---METADATA---
VENDOR: WordPress
PRODUCT: Custom css-js-php
AFFECTED_VERSIONS: 2.0.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Custom css-js-php WordPress plugin allows unauthenticated code injection due to improper control of generation of code.

Executive Summary:
A critical code injection vulnerability exists in the Custom css-js-php WordPress plugin, potentially allowing unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6433

Affected Software: WordPress Custom css-js-php

Affected Versions: 2.0.7

Vulnerability: This vulnerability is a CWE-94 Code Injection flaw. It allows an unauthenticated attacker to inject arbitrary code into the WordPress environment, leading to full site compromise.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code, which can result in complete loss of confidentiality, integrity, and availability of the WordPress site. While the base CVSS score is 7.3, the Wordfence Intelligence assessment rates this at 9.8 (Critical) due to the ease of unauthenticated exploitation, posing a severe risk to organizational data and operational continuity.

Remediation Plan

Immediate Action: As no patched version is currently available, administrators must immediately deactivate and remove the Custom css-js-php plugin from all WordPress installations.

Proactive Monitoring: Monitor server logs for suspicious PHP execution patterns or unexpected file modifications in the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common injection payloads, though removal remains the only definitive remediation.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub and a Nuclei detection template is available.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The severity of this flaw cannot be overstated given the potential for unauthenticated remote code execution. Because no vendor patch is currently available, organizations must prioritize the immediate removal of this plugin to prevent unauthorized access and potential site takeover.

---METADATA---
VENDOR: Koha Community
PRODUCT: Koha
AFFECTED_VERSIONS: Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00.
---END_METADATA---

Description Summary:
An authenticated SQL injection vulnerability in the Koha library management system allows staff users to extract sensitive database information via the Filter URL parameter.

Executive Summary:
An authenticated SQL injection vulnerability in the Koha reports module could allow staff users to extract sensitive information from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-6428

Affected Software: Koha Community Koha

Affected Versions: Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00.

Vulnerability: This is a SQL injection vulnerability within the reports/catalogue_out.pl script. An authenticated staff user with the Reports module capability can manipulate the Filter URL parameter to execute arbitrary database queries.

Business Impact

With a CVSS score of 7.6, this vulnerability represents a significant risk of data exposure. An attacker could exfiltrate sensitive patron or library data, leading to severe privacy violations and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade to the patched versions: 22.11.38, 24.11.16, 25.05.11, 25.11.05, 26.05.01, or 26.11.00.

Proactive Monitoring: Enable database query logging and review logs for suspicious or malformed queries originating from the Reports module.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and sanitize input parameters in the reports/catalogue_out.pl path.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 15, 2026, a proof-of-concept exploit is available, increasing the risk of active exploitation. Organizations should treat this as a high-priority remediation task.

Analyst Recommendation

The availability of a public exploit significantly elevates the risk of this vulnerability. Administrators must apply the vendor patches immediately to prevent unauthorized data access and minimize the window of exposure.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 5.15.210, 6.1.176, 6.6.143, and 6.12.93
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A boundary condition error in the Linux kernel ASoC simple-mux codec driver allows for improper validation of enum control values, leading to potential memory corruption.

Executive Summary:
An input validation flaw in the Linux kernel audio subsystem may allow a local attacker to cause memory corruption and system instability.

Vulnerability Details

CVE-ID: CVE-2026-64243

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 5.15.210, 6.1.176, 6.6.143, and 6.12.93

Vulnerability: This is a boundary check vulnerability in the simple_mux_control_put function. The flaw allows an authenticated local user to provide values that exceed the defined array bounds, potentially leading to unauthorized data access or system crashes.

Business Impact

The vulnerability, while requiring local access, poses a threat to system integrity and availability. By manipulating audio codec controls, an attacker could potentially induce system instability or bypass intended functionality. With a CVSS score of 7.1, it is categorized as high severity due to the potential for memory corruption.

Remediation Plan

Immediate Action: Update the Linux kernel to versions 5.15.210, 6.1.176, 6.6.143, 6.12.93, or later.

Proactive Monitoring: Audit access logs for unauthorized attempts to interact with audio control interfaces or abnormal system behavior following audio driver interactions.

Compensating Controls: Limit access to audio configuration interfaces and hardware control devices to authorized users only through standard Linux permission models.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is limited to local users who have the capability to interact with the ASoC interface.

Analyst Recommendation

Organizations should ensure that kernels are updated to the specified patched versions to prevent potential local exploitation. While the requirement for local access mitigates the immediate remote risk, the potential for kernel-level memory corruption makes patching an essential maintenance task.

---METADATA---
VENDOR: ESET
PRODUCT: ESET Inspect Connector
AFFECTED_VERSIONS: 0 through 3.0.5775.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability in the ESET Inspect Connector allows an authenticated local user to gain higher privileges on the host system.

Executive Summary:
A local privilege escalation flaw in the ESET Inspect Connector enables authenticated users to gain elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2026-6423

Affected Software: ESET ESET Inspect Connector

Affected Versions: 0 through 3.0.5775.0

Vulnerability: This is an improper privilege management vulnerability (CWE-269) within the ESET Inspect Connector. It requires an attacker to have low-level local privileges to exploit the vulnerability, but it does not require additional user interaction.

Business Impact

A successful exploit allows a local, low-privileged user to escalate their permissions to a higher level, potentially gaining full control over the affected Windows host. This undermines the security posture of the endpoint, allowing for the bypass of security restrictions and the potential exfiltration of sensitive data. The high CVSS score of 8.5 reflects the significant impact on host integrity.

Remediation Plan

Immediate Action: Update the ESET Inspect Connector to the latest version, which contains the fix for this privilege management issue.

Proactive Monitoring: Review system logs for unauthorized attempts to access or modify protected processes or registry keys associated with ESET Inspect.

Compensating Controls: Apply the principle of least privilege to all local user accounts to minimize the potential impact of an escalation attempt.

Exploitation Status

Public Exploit Available: No (no weaponized exploit confirmed).

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically limited to local attackers, requiring prior access to the system.

Analyst Recommendation

While this vulnerability requires local access, it represents a significant security risk for the integrity of managed endpoints. Organizations should prioritize patching the ESET Inspect Connector across all managed machines to prevent potential privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 6.12.92, 6.18.34, and 7.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability exists in the Linux kernel mac80211 Wi-Fi subsystem due to incorrect handling of negotiated TTLM elements during parsing.

Executive Summary:
A flaw in the Linux kernel Wi-Fi subsystem allows for an out-of-bounds read, potentially impacting system stability and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-64223

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 6.12.92, 6.18.34, and 7.0.11

Vulnerability: This is an out-of-bounds read vulnerability in the ieee80211_parse_neg_ttlm function. The vulnerability is triggered via adjacent network access, requiring no authentication from an attacker, which contributes to its high CVSS score of 8.1.

Business Impact

The vulnerability allows an attacker within radio range to potentially access sensitive memory or crash the Wi-Fi subsystem. This presents a risk to confidentiality and availability, especially in environments where secure wireless communication is paramount. The high CVSS score reflects the ease of exploitation from adjacent network segments.

Remediation Plan

Immediate Action: Update the Linux kernel to versions 6.12.92, 6.18.34, 7.0.11, or later.

Proactive Monitoring: Monitor for unexpected Wi-Fi connection drops or kernel messages indicating memory-related issues in the wireless driver.

Compensating Controls: If patching is delayed, consider disabling unnecessary wireless interfaces or implementing physical access controls to limit potential adjacent network exposure.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is primarily triggered by malformed packets processed by the mac80211 subsystem.

Analyst Recommendation

Given the potential for remote adjacent exploitation and the high severity score, organizations should treat this update with high priority. Applying the kernel patch is the only definitive way to resolve the underlying logic error in the TTLM parser.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: Linux kernel versions prior to 5.10.259, 5.15.210, 6.1.176, and 6.6.143
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A double free vulnerability in the Linux kernel OcteonTX2 network driver's pool management subsystem during Admin Queue initialization can lead to system instability.

Executive Summary:
A memory safety flaw in the Linux kernel OcteonTX2 driver exposes the system to potential crashes and exploitation due to a double free condition.

Vulnerability Details

CVE-ID: CVE-2026-64222

Affected Software: Linux Kernel

Affected Versions: Linux kernel versions prior to 5.10.259, 5.15.210, 6.1.176, and 6.6.143

Vulnerability: This is a memory corruption issue caused by a double free condition in the otx2_pool_aq_init function. The vulnerability requires local access and, while the CVSS score of 7.0 suggests high severity, the attack complexity is elevated by the requirement for specific error conditions during initialization.

Business Impact

The vulnerability poses a significant risk to system availability and integrity. Successful exploitation could lead to kernel panics, resulting in denial of service, or potentially allow a local attacker to execute arbitrary code with elevated privileges. Given the critical nature of the kernel, this flaw warrants immediate attention in environments utilizing OcteonTX2 hardware.

Remediation Plan

Immediate Action: Update the Linux kernel to versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts related to the network driver stack.

Compensating Controls: Restrict access to the local system to trusted users only to minimize the risk of a local attacker triggering the initialization failure.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently difficult to trigger as it requires a specific failure path during hardware initialization.

Analyst Recommendation

This vulnerability represents a serious memory safety issue within the kernel. Administrators should prioritize patching the affected kernel versions across all systems utilizing OcteonTX2 hardware to eliminate the risk of exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 4.12, and various commit ranges starting from c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel spi: ti-qspi driver occurs when DMA setup fails, allowing for potential memory corruption or code execution.

Executive Summary:
A use-after-free vulnerability in the Linux kernel spi: ti-qspi driver allows local, authenticated users to potentially escalate privileges or crash the system.

Vulnerability Details

CVE-ID: CVE-2026-64221

Affected Software: Linux Kernel

Affected Versions: Linux kernel 4.12, and versions within specific commit ranges starting from c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83.

Vulnerability: This is a use-after-free vulnerability (CWE-825) in the ti-qspi driver that occurs during probe-time DMA setup failure. The driver fails to clear a pointer, leading to an expired pointer dereference, which requires a local authenticated attacker to trigger.

Business Impact

The CVSS score of 7.8 indicates a high severity. While the attack vector is local (AV:L), the impact on confidentiality, integrity, and availability is total. A successful exploit could lead to privilege escalation or kernel-level code execution, posing a severe risk to the security of the underlying host.

Remediation Plan

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, 6.6.142, or later.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service crashes occurring during driver initialization or SPI bus activity.

Compensating Controls: Restrict local access to systems utilizing the ti-qspi driver to trusted users only to minimize the risk of exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex, requiring specific conditions during the hardware probing phase to trigger.

Analyst Recommendation

Although the vulnerability requires local access, the potential for code execution makes this a high-priority item for systems using the affected hardware. Administrators should apply the recommended kernel patches during the next maintenance window to eliminate the risk of local privilege escalation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: 5.3, and specific commit ranges starting from db05815b36cbd486c86fd002dfa81c9af6245e25
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Linux kernel Mellanox mlx5e network driver allows for unlocked access to the ICOSQ during NAPI polling, resulting in potential denial-of-service.

Executive Summary:
A high-severity race condition in the Linux kernel Mellanox mlx5e driver, currently being exploited in the wild, can cause system-wide denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-64210

Affected Software: Linux Kernel

Affected Versions: Linux kernel 5.3, and versions ranging from db05815b36cbd486c86fd002dfa81c9af6245e25 up to (excluding) 8d3b91e7d81000d295cd914d4d9d6f860252e2bf or c326f9c68921e2f14dfcecb2f6b4216313d50248.

Vulnerability: This is a race condition vulnerability within the AF_XDP socket implementation of the mlx5e network driver. It occurs due to unlocked writes to the Internal Channel Operations Send Queue (ICOSQ) when CPU affinity changes, which is reachable by unauthenticated users.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to system availability. Because it triggers kernel-level errors and crashes, it can lead to unplanned downtime for infrastructure relying on Mellanox network interfaces. The observed exploitation in the wild heightens the urgency for patching.

Remediation Plan

Immediate Action: Update the Linux kernel to version 7.0.11 or later to apply the necessary synchronization fixes.

Proactive Monitoring: Monitor system logs for kernel warnings, specifically those containing "Bad OP in ICOSQ CQE" or references to drivers/net/ethernet/mellanox/mlx5/core/en_rx.c.

Compensating Controls: If immediate patching is not feasible, restrict the use of AF_XDP sockets on affected hardware to limit the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of July 24, 2026. The technical complexity of the race condition makes it a reliable vector for causing system instability on target hardware.

Analyst Recommendation

The fact that this vulnerability is actively observed in the wild necessitates immediate patching. Security teams should identify all Linux systems utilizing Mellanox network drivers and schedule kernel updates as a top priority to prevent service disruption.

---METADATA---
VENDOR: NLNETLABS
PRODUCT: Net::DNS
AFFECTED_VERSIONS: Net::DNS versions 0 through 1.55 for Perl
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A recursion depth vulnerability in Net::DNS for Perl allows unauthenticated attackers to cause a Denial of Service via crafted DNS compression pointer chains.

Executive Summary:
NLNETLABS Net::DNS versions 0 through 1.55 are susceptible to a stack exhaustion vulnerability that can result in a service outage for applications parsing malicious DNS data.

Vulnerability Details

CVE-ID: CVE-2026-64194

Affected Software: NLNETLABS Net::DNS

Affected Versions: Net::DNS versions 0 through 1.55 for Perl

Vulnerability: This vulnerability involves uncontrolled recursion in the Net::DNS::DomainName::decode function, which fails to enforce a depth limit when following RFC 1035 compression pointers. The attack vector is network based and requires no authentication, allowing an attacker to trigger a stack overflow by sending a specially crafted DNS packet to the application.

Business Impact

The flaw carries a CVSS score of 7.5, reflecting its high potential for service disruption. Successful exploitation leads to a crash of the affected application or service, causing downtime that impacts availability for end users. Organizations relying on this library to parse DNS traffic are at risk of localized service outages if they process untrusted or malicious DNS responses.

Remediation Plan

Immediate Action: Upgrade the Net::DNS library to version 1.56 or later immediately to implement the required recursion depth limits.

Proactive Monitoring: Monitor application logs for unexpected service restarts or stack trace errors that may indicate attempts to trigger a crash via malformed DNS packets.

Compensating Controls: Deploy network traffic inspection tools or firewalls capable of identifying and dropping malformed DNS packets containing excessively deep compression chains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by unauthenticated network traffic, making it a high priority for systems that process external DNS data.

Analyst Recommendation

Given the ease of exploitability and the potential for service disruption, administrators should prioritize updating to version 1.56. Implementing this patch is the only definitive way to secure the application against stack exhaustion attacks targeting this library.

---METADATA---
VENDOR: NLNETLABS
PRODUCT: Net::DNS
AFFECTED_VERSIONS: 0 through 1.55
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Net::DNS Perl module contains an eval injection vulnerability in the EDNS EXTENDED-ERROR parsing logic, allowing remote code execution via crafted EXTRA-TEXT fields.

Executive Summary:
A critical eval injection vulnerability in the Net::DNS Perl module allows remote attackers to execute arbitrary code by supplying crafted EDNS payloads.

Vulnerability Details

CVE-ID: CVE-2026-64193

Affected Software: NLNETLABS Net::DNS

Affected Versions: 0 through 1.55

Vulnerability: This is an eval injection (CWE-95) vulnerability located in the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function. The function improperly tokenizes raw bytes from the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option and passes them to Perl's eval without adequate sanitization, enabling command execution.

Business Impact

This vulnerability is critical, as it allows for arbitrary code execution on any system utilizing the vulnerable Net::DNS module to process DNS responses. Given the widespread use of this module in network-facing applications and services, the impact includes complete system compromise, data theft, and potential disruption of DNS-dependent services. The CVSS score of 9.8 reflects the high probability of successful remote exploitation without authentication.

Remediation Plan

Immediate Action: Upgrade the Net::DNS Perl module to version 1.56 or later to ensure the proper sanitization of input data.

Proactive Monitoring: Monitor systems for unexpected child processes or suspicious shell commands spawned by applications that utilize the Net::DNS library.

Compensating Controls: Use network-level filtering to drop malformed DNS responses or those containing unusual character sequences in the EXTRA-TEXT field if an immediate patch is not feasible.

Exploitation Status

Public Exploit Available: Yes, a public exploit exists.

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation in the wild, though a public proof-of-concept is available. The direct injection into a Perl eval call makes this vulnerability highly dangerous and relatively simple to weaponize.

Analyst Recommendation

The severity of this remote code execution vulnerability necessitates an immediate audit of all environments running Perl-based DNS services. Administrators must upgrade to version 1.56 or later to mitigate the risk of command injection. Delaying this patch could allow attackers to gain persistent access to critical network infrastructure.

---METADATA---
VENDOR: WishList Products
PRODUCT: WishList Member
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WishList Member plugin for WordPress is vulnerable to privilege escalation due to missing authorization.

Executive Summary:
A high-severity vulnerability in the WishList Member WordPress plugin allows unauthorized users to escalate their privileges, potentially gaining administrative control.

Vulnerability Details

CVE-ID: CVE-2026-6419

Affected Software: WishList Products WishList Member

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from missing authorization controls, allowing users to perform actions they should not have the permissions to execute. This can be leveraged to escalate privileges within the application.

Business Impact

The CVSS score of 8.8 underscores the gravity of this flaw. By escalating privileges, an attacker can gain unrestricted control over the WordPress site, leading to the compromise of member data and administrative configuration settings.

Remediation Plan

Immediate Action: Update the WishList Member plugin to the latest version.

Proactive Monitoring: Audit user roles and permissions periodically to identify any unauthorized escalations.

Compensating Controls: Implement a WAF to detect and block common privilege escalation attempts directed at plugin-specific endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Protecting against unauthorized privilege escalation is vital for maintaining the security of the CMS. Administrators must update the WishList Member plugin as soon as a patch is available.