomalous requests to web services and perform a credential rotation for all services integrated with Sitefinity Insight following the patch.

Compensating Controls: Ensure the Sitefinity instance is behind a robust WAF and restrict external access to web service endpoints that are not required for public operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the perfect CVSS score, this vulnerability demands immediate attention. Administrators must identify their current version and apply the specified patch to prevent the exposure of sensitive service credentials.

---METADATA---
VENDOR: TinyPNG
PRODUCT: JPEG, PNG & WebP image compression plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The TinyPNG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient input validation within the delete_converted_image_size function.

Executive Summary:
A critical arbitrary file deletion vulnerability in the TinyPNG WordPress plugin exposes the underlying server filesystem to unauthorized modification and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-7311

Affected Software: TinyPNG JPEG, PNG & WebP image compression plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to adequately sanitize user-supplied input within the delete_converted_image_size function. This allows an authenticated attacker with sufficient privileges to delete arbitrary files on the web server.

Business Impact

The ability for an attacker to delete arbitrary files poses a severe risk to system integrity and availability. An attacker could remove critical configuration files, core WordPress files, or security-related logs, potentially leading to a complete denial-of-service or facilitating further system compromise. With a CVSS score of 8.1, this high-severity flaw requires immediate attention to prevent operational downtime.

Remediation Plan

Immediate Action: Update the TinyPNG plugin to the latest available version provided by the vendor to implement proper path validation.

Proactive Monitoring: Monitor server file system activity logs for unauthorized deletion attempts or access patterns targeting sensitive directories.

Compensating Controls: Implement file integrity monitoring (FIM) and ensure the web server service account operates with the principle of least privilege regarding filesystem permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates prompt remediation. Administrators should verify their current plugin version and apply updates immediately. If a patch is not yet available, consider disabling the plugin until a secure version is released to mitigate the risk of filesystem manipulation.

---METADATA---
VENDOR: Activepieces
PRODUCT: Activepieces
AFFECTED_VERSIONS: < 0.80.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Activepieces is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying operating system.

Executive Summary:
An OS Command Injection vulnerability in Activepieces allows authenticated users to execute arbitrary system commands, leading to full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-73081

Affected Software: Activepieces

Affected Versions: All versions prior to 0.80.0

Vulnerability: The software fails to properly neutralize special elements used in OS commands (CWE-78). An authenticated attacker can manipulate input parameters to execute arbitrary commands at the operating system level, effectively bypassing application-level restrictions.

Business Impact

The CVSS score of 8.7 highlights the critical nature of this vulnerability, as it allows for full system control by an authenticated user. This could lead to unauthorized access to sensitive workflow data, lateral movement within the network, or the installation of persistent malicious backdoors. The impact is elevated if the platform is integrated with highly privileged cloud services or internal infrastructure.

Remediation Plan

Immediate Action: Upgrade the Activepieces platform to version 0.80.0 or later as provided in the official release notes.

Proactive Monitoring: Inspect server logs for unusual process execution patterns or unauthorized attempts to access system-level binaries and configuration files.

Compensating Controls: Restrict access to the Activepieces administrative interface to trusted users only, and run the service with the least privilege necessary to minimize the potential impact of command execution.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in insecure input handling when interacting with the host OS.

Analyst Recommendation

Given the potential for complete system takeover, administrators should upgrade to version 0.80.0 immediately. Organizations should also review the access logs of the platform to ensure that no unauthorized users have utilized this vector to gain persistent access.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.2, 26.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A flaw in Red Hat build of Keycloak involves improper validation of syntactic correctness of input, which can lead to a denial-of-service condition.

Executive Summary:
A critical input validation vulnerability in the Red Hat build of Keycloak can be exploited by unauthenticated remote attackers to trigger a denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-7307

Affected Software: Red Hat build of Keycloak

Affected Versions: 26.2 and 26.4

Vulnerability: The vulnerability (CWE-1286) stems from improper validation of input syntax. An unauthenticated attacker can send specially crafted requests to the application, resulting in service disruption or exhaustion of resources.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to availability. Successful exploitation would result in a denial-of-service, rendering the authentication service unavailable and preventing legitimate users from accessing critical enterprise applications, which could lead to significant operational downtime.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to the versions specified in the vendor errata (e.g., 26.2.16-1 or 26.4.12-1 and later) to resolve the underlying input validation error.

Proactive Monitoring: Review access logs for high-frequency or malformed request patterns that may indicate attempts to trigger a denial-of-service condition.

Compensating Controls: Deploy rate-limiting and request-filtering policies at the network perimeter or via an API gateway to mitigate the impact of malformed input attacks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly automatable, increasing the risk of opportunistic attacks.

Analyst Recommendation

Organizations utilizing the Red Hat build of Keycloak must apply the provided security updates as a matter of priority to restore service integrity. Ensure that all affected nodes in the cluster are patched to prevent potential service outages.

---METADATA---
VENDOR: Scriban
PRODUCT: Scriban
AFFECTED_VERSIONS: 3.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A denial of service vulnerability in Scriban allows remote, unauthenticated attackers to cause resource exhaustion via specifically crafted array multiplication operations.

Executive Summary:
Scriban versions 3.x are vulnerable to a denial of service attack that can be exploited by unauthenticated actors to crash the application.

Vulnerability Details

CVE-ID: CVE-2026-73062

Affected Software: Scriban Scriban

Affected Versions: 3.x

Vulnerability: This flaw relates to CWE-770: Allocation of Resources Without Limits or Throttling. An unauthenticated attacker can supply crafted array multiplication inputs that cause the application to consume excessive system memory or CPU cycles.

Business Impact

A successful exploit leads to a denial of service, causing system instability or complete application failure. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, which could lead to significant service outages for dependent business applications.

Remediation Plan

Immediate Action: Update the Scriban NuGet package to version 7.2.1 or later to resolve the underlying resource management flaw.

Proactive Monitoring: Analyze application logs for frequent crashes or latency spikes occurring during template processing tasks.

Compensating Controls: Deploy a Web Application Firewall to detect and block requests containing unusually large or complex array structures in template inputs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw is a standard resource exhaustion vector that is common in template engines lacking strict input limits.

Analyst Recommendation

All systems using the Scriban library must be updated to version 7.2.1 immediately to patch this vulnerability. Proactive patching is essential to prevent potential service disruption caused by malicious actors leveraging this resource exhaustion flaw.

---METADATA---
VENDOR: scriban
PRODUCT: scriban
AFFECTED_VERSIONS: 0 up to (excluding) 7.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Scriban template engine contains an access-modifier bypass vulnerability in TypedObjectAccessor, allowing unauthenticated attackers to perform unauthorized writes to CLR object properties.

Executive Summary:
A critical access-modifier bypass in the Scriban template engine allows unauthenticated remote attackers to modify protected object properties, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73061

Affected Software: scriban scriban

Affected Versions: 0 up to (excluding) 7.2.2

Vulnerability: The vulnerability exists in the TypedObjectAccessor component, where template code can write to CLR object properties without proper setter-visibility checks. This allows an unauthenticated attacker to manipulate private, internal, or init-only setters, effectively performing mass assignment on sensitive host objects.

Business Impact

Successful exploitation allows an attacker to permanently alter the state of live host objects after template rendering. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and system security, potentially enabling arbitrary code execution or privilege escalation within the application environment.

Remediation Plan

Immediate Action: Update the scriban package to version 7.2.2 or later via your package manager (e.g., NuGet).

Proactive Monitoring: Review application logs for unusual template rendering behavior or unexpected modifications to internal object states.

Compensating Controls: Implement strict input validation for templates and, where possible, utilize sandboxing configurations that restrict the scope of accessible object properties.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Organizations utilizing the Scriban template engine should prioritize upgrading to version 7.2.2 to close this access-modifier bypass. Failure to patch may allow remote attackers to gain unauthorized control over application logic and object data.

---METADATA---
VENDOR: Scriban
PRODUCT: Scriban
AFFECTED_VERSIONS: Versions 3.x
CONFIDENCE: medium
MISSING: none
---END_METADATA---

Description Summary:
Scriban is susceptible to a denial of service vulnerability caused by improper resource allocation during script range multiplication operations.

Executive Summary:
A vulnerability in the Scriban template engine allows unauthenticated remote attackers to trigger a denial of service condition through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-73060

Affected Software: Scriban Scriban

Affected Versions: 3.x

Vulnerability: This vulnerability is categorized under CWE-770: Allocation of Resources Without Limits or Throttling. It allows an unauthenticated attacker to exhaust system resources by submitting malicious script range multiplication inputs.

Business Impact

The successful exploitation of this vulnerability results in a denial of service, which can render applications utilizing the Scriban engine unresponsive or cause them to crash. Given the CVSS score of 7.5, this high severity flaw poses a significant operational risk to business continuity, particularly for web services relying on template rendering for user-facing content.

Remediation Plan

Immediate Action: Review the project dependencies and ensure the template engine is updated to a version that implements proper resource limits for script operations.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes associated with template parsing or rendering functions.

Compensating Controls: Implement input validation to restrict the size and complexity of template scripts submitted by users to prevent resource exhaustion attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable because the library fails to throttle resource-intensive operations during template execution.

Analyst Recommendation

Organizations utilizing the Scriban template engine should prioritize auditing their implementation to verify if they are using the affected version range. It is critical to apply updates or implement strict input validation to mitigate the risk of denial of service attacks.

---METADATA---
VENDOR: stoatchat
PRODUCT: stoatchat
AFFECTED_VERSIONS: All versions prior to 0.15.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The stoatchat application is vulnerable to a denial of service attack due to improper resource management during SVG rendering.

Executive Summary:
Stoatchat versions prior to 0.15.0 are affected by an uncontrolled resource consumption vulnerability during SVG rendering, which can lead to a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-73057

Affected Software: stoatchat

Affected Versions: All versions prior to 0.15.0

Vulnerability: This vulnerability, classified under CWE-400, stems from the application's failure to properly cap resources while rendering SVG files. An unauthenticated attacker can exploit this by submitting specifically crafted SVG content, causing the application to consume excessive system resources and crash.

Business Impact

The CVSS score of 7.5 indicates a high severity rating due to the potential for complete service disruption. A successful denial of service attack could render the chat platform unavailable to users, causing significant operational impact and loss of communication capabilities.

Remediation Plan

Immediate Action: Update the stoatchat software to version 0.15.0 or later to patch the resource consumption vulnerability.

Proactive Monitoring: Monitor server CPU and memory usage for spikes that may indicate attempts to exploit SVG rendering processes.

Compensating Controls: Implement input validation or sanitization layers to filter or block malicious SVG files before they reach the rendering engine.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable via network-based vectors, making it a critical threat to availability.

Analyst Recommendation

Availability is a core requirement for chat applications, and this vulnerability poses a direct threat to that goal. It is strongly recommended that all administrators apply the update to version 0.15.0 immediately to prevent potential service outages caused by malicious SVG payloads.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: < 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SiYuan kernel before 3.7.4 fails to restrict excessive authentication attempts, allowing unauthenticated attackers to brute-force API tokens and gain administrative access.

Executive Summary:
A critical authentication brute-force vulnerability in SiYuan kernel versions prior to 3.7.4 allows unauthenticated attackers to gain full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-73056

Affected Software: siyuan-note siyuan

Affected Versions: < 3.7.4

Vulnerability: The CheckAuth middleware fails to enforce rate limiting or CAPTCHA requirements on API token authentication. This allows an unauthenticated remote attacker to perform unlimited brute-force guesses against the API token, leading to full RoleAdministrator access.

Business Impact

With a CVSS score of 9.8, this flaw presents a critical risk, as it allows attackers to gain full control over the application. Administrative access grants the ability to perform arbitrary file operations and execute SQL queries, leading to potential data exfiltration or complete loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately to apply the necessary authentication rate limiting.

Proactive Monitoring: Review audit logs for high volumes of failed API authentication attempts or suspicious patterns originating from single IP addresses.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to rate-limit requests to API endpoints or block unauthorized IP addresses exhibiting rapid authentication failures.

Exploitation Status

Public Exploit Available: No (No confirmed weaponized exploit is documented in the provided data.)

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of built-in lockout mechanisms.

Analyst Recommendation

This vulnerability is highly critical due to the ease of brute-forcing API tokens. All deployments of SiYuan must be updated to version 3.7.4 or later as the primary mitigation. Ensure that API tokens are sufficiently long and complex to further reduce the risk of successful guessing.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability involving the websocket implementation, allowing unauthenticated remote access.

Executive Summary:
A high-severity authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to gain unauthorized access to the application via websocket communication.

Vulnerability Details

CVE-ID: CVE-2026-73054

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application suffers from improper authentication (CWE-287), specifically within its websocket handling, which permits unauthenticated attackers to interact with the system without valid credentials.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a critical failure in the application security model. Exploitation provides attackers with unauthorized access to system functions, creating a high risk of data exfiltration and administrative compromise.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later to resolve the websocket authentication bypass.

Proactive Monitoring: Review websocket traffic and connection logs for unusual patterns or connections originating from unauthorized or external sources.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and filter incoming websocket traffic for suspicious handshake patterns or unauthorized access attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw represents a fundamental breakdown in the application authentication logic.

Analyst Recommendation

The severity of this authentication bypass requires immediate attention. Security teams must ensure all instances of SiYuan are patched to version 3.7.4 to prevent potential unauthorized access and maintain the integrity of the application.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 are susceptible to cross-site scripting in the unicode2Emoji function, allowing arbitrary code execution in the renderer.

Executive Summary:
A critical cross-site scripting vulnerability in the SiYuan unicode2Emoji function permits attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73053

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability resulting from improper sanitization of codepoint branch output. By crafting specific document icons with hex-encoded markup, an authenticated attacker can execute arbitrary code within the renderer, which runs with Node integration enabled.

Business Impact

The vulnerability is rated as critical with a CVSS score of 9.0. It allows an attacker to bypass application-level controls to execute system-level commands, creating a direct path to full workstation or server compromise depending on where the application is deployed.

Remediation Plan

Immediate Action: Update to SiYuan version 3.7.4 or later, which includes necessary sanitization for the unicode2Emoji function.

Proactive Monitoring: Audit document icon metadata and look for abnormally long or hex-encoded strings that may indicate an attempt to trigger the vulnerable function.

Compensating Controls: Limit access to document creation or modification features for untrusted users until the software has been updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the application's configuration allowing Node.js integration in the renderer.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, immediate patching to version 3.7.4 is mandatory. Security teams should verify that all deployments are running the updated version to mitigate this risk.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary JavaScript by injecting malicious markup into attribute-view field names.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan can lead to arbitrary code execution when malicious attribute names are viewed by a user, particularly within the desktop client.

Vulnerability Details

CVE-ID: CVE-2026-73052

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to sanitize attribute-view field names, which are rendered via innerHTML in the sort menu. An authenticated attacker can rename a database field to include malicious scripts that execute in the context of the victim's session.

Business Impact

The impact is severe, as the vulnerability allows for arbitrary JavaScript execution. In the context of the SiYuan desktop client, where Node integration may be enabled, this vulnerability can escalate to full system command execution, threatening the integrity and confidentiality of the host environment.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later, which includes the necessary output encoding to prevent script injection.

Proactive Monitoring: Monitor for unusual modifications to database field names that contain HTML tags or script-related keywords.

Compensating Controls: Ensure that users are not granted unnecessary privileges to modify database structures and employ Content Security Policy (CSP) headers where applicable.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is elevated in desktop environments where improper neutralization of input can lead to local code execution.

Analyst Recommendation

While this vulnerability requires an authenticated user to initiate the injection, the potential for escalation to remote code execution in the desktop client is significant. Administrators should apply the update to version 3.7.4 as soon as possible to neutralize this stored XSS vector.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan before v3.7.4 contains a stored Cross-site Scripting vulnerability in the attribute-view select option color field, allowing arbitrary JavaScript execution.

Executive Summary:
A critical stored cross-site scripting flaw in SiYuan allows authenticated users to execute arbitrary JavaScript by injecting malicious payloads into select option color fields.

Vulnerability Details

CVE-ID: CVE-2026-73050

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to validate or escape the color field within attribute-view select options. This allows an attacker to inject event-handler attributes by including quotation marks in the input, which then execute when other users view the affected database records.

Business Impact

This vulnerability allows for the execution of arbitrary JavaScript in the context of other users' sessions, which can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. With a CVSS score of 9.0, this poses a high risk to the security of user data and the overall integrity of the collaborative environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Review application logs for suspicious entries in attribute-view select options or unusual client-side script execution.

Compensating Controls: Limit the ability of users to define custom colors or metadata in attribute-view fields until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of injecting malicious payloads into commonly used UI elements.

Analyst Recommendation

Given the critical severity of this cross-site scripting vulnerability, administrators should ensure all instances are updated to version 3.7.4 as soon as possible. Prompt patching is essential to prevent unauthorized code execution within the user base.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The SiYuan CheckAuth middleware fails to enforce rate limiting or account lockout for HTTP Basic Authentication, allowing unauthenticated attackers to brute-force the workspace access code.

Executive Summary:
A critical authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to brute-force administrative access codes, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73046

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to restrict excessive authentication attempts within the CheckAuth middleware for the HTTP Basic Authentication branch. This flaw allows unauthenticated attackers to perform unlimited brute-force attempts to guess the workspace access code and gain administrative privileges.

Business Impact

Successful exploitation grants an attacker full RoleAdministrator access to the application kernel. This level of access poses a severe risk of unauthorized data modification, total loss of confidentiality, and potential disruption of business operations, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later to implement proper authentication rate limiting.

Proactive Monitoring: Review system access logs for high volumes of failed authentication attempts targeting the /api/* endpoints.

Compensating Controls: Implement network-level rate limiting or an IP-based blocklist via a Web Application Firewall to restrict automated brute-force traffic.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of constant-time string comparisons combined with the absence of account lockout mechanisms.

Analyst Recommendation

Given the ease of exploitation and the high level of access granted, this vulnerability presents an immediate risk to any exposed SiYuan instance. Organizations must prioritize updating to version 3.7.4 immediately to remediate the authentication bypass and prevent unauthorized administrative access.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions prior to 3.7.4 are vulnerable to a lack of proper restrictions on authentication attempts, potentially allowing attackers to conduct brute force attacks against the application.

Executive Summary:
A high-severity authentication vulnerability in SiYuan allows unauthenticated attackers to perform brute force attacks, risking unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-73045

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly restrict excessive authentication attempts (CWE-307), allowing unauthenticated remote attackers to bypass traditional rate limiting or lockout mechanisms.

Business Impact

This vulnerability carries a CVSS score of 7.5, reflecting a significant risk to confidentiality. Successful exploitation could lead to unauthorized access to sensitive user data or system configurations, potentially resulting in data breaches and loss of trust.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.4 or later to implement proper authentication attempt restrictions.

Proactive Monitoring: Monitor authentication logs for patterns of high-frequency login attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules configured to block excessive requests to authentication endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of built-in threshold management for authentication requests.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize updating to version 3.7.4 immediately. Securing the authentication gateway is critical to preventing account takeovers and protecting sensitive information stored within the SiYuan environment.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 are vulnerable to stored cross-site scripting via the setAttrViewColWidth API, which can lead to arbitrary code execution within the Electron renderer.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary code with Node integration enabled.

Vulnerability Details

CVE-ID: CVE-2026-73044

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where improper validation of table column width values permits malicious injection into style attributes. The vulnerability requires low privileges and user interaction, allowing an attacker to inject event handlers that trigger code execution in the Electron environment.

Business Impact

The exploitation of this vulnerability results in full system compromise, as the application runs with Node integration enabled. Given the CVSS score of 9.0, this represents a critical risk where an attacker can gain unauthorized control over the host system, leading to data exfiltration or total loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later to apply the necessary input validation and sanitization fixes.

Proactive Monitoring: Review application logs for unusual API calls to setAttrViewColWidth and monitor for unexpected process spawning from the SiYuan application.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if possible to restrict the execution of unauthorized scripts within the application interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of cross-site scripting and enabled Node.js integration within the renderer.

Analyst Recommendation

This vulnerability presents a severe risk to host system integrity. All administrators should prioritize updating to version 3.7.4 immediately to remediate this flaw and prevent potential remote code execution.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 contain a remote code execution vulnerability in the Template calculation operator, allowing execution of arbitrary code via injected malicious templates.

Executive Summary:
A critical remote code execution vulnerability in the SiYuan desktop client allows an attacker to execute arbitrary code when a malicious database is opened.

Vulnerability Details

CVE-ID: CVE-2026-73043

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to 3.7.4

Vulnerability: This is a cross-site scripting (CWE-79) and remote code execution vulnerability originating from the Template calculation operator. The operator fails to sanitize user-authored Go templates, which are rendered with Node integration enabled in the desktop client.

Business Impact

Successful exploitation allows an attacker to achieve code execution on the host machine running the SiYuan desktop client. This could lead to local data theft, lateral movement within the network, or complete control over the user's workstation, justifying the critical severity rating.

Remediation Plan

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.4 or later immediately.

Proactive Monitoring: Users should exercise caution when opening database files from untrusted sources and monitor for unexpected application behavior or unauthorized network connections.

Compensating Controls: Ensure the application is run with the least privilege necessary and utilize endpoint protection software to detect unauthorized child processes spawned by the SiYuan client.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of Aug 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of template rendering and enabled Node integration.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.7.4 to remediate this vulnerability. Given the ease with which local code execution can occur, users should avoid opening untrusted or shared SiYuan database files until the software has been patched.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan before v3.7.4 is vulnerable to stored Cross-site Scripting via improperly escaped database menu metadata, allowing execution of arbitrary code due to Electron's insecure configuration.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated users to achieve remote code execution through manipulated menu metadata.

Vulnerability Details

CVE-ID: CVE-2026-73042

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly escape database menu metadata during HTML interpolation. This flaw allows an authenticated user to inject malicious markup that executes arbitrary JavaScript, which, due to the application's use of Electron with insecure configuration, can escalate to full remote code execution.

Business Impact

The ability to execute arbitrary code with the privileges of the application provides an attacker with complete control over the user's local system. Given the CVSS score of 9.0, this represents a critical risk to confidentiality, integrity, and availability, as it allows for data exfiltration and total compromise of the host environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Monitor for unusual script execution or unexpected outbound network connections from the SiYuan application process.

Compensating Controls: Restrict permissions on database fields and views to trusted users only until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it bridges the gap between stored XSS and remote code execution in an Electron environment.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for remote code execution. Users are strongly advised to apply the version 3.7.4 update immediately to secure the application against potential exploitation.

---METADATA---
VENDOR: siyuan-note
PRODUCT: siyuan
AFFECTED_VERSIONS: 0 up to (excluding) 3.7.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SiYuan versions before 3.7.4 allow arbitrary code execution via malicious PDF annotations that trigger script execution in the PDF renderer with Node.js access.

Executive Summary:
A critical vulnerability in SiYuan PDF annotation handling allows authenticated attackers to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73041

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where the setFileAnnotation endpoint fails to sanitize markup injected into annotation fields. When a user opens a compromised PDF, the injected payload executes with full Node.js privileges, bypassing standard browser security boundaries.

Business Impact

With a CVSS score of 9.0, this vulnerability poses a high risk of total system takeover. Successful exploitation allows an attacker to execute arbitrary commands, potentially leading to the theft of sensitive user data, credential harvesting, or further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or newer to ensure that annotation fields are properly escaped and sanitized before being written to disk.

Proactive Monitoring: Monitor user activity logs for suspicious PDF file access or unexpected modifications to annotation data.

Compensating Controls: Restrict the ability of users to import or annotate untrusted PDF files from external sources until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it leverages the application's own file processing capabilities to trigger execution.

Analyst Recommendation

The risk of remote code execution via document processing is significant. Organizations must treat this as a high-priority update and deploy the patch to version 3.7.4 across all instances immediately.

---METADATA---
VENDOR: louislam
PRODUCT: dockge
AFFECTED_VERSIONS: 0 through 1.5.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dockge contains a path traversal vulnerability due to improper validation of stack names, which allows authenticated attackers to disclose arbitrary files and delete directories.

Executive Summary:
An authenticated path traversal vulnerability in louislam Dockge versions 1.5.0 and earlier allows attackers to perform unauthorized file operations and directory deletions.

Vulnerability Details

CVE-ID: CVE-2026-73040

Affected Software: louislam Dockge

Affected Versions: 0 through 1.5.0

Vulnerability: The application fails to properly validate stack names on the write path, leading to a path traversal vulnerability (CWE-22). This allows an authenticated user with low privileges to manipulate file paths, resulting in arbitrary file disclosure and directory deletion.

Business Impact

The ability to read arbitrary files and delete directories poses a severe risk to system integrity and confidentiality. An attacker could extract sensitive configuration files or environment variables, potentially leading to a full system compromise. With a CVSS score of 8.8, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Monitor the official repository for a patched version release and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious stack naming patterns or attempts to access restricted directory paths.

Compensating Controls: Implement strict network segmentation and ensure that the Dockge instance runs with the minimum necessary filesystem permissions to limit the impact of a successful traversal.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for arbitrary file interaction.

Analyst Recommendation

Given the high severity of this path traversal flaw, administrators should prioritize the deployment of security patches once released by the vendor. Until a fix is available, restrict access to the Dockge interface to trusted users only and enforce the principle of least privilege regarding the service account running the software.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when custom logit processing is enabled, due to unsafe Python object deserialization.

Executive Summary:
Unsafe deserialization in SGLangs allows unauthenticated attackers to execute arbitrary code remotely, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-7304

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: The application utilizes dill.loads() to deserialize Python objects without validation when the --enable-custom-logit-processor option is active, allowing an unauthenticated remote attacker to inject malicious payloads.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the ability for an attacker to achieve full remote code execution. This could lead to a complete compromise of the host system, theft of sensitive AI models, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Disable the --enable-custom-logit-processor option immediately if not strictly required, and update to the latest patched version.

Proactive Monitoring: Monitor server processes for unexpected child spawns or outbound connections originating from the runtime environment.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Network Intrusion Detection System (NIDS) to inspect and block malicious serialized object payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: eosphoros-ai
PRODUCT: DB-GPT
AFFECTED_VERSIONS: 0 through 0.8.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DB-GPT v0.8.1 is vulnerable to an unauthenticated path traversal attack that allows remote attackers to write arbitrary files to the server via the user_id HTTP header.

Executive Summary:
A critical unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to achieve remote code execution by writing arbitrary files to the server.

Vulnerability Details

CVE-ID: CVE-2026-73034

Affected Software: eosphoros-ai DB-GPT

Affected Versions: 0 through 0.8.1

Vulnerability: The application suffers from improper path validation (CWE-22) in the file-upload endpoint. An unauthenticated attacker can inject directory traversal sequences into the user_id HTTP header to escape the designated upload directory and overwrite sensitive system files.

Business Impact

The ability to write arbitrary files to the server, such as startup hooks or configuration files, results in full remote code execution. With a CVSS score of 9.8, this vulnerability allows total system compromise, leading to complete loss of confidentiality, integrity, and availability for the affected host.

Remediation Plan

Immediate Action: Apply the vendor-provided patch or update to the latest version identified in the project repository.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at file-upload endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences in headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical due to the lack of required authentication and the direct path to remote code execution.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Because it allows unauthenticated remote code execution, it should be treated as a top-priority remediation item. Ensure all public-facing instances are protected until updates are verified and applied.

---METADATA---
VENDOR: GramSearch
PRODUCT: telegram-search
AFFECTED_VERSIONS: 0 through 1.2.8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in GramSearch telegram-search allows remote attackers to execute arbitrary JavaScript by sending crafted messages containing unsanitized HTML.

Executive Summary:
A stored cross-site scripting vulnerability in GramSearch telegram-search could allow authenticated attackers to execute malicious scripts in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2026-73031

Affected Software: GramSearch telegram-search

Affected Versions: 0 through 1.2.8

Vulnerability: This vulnerability is a stored cross-site scripting flaw caused by improper neutralization of input in message handling. The vulnerability requires low privileges (authenticated) and user interaction to trigger the execution of arbitrary JavaScript.

Business Impact

The ability to execute arbitrary scripts in a victim's browser poses a significant risk to data confidentiality and session integrity. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information, justifying the high CVSS score of 8.7.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application logs for unusual message content or suspicious HTML tags being processed within Telegram group communications.

Compensating Controls: Implement or tune Content Security Policy (CSP) headers to restrict the execution of inline scripts and unauthorized external resources within the application interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of stored XSS, which can facilitate widespread impact across users of a shared group.

Analyst Recommendation

Given the high severity of this XSS vulnerability, administrators should prioritize the identification of affected instances. Until a formal patch is released, users should exercise extreme caution when interacting with message content from untrusted sources, and security teams should enforce strict CSP headers to mitigate potential script execution.

---METADATA---
VENDOR: frostming
PRODUCT: unearth
AFFECTED_VERSIONS: 0 through 0.18.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The unearth library is susceptible to a path traversal vulnerability via unnormalized paths and symlink escapes.

Executive Summary:
A path traversal vulnerability in the unearth library allows unauthenticated attackers to perform unauthorized file operations, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-73030

Affected Software: frostming unearth

Affected Versions: 0 through 0.18.2

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) that occurs when unnormalized paths are processed, allowing for symlink escapes by an unauthenticated attacker.

Business Impact

The CVSS score of 8.1 indicates a high-risk vulnerability that could allow attackers to read or write files outside of intended directories. This could lead to critical data compromise or system instability depending on the implementation of the library within the host application.

Remediation Plan

Immediate Action: Update the unearth library to the version containing the fix identified in commit 6c78164e7bfa28b8b3d6f247b87e560692e3c8ba.

Proactive Monitoring: Review application logs for unexpected file system access requests or directory traversal patterns.

Compensating Controls: Implement strict input validation and sanitization for all file paths processed by the library as a temporary measure.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ability to escape symlinks significantly increases the threat surface of this traversal vulnerability.

Analyst Recommendation

Developers and administrators should immediately update to the patched version of unearth to prevent potential exploitation. Given the nature of path traversal vulnerabilities, ensuring that user-supplied paths are strictly validated is essential to maintaining system security.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs runtime is vulnerable to an unauthenticated path traversal attack, allowing remote attackers to write arbitrary files to the server's filesystem.

Executive Summary:
Unauthenticated path traversal in the SGLangs runtime allows attackers to overwrite critical files, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7302

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: The application fails to validate filenames provided during upload, allowing the use of ../ sequences to traverse outside of intended directories and overwrite arbitrary system files.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an attacker to achieve code execution or denial of service by overwriting application binaries or configuration files. This represents a critical risk to the availability and integrity of the hosting server.

Remediation Plan

Immediate Action: Update to the latest version of SGLangs and implement strict path validation for file uploads.

Proactive Monitoring: Monitor filesystem integrity and alert on unauthorized write attempts to sensitive system directories.

Compensating Controls: Run the SGLangs service with the least privilege necessary, restricting its write access to specific, isolated directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: SGLangs
PRODUCT: Multimodal Generation Runtime
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The SGLangs scheduler binds its ROUTER socket to 0.0.0.0 and performs unsafe pickle deserialization on incoming messages, enabling unauthenticated remote code execution.

Executive Summary:
A critical vulnerability in the SGLangs runtime scheduler allows unauthenticated attackers to execute arbitrary code by sending malicious packets to the exposed ROUTER socket.

Vulnerability Details

CVE-ID: CVE-2026-7301

Affected Software: SGLangs Multimodal Generation Runtime

Affected Versions: See vendor advisory

Vulnerability: By binding to all interfaces and using pickle.loads() on untrusted input, the scheduler creates an exploitable attack surface for any remote actor capable of reaching the socket.

Business Impact

The CVSS score of 9.8 underscores the severity of this remote code execution flaw. If the service is exposed to the internet, it provides an immediate vector for full system compromise, data theft, and persistent unauthorized access.

Remediation Plan

Immediate Action: Bind the ROUTER socket to 'localhost' (127.0.0.1) and update to the latest patched version.

Proactive Monitoring: Use network monitoring tools to ensure the ROUTER socket is not accessible from external, untrusted networks.

Compensating Controls: Place the service behind a restrictive firewall or VPN, ensuring it is not reachable from the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Edge (Chromium-based)
AFFECTED_VERSIONS: 1.0.0.0 up to (excluding) 152.0.4191.53
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72984","name":"Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}]
---END_METADATA---

Description Summary:
A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code.

Executive Summary:
A critical type confusion vulnerability in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-72984

Affected Software: Microsoft Microsoft Edge (Chromium-based)

Affected Versions: 1.0.0.0 up to (excluding) 152.0.4191.53

Vulnerability: The software suffers from a type confusion flaw (CWE-843) that occurs when an application accesses a resource using an incompatible type. This vulnerability allows an unauthenticated attacker to execute code over a network by leveraging memory corruption.

Business Impact

The ability for an unauthorized remote attacker to execute arbitrary code represents a severe compromise of system integrity and confidentiality. Given the high CVSS score of 8.8, this flaw poses a significant risk of full system takeover, potential lateral movement within the network, and the exfiltration of sensitive data.

Remediation Plan

Immediate Action: Update Microsoft Edge (Chromium-based) to version 152.0.4191.53 or later immediately to resolve the memory corruption vulnerability.

Proactive Monitoring: Review browser logs and endpoint detection system alerts for unusual process execution patterns or unexpected browser crashes that may indicate exploitation attempts.

Compensating Controls: Implement browser-based security policies, such as disabling unnecessary plugins or restricting the execution of untrusted scripts, to reduce the attack surface until updates are applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Type confusion vulnerabilities in browser engines are highly technical and often targeted by sophisticated actors, so the lack of current public exploit data does not preclude the risk of future weaponization.

Analyst Recommendation

Due to the severity of this remote code execution flaw, organizations should prioritize patching all instances of Microsoft Edge to the remediated version. Security teams must ensure that automatic updates are enabled and verify compliance across all managed endpoints to mitigate the risk of exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Edge (Chromium-based)
AFFECTED_VERSIONS: 1.0.0.0 up to (excluding) 151.0.4129.86
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code via a crafted network request.

Executive Summary:
A critical heap-based buffer overflow in Microsoft Edge could allow an unauthenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-72970

Affected Software: Microsoft Edge (Chromium-based)

Affected Versions: 1.0.0.0 up to (excluding) 151.0.4129.86

Vulnerability: This is a heap-based buffer overflow (CWE-122) occurring within the browser's memory management. The vulnerability permits an unauthenticated attacker to trigger a crash or execute arbitrary code, requiring only user interaction to process malicious content.

Business Impact

The CVSS score of 8.3 reflects a high severity risk that could lead to full system compromise. Successful exploitation allows unauthorized actors to execute code with the privileges of the victim, potentially leading to data exfiltration, lateral movement within the network, and complete loss of system integrity.

Remediation Plan

Immediate Action: Update Microsoft Edge (Chromium-based) to version 151.0.4129.86 or later immediately to resolve the overflow vulnerability.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution patterns or abnormal browser crashes that may indicate exploitation attempts.

Compensating Controls: Deploy browser-based security policies that restrict loading of untrusted content and utilize endpoint detection and response (EDR) solutions to identify anomalous child process spawning.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly exploitable due to the nature of heap overflows in browsers, there is no evidence of weaponized code currently in the wild.

Analyst Recommendation

Given the high severity and the potential for remote code execution, organizations must prioritize patching all instances of Microsoft Edge. Ensure that automated update channels are functioning correctly and verify that the browser version is updated to 151.0.4129.86 across all enterprise environments to mitigate this risk.