Executive Summary:
A critical vulnerability, identified as CVE-2025-0603, has been discovered in Callvision Healthcare's Callvision Emergency Code and potentially other products. This flaw, a severe SQL Injection, allows an unauthenticated attacker to manipulate the application's database, potentially leading to the theft, modification, or deletion of highly sensitive data. Due to its critical CVSS score of 9.8, immediate remediation is required to prevent a significant data breach.

Vulnerability Details

CVE-ID: CVE-2025-0603

Affected Software: Callvision Healthcare Callvision Emergency Code (and potentially other products)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The application fails to properly sanitize user-supplied input before using it in a database query. An attacker can exploit this by crafting input that includes malicious SQL commands, which are then executed by the back-end database, allowing for both standard and blind SQL injection techniques. This could enable an attacker to bypass authentication controls, read sensitive data from the database, modify or delete data, and in some cases, execute administrative commands on the database server.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation could have devastating consequences for the organization. An attacker could gain unauthorized access to and exfiltrate sensitive data, which in a healthcare context, likely includes Protected Health Information (PHI). This could lead to severe regulatory penalties (e.g., under HIPAA), significant reputational damage, and loss of customer trust. Furthermore, the ability to modify or delete data within an "Emergency Code" system could disrupt critical healthcare operations, potentially impacting patient safety.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor. Update Callvision Healthcare Callvision Emergency Code and any other affected products to the latest patched version immediately. After patching, it is crucial to monitor for any signs of exploitation that may have occurred prior to remediation by reviewing web server and database access logs for suspicious activity.

Proactive Monitoring: Implement enhanced monitoring of web application and database logs. Look for anomalous SQL queries, especially those containing keywords like UNION, SELECT, SLEEP, '--, or ' OR '1'='1'. Monitor for unusual outbound network traffic from the database server, which could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, implement the following controls to mitigate risk:

• Deploy a Web Application Firewall (WAF) with a ruleset configured to detect and block SQL injection attempts.
• Restrict access to the application and its database at the network level, allowing connections only from trusted IP addresses.
• Ensure the application's database service account is configured with the principle of least privilege, limiting its ability to read from non-essential tables or perform destructive actions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, Oct 7, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, SQL injection vulnerabilities are well-understood and exploits can be developed rapidly by threat actors. Organizations should assume that this vulnerability will be targeted due to its high severity.

Analyst Recommendation
Given the critical 9.8 CVSS score and the potential for a catastrophic data breach involving sensitive healthcare information, this vulnerability represents a severe risk to the organization. We strongly recommend that all affected Callvision Healthcare products are patched on an emergency basis. Although this CVE is not currently listed on the CISA KEV list, its critical nature makes it a prime candidate for future inclusion and a high-priority target for attackers. Immediate action to patch, monitor, and apply compensating controls is essential to protect the organization's data and operational integrity.

Executive Summary:
A high-severity security vulnerability in HCL Compass allows an attacker to gain unauthorized access to the underlying database, risking the confidentiality and integrity of all stored data.

Vulnerability Details

CVE-ID: CVE-2025-0280

Affected Software: HCL Compass

Affected Versions: See vendor advisory for affected versions

Vulnerability: The application contains an unspecified vulnerability that can be exploited by an attacker to bypass security controls and directly access the database. This likely stems from a flaw such as SQL Injection or an insecure direct object reference, which could be leveraged by an unauthenticated or low-privileged authenticated attacker.

Business Impact

Rated as High with a CVSS score of 7.5, this vulnerability poses a direct threat to the data managed by HCL Compass. Successful exploitation could allow an attacker to read, modify, or delete any information in the database, including project data, user credentials, and proprietary information. This could lead to intellectual property theft, operational disruption, and a severe data breach.

Remediation Plan

Immediate Action: Apply the vendor-supplied security updates for HCL Compass immediately. Restrict network access to the database server, allowing connections only from the HCL Compass application server.

Proactive Monitoring: Enable and review detailed database audit logs for unauthorized access, unusual queries, or connections originating from unexpected sources. Monitor application logs for errors that might indicate SQL injection attempts.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) or a database activity monitoring (DAM) solution to detect and block malicious queries targeting the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 4, 2025, there is no public information indicating active exploitation of this vulnerability. However, direct database access vulnerabilities are highly sought after by attackers due to the high value of the potential data yield.

Analyst Recommendation

The risk of unauthorized database access makes this a critical vulnerability to address. The potential for complete data compromise requires that administrators prioritize the installation of the vendor-provided patch without delay. Securing the database is paramount to protecting the organization's sensitive project and operational data.

Executive Summary:
A high-severity vulnerability, identified as CVE-2025-0084, has been discovered in multiple products from various vendors. This flaw is a memory corruption issue that could allow a remote attacker to execute arbitrary code on an affected system, potentially leading to a full system compromise. Organizations are urged to apply vendor-supplied security patches immediately to mitigate the significant risk of data theft, system takeover, or service disruption.

Vulnerability Details

CVE-ID: CVE-2025-0084

Affected Software: multiple Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Use-After-Free (UAF) condition. The flaw occurs when an application continues to use a pointer to a memory location after that memory has been deallocated or "freed." An attacker can exploit this by crafting specific input that causes the application to write data to this now-invalid memory location. This can corrupt valid data, cause the application to crash (Denial of Service), or, in a worst-case scenario, overwrite a function pointer to redirect program execution, allowing the attacker to run arbitrary code with the privileges of the affected application.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Successful exploitation could have a significant negative impact on business operations. An attacker who executes arbitrary code could gain complete control over the affected system, leading to the theft of sensitive corporate or customer data (loss of confidentiality), unauthorized modification of critical information (loss of integrity), and system-wide outages (loss of availability). Depending on the function of the affected product, this could result in regulatory fines, reputational damage, financial loss, and disruption of critical business processes.

Remediation Plan

Immediate Action: Apply vendor security updates immediately across all affected systems. Prioritize patching for internet-facing systems and those hosting critical data or services. After patching, continue to monitor for any signs of compromise and review system and application access logs for suspicious activity preceding the patch deployment.

Proactive Monitoring: Implement enhanced monitoring to detect potential exploitation attempts. Security teams should look for:

• Log Analysis: Unexpected application crashes or error messages in system event logs related to the affected software.
• Network Traffic: Unusual outbound connections from affected systems, which could indicate command-and-control (C2) communication or data exfiltration.
• Endpoint Behavior: Utilize Endpoint Detection and Response (EDR) tools to monitor for anomalous process creation, memory allocation patterns, or suspicious child processes spawned by the vulnerable application.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Network Segmentation: Isolate affected systems from the internet and other critical network segments to limit their exposure.
• Access Control: Restrict access to the affected application or service to only trusted users and systems.
• Intrusion Prevention System (IPS): Deploy virtual patching rules or generic exploit-prevention signatures on an IPS to block traffic patterns associated with exploiting memory corruption vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 27, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and the common nature of use-after-free vulnerabilities, it is highly probable that threat actors will develop exploits in the near future. Organizations should operate under the assumption that an exploit is imminent.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability poses a critical risk to the organization. The immediate priority must be to identify all affected assets and deploy the necessary vendor patches without delay. While CVE-2025-0084 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a likely candidate for future inclusion. We strongly recommend treating this vulnerability with the highest urgency, prioritizing the patching of critical and internet-exposed systems to prevent potential compromise.

Executive Summary:
A high-severity vulnerability has been identified in multiple products from the vendor "In". This flaw exists in the component responsible for processing DNG image files and could allow an attacker to execute malicious code on a user's system if they open a specially crafted image, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-0081

Affected Software: In Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the dng_lossless_decoder::HuffDecode function, which is part of the library responsible for processing lossless JPEG compression in DNG (Digital Negative) image files. An attacker can create a malicious DNG file with malformed Huffman-coded data. When an application using the vulnerable library attempts to open or process this file, it can trigger a memory corruption error, such as a buffer overflow, leading to arbitrary code execution in the security context of the user running the application.

Business Impact

This is a high-severity vulnerability with a CVSS score of 7.5. Successful exploitation could allow an attacker to take control of an affected system, leading to significant business risks. These risks include the theft of sensitive corporate or personal data, the installation of persistent malware like ransomware or spyware, and the disruption of critical business operations that rely on the compromised system. The impact is particularly high for workstations involved in media processing, design, or photography where the handling of DNG files is common.

Remediation Plan

Immediate Action: The primary remediation step is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to monitor systems for any signs of post-patch exploitation attempts and to review relevant application and system logs for indicators of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Monitor for unexpected crashes in applications that process DNG files. Security teams should look for anomalous process creation originating from these applications, especially child processes like command shells or PowerShell. Network monitoring should be used to detect unusual outbound connections from workstations after a user interacts with a DNG image file.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Block the receipt of DNG files from untrusted or external sources at the email gateway and other ingress points.
• Use application control solutions (e.g., AppLocker) to prevent the execution of unauthorized code.
• Ensure Endpoint Detection and Response (EDR) solutions are deployed and configured to detect and block memory exploitation techniques and suspicious process behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 27, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, memory corruption vulnerabilities are frequently targeted by threat actors, and a proof-of-concept exploit could be developed quickly.

Analyst Recommendation

Due to the high severity rating (CVSS 7.5) and the potential for arbitrary code execution through a common file type, we strongly recommend that organizations prioritize the immediate deployment of vendor-supplied security patches. Although this CVE is not currently on the CISA KEV list, the risk of future exploitation is significant. Organizations should identify all systems running the affected software components, apply the necessary updates as soon as possible, and verify that the patches have been successfully installed.

Executive Summary:
A critical use-after-free vulnerability, identified as CVE-2025-0075, has been discovered in multiple products from the vendor "In". This flaw, with a CVSS score of 9.8, can be exploited by a remote, unauthenticated attacker to execute arbitrary code on an affected system. Successful exploitation could lead to a complete system compromise, posing a severe risk to confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2025-0075

Affected Software: In Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a use-after-free condition located in the process_service_search_attr_req function of the Service Discovery Protocol (SDP) server component (sdp_server.cc). An unauthenticated remote attacker can exploit this flaw by sending a specially crafted service search attribute request to the affected SDP service. This malicious request triggers the premature freeing of a memory allocation, which is later accessed by the application, leading to memory corruption that can be leveraged to achieve arbitrary code execution with the privileges of the target service.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation by a remote attacker could lead to a full system compromise, resulting in significant business impact. Potential consequences include the theft of sensitive corporate or customer data, deployment of ransomware, disruption of critical services, and using the compromised system as a foothold to launch further attacks against the internal network. The lack of any requirement for authentication or user interaction makes this an easily exploitable and highly dangerous vulnerability.

Remediation Plan

Immediate Action: Update In Multiple Products to the latest version. Organizations must consult the vendor's security advisory to identify the specific patch details applicable to their environment. After patching, it is essential to monitor for any post-remediation exploitation attempts and review relevant system and access logs for indicators of compromise.

Proactive Monitoring:

• Monitor network traffic for unusual or malformed requests to the Service Discovery Protocol (SDP) service.
• Use Endpoint Detection and Response (EDR) solutions to monitor for anomalous process behavior, such as the SDP server process crashing or spawning unexpected child processes (e.g., command shells).
• Review system logs for errors or crashes related to the sdp_server component.

Compensating Controls:

• If patching is not immediately possible, restrict network access to the affected SDP service from untrusted networks using a firewall.
• Implement network segmentation to isolate vulnerable systems and prevent potential lateral movement from a compromised host.
• Disable the SDP service on systems where it is not a business-critical function.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 26, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and the potential for remote code execution, security researchers and threat actors are likely to develop exploit code in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the potential for remote code execution without user interaction, this vulnerability requires immediate attention. We strongly recommend that all organizations identify affected assets and apply the vendor-provided patches on an emergency basis. Although CVE-2025-0075 is not currently on the CISA KEV list, its high impact and low attack complexity make it a prime target for future exploitation. If patching cannot be performed immediately, implement the suggested compensating controls to reduce the attack surface and mitigate risk.

Executive Summary:
A critical use-after-free vulnerability, identified as CVE-2025-0074, has been discovered in multiple products from the vendor "In". This flaw allows a remote, unauthenticated attacker to execute arbitrary code on an affected system, potentially leading to a full system compromise without any user interaction. Due to its critical severity and the potential for remote exploitation, immediate remediation is strongly advised.

Vulnerability Details

CVE-ID: CVE-2025-0074

Affected Software: In Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a use-after-free condition located in the process_service_attr_rsp function of the sdp_discovery.cc source file. This function is responsible for processing Service Discovery Protocol (SDP) attribute responses, likely within a Bluetooth stack. An unauthenticated attacker within proximity (e.g., Bluetooth range) can send a specially crafted SDP response to a vulnerable device, causing the application to use a pointer to memory that has already been deallocated. By controlling the data subsequently written to this memory location, the attacker can hijack the program's execution flow, resulting in remote code execution.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. Successful exploitation allows a remote attacker to gain complete control over an affected device, compromising its confidentiality, integrity, and availability. The potential consequences include theft of sensitive data, deployment of malware such as ransomware or spyware, disruption of business operations, and using the compromised system as a pivot point to attack other internal network resources. The lack of required user interaction or authentication lowers the bar for a successful attack significantly.

Remediation Plan

Immediate Action: Prioritize the deployment of vendor-supplied patches. Update all instances of "In Multiple Products" to the latest version immediately. Refer to the official vendor security advisory for specific patch information and detailed instructions for affected product lines.

Proactive Monitoring: Implement enhanced monitoring for anomalous Bluetooth traffic, specifically looking for malformed or unexpected SDP attribute responses. On host systems, monitor for crashes in Bluetooth-related services, unexpected process execution, and unauthorized system modifications. Review system and application logs for any errors or warnings related to the sdp_discovery function.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Disable Bluetooth functionality on devices where it is not essential for business operations.
• Implement network segmentation to limit the exposure of vulnerable services to untrusted devices.
• Deploy host-based intrusion prevention systems (HIPS) to detect and block memory corruption exploitation techniques.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 26, 2025, there is no known public proof-of-concept exploit code, and no active exploitation has been observed in the wild. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and potential for remote code execution, it is highly likely to be targeted by threat actors in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability must be treated with the highest priority. We strongly recommend that organizations identify all affected assets and apply the necessary security updates immediately. While there is no current evidence of active exploitation or inclusion in the CISA KEV catalog, the severity of this flaw makes proactive remediation essential to prevent a potential system compromise. If patching cannot be performed immediately, apply the suggested compensating controls to mitigate the immediate risk.

---METADATA---
VENDOR: Eclipse Foundation
PRODUCT: GlassFish
AFFECTED_VERSIONS: 6.2.5
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
Eclipse GlassFish version 6.2.5 is susceptible to Server Side Request Forgery (SSRF) via specific endpoints, potentially allowing attackers to interact with internal network resources.

Executive Summary:
A critical Server Side Request Forgery (SSRF) vulnerability in Eclipse GlassFish 6.2.5 enables attackers to potentially access unauthorized internal services.

Vulnerability Details

CVE-ID: CVE-2024-9408

Affected Software: Eclipse Foundation GlassFish

Affected Versions: 6.2.5

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in specific endpoints, allowing unauthenticated attackers to force the server to make unauthorized requests to internal resources.

Business Impact

Successful exploitation of this SSRF vulnerability could allow an attacker to bypass firewalls, probe internal network services, or access sensitive metadata services that are otherwise unreachable from the internet. Given the critical CVSS score of 9.8, this flaw represents a significant risk to the confidentiality and integrity of the internal network architecture.

Remediation Plan

Immediate Action: As no specific fix version is currently listed, administrators should restrict access to the GlassFish administration interface to trusted networks only.

Proactive Monitoring: Review web server and application logs for anomalous requests to internal IP addresses or unusual outbound traffic patterns originating from the GlassFish server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect requests targeting vulnerable endpoints and prevent unauthorized outbound connections.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of a confirmed patch necessitates strict network segmentation until the vendor provides a remediation path.

Analyst Recommendation

Organizations should immediately isolate the affected GlassFish instances from public-facing networks. Monitor for upcoming vendor security updates and apply them as soon as they become available to eliminate the SSRF risk.

---METADATA---
VENDOR: Eclipse Foundation
PRODUCT: GlassFish
AFFECTED_VERSIONS: 5.1.0, 6.0.0 through 6.2.5, 7.0.0 through 7.0.25, 7.1.0, 8.0.0 up to 8.0.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Eclipse GlassFish versions up to 8.0.3 are vulnerable to login brute-force attacks due to the lack of rate limiting or account lockout mechanisms for failed authentication attempts.

Executive Summary:
A critical lack of authentication rate limiting in Eclipse GlassFish allows for prolonged brute-force attacks against administrative or user accounts.

Vulnerability Details

CVE-ID: CVE-2024-9342

Affected Software: Eclipse Foundation GlassFish

Affected Versions: 5.1.0, 6.0.0-6.2.5, 7.0.0-7.0.25, 7.1.0, and 8.0.0 prior to 8.0.3.

Vulnerability: This vulnerability (CWE-307) stems from an improper restriction of excessive authentication attempts, allowing unauthenticated attackers to perform unlimited login attempts against the system.

Business Impact

The absence of brute-force protection significantly increases the risk of unauthorized account access through credential stuffing or dictionary attacks. If successful, an attacker could gain administrative control over the application server, leading to full system compromise, data theft, or service disruption, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Implement account lockout policies or rate-limiting at the Web Application Firewall (WAF) or load balancer level to mitigate brute-force attempts.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts from single or multiple IP addresses.

Compensating Controls: Enforce Multi-Factor Authentication (MFA) for all administrative interfaces to render brute-force attacks ineffective even if a password is guessed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently easy to exploit given the lack of standard defensive controls.

Analyst Recommendation

While waiting for a vendor-supplied patch, organizations must deploy compensating controls such as WAF-based rate limiting or MFA to protect against brute-force attacks. Securing the authentication entry point is of the highest priority to prevent unauthorized access.

Executive Summary:
A high-severity memory corruption vulnerability has been identified in Google Chrome on iOS devices. This flaw, known as a "Use after free," could allow a remote attacker to execute arbitrary code or cause a crash by tricking a user into visiting a specially crafted webpage. Successful exploitation could lead to the compromise of the affected iPhone or iPad, potentially resulting in data theft or unauthorized access to sensitive information.

Vulnerability Details

CVE-ID: CVE-2024-9126

Affected Software: Google Multiple Products

Affected Versions: Google Chrome on iOS versions prior to 127

Vulnerability: The vulnerability is a Use-After-Free (UAF) condition within the "Internals" component of Google Chrome. A UAF flaw occurs when a program continues to use a pointer to a memory location after that memory has been deallocated or "freed." An attacker can exploit this by crafting a malicious webpage that triggers this specific memory handling error. By manipulating the freed memory space before the application attempts to use it again, the attacker can overwrite legitimate data with malicious code, leading to arbitrary code execution within the security context of the Chrome browser.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Exploitation could have a significant business impact, particularly in organizations with a mobile workforce or Bring-Your-Own-Device (BYOD) policies. If an employee using an unpatched version of Chrome on an iPhone or iPad visits a malicious website, their device could be compromised. This could lead to the theft of sensitive corporate data stored on the device, interception of communications, unauthorized access to internal networks, or the device being used as a pivot point for further attacks against the organization.

Remediation Plan

Immediate Action: All instances of Google Chrome on corporate-managed and personal (BYOD) iOS devices must be updated to version 127 or later immediately. Use Mobile Device Management (MDM) solutions to enforce the update across the fleet. Concurrently, security teams should monitor for any signs of exploitation attempts by reviewing network logs for connections to suspicious domains and endpoint logs for anomalous browser behavior.

Proactive Monitoring: Implement enhanced monitoring for mobile devices. Look for unusual network traffic patterns originating from iPhones and iPads, particularly unexpected data exfiltration or communication with known command-and-control (C2) servers. Monitor for an increase in Chrome application crashes on iOS devices, as this can be an indicator of failed exploitation attempts.

Compensating Controls: If immediate patching is not feasible, consider the following controls:

• Utilize web filtering and DNS protection services to block access to known malicious and uncategorized websites.
• Enforce policies that restrict access to sensitive corporate resources from unpatched mobile devices.
• Increase user awareness through a security advisory, warning employees to be cautious of unsolicited links in emails and messages.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 14, 2025, there is no public proof-of-concept exploit code available for this vulnerability, and it has not been reported as being actively exploited in the wild. However, memory corruption vulnerabilities in widely-used web browsers are highly attractive targets for threat actors, and it is likely that exploitation techniques will be developed.

Analyst Recommendation

Given the high severity (CVSS 7.5) and the widespread use of Google Chrome on iOS, this vulnerability presents a significant risk to the organization. The ease of exploitation—requiring only that a user visit a malicious webpage—increases the urgency for remediation. We strongly recommend prioritizing the immediate deployment of the security update for Google Chrome to version 127 or newer on all managed and BYOD iOS devices. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion should it be exploited in the wild. Swift and comprehensive patching is the most effective defense.

---METADATA---
VENDOR: Ivanti
PRODUCT: vTM (Virtual Traffic Manager)
AFFECTED_VERSIONS: All versions other than 22.2R1 or 22.7R2
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in the Ivanti vTM admin panel allows remote unauthenticated attackers to gain unauthorized administrative access.

Executive Summary:
Ivanti vTM is affected by a critical authentication bypass vulnerability that is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2024-7593

Affected Software: Ivanti vTM

Affected Versions: All versions other than 22.2R1 or 22.7R2

Vulnerability: This vulnerability stems from an incorrect implementation of the authentication algorithm within the admin panel, enabling remote unauthenticated attackers to bypass security controls entirely.

Business Impact

Successful exploitation grants an attacker full administrative control over the Ivanti vTM appliance. Given the CVSS score of 9.8 and confirmed active exploitation, the risk of total system compromise, data exfiltration, and lateral movement within the network is extreme. Failure to remediate immediately could lead to a catastrophic security breach.

Remediation Plan

Immediate Action: Upgrade to version 22.2R1 or 22.7R2 immediately as per vendor instructions.

Proactive Monitoring: Review administrative access logs for unusual login patterns or unauthorized source IPs accessing the management interface.

Compensating Controls: Restrict access to the vTM management interface to trusted management networks or VPNs only, and implement strict egress filtering.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Aug 13, 2024, this vulnerability is confirmed to be under active exploitation in the wild. Organizations must prioritize this patch above all other non-critical maintenance tasks.

Analyst Recommendation

The severity of this vulnerability, combined with confirmed active exploitation, necessitates immediate action. Administrators must verify their versioning and apply the provided security patches without delay to prevent unauthorized administrative access to critical infrastructure.

Executive Summary:
A high-severity vulnerability, identified as CVE-2024-7017, has been discovered in the DevTools component of Google Chrome. This flaw, resulting from an inappropriate implementation, could allow a remote attacker to compromise a user's browser by tricking them into visiting a malicious website. Successful exploitation could lead to data theft, session hijacking, or further system compromise, posing a significant risk to organizational data and security.

Vulnerability Details

CVE-ID: CVE-2024-7017

Affected Software: Google Multiple Products

Affected Versions: Google Chrome versions prior to 126. See vendor advisory for other affected Chromium-based products.

Vulnerability: The vulnerability is an "Inappropriate implementation" flaw within the Developer Tools (DevTools) component of Google Chrome. An attacker can exploit this by crafting a malicious webpage that, when visited by a user, triggers the logical flaw in the DevTools component. This could potentially lead to a sandbox escape, universal cross-site scripting (UXSS), or other high-impact scenarios, allowing the attacker to execute arbitrary code or access sensitive information within the context of the user's browser.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could have a significant business impact, including the compromise of user credentials, theft of sensitive corporate data stored in or accessed via the browser (e.g., cookies, session tokens, autofill data), and unauthorized access to internal web applications. An attacker could leverage a compromised browser as an initial access point to pivot deeper into the corporate network, potentially leading to a wider data breach, malware infection, or ransomware deployment.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. All instances of Google Chrome and other affected Chromium-based browsers (e.g., Microsoft Edge, Brave, Opera) must be updated to version 126 or later across all enterprise endpoints. After patching, monitor for any signs of post-compromise activity by reviewing access logs and endpoint security alerts.

Proactive Monitoring: Security teams should monitor for suspicious activity related to browser processes. This includes observing for unusual network connections originating from chrome.exe (or equivalent processes), unexpected child processes being spawned by the browser, and alerts from Endpoint Detection and Response (EDR) systems indicating potential process injection or sandbox escape attempts. Review web proxy logs for connections to uncategorized or known malicious domains.

Compensating Controls: If immediate patching is not feasible, organizations can implement compensating controls to reduce risk. Enforce strict web filtering to block access to untrusted and malicious websites. If not required for business operations, consider using enterprise policies (e.g., Group Policy) to disable access to Developer Tools for standard users. Ensure EDR and antivirus solutions are up-to-date and configured to detect and block anomalous browser behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 14, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, vulnerabilities in widely-used software like Google Chrome are high-value targets for threat actors. It is highly probable that proof-of-concept exploits will be developed, increasing the likelihood of future exploitation.

Analyst Recommendation

Given the high severity (CVSS 7.5) of this vulnerability and the ubiquitous nature of Google Chrome in enterprise environments, immediate patching is strongly recommended. Although CVE-2024-7017 is not currently on the CISA KEV list, its potential impact on confidentiality and integrity makes it a critical vulnerability to address. Organizations must prioritize the deployment of the security update across all managed endpoints to prevent potential data breaches, credential theft, and system compromise. The patch and remediation plan should encompass all Chromium-based browsers in use within the environment, not just Google Chrome.

---METADATA---
VENDOR: WordPress
PRODUCT: Notifications for Forms & WordPress Actions
AFFECTED_VERSIONS: 0 up to (excluding) 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Notifications for Forms & WordPress Actions plugin allows authenticated users to access or manipulate restricted files.

Executive Summary:
An authenticated path traversal vulnerability in the Notifications for Forms & WordPress Actions plugin could allow attackers to gain unauthorized access to sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2024-6228

Affected Software: WordPress Notifications for Forms & WordPress Actions

Affected Versions: 0 up to (excluding) 2.6

Vulnerability: The plugin fails to properly validate pathnames, leading to a path traversal vulnerability. An attacker with authenticated access (typically subscriber level or higher) can leverage this flaw to escape the intended directory and access sensitive system files.

Business Impact

Exploitation of this vulnerability could lead to the exposure of sensitive configuration files, database credentials, or source code, resulting in total system compromise. With a CVSS score of 7.5, the impact is severe, as it enables lateral movement and further exploitation within the WordPress environment.

Remediation Plan

Immediate Action: Update the "Notifications for Forms & WordPress Actions" plugin to version 2.6 or later immediately.

Proactive Monitoring: Review web server access logs for directory traversal patterns (e.g., ../../) targeting the plugin's directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets to block path traversal attempts targeting the WordPress installation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must verify the version of the installed plugin and apply updates immediately. Given the potential for full system compromise, this should be treated as a high-priority maintenance task.

Executive Summary:
A critical authentication bypass vulnerability has been identified in multiple products, including Canonical MAAS. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the affected system, potentially leading to a complete compromise of the managed infrastructure. Due to the high severity and the potential for full system takeover, immediate remediation is strongly recommended.

Vulnerability Details

CVE-ID: CVE-2024-6107

Affected Software: Due to insufficient Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to insufficient verification of client requests. An unauthenticated attacker can craft a malicious client request to the RPC (Remote Procedure Call) endpoint. Because the server fails to properly validate the authenticity of the request, it bypasses standard authentication checks, allowing the attacker to execute privileged RPC commands within a MAAS region, effectively granting them administrative control.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.6. Successful exploitation would have a catastrophic business impact, as it allows for a complete takeover of the MAAS environment. An attacker could provision, de-provision, or reconfigure physical servers, leading to widespread service outages, deployment of ransomware, theft of sensitive data stored on managed systems, and a complete loss of integrity and availability for the organization's core infrastructure.

Remediation Plan

Immediate Action: Update Due to insufficient Multiple Products to the latest version. The vendor has released patches that address this vulnerability by implementing proper verification checks. After patching, monitor for exploitation attempts and review access logs for any anomalous RPC command executions that may have occurred before the update was applied.

Proactive Monitoring: Organizations should enhance monitoring of MAAS region controllers. Specifically, monitor network traffic for malformed or unusual RPC requests. Review MAAS application logs for any command executions originating from unexpected or unauthenticated sources and set up alerts for high-privilege operations that do not correlate with scheduled administrative tasks.

Compensating Controls: If patching is not immediately possible, restrict network access to the MAAS API and RPC endpoints to only trusted IP addresses using strict firewall rules. Consider deploying an Intrusion Prevention System (IPS) or a Web Application Firewall (WAF) with signatures capable of detecting and blocking requests that attempt to exploit this authentication bypass.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 21, 2025, there is no known public exploit code available for this vulnerability. However, given the nature of an authentication bypass, it is highly probable that threat actors will develop exploits rapidly. Organizations should assume that exploitation is imminent and act accordingly.

Analyst Recommendation

This vulnerability represents a critical risk to the organization. We strongly recommend prioritizing the deployment of the vendor-provided security updates across all affected systems immediately. The CVSS score of 9.6 indicates that minimal skill is required for exploitation, and the impact is severe. Although CVE-2024-6107 is not currently on the CISA KEV list, its critical nature warrants treatment as a top-priority patch to prevent a potential infrastructure-wide compromise.

Executive Summary:
A critical vulnerability has been identified in the h2oai/h2o-3 data analysis platform, which allows a remote, unauthenticated attacker to write arbitrary files to the server. Successful exploitation could lead to remote code execution, granting the attacker complete control over the affected system, the ability to steal sensitive data, and pivot to other systems within the network.

Vulnerability Details

CVE-ID: CVE-2024-5986

Affected Software: h2oai/h2o-3

Affected Versions: Version 3.46.0.1 is confirmed to be vulnerable. See vendor advisory for a complete list of affected versions.

Vulnerability: This vulnerability is an arbitrary file write flaw that can be exploited through a two-step process. First, an attacker sends a specially crafted request to the /3/Parse API endpoint to create an in-memory data frame from an empty file, injecting malicious content into the frame's header. Second, the attacker uses the /3/Frames/framename/export endpoint to save this malicious frame to a file on the server's filesystem, specifying an arbitrary path and filename. This allows the attacker to overwrite critical system files, such as SSH authorized keys (~/.ssh/authorized_keys), web application scripts, or system cron jobs, leading to remote code execution.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.1. Exploitation could lead to a complete compromise of the server hosting the h2o-3 software. The potential business impact is severe, including theft of sensitive corporate or customer data processed by the platform, reputational damage, and significant operational disruption. An attacker with full system access could also use the compromised server as a foothold to launch further attacks against the internal network, escalating the scope of the breach.

Remediation Plan

Immediate Action: Immediately apply the security patch provided by the vendor. The primary remediation is to update the h2oai/h2o-3 software to the latest version that addresses this vulnerability. After patching, review system logs for any signs of compromise prior to the update.

Proactive Monitoring: Security teams should actively monitor web server and application logs for suspicious POST requests to the /3/Parse and /3/Frames/{frame_name}/export endpoints. Monitor for unexpected file modifications or creations in sensitive directories, particularly application directories, user home directories (e.g., .ssh/), and system script locations (e.g., /etc/cron.d/).

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Use a firewall or reverse proxy to restrict network access to the h2o-3 instance, allowing connections only from trusted IP addresses.
• Run the h2o-3 service with a dedicated, low-privilege user account to limit the impact of a file-write, preventing the overwrite of critical system-level files.
• Deploy a Web Application Firewall (WAF) with rules to block or alert on requests containing suspicious path traversal sequences or filenames targeting the vulnerable API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date (Feb 2, 2026), there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to its critical severity and the low complexity of exploitation, it is highly likely that threat actors will develop and use exploits in the near future. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical 9.1 CVSS score and the potential for complete system compromise, immediate remediation is strongly recommended. Organizations must prioritize patching all vulnerable h2o-3 instances without delay. The risk of remote code execution represents a direct and severe threat to the confidentiality, integrity, and availability of the affected system and the data it processes. Even in the absence of known exploits, the severity of this vulnerability warrants urgent attention.

---METADATA---
VENDOR: Eliz Software
PRODUCT: Eliz Software Panel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Eliz Software Panel is vulnerable to SQL injection, which can be leveraged to achieve arbitrary command line execution on the underlying host.

Executive Summary:
An SQL injection vulnerability in the Eliz Software Panel enables attackers to execute arbitrary commands, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2024-5958

Affected Software: Eliz Software Panel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the improper neutralization of special elements within SQL commands. By injecting malicious SQL syntax, an attacker can manipulate database queries to achieve command line execution, bypassing standard application security controls.

Business Impact

The CVSS score of 8.8 reflects the high risk of this vulnerability. Successful exploitation permits an attacker to execute OS-level commands, leading to data exfiltration, unauthorized modification of records, and total compromise of the server hosting the software panel.

Remediation Plan

Immediate Action: Apply all available security patches provided by Eliz Software immediately to remediate the SQL injection flaw.

Proactive Monitoring: Enable detailed database query logging and monitor for unusual execution patterns or system calls originating from the database service.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection remains a primary vector for system compromise. It is imperative to apply vendor-supplied patches immediately and conduct a thorough security audit of all database-interacting components to ensure no additional injection points exist.

---METADATA---
VENDOR: SurrealDB
PRODUCT: SurrealDB
AFFECTED_VERSIONS: 0 up to (excluding) 1.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SurrealDB versions prior to 1.1.0 are susceptible to a denial of service vulnerability caused by an uncaught exception during HTTP header processing.

Executive Summary:
A denial of service vulnerability in SurrealDB allows unauthenticated attackers to crash the service via specially crafted HTTP headers.

Vulnerability Details

CVE-ID: CVE-2024-58368

Affected Software: SurrealDB SurrealDB

Affected Versions: 0 up to (excluding) 1.1.0

Vulnerability: The application is vulnerable to an uncaught exception (CWE-248) when processing specific HTTP headers. This flaw is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation results in service unavailability, which directly impacts business continuity for applications relying on the database. With a CVSS score of 7.5, this high severity vulnerability poses a significant risk to system uptime and stability if left unpatched.

Remediation Plan

Immediate Action: Update SurrealDB to version 1.1.0 or later to include the necessary exception handling fixes.

Proactive Monitoring: Monitor server logs and service health metrics for unexpected restarts or crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and sanitize incoming HTTP headers, blocking requests that exhibit anomalous patterns or malformed structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to cause a crash without requiring authentication.

Analyst Recommendation

Given the high impact on service availability, organizations should prioritize upgrading their SurrealDB instances to version 1.1.0 immediately. Ensuring the database remains stable and resilient against remote crashes is critical for maintaining overall infrastructure integrity.

---METADATA---
VENDOR: SurrealDB
PRODUCT: surrealdb
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SurrealDB contains an improper authorization vulnerability that allows authenticated users with low privileges to access sensitive data through improper select permissions.

Executive Summary:
An improper authorization vulnerability in SurrealDB versions prior to 2.0.4 allows authenticated users to potentially access unauthorized data.

Vulnerability Details

CVE-ID: CVE-2024-58367

Affected Software: SurrealDB surrealdb

Affected Versions: 0 up to (excluding) 2.0.4

Vulnerability: The software suffers from an improper authorization flaw (CWE-285), which can be exploited by an authenticated attacker to perform unauthorized data selection operations. The attack vector is network-based and requires low-level privileges.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information stored within the SurrealDB instance. With a CVSS score of 7.1, this flaw presents a high risk to data confidentiality, potentially impacting compliance and internal data security policies.

Remediation Plan

Immediate Action: Update the SurrealDB package to version 2.0.4 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review database access logs for unusual query patterns or unauthorized attempts to access tables or records outside of a user's typical scope.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and follow the principle of least privilege to limit the impact of potential authorization bypasses.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The issue is specific to the handling of permission checks during select operations.

Analyst Recommendation

Administrators should treat this vulnerability with high priority by scheduling an update to version 2.0.4 at the earliest opportunity. Ensuring that the database engine is patched is the most effective way to eliminate the risk of unauthorized data access.

---METADATA---
VENDOR: SurrealDB
PRODUCT: SurrealDB
AFFECTED_VERSIONS: 0 up to 1.1.1 (excluding 0.4.2)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SurrealDB is affected by a format string vulnerability that allows authenticated users to execute arbitrary code via scripting functions.

Executive Summary:
A high-severity format string vulnerability in SurrealDB allows authenticated attackers to execute arbitrary code, threatening complete system compromise.

Vulnerability Details

CVE-ID: CVE-2024-58366

Affected Software: SurrealDB SurrealDB

Affected Versions: 0 up to 1.1.1 (excluding 0.4.2)

Vulnerability: The software contains a format string vulnerability (CWE-134) in its scripting functions. This flaw requires that an attacker have low-level privileges to successfully interact with the vulnerable function.

Business Impact

With a CVSS score of 8.5, this vulnerability represents a significant threat to organizational security. Successful exploitation grants an attacker the ability to execute code on the database server, which could lead to full database compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update SurrealDB to version 1.1.1 immediately to resolve the vulnerable scripting function implementation.

Proactive Monitoring: Audit database logs for unusual scripting activity or unexpected function calls that deviate from standard operational patterns.

Compensating Controls: Restrict access to database scripting features to only trusted and necessary service accounts, and ensure the database runs in a hardened, least-privilege environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which limits the initial attack surface to internal or compromised accounts.

Analyst Recommendation

The severity of this flaw demands immediate attention. Administrators must upgrade to the specified patch version to prevent potential remote code execution and maintain the security posture of their database infrastructure.

---METADATA---
VENDOR: SurrealDB
PRODUCT: SurrealDB
AFFECTED_VERSIONS: 0 up to (excluding) 1.5.5, 2.0.0-beta.3; 0 up to (excluding) 1.5.2 (surrealdb-core)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SurrealDB is vulnerable to a query injection attack via the RPC API, allowing authenticated users to execute unauthorized commands.

Executive Summary:
A query injection vulnerability in the SurrealDB RPC API allows authenticated users to execute unauthorized commands, presenting a high risk to database integrity.

Vulnerability Details

CVE-ID: CVE-2024-58362

Affected Software: SurrealDB surrealdb

Affected Versions: 0 up to (excluding) 1.5.5, 2.0.0-beta.3; 0 up to (excluding) 1.5.2 for surrealdb-core.

Vulnerability: This is a failure to sanitize special elements (CWE-75), which leads to a query injection vulnerability. An authenticated user can leverage the RPC API to inject malicious queries into the database engine.

Business Impact

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data extraction, modification, or destruction. Given the CVSS score of 8.8, this vulnerability poses a severe threat to the business, as it directly undermines the core security of the database management system.

Remediation Plan

Immediate Action: Update to SurrealDB 1.5.5 or 2.0.0-beta.3, and ensure surrealdb-core is updated to at least 1.5.2.

Proactive Monitoring: Review RPC API request logs for patterns indicative of injection attempts, such as unusual character sequences or unexpected query structures.

Compensating Controls: Utilize network-level access controls to restrict access to the RPC API to authorized application servers only, reducing the likelihood of malicious user interaction.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability highlights the importance of rigorous input sanitization in API-driven database interfaces.

Analyst Recommendation

Given the potential for complete database compromise via query injection, immediate patching is mandatory. Administrators must ensure all components, including core dependencies, are updated to the specified non-vulnerable versions to mitigate this critical risk.

---METADATA---
VENDOR: calcom
PRODUCT: cal.diy
AFFECTED_VERSIONS: 0 through 4.7.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability in cal.diy allows authenticated users to inject malicious scripts through booking questions, mirroring the characteristics of related security flaws.

Executive Summary:
A cross-site scripting vulnerability in cal.diy allows authenticated attackers to execute arbitrary scripts, creating a substantial risk to user data and session integrity.

Vulnerability Details

CVE-ID: CVE-2024-58355

Affected Software: calcom cal.diy

Affected Versions: 0 through 4.7.15

Vulnerability: This is a CWE-80 vulnerability involving improper neutralization of script-related HTML tags. It requires an authenticated user with low privileges to trigger the vulnerability through specially crafted booking questions.

Business Impact

Successful exploitation permits attackers to compromise user sessions and perform unauthorized actions, potentially leading to widespread data exposure. With a CVSS score of 8.9, this vulnerability poses a severe threat to the confidentiality and integrity of the affected application.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to remediate the underlying sanitization flaw.

Proactive Monitoring: Review user-generated content and booking logs for signs of script injection or unusual character sequences.

Compensating Controls: Utilize a Web Application Firewall (WAF) to prevent the delivery of malicious scripts to the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability demonstrates a systemic issue with input handling that should be addressed comprehensively during the patching process.

Analyst Recommendation

The high CVSS score necessitates immediate attention to prevent potential exploitation. Administrators should apply the vendor-recommended patches as soon as they are available to ensure the security of their deployment.

---METADATA---
VENDOR: calcom
PRODUCT: cal.diy
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A repository takeover vulnerability exists in the cal.diy GitHub Actions workflow, allowing attackers to execute arbitrary code via malicious pull requests and compromise the repository.

Executive Summary:
A critical repository takeover vulnerability in the cal.diy GitHub Actions workflow enables attackers to execute arbitrary code and gain unauthorized control over the codebase.

Vulnerability Details

CVE-ID: CVE-2024-58354

Affected Software: calcom cal.diy

Affected Versions: See vendor advisory

Vulnerability: The vulnerability stems from insecure GitHub Actions workflow configurations, specifically the use of pull_request_target combined with dangerous checkout practices. This allows an attacker with low privileges to trigger arbitrary command execution using the repository's write-scoped GITHUB_TOKEN.

Business Impact

Exploitation of this flaw allows an attacker to mutate the repository, including pushing malicious code, merging unauthorized pull requests, and modifying branches. This represents a significant supply chain and integrity risk, as it could facilitate the distribution of backdoored software to end users.

Remediation Plan

Immediate Action: Audit and restrict GitHub Actions workflow permissions immediately, ensuring that pull requests from untrusted sources do not have access to repository write tokens.

Proactive Monitoring: Monitor repository audit logs for unauthorized branch mutations, unexpected commits, or suspicious workflow execution activity.

Compensating Controls: Implement mandatory code review processes for all pull requests and utilize branch protection rules to prevent unauthorized merging of code.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector requires specific knowledge of the repository workflow configuration.

Analyst Recommendation

While no patched version is currently available, administrators must proactively secure their CI/CD pipelines by hardening workflow permissions. Prioritize reviewing the vendor's security advisory and applying recommended configuration changes to mitigate the risk of repository takeover.

---METADATA---
VENDOR: calcom
PRODUCT: cal.diy
AFFECTED_VERSIONS: 0 through 4.7.15
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-site scripting (XSS) vulnerability exists in cal.diy, allowing authenticated users to inject malicious scripts via booking questions.

Executive Summary:
A cross-site scripting vulnerability in cal.diy allows authenticated attackers to execute arbitrary scripts, posing a significant risk to user session security.

Vulnerability Details

CVE-ID: CVE-2024-58353

Affected Software: calcom cal.diy

Affected Versions: 0 through 4.7.15

Vulnerability: The software fails to properly neutralize script-related HTML tags, leading to a CWE-80 basic XSS vulnerability. The attack vector requires the attacker to be authenticated with low privileges and requires user interaction to execute the malicious payload.

Business Impact

Exploitation of this XSS vulnerability can lead to session hijacking, unauthorized actions performed on behalf of other users, or the theft of sensitive information. The high CVSS score of 8.9 reflects the potential for significant impact on both data confidentiality and integrity within the application environment.

Remediation Plan

Immediate Action: Update the cal.diy software to the version containing the fix, as specified in the official vendor security advisory.

Proactive Monitoring: Monitor application logs for suspicious script injection attempts or anomalous booking activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious script payloads from web requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in inadequate input sanitization, which is a common vector for web-based attacks.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency due to its potential for full session compromise. Applying the vendor-provided update is the only effective way to neutralize this flaw and ensure the continued security of the platform.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Before 2.1.4
---END_METADATA---

Description Summary:
Flowise versions before 2.1.4 are vulnerable to remote code execution and sandbox escape via an insecure overrideConfig option in the Chainflow execution process.

Executive Summary:
An unauthenticated remote code execution vulnerability in Flowise allows attackers to achieve full system compromise via insecure configuration injection.

Vulnerability Details

CVE-ID: CVE-2024-58351

Affected Software: Flowise Flowise

Affected Versions: Before 2.1.4

Vulnerability: This vulnerability stems from an insecure implementation of the overrideConfig option, which lacks an allow-list for permitted variables and relies on an insufficient vm2 sandbox. Attackers can leverage this to execute arbitrary code, perform SSRF, or exfiltrate sensitive server-side data without prior authentication.

Business Impact

With a CVSS score of 9.8, this critical vulnerability poses a severe risk of total server compromise. Successful exploitation allows an attacker to execute arbitrary commands, potentially leading to unauthorized data access, complete loss of confidentiality and integrity, and significant operational downtime for organizations relying on Flowise for workflow automation.

Remediation Plan

Immediate Action: Upgrade Flowise to version 2.1.4 or later immediately to remove the vulnerable configuration injection path.

Proactive Monitoring: Review backend Prediction API logs for anomalous overrideConfig payloads or unexpected execution patterns that deviate from standard workflow triggers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict rules to inspect and filter incoming JSON payloads for suspicious overrideConfig parameters until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of the remote code execution risk, organizations must prioritize patching Flowise instances to version 2.1.4. Failure to remediate this vulnerability leaves the underlying infrastructure exposed to complete takeover by unauthenticated remote actors.

---METADATA---
VENDOR: WordPress
PRODUCT: Theme Travelscape
AFFECTED_VERSIONS: 1.0.3
---END_METADATA---

Description Summary:
WordPress Theme Travelscape 1.0.3 is susceptible to remote code execution due to insufficient validation of file uploads in the theme directory.

Executive Summary:
The WordPress Theme Travelscape 1.0.3 contains a critical remote code execution vulnerability that allows unauthenticated attackers to upload and execute malicious files.

Vulnerability Details

CVE-ID: CVE-2024-58349

Affected Software: WordPress Theme Travelscape

Affected Versions: 1.0.3

Vulnerability: The theme features an arbitrary file upload vulnerability caused by inadequate validation of user-supplied files. An unauthenticated attacker can exploit this flaw to upload malicious scripts to the theme directory and execute them to gain system-level control.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to business continuity and data security. An attacker can leverage this access to gain control over the WordPress database, steal administrative credentials, or deploy ransomware, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update to the latest version of Theme Travelscape to ensure proper file validation is implemented.

Proactive Monitoring: Monitor server access logs for unusual upload activity and scan the /wp-content/themes/travelscape/ directory for any suspicious file signatures.

Compensating Controls: Apply WAF rules to detect and block malicious file uploads and restrict PHP execution within the theme's upload subdirectories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Organizations utilizing Theme Travelscape should perform an emergency update and conduct a security audit to confirm that no malicious files have been successfully uploaded or executed.

---METADATA---
VENDOR: WordPress
PRODUCT: Background Image Cropper
AFFECTED_VERSIONS: Version 1.2
---END_METADATA---

Description Summary:
WordPress Background Image Cropper 1.2 allows unauthenticated attackers to execute arbitrary code via an insecure file upload endpoint.

Executive Summary:
A critical remote code execution vulnerability in the WordPress Background Image Cropper plugin allows unauthenticated attackers to compromise the host server via arbitrary file uploads.

Vulnerability Details

CVE-ID: CVE-2024-58348

Affected Software: WordPress Background Image Cropper

Affected Versions: 1.2

Vulnerability: The plugin contains an insecure file upload vulnerability in the ups.php endpoint. Unauthenticated attackers can leverage this endpoint to upload malicious PHP files, which are then stored and executable on the server.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation results in complete server compromise, allowing attackers to read, modify, or delete sensitive application data and potentially pivot into the wider network infrastructure.

Remediation Plan

Immediate Action: Update the Background Image Cropper plugin to the latest version immediately to address the insecure endpoint.

Proactive Monitoring: Review server logs for suspicious POST requests directed at ups.php and examine the plugin directory for unauthorized file modifications or new script uploads.

Compensating Controls: Utilize a WAF to restrict access to the ups.php file and implement strict file type validation and execution restrictions on the plugin's upload directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of exploitation for this remote code execution flaw necessitates immediate action. Administrators must update the plugin and verify the integrity of the WordPress installation to ensure no unauthorized files remain on the system.

Executive Summary:
A critical vulnerability has been identified in Anevia Flamingo XL products, assigned CVE-2024-58338 with a CVSS score of 9.8. This flaw allows a remote attacker to escape a restricted user environment by manipulating the traceroute command, leading to a complete system takeover with root-level privileges. Successful exploitation could result in total compromise of the affected device, service disruption, and unauthorized access to the network.

Vulnerability Details

CVE-ID: CVE-2024-58338

Affected Software: Anevia Flamingo XL Multiple Products

Affected Versions: Version 3.2.9 is confirmed to be vulnerable. See vendor advisory for a complete list of affected versions.

Vulnerability: The vulnerability is a restricted shell escape due to improper input validation in the traceroute command. An attacker with access to the device's restricted shell can inject arbitrary shell commands as arguments to the traceroute utility. Because the input is not properly sanitized, these injected commands are executed by the underlying operating system with elevated privileges, bypassing the intended sandbox restrictions and resulting in full root access to the device.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, indicating a high risk of exploitation and severe potential impact. A successful attack would grant an adversary complete control over the affected Anevia Flamingo XL device. This could lead to significant business consequences, including the theft of sensitive data, disruption of critical video streaming services, installation of persistent malware or backdoors, and using the compromised device as a pivot point to launch further attacks against the internal network. The potential for reputational damage and financial loss is substantial.

Remediation Plan

Immediate Action: Immediately apply the security patches provided by the vendor. Update all Anevia Flamingo XL Multiple Products to the latest recommended version to mitigate this vulnerability. In parallel, initiate a review of all system and access logs for any signs of compromise or suspicious activity related to the traceroute command.

Proactive Monitoring: Implement enhanced monitoring on affected devices. Security teams should look for unusual usage of the traceroute command in shell logs, especially those containing special characters or chained commands (e.g., ;, |, &&). Monitor for unexpected outbound network connections, unauthorized processes running with root privileges, and any unauthorized file modifications on the system.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls:

• Restrict network access to the device's management interface to a limited set of trusted IP addresses.
• If possible within the device's configuration, disable the traceroute command for restricted user accounts or further limit the permissions of the shell environment.
• Deploy an Intrusion Prevention System (IPS) with rules designed to detect and block command injection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Dec 30, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the straightforward nature of shell escape vulnerabilities, it is highly probable that proof-of-concept exploits will be developed and weaponized by threat actors. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability presents an immediate and severe threat to the organization. We strongly recommend that all affected Anevia Flamingo XL devices be patched on an emergency basis. Although there is no evidence of active exploitation at this time, the risk of a full system compromise is too significant to delay remediation. If patching cannot be performed immediately, apply the recommended compensating controls and prioritize these systems for the next available maintenance window.

Executive Summary:
A critical vulnerability has been identified in multiple Akuvox Smart Intercom products, allowing unauthenticated remote attackers to access live video streams. This flaw, tracked as CVE-2024-58336, poses a significant risk to physical security and privacy by enabling unauthorized surveillance of sensitive areas without requiring any credentials. Immediate patching is required to prevent potential exploitation and protect sensitive video data.

Vulnerability Details

CVE-ID: CVE-2024-58336

Affected Software: Akuvox Smart Intercom Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an instance of Broken Access Control. The video.cgi endpoint, which serves the device's live video stream, is exposed on TCP port 8080 without any authentication mechanism. A remote attacker can exploit this by sending a direct HTTP request to this endpoint, and the device will return the video stream data without verifying the user's identity or authorization, granting unauthorized access to the camera feed.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation could lead to a severe breach of physical security and personal privacy, as attackers could monitor building entrances, secure areas, or private residences in real-time. This exposure creates significant risks, including corporate espionage, targeted theft, stalking, and reputational damage. The organization could also face legal and regulatory consequences related to privacy violations if sensitive areas are exposed.

Remediation Plan

Immediate Action: The primary remediation is to apply the vendor-supplied security patch immediately. Organizations must identify all affected Akuvox devices and update them to the latest firmware version that addresses this vulnerability. After patching, review access logs for any signs of past exploitation.

Proactive Monitoring: Security teams should actively monitor network traffic for suspicious requests to TCP port 8080 on Akuvox devices, specifically looking for access attempts to the /video.cgi endpoint from untrusted or external IP addresses. Configure alerts for unusual traffic patterns or repeated connections to this port and endpoint.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Use a firewall to restrict all access to TCP port 8080 from external networks.
• If remote access is required, place the device behind a VPN or a reverse proxy that enforces strong authentication.
• Segment the network to isolate the intercom devices from critical internal systems and the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Dec 30, 2025, there is no known public exploit code for this vulnerability. However, due to the simplicity of exploitation (a single unauthenticated web request), it is highly likely that threat actors will independently develop and use exploits. The low complexity of the attack vector means organizations should assume active exploitation is imminent.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the severe impact on physical security and privacy, this vulnerability requires immediate attention. The top priority is to apply the vendor patch to all affected Akuvox devices without delay. Although this CVE is not currently listed on the CISA KEV list, its high severity and ease of exploitation warrant treating it with the same urgency. If patching is delayed for any reason, compensating controls such as firewall restrictions must be implemented immediately to mitigate the risk of unauthorized surveillance.

Executive Summary:
A high-severity vulnerability has been identified in multiple Atcom IP Phone products, specifically affecting devices running firmware version 2. This flaw could allow a remote, unauthenticated attacker to gain complete control over the affected phones. Successful exploitation could lead to eavesdropping on conversations, service disruption, or using the compromised devices to launch further attacks against the internal network.

Vulnerability Details

CVE-ID: CVE-2024-58314

Affected Software: Atcom Multiple Products

Affected Versions: Firmware version 2 for Atcom 100M IP Phones. See vendor advisory for a complete list of affected products.

Vulnerability: This vulnerability is a critical command injection flaw in the web management interface of the affected firmware. An unauthenticated attacker can send a specially crafted HTTP request to the device's web server. The input is not properly sanitized, allowing the attacker to inject and execute arbitrary operating system commands with the privileges of the root user, leading to a full compromise of the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. Exploitation could result in the complete loss of confidentiality, integrity, and availability of the IP phone system. Specific business impacts include the interception of sensitive or confidential phone calls, unauthorized modification of device configurations, denial of service for critical voice communications, and the potential for attackers to use the compromised phones as a pivot point to attack other sensitive assets on the corporate network.

Remediation Plan

Immediate Action: The primary and most effective remediation is to apply the security updates provided by Atcom to all affected IP phones immediately. Before and after patching, closely monitor device logs and network traffic for any signs of compromise or exploitation attempts.

Proactive Monitoring: Implement enhanced monitoring for affected devices. Review web access logs on the phones for unusual requests, especially from untrusted internal or external IP addresses. Monitor network traffic for anomalous outbound connections from the IP phones to unknown destinations, which could indicate a successful compromise and communication with a command-and-control server.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Isolate the IP phones on a dedicated, restricted VLAN.
• Use network access control lists (ACLs) or firewall rules to restrict access to the web management interface, allowing connections only from a limited set of trusted administrative workstations.
• Disable the web management interface if it is not required for business operations.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date, December 14, 2025, there are no known public exploits or reports of this vulnerability being actively exploited in the wild. However, given the high CVSS score and the relative simplicity of command injection vulnerabilities, it is highly probable that threat actors will develop and release exploit code in the near future.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this vulnerability, we strongly recommend that organizations prioritize the immediate patching of all affected Atcom IP Phone devices. While this vulnerability is not currently listed on the CISA KEV list, its critical nature makes it a prime target for future exploitation. If patching cannot be performed immediately, the compensating controls outlined above, particularly network segmentation and restricting access to the management interface, must be implemented as an urgent priority to mitigate risk.

Executive Summary:
A critical vulnerability exists in multiple Dormakaba Saflok System products that allows an attacker to create their own valid access keys. The system uses a predictable method to generate keys from a card's unique identifier, enabling unauthorized individuals to bypass physical security controls and gain access to secured areas. This flaw presents a severe risk of physical intrusion, theft, and compromise of sensitive environments.

Vulnerability Details

CVE-ID: CVE-2024-58311

Affected Software: Dormakaba Saflok System Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability lies in a deterministic key generation algorithm within the Dormakaba Saflok System. The system creates cryptographic access keys using a predictable, simple mathematical transformation of a card's 32-bit unique identifier (UID). An attacker can obtain a card's UID (e.g., through physical access or using a nearby RFID/NFC reader) and apply the known transformation to calculate the corresponding access key, effectively allowing them to clone or create a master key without authorization.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, reflecting the ease of exploitation and the potential for complete compromise of physical security. Successful exploitation could lead to unauthorized physical access to facilities, including corporate offices, server rooms, and other restricted areas. The consequences include theft of physical assets, intellectual property, and sensitive data, as well as potential harm to personnel and significant reputational damage to the organization.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor. Organizations must update all affected Dormakaba Saflok System components, including lock firmware and management software, to the latest version immediately. Following the update, closely monitor for any unusual access attempts and conduct a thorough review of historical access logs for signs of compromise.

Proactive Monitoring: Implement enhanced monitoring of physical access control systems. Specifically, look for logs showing an unusual pattern of access, such as multiple failed attempts followed by a successful entry from an unfamiliar card ID, or access events at odd hours or in locations inconsistent with employee roles. Correlate access logs with surveillance video where available to verify the identity of individuals entering sensitive areas.

Compensating Controls: If patching cannot be deployed immediately, implement compensating controls to mitigate risk. These include adding a secondary authentication factor (e.g., PIN code) for entry to high-security areas, increasing the presence of physical security personnel, and temporarily disabling affected card readers on critical entry points until they can be updated. Conduct a review of all access privileges and enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Dec 12, 2025, the technical details describing the "simple mathematical transformation" are publicly available, making it trivial for attackers to create exploit tools. While the vulnerability is not currently listed on the CISA KEV catalog, its critical nature and the availability of public exploit details mean active exploitation is highly probable. Organizations should assume they are being targeted.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the direct threat to physical security, this vulnerability requires immediate attention. We strongly recommend that all organizations using affected Dormakaba Saflok systems prioritize the deployment of the vendor-supplied patches across all facilities without delay. Due to the high likelihood of exploitation, organizations should also immediately implement the recommended monitoring and compensating controls to detect and prevent unauthorized access while the patching process is underway.

Executive Summary:
A critical vulnerability has been discovered in WonderCMS, a popular content management system. This flaw, identified as CVE-2024-58305, allows an unauthenticated remote attacker to execute arbitrary code, potentially leading to a complete takeover of the affected website and its underlying server. Successful exploitation could result in data theft, website defacement, or the distribution of malware to visitors.

Vulnerability Details

CVE-ID: CVE-2024-58305

Affected Software: WonderCMS Multiple Products

Affected Versions: WonderCMS version 4.x prior to the patched release. See vendor advisory for specific affected versions.

Vulnerability: This vulnerability is an unauthenticated Remote Code Execution (RCE) flaw. It exists within the file upload functionality of a core component. An attacker can bypass file type validation checks by crafting a malicious request, allowing them to upload a PHP web shell or other malicious script to a web-accessible directory. By subsequently navigating to the URL of the uploaded file, the attacker can execute arbitrary commands on the server with the permissions of the web server process, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. A successful exploit could lead to a complete compromise of the web server's confidentiality, integrity, and availability. Potential consequences include the theft of sensitive business or customer data stored on the server, unauthorized modification of website content (defacement), reputational damage, and using the compromised server to launch further attacks or host malicious content. The ease of exploitation by an unauthenticated attacker elevates the likelihood of this vulnerability being targeted.

Remediation Plan

Immediate Action: Apply the security updates released by WonderCMS immediately to patch the vulnerability. Before patching, create a full backup of the website's files and database. After the update is applied, verify that the website is functioning correctly and that the patch has been successfully installed.

Proactive Monitoring: Monitor web server access logs for suspicious POST requests to file upload endpoints, particularly for files with executable extensions (e.g., .php, .phtml, .phar). Implement file integrity monitoring to detect the creation of unexpected files in web directories. Monitor for unusual outbound network traffic from the web server, which could indicate a reverse shell or data exfiltration.

Compensating Controls: If patching is not immediately possible, implement a Web Application Firewall (WAF) with rules specifically designed to block malicious file uploads and common web shell patterns. Additionally, configure the web server to disallow script execution in the uploads directory and enforce strict file permissions to prevent unauthorized access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 14, 2025, there are no known public exploits targeting CVE-2024-58305. However, given the critical nature of the vulnerability (unauthenticated RCE) and the platform's widespread use, it is highly likely that security researchers or threat actors will develop a functional proof-of-concept exploit in the near future. Organizations should anticipate active scanning for vulnerable instances.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the potential for complete system compromise, immediate remediation of CVE-2024-58305 is strongly recommended. Although this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, its critical impact warrants urgent action. Organizations must prioritize applying the vendor-supplied security update to all affected WonderCMS installations without delay to prevent potential exploitation.