---METADATA---
VENDOR: Apereo
PRODUCT: CAS
AFFECTED_VERSIONS: 7.3.0 before 8.0.0-RC6
---END_METADATA---

Description Summary:
A cryptographic flaw in Apereo CAS allows unauthenticated attackers to decrypt webflow conversation states by exploiting AES-GCM initialization vector reuse.

Executive Summary:
Apereo CAS contains a critical cryptographic vulnerability that allows unauthenticated attackers to recover plaintext conversation state, leading to potential identity and session compromise.

Vulnerability Details

CVE-ID: CVE-2026-59099

Affected Software: Apereo CAS

Affected Versions: 7.3.0 before 8.0.0-RC6

Vulnerability: The application utilizes a fixed all-zero initialization vector (IV) with AES-GCM encryption, resulting in keystream reuse. This allows unauthenticated remote attackers to perform known-plaintext analysis on collected webflow execution tokens.

Business Impact

The ability to decrypt conversation states poses a severe threat to authentication security, potentially exposing sensitive session information or facilitating session hijacking. With a CVSS score of 9.1, this represents a critical risk to any enterprise relying on Apereo CAS for centralized authentication and identity management.

Remediation Plan

Immediate Action: Upgrade to version 8.0.0-RC6 or later to implement secure, unique initialization vector generation for all cryptographic operations.

Proactive Monitoring: Monitor authentication logs and webflow traffic for patterns indicative of automated token collection or high-frequency requests from single sources.

Compensating Controls: While no direct WAF rule can fix the underlying cryptographic flaw, rate-limiting login attempts can slow down the token collection process required for this attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability undermines the fundamental security of the CAS identity provider. Organizations must treat this as a high-priority update to prevent the exposure of plaintext session data. Patching is the only effective way to resolve the underlying keystream reuse issue.

---METADATA---
VENDOR: LobeHub
PRODUCT: LobeChat
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability exists in LobeChat that could potentially lead to unauthorized access or data exposure.

Executive Summary:
LobeChat versions prior to 2 are vulnerable to a high-severity security flaw that could result in unauthorized access or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-59095

Affected Software: LobeHub LobeChat

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the LobeChat application framework, potentially allowing an attacker to bypass security controls or perform unauthorized actions. The specific entry point and authentication requirements depend on the underlying implementation flaw within the application logic.

Business Impact

The vulnerability carries a CVSS score of 7.7, indicating a high risk to organizational security. Successful exploitation could lead to the exposure of sensitive chat data, unauthorized usage of LLM resources, or potential compromise of the host environment, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade LobeChat to version 2 or the latest available release immediately to patch the underlying security flaw.

Proactive Monitoring: Review application access logs for irregular patterns and monitor for unauthorized session activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common injection and traversal patterns against the LobeChat interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The urgency of this vulnerability is high due to the potential for data exfiltration within the chat application. Administrators are strongly advised to update to version 2 or later immediately and verify that no unauthorized sessions persist following the update.

---METADATA---
VENDOR: Weaviate
PRODUCT: Weaviate
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability in Weaviate versions prior to 1 allows for potential unauthorized system interaction.

Executive Summary:
A high-severity vulnerability in the Weaviate vector database platform could allow an attacker to bypass security controls and compromise the underlying data infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-59093

Affected Software: Weaviate Weaviate

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core architecture of Weaviate prior to version 1. The exact authentication requirements remain subject to vendor clarification, but the high CVSS impact suggests significant risk to the application's security boundary.

Business Impact

Successful exploitation could lead to total unauthorized access to the vector database, resulting in the compromise of sensitive machine learning datasets and proprietary information. With a CVSS score of 8.8, this vulnerability represents an urgent threat to organizations relying on Weaviate for production AI/ML workloads.

Remediation Plan

Immediate Action: Upgrade all instances of Weaviate to the latest version immediately upon the release of security patches.

Proactive Monitoring: Review system and application access logs for anomalous API calls or unauthorized attempts to reach the database management interface.

Compensating Controls: Restrict network access to the Weaviate API via strict firewall rules and ensure that the instance is not exposed to the public internet without robust authentication layers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates an immediate review of all Weaviate deployments. Administrators must monitor vendor security channels for specific patch details and prepare for an accelerated deployment cycle to neutralize this threat.

---METADATA---
VENDOR: JuiceFS
PRODUCT: JuiceFS
AFFECTED_VERSIONS: JuiceFS through 1.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass in JuiceFS allows unauthenticated remote attackers to access sensitive debug endpoints and filesystem metadata.

Executive Summary:
JuiceFS versions through 1.3.1 are vulnerable to an authentication bypass that permits unauthenticated remote attackers to access sensitive system credentials and data.

Vulnerability Details

CVE-ID: CVE-2026-59092

Affected Software: JuiceFS JuiceFS

Affected Versions: JuiceFS through 1.3.1

Vulnerability: This is an authentication bypass vulnerability that permits unauthenticated remote attackers to access sensitive debug and metrics endpoints. By exploiting this, an attacker can retrieve process command lines containing database credentials and obtain full read/write access to filesystem metadata.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a critical security failure. Because it allows for the exfiltration of database credentials and grants full control over filesystem metadata, an attacker could compromise the entire storage backend, leading to total data loss, unauthorized data modification, or long-term persistence in the environment.

Remediation Plan

Immediate Action: Update JuiceFS to the version containing the fix (commit a46979c).

Proactive Monitoring: Inspect server logs for unauthorized access attempts to debug or metrics endpoints and monitor for any anomalous database connection requests.

Compensating Controls: Ensure that sensitive debug and metrics endpoints are not exposed to the public internet; implement network-level access control lists (ACLs) to restrict access to trusted management IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to the exposure of credentials and metadata. Organizations must prioritize patching to the corrected commit immediately. If an immediate update is not possible, ensure these endpoints are isolated from any untrusted network segments to prevent remote exploitation.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Tomcat
AFFECTED_VERSIONS: Apache Tomcat: 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, 8.5.0 through 8.5.100.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A URL encoding vulnerability in Apache Tomcat's RewriteValve allows unauthenticated attackers to bypass security constraints by manipulating hex-encoded characters in requests.

Executive Summary:
A critical security constraint bypass vulnerability in Apache Tomcat allows unauthenticated remote attackers to access restricted resources via crafted URL requests.

Vulnerability Details

CVE-ID: CVE-2026-59083

Affected Software: Apache Software Foundation Apache Tomcat

Affected Versions: Apache Tomcat: 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, 8.5.0 through 8.5.100.

Vulnerability: This is an improper handling of URL encoding vulnerability (CWE-177) within the RewriteValve component. The valve incorrectly decodes the plus character in rewritten URIs, enabling attackers to bypass path-based security constraints.

Business Impact

This vulnerability is rated at a critical CVSS score of 9.1. It allows unauthenticated attackers to bypass security controls that protect administrative interfaces or sensitive application endpoints. This can result in unauthorized access to restricted application features or data, potentially leading to a full compromise of the application environment.

Remediation Plan

Immediate Action: Update Apache Tomcat to version 11.0.24, 10.1.57, or 9.0.120 immediately to resolve the URL decoding flaw.

Proactive Monitoring: Monitor web access logs for suspicious URL patterns, specifically those containing unusual hex-encoded sequences or unexpected plus characters that deviate from standard request formats.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and normalize incoming request URIs, which may help block exploitation attempts targeting the RewriteValve until patching is complete.

Exploitation Status

Public Exploit Available: No (false)

Analyst Notes: As of July 14, 2026, the IONIX research team is tracking ongoing exploitation attempts in the wild. While there is no public weaponized exploit code, the active observation of exploitation attempts necessitates immediate patching.

Analyst Recommendation

The critical severity and confirmed reports of exploitation attempts make this a high-priority remediation. Organizations must verify their current Tomcat version and apply the recommended patches immediately to prevent unauthorized access and potential data compromise.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: prior to 147.0.7727.55
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Media component of Google Chrome allows remote attackers to execute arbitrary code via a crafted HTML page.

Executive Summary:
A high-severity use-after-free vulnerability in Google Chrome's Media component enables remote code execution, posing a significant risk to end-user workstations.

Vulnerability Details

CVE-ID: CVE-2026-5883

Affected Software: Google Chrome

Affected Versions: prior to 147.0.7727.55

Vulnerability: The vulnerability is a use-after-free error occurring within the Media processing logic, which can be triggered by a remote attacker through a specially crafted HTML page to execute code within the browser sandbox.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on the host machine, potentially leading to malware installation, credential theft, or further lateral movement within the network. With a CVSS score of 8.8, this vulnerability is a high-priority risk for all endpoints utilizing the Chrome browser.

Remediation Plan

Immediate Action: Update Google Chrome to version 147.0.7727.55 or later across all managed devices.

Proactive Monitoring: Review endpoint security logs for unusual browser activity or attempts to load malicious media files.

Compensating Controls: Enforce browser security policies that restrict the execution of untrusted scripts and ensure all endpoints are running active EDR solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser-based vulnerabilities are common targets for attackers. Organizations should ensure that the automatic update mechanism for Google Chrome is functioning correctly or push the update to all endpoints immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Google
PRODUCT: Chrome for Mac
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Insufficient validation of untrusted input in the ANGLE graphics component of Google Chrome for Mac allows for potential code execution.

Executive Summary:
A vulnerability in Google Chrome for Mac's ANGLE component allows for potential remote code execution due to insufficient input validation.

Vulnerability Details

CVE-ID: CVE-2026-5879

Affected Software: Google Chrome for Mac

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is caused by insufficient validation of untrusted input within the ANGLE graphics layer. An unauthenticated attacker can trigger this flaw by enticing a user to visit a malicious site, leading to code execution.

Business Impact

Compromise of the browser on Mac systems can lead to unauthorized access to sensitive user data and local files. The CVSS score of 8.8 highlights the severity of this vulnerability for Mac-based corporate environments.

Remediation Plan

Immediate Action: Update Google Chrome on all Mac systems to version 147 or later.

Proactive Monitoring: Monitor for unusual graphics-related processes or browser crashes which could indicate exploitation.

Compensating Controls: Ensure macOS security settings are configured to minimize the impact of browser-based exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Mac users are equally susceptible to browser-based attacks. Security teams should ensure that all Chrome installations on macOS are updated promptly to mitigate this high-severity risk.

---METADATA---
VENDOR: Apache
PRODUCT: Apache Thrift
AFFECTED_VERSIONS: 0 up to (excluding) 0.24.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Thrift C++ bindings are susceptible to an out-of-bounds read vulnerability due to improper validation of specified quantities in input data.

Executive Summary:
A high severity out-of-bounds read vulnerability in Apache Thrift C++ bindings could allow an unauthenticated attacker to cause crashes or potentially leak sensitive process memory.

Vulnerability Details

CVE-ID: CVE-2026-58662

Affected Software: Apache Thrift

Affected Versions: 0 up to (excluding) 0.24.0

Vulnerability: The vulnerability stems from improper validation of input quantities, leading to an out-of-bounds read condition during processing by the C++ bindings. This flaw is remotely exploitable by unauthenticated attackers.

Business Impact

The ability to trigger an out-of-bounds read can result in service instability, crashes, or the exposure of sensitive memory contents. With a CVSS score of 8.7, this vulnerability poses a severe risk to the confidentiality and availability of data processed by the affected Apache Thrift services.

Remediation Plan

Immediate Action: Update Apache Thrift to version 0.24.0, which includes the necessary validation logic to prevent out-of-bounds access.

Proactive Monitoring: Review application error logs for segmentation faults or unusual crash reports that might indicate an attacker is attempting to probe memory boundaries.

Compensating Controls: Implement input validation at the gateway or proxy level to drop malformed requests before they reach the C++ processing layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw makes it a prime candidate for automated probing.

Analyst Recommendation

Organizations utilizing the Apache Thrift C++ bindings must treat this as a high priority item. Patching to version 0.24.0 is the only reliable method to eliminate this memory safety issue and prevent potential exploitation.

---METADATA---
VENDOR: GPUStack
PRODUCT: GPUStack
AFFECTED_VERSIONS: 0 through 2.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
GPUStack contains a missing authentication vulnerability in worker endpoints that allows unauthenticated attackers to disclose sensitive information.

Executive Summary:
A missing authentication vulnerability in GPUStack versions 2.2.1 and earlier allows unauthenticated attackers to perform unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-58658

Affected Software: GPUStack GPUStack

Affected Versions: 0 through 2.2.1

Vulnerability: This vulnerability stems from missing authentication for critical worker endpoints, allowing unauthenticated remote attackers to access sensitive information.

Business Impact

The unauthorized disclosure of sensitive information can lead to data breaches or the compromise of operational intelligence regarding GPU resources. With a CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality of the affected deployment.

Remediation Plan

Immediate Action: Update to the latest version of GPUStack that incorporates the fix provided in commit 4e20551b5aaf76f93a8769d32b7fef999e22a4d3.

Proactive Monitoring: Monitor API and worker endpoint traffic for anomalous request patterns or unauthorized access attempts.

Compensating Controls: Implement strict network segmentation and ensure that worker endpoints are not exposed to untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of authentication on critical endpoints.

Analyst Recommendation

The presence of a proof-of-concept increases the urgency of this remediation. Security teams should verify their current version and apply the necessary updates immediately to secure sensitive information stored within the GPUStack infrastructure.

---METADATA---
VENDOR: Grav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to 1.4.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav Flex Objects plugin is vulnerable to server-side template injection, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A server-side template injection flaw in the Grav Flex Objects plugin allows authenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-58655

Affected Software: Grav Grav

Affected Versions: 0 up to 1.4.0

Vulnerability: The Grav Flex Objects plugin is susceptible to code injection (CWE-94) via dynamic titles, which permits an authenticated attacker to perform server-side template injection. This allows for the execution of arbitrary code within the application context.

Business Impact

Rated at 8.8 on the CVSS scale, this vulnerability represents a severe threat to the integrity and availability of the Grav CMS. Successful exploitation enables an attacker to gain full control over the web server, leading to potential data theft, site defacement, or the deployment of persistent malware.

Remediation Plan

Immediate Action: Update the Grav Flex Objects plugin to version 1.4.0 or later to patch the template injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual system calls or command execution attempts originating from the web application process.

Compensating Controls: Restrict administrative access to trusted personnel only and employ a Web Application Firewall to inspect and sanitize input fields for common template injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires authenticated access, which serves as a primary barrier to entry.

Analyst Recommendation

While this vulnerability requires authentication, the potential for remote code execution makes it a high-priority item. Administrators must update the affected plugin to version 1.4.0 immediately to prevent potential system-level compromise.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows for potential arbitrary code execution.

Executive Summary:
A type confusion vulnerability in Google Chrome’s V8 engine presents a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5865

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a type confusion error within the V8 JavaScript engine. An unauthenticated attacker can exploit this by crafting a malicious website, causing the browser to execute arbitrary code.

Business Impact

Exploiting the V8 engine is a common technique used by threat actors to break out of browser sandboxes. With a CVSS score of 8.8, this vulnerability poses a high risk to the overall security posture of any organization relying on Google Chrome.

Remediation Plan

Immediate Action: Update Google Chrome to version 147 or higher to patch the V8 engine vulnerability.

Proactive Monitoring: Monitor for browser-related anomalies and ensure that endpoints are running updated anti-malware software.

Compensating Controls: Use a modern browser with robust sandboxing and disable unnecessary features or plugins that could increase the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

V8 engine flaws are consistently targeted by attackers. Organizations must ensure that Google Chrome is kept up to date across all workstations to protect against potential exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016: 16.0.0 up to (excluding) 16.0.5556.1005, SharePoint Server 2019: 16.0.0 up to (excluding) 16.0.10417.20153, SharePoint Server Subscription Edition: 16.0.0 up to (excluding) 16.0.19725.20384
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in Microsoft SharePoint allows an unauthenticated, remote attacker to execute arbitrary code.

Executive Summary:
A critical remote code execution vulnerability exists in Microsoft SharePoint that allows unauthenticated attackers to compromise affected servers.

Vulnerability Details

CVE-ID: CVE-2026-58644

Affected Software: Microsoft SharePoint

Affected Versions: SharePoint Enterprise Server 2016: 16.0.0 up to (excluding) 16.0.5556.1005; SharePoint Server 2019: 16.0.0 up to (excluding) 16.0.10417.20153; SharePoint Server Subscription Edition: 16.0.0 up to (excluding) 16.0.19725.20384

Vulnerability: The software fails to properly sanitize serialized data, allowing an unauthenticated attacker to trigger remote code execution via a crafted network request.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to business continuity and data integrity. Successful exploitation grants an attacker full control over the SharePoint environment, leading to potential data theft, lateral movement within the network, and complete system compromise.

Remediation Plan

Immediate Action: Apply the security updates provided by Microsoft in the official security advisory immediately to patch the affected SharePoint versions.

Proactive Monitoring: Monitor network traffic for unexpected serialized objects or unusual process execution originating from the SharePoint service account.

Compensating Controls: Deploy a Web Application Firewall with rules configured to inspect and block suspicious serialized payloads targeting SharePoint entry points.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Jul 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the critical severity and remote exploitability, organizations must prioritize patching these SharePoint instances. Failure to apply these updates leaves the organization susceptible to full system compromise by unauthenticated remote actors.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure App Service for Linux
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An improper access control flaw in Microsoft Azure App Service for Linux allows an unauthenticated, remote attacker to elevate privileges over a network.

Executive Summary:
A critical privilege escalation vulnerability in Microsoft Azure App Service for Linux poses a severe risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-58630

Affected Software: Microsoft Azure App Service for Linux

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper access control (CWE-284) that allows an unauthenticated attacker to elevate privileges via network exploitation. Per MITRE ATT&CK, this is classified as technique T1068, indicating a significant risk to system integrity.

Business Impact

The CVSS score of 10.0 reflects the critical nature of this flaw, as it allows for total system compromise by an unauthenticated attacker. Successful exploitation could lead to full unauthorized control over the affected service environment, resulting in data breaches, loss of service availability, and potential lateral movement within the broader Azure ecosystem.

Remediation Plan

Immediate Action: Review the Microsoft Security Response Center (MSRC) update guide at the provided reference link and apply all relevant security updates immediately.

Proactive Monitoring: Monitor network traffic for unusual privilege escalation patterns and review system access logs for unauthorized administrative activity.

Compensating Controls: Ensure that appropriate Network Security Groups (NSGs) are configured to restrict access to the service to known, trusted IP ranges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the high severity of the flaw necessitates immediate patching.

Analyst Recommendation

This vulnerability represents the highest level of risk due to its unauthenticated, network-accessible nature. Security teams must prioritize applying updates provided by Microsoft to eliminate this critical privilege escalation path and safeguard the integrity of their cloud infrastructure.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 21H2 (10.0.19044.0 to 10.0.19044.7547), Windows 10 Version 22H2 (10.0.19045.0 to 10.0.19045.7547), Windows 11 Version 24H2 (10.0.26100.0 to 10.0.26100.8874), Windows 11 Version 25H2 (10.0.26200.0 to 10.0.26200.8874), Windows 11 version 26H1 (10.0.28000.0 to 10.0.28000.2524), Windows Server 2022 (10.0.20348.0 to 10.0.20348.5385)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use after free vulnerability in Windows Remote Desktop Services allows an authenticated attacker to execute code over a network.

Executive Summary:
An authenticated attacker could execute arbitrary code via a use after free vulnerability in Windows Remote Desktop Services, presenting a high risk of remote system compromise.

Vulnerability Details

CVE-ID: CVE-2026-58626

Affected Software: Microsoft Windows

Affected Versions: See METADATA for detailed build ranges.

Vulnerability: This is a use after free vulnerability (CWE-416) within Windows Remote Desktop Services. The vulnerability can be triggered by an authenticated attacker over a network connection to execute code.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a severe threat to business continuity and data security. An attacker who successfully exploits this service could gain full control over the remote desktop environment, facilitating data exfiltration or the installation of malicious software.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patches to all affected Windows Server and client installations immediately.

Proactive Monitoring: Audit RDP service logs for signs of abnormal behavior or unauthorized attempts to leverage the Remote Desktop service.

Compensating Controls: Limit access to Remote Desktop Services through network segmentation or VPN requirements to minimize exposure to potentially malicious actors.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, the impact is severe, necessitating prompt attention to the patch release.

Analyst Recommendation

Security teams must prioritize this patch for all servers and workstations running Remote Desktop Services. Applying the vendor update is the most effective method to eliminate the vulnerability and protect the environment from potential code execution attacks.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Print Spooler
AFFECTED_VERSIONS: Various Windows 10 and 11 versions; see enrichment data for full list
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in the Windows Print Spooler allows an authenticated attacker to execute arbitrary code over the network.

Executive Summary:
A race condition vulnerability in the Windows Print Spooler components allows an authenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-58608

Affected Software: Microsoft Windows Print Spooler

Affected Versions: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2)

Vulnerability: This flaw stems from improper synchronization when using shared resources, specifically a race condition (CWE-362) and potential use-after-free (CWE-416) conditions. An attacker with low-level privileges can exploit this to execute code in the context of the print spooler service.

Business Impact

The ability to execute arbitrary code on a system, even when requiring initial authentication, poses a severe risk to organizational security. This could allow an attacker to move laterally within the network, install persistent backdoors, or exfiltrate sensitive data from the host machine. The CVSS score of 8.8 underscores the critical nature of this vulnerability in an enterprise environment.

Remediation Plan

Immediate Action: Install the latest Windows security updates for the affected versions of Windows 10 and 11 immediately.

Proactive Monitoring: Monitor for unusual Print Spooler service behavior, such as unexpected crashes or unauthorized process spawning originating from the spooler subsystem.

Compensating Controls: If patching is delayed, disable the Print Spooler service on systems where printing is not required to eliminate the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of race conditions often makes them difficult to weaponize reliably, but the impact remains high.

Analyst Recommendation

Security teams should treat this vulnerability as a high priority due to the Print Spooler's history as an attack vector. Ensure all endpoints receive the relevant Microsoft monthly security patches to remediate the underlying synchronization flaws.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 147 could allow a remote attacker to trigger a crash or execute code.

Executive Summary:
A use-after-free vulnerability in the WebRTC component of Google Chrome may lead to system compromise if successfully exploited.

Vulnerability Details

CVE-ID: CVE-2026-5860

Affected Software: Google, Chrome

Affected Versions: See vendor advisory

Vulnerability: This is a use-after-free vulnerability within the WebRTC implementation. An attacker could exploit this by enticing a user to visit a malicious website, leading to potential code execution or application instability.

Business Impact

As a browser-based vulnerability, the impact is significant for all users within an organization. A CVSS score of 8.8 indicates high risk, as exploitation can result in the compromise of user sessions, data theft, or malware installation on endpoints.

Remediation Plan

Immediate Action: Update Google Chrome to version 147 or later immediately.

Proactive Monitoring: Monitor for browser-related security alerts and ensure that automatic update mechanisms are functioning across the fleet.

Compensating Controls: Use browser-based security policies to restrict the execution of untrusted scripts or plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Browser vulnerabilities are frequently targeted. Organizations must ensure that all endpoints are running the latest version of Google Chrome to mitigate the risk of drive-by attacks exploiting this use-after-free flaw.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Edge (Chromium-based)
AFFECTED_VERSIONS: 1.0.0.0 up to (excluding) 150.0.4078.48
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An untrusted pointer dereference vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to potentially elevate privileges via a specifically crafted network interaction.

Executive Summary:
Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 are affected by an untrusted pointer dereference vulnerability that could allow an attacker to elevate privileges.

Vulnerability Details

CVE-ID: CVE-2026-58596

Affected Software: Microsoft Edge (Chromium-based)

Affected Versions: 1.0.0.0 up to (excluding) 150.0.4078.48

Vulnerability: The software fails to properly handle pointers, leading to an untrusted pointer dereference. This allows an unauthorized attacker to influence system behavior, potentially resulting in privilege escalation.

Business Impact

While the CVSS score is 8.3, the potential for privilege escalation makes this a high-priority concern for endpoint security. Successful exploitation could allow an attacker to move from a standard user context to a higher privilege level, significantly increasing the risk of persistent malware installation or full system takeover.

Remediation Plan

Immediate Action: Update Microsoft Edge to version 150.0.4078.48 or later through the browser's built-in update mechanism or via centralized deployment tools.

Proactive Monitoring: Review endpoint security logs for anomalous process execution patterns or signs of unexpected privilege escalation attempts.

Compensating Controls: Maintain robust endpoint protection platforms (EPP) to detect and block malicious code execution attempts arising from browser-based vulnerabilities.

Exploitation Status

Public Exploit Available: No confirmed public weaponized exploit.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Pointer dereference flaws are complex to exploit, often requiring user interaction to trigger the initial condition.

Analyst Recommendation

Organizations should ensure that automatic updates for Microsoft Edge are enabled and enforced across the fleet. Given the potential for privilege escalation, patching should be treated with high urgency to protect against future weaponization of this vulnerability.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: See enrichment data for specific Windows 10 and 11 versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow or wraparound vulnerability in Windows RDP allows an unauthorized attacker to execute arbitrary code over a network.

Executive Summary:
A critical integer overflow vulnerability in Windows RDP allows for remote code execution, necessitating urgent patching across affected Windows environments.

Vulnerability Details

CVE-ID: CVE-2026-58594

Affected Software: Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (24H2, 25H2)

Affected Versions: See individual build requirements: Windows 10 1607 (pre-10.0.14393.9339), 1809 (pre-10.0.17763.9020), 21H2 (pre-10.0.19044.7548), 22H2 (pre-10.0.19045.7548), Windows 11 24H2 (pre-10.0.26100.8875), 25H2 (pre-10.0.26100.8875).

Vulnerability: This vulnerability resides in the Windows Remote Desktop Protocol (RDP) stack, where an integer overflow or wraparound condition can be triggered. An unauthorized attacker can leverage this over a network to achieve remote code execution, typically involving user interaction.

Business Impact

Remote code execution in the RDP stack is a critical risk, as it provides an attacker with the ability to run arbitrary commands with the privileges of the logged-in user. With a CVSS score of 8.8, this vulnerability could lead to total system compromise, ransomware deployment, or the exfiltration of sensitive data from affected machines.

Remediation Plan

Immediate Action: Deploy the latest cumulative security updates for all affected versions of Windows 10 and 11 immediately.

Proactive Monitoring: Monitor network traffic for anomalous RDP activity and check system logs for signs of unexpected process execution.

Compensating Controls: Restrict access to RDP services to trusted networks only, preferably behind a VPN or through an RD Gateway with multi-factor authentication.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Integer overflow flaws in core protocols like RDP are often high-value targets for attackers, and the potential for remote code execution makes this a high-risk scenario.

Analyst Recommendation

Due to the nature of RDP as a primary attack vector, this vulnerability must be treated with the highest level of urgency. Administrators should prioritize patching all exposed Windows endpoints to prevent potential remote code execution attacks against their infrastructure.

---METADATA---
VENDOR: ZAPAD
PRODUCT: Image::WebP
AFFECTED_VERSIONS: 0 up to (excluding) 0.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Perl module Image::WebP bundles a vulnerable version of libwebp, which allows remote attackers to trigger heap corruption and potential code execution via a specially crafted WebP image.

Executive Summary:
A critical vulnerability in the ZAPAD Image::WebP module for Perl exposes systems to remote code execution due to the use of an outdated, vulnerable third-party component.

Vulnerability Details

CVE-ID: CVE-2026-58586

Affected Software: ZAPAD Image::WebP

Affected Versions: 0 up to (excluding) 0.3.0

Vulnerability: The software suffers from a dependency on a vulnerable third-party component, specifically an outdated version of libwebp. This allows an unauthenticated remote attacker to trigger heap corruption through malicious image processing.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for unauthenticated remote code execution with minimal complexity. Successful exploitation could lead to full system compromise, unauthorized access to sensitive data, and significant operational downtime. Because the vulnerable component is bundled directly within the module, standard system library updates will not remediate this risk.

Remediation Plan

Immediate Action: Upgrade the ZAPAD Image::WebP module to version 0.3.0 or later to ensure the bundled libwebp dependency is updated.

Proactive Monitoring: Monitor server application logs for abnormal memory usage or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Implement input validation or use a Web Application Firewall (WAF) to inspect incoming image files for malicious patterns, although these are temporary measures and not a replacement for patching.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild, but the presence of public proof-of-concept code elevates the risk significantly. The architectural decision to bundle outdated dependencies makes this module particularly susceptible to legacy vulnerabilities like CVE-2023-4863.

Analyst Recommendation

Given the critical severity and the ease of exploitation, immediate action is required to update the Image::WebP module. Organizations should verify their Perl environment dependencies and prioritize the transition to version 0.3.0 or newer to eliminate this high-risk attack vector.

---METADATA---
VENDOR: Contiki-NG
PRODUCT: Contiki-NG
AFFECTED_VERSIONS: Contiki-NG 0 up to (excluding) a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Contiki-NG is vulnerable to an out-of-bounds write in the MQTT client parse_publish_vhdr function, potentially leading to memory corruption.

Executive Summary:
A critical out-of-bounds write vulnerability in the Contiki-NG MQTT client allows unauthenticated remote attackers to trigger memory corruption, posing a significant risk to system stability.

Vulnerability Details

CVE-ID: CVE-2026-5857

Affected Software: Contiki-NG Contiki-NG

Affected Versions: Contiki-NG 0 up to (excluding) a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d

Vulnerability: This is an out-of-bounds write vulnerability (CWE-787) located in the parse_publish_vhdr function within the MQTT client implementation. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this memory corruption vulnerability could result in a denial of service or potentially arbitrary code execution within the context of the MQTT client. Given the CVSS score of 8.1, the high potential for system impact necessitates immediate attention to prevent disruption of critical IoT or embedded communications.

Remediation Plan

Immediate Action: Update the Contiki-NG source code to include the fix provided in commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d.

Proactive Monitoring: Monitor MQTT traffic for malformed packets or unexpected client crashes that may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation to isolate MQTT-enabled devices and limit exposure to untrusted network traffic.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the nature of memory corruption in embedded network stacks.

Analyst Recommendation

The severity of this vulnerability, combined with its potential to impact core network functionality, requires immediate remediation. Developers and system integrators should integrate the provided upstream fix into their build environments as soon as possible to mitigate the risk of remote compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setWiFiEasyCfg function, specifically through the merge argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5854

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability in the setWiFiEasyCfg function of the CGI handler, where the merge argument is not properly sanitized, allowing remote unauthenticated attackers to execute commands.

Business Impact

The severity of this flaw (CVSS 9.8) means an attacker can gain complete control over the device, leading to significant security risks including data theft, network interception, and further compromise of the local environment.

Remediation Plan

Immediate Action: Deploy the latest firmware update provided by Totolink to remediate the vulnerability.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or attempts to interact with the CGI handler.

Compensating Controls: Block external access to the device’s administrative CGI endpoints using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, significantly increasing the probability of exploitation.

Analyst Recommendation

Prompt firmware updates are critical for all Totolink A7100RU devices. Given the existence of public exploits, organizations should prioritize this remediation to maintain the security and integrity of their network infrastructure.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1607: 10.0.14393.0 up to (excluding) 10.0.14393.9339; Windows 10 Version 1809: 10.0.17763.0 up to (excluding) 10.0.17763.9020; Windows 10 Version 21H2: 10.0.19044.0 up to (excluding) 10.0.19044.7548; Windows 10 Version 22H2: 10.0.19045.0 up to (excluding) 10.0.19045.7548; Windows 11 Version 24H2: 10.0.26100.0 up to (excluding) 10.0.26100.8875; Windows 11 Version 25H2: 10.0.26200.0 up to (excluding) 10.0.26100.8875
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Microsoft Input Method Editor (IME) allows an authorized local attacker to elevate privileges on affected Windows systems.

Executive Summary:
A heap-based buffer overflow vulnerability in the Microsoft Input Method Editor allows an authenticated local attacker to achieve privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-58534

Affected Software: Microsoft Windows

Affected Versions: See metadata for specific version ranges.

Vulnerability: This is a heap-based buffer overflow (CWE-122) in the Microsoft Input Method Editor. An attacker must already have local access and low-level privileges to trigger the flaw, as the vulnerability requires authentication.

Business Impact

The ability for an authenticated user to elevate privileges can lead to a complete compromise of the local host. Given the CVSS score of 8.8, this vulnerability represents a high risk, as it enables attackers to bypass security boundaries, potentially leading to unauthorized data access, persistence, or lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft to the affected Windows versions listed in the metadata.

Proactive Monitoring: Monitor system logs for suspicious process execution or unexpected crashes related to the Input Method Editor service.

Compensating Controls: Ensure least-privilege principles are strictly enforced to limit the potential impact of local users.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires local access, the potential for privilege escalation makes it a high-priority item for patching in enterprise environments.

Analyst Recommendation

Due to the high CVSS score and the potential for full system compromise, organizations should prioritize the deployment of the vendor-provided patches. Immediate testing and deployment of these updates will mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is vulnerable to remote OS command injection via the setIpv6LanCfg function, exploitable through the addrPrefixLen argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5853

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setIpv6LanCfg function within the CGI handler fails to sanitize user input for the addrPrefixLen parameter, leading to an OS command injection vulnerability accessible to unauthenticated remote attackers.

Business Impact

Successful exploitation results in full control of the device, enabling the attacker to manipulate network traffic and pivot into the internal network. The 9.8 CVSS score reflects the high severity of this remote, unauthenticated access vector.

Remediation Plan

Immediate Action: Update the affected device to the latest firmware version provided by the manufacturer.

Proactive Monitoring: Review system logs for suspicious activity and monitor for unexpected changes to IPv6 settings.

Compensating Controls: Restrict management access to the device to a dedicated, secure management VLAN or trusted local IP addresses.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, necessitating immediate attention to prevent exploitation.

Analyst Recommendation

Given the high-risk nature of this vulnerability and the availability of public exploits, immediate firmware updates are essential. Administrators should treat this as a high-priority remediation task for all deployed A7100RU units.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Edge (Chromium-based)
AFFECTED_VERSIONS: 1.0.0.0 up to (excluding) 150.0.4078.50
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Microsoft Edge (Chromium-based) contains an improper access control vulnerability that enables unauthenticated attackers to perform security feature bypasses.

Executive Summary:
An improper access control flaw in Microsoft Edge (Chromium-based) presents a high risk by allowing unauthorized attackers to bypass critical security features over the network.

Vulnerability Details

CVE-ID: CVE-2026-58525

Affected Software: Microsoft Edge (Chromium-based)

Affected Versions: 1.0.0.0 up to (excluding) 150.0.4078.50

Vulnerability: The vulnerability (CWE-284) involves improper access control that permits an unauthenticated attacker to circumvent security controls. This is typically triggered over a network, potentially allowing a malicious actor to gain unauthorized access or manipulate browser security contexts.

Business Impact

Exploitation of this vulnerability could lead to the bypass of security mechanisms designed to protect user data and system integrity. With a CVSS score of 8.2, the risk of unauthorized access or escalation is significant, potentially resulting in data exfiltration or the compromise of local browser-based sessions.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft for the Edge browser as soon as they become available.

Proactive Monitoring: Review browser-related logs and network traffic for unusual patterns that might indicate attempts to trigger security feature bypasses.

Compensating Controls: Utilize endpoint protection software and enforce organizational policies that restrict the execution of untrusted web content.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Microsoft Edge users are advised to ensure their browser is updated to version 150.0.4078.50 or higher. Organizations should verify that their automated update channels are active to mitigate this high-severity risk.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU allows remote OS command injection via the setIptvCfg function by manipulating the igmpVer argument in the CGI handler.

Executive Summary:
A critical OS command injection flaw in Totolink A7100RU routers permits remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-5852

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability occurs in the setIptvCfg function of the CGI handler. An unauthenticated remote attacker can supply a malicious payload in the igmpVer argument to trigger OS command injection.

Business Impact

The ability to execute arbitrary commands remotely on a network device leads to total compromise of the device's functionality. This could lead to redirection of traffic, man-in-the-middle attacks, and unauthorized access to protected internal resources, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update to address the vulnerability in the CGI handler.

Proactive Monitoring: Monitor for anomalous traffic patterns and unexpected system configuration changes within the router's logs.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent filtering to inspect and block malicious CGI requests directed at the router.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code exists, significantly increasing the risk of active exploitation.

Analyst Recommendation

Urgent patching is required for all Totolink A7100RU devices. Administrators should ensure the latest firmware is deployed to mitigate the risk of remote command execution and potential network-wide compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setUPnPCfg function, specifically through the enable parameter in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-5851

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi component. An unauthenticated attacker can manipulate the enable parameter to inject and execute arbitrary OS commands.

Business Impact

This vulnerability enables full remote control of the affected device, potentially exposing the entire local area network to unauthorized surveillance or data exfiltration. With a CVSS score of 9.8, the impact includes total loss of device integrity and potential compromise of connected internal assets.

Remediation Plan

Immediate Action: Update the device firmware to the latest version supplied by the vendor to eliminate the command injection vector.

Proactive Monitoring: Review system logs for suspicious process spawning and monitor for unexpected changes to the UPnP configuration.

Compensating Controls: Disable UPnP and restrict access to the web management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available. The ease of remote exploitation makes this a high-priority threat.

Analyst Recommendation

Given the availability of public exploits and the critical nature of command injection, users must prioritize firmware remediation. Ensure all Totolink A7100RU devices are patched to prevent remote code execution attacks.

---METADATA---
VENDOR: MCP
PRODUCT: appium-mcp
AFFECTED_VERSIONS: < 1.85.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-site Scripting (XSS) vulnerability in MCP Appium allows for unauthorized script execution via improper input neutralization.

Executive Summary:
An unauthenticated Cross-site Scripting (XSS) vulnerability in the MCP Appium server presents a high risk of malicious script injection and unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-58500

Affected Software: MCP appium-mcp

Affected Versions: < 1.85.10

Vulnerability: The application is susceptible to CWE-79 (Cross-site Scripting) due to improper neutralization of input. This vulnerability is exploitable by an unauthenticated attacker via a network-based attack vector, potentially leading to unauthorized data access or malicious actions within the context of the user's browser.

Business Impact

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, unauthorized data exfiltration, or the defacement of the application interface. Given the CVSS 8.2 score, this is classified as a High-severity risk that could compromise the integrity and confidentiality of automated testing environments managed by the MCP server.

Remediation Plan

Immediate Action: Update the appium-mcp package to version 1.85.10 or later to resolve the input sanitization flaw.

Proactive Monitoring: Monitor application access logs for suspicious URL patterns or unexpected script injections targeting the MCP server interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unconfirmed, XSS vulnerabilities in server-side automation tools often attract interest for supply chain or lateral movement attacks.

Analyst Recommendation

The presence of an XSS vulnerability in a component designed for AI-assisted automation poses a significant risk to the security of testing workflows. Administrators must prioritize updating to the patched version immediately to prevent unauthorized script execution and potential systemic compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU contains an OS command injection vulnerability in the setVpnPassCfg function, allowing remote attackers to execute arbitrary system commands via the pptpPassThru parameter.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5850

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability within the CGI handler’s setVpnPassCfg function. An unauthenticated remote attacker can inject malicious commands through the pptpPassThru argument.

Business Impact

Successful exploitation grants an attacker complete control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of sensitive data, and the establishment of a persistent foothold for further lateral movement within the corporate environment. Given the CVSS score of 9.8, this poses a severe risk to organizational confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink immediately to patch the vulnerable CGI handler.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous command execution patterns.

Compensating Controls: Implement strict firewall rules to restrict access to the device's administrative interface and CGI endpoints from untrusted external networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability. The risk of active exploitation is high; immediate patching is required.

Analyst Recommendation

The presence of a publicly available exploit for this critical command injection flaw necessitates immediate action. Administrators must prioritize updating the firmware on all exposed A7100RU units to prevent unauthorized system access and potential full device takeover.

---METADATA---
VENDOR: EverMind-AI
PRODUCT: EverOS
AFFECTED_VERSIONS: < 1.0.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
EverOS contains a path traversal vulnerability that allows unauthenticated attackers to manipulate file paths and potentially access unauthorized areas of the system.

Executive Summary:
A path traversal vulnerability in EverMind-AI EverOS poses a significant risk of unauthorized file system access due to improper input validation.

Vulnerability Details

CVE-ID: CVE-2026-58499

Affected Software: EverMind-AI EverOS

Affected Versions: < 1.0.1

Vulnerability: This vulnerability is caused by improper limitation of a pathname to a restricted directory (CWE-22). The flaw allows an unauthenticated remote attacker to traverse the file system and access or manipulate sensitive files outside the intended application directory.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, source code, or application data, resulting in a loss of confidentiality. With a CVSS score of 8.2, this high-severity flaw requires immediate attention to prevent potential system compromise and unauthorized data access that could disrupt business operations.

Remediation Plan

Immediate Action: Upgrade to EverOS version 1.0.1 or later immediately to resolve the path traversal vulnerability.

Proactive Monitoring: Review system and application access logs for suspicious path patterns, such as sequences like "../" or absolute file paths in request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts directed at the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk to the integrity and confidentiality of the EverOS environment. Administrators must prioritize the application of the vendor-provided patch (v1.0.1) as soon as possible to neutralize this threat.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: < 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The grav-plugin-database for Grav CMS is vulnerable to SQL injection via the PDO::tableExists method due to improper input sanitization.

Executive Summary:
A critical SQL injection vulnerability in the Grav CMS database plugin allows unauthorized attackers to execute arbitrary SQL commands against the backend database.

Vulnerability Details

CVE-ID: CVE-2026-58492

Affected Software: getgrav grav

Affected Versions: < 1.2.0

Vulnerability: The plugin fails to sanitize the table argument in the PDO::tableExists method before interpolating it into a raw SQL query. This allows an attacker to inject arbitrary SQL commands, resulting in unauthorized database interaction.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to the complete exposure of sensitive site data, unauthorized modification of records, or potential administrative account takeover. With a CVSS score of 9.2, the vulnerability poses a high risk to the confidentiality and integrity of the CMS-managed data.

Remediation Plan

Immediate Action: Update the grav-plugin-database to version 1.2.0 or later to resolve the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected table enumeration or syntax errors indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection capabilities to block malicious payloads targeting the database plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of SQL injection vulnerabilities, immediate application of the provided patch is essential. Organizations should update the plugin and perform a security audit of the database to ensure no unauthorized modifications have occurred prior to the update.

---METADATA---
VENDOR: HedgeDoc
PRODUCT: HedgeDoc
AFFECTED_VERSIONS: < 1.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HedgeDoc is susceptible to uncontrolled resource consumption and data amplification vulnerabilities that may allow a logged-in user to cause a denial-of-service condition.

Executive Summary:
HedgeDoc versions prior to 1.11.0 are vulnerable to resource exhaustion attacks, potentially leading to service unavailability.

Vulnerability Details

CVE-ID: CVE-2026-58486

Affected Software: HedgeDoc HedgeDoc

Affected Versions: < 1.11.0

Vulnerability: This vulnerability involves uncontrolled resource consumption (CWE-400) and improper handling of highly compressed data (CWE-409). It requires low-privilege authenticated access to trigger the data amplification, which can lead to a significant denial-of-service condition affecting the application's availability.

Business Impact

The exploitation of this vulnerability could lead to significant system downtime, impacting the ability of teams to collaborate on markdown notes. With a CVSS score of 8.3, the high impact on availability is a critical concern for organizations relying on HedgeDoc for real-time documentation and project management, potentially disrupting workflows.

Remediation Plan

Immediate Action: Update the HedgeDoc installation to version 1.11.0 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory usage, for sudden, anomalous spikes that could indicate exploitation attempts.

Compensating Controls: Implement rate limiting and request size restrictions at the Web Application Firewall (WAF) or load balancer level to mitigate the impact of data amplification attacks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to crash the application via malformed or highly compressed data inputs.

Analyst Recommendation

Given the CVSS score of 8.3, this vulnerability presents a high risk to service availability. Administrators should prioritize updating to version 1.11.0 immediately to eliminate the underlying resource consumption flaw.

---METADATA---
VENDOR: Creative Themes
PRODUCT: Blocksy Companion
AFFECTED_VERSIONS: 0 through 2.1.46
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Blocksy Companion WordPress plugin is vulnerable to unauthenticated arbitrary file uploads via the save_attachments function, enabling remote code execution by bypassing file extension validation.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress poses a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-58480

Affected Software: Creative Themes Blocksy Companion

Affected Versions: 0 through 2.1.46

Vulnerability: This vulnerability exists due to improper input validation in the save_attachments function, which allows unauthenticated attackers to upload malicious files. By utilizing double-extension filenames, an attacker can bypass the extension filter and trigger execution of arbitrary PHP code on the underlying web server.

Business Impact

A successful exploit grants an attacker full remote code execution capabilities on the host server. This could lead to a complete compromise of the WordPress environment, unauthorized access to site databases, and the potential for lateral movement within the hosting infrastructure. Given the 9.8 CVSS score, this vulnerability represents an immediate and severe threat to business continuity and data integrity.

Remediation Plan

Immediate Action: Update the Blocksy Companion plugin to version 2.1.47 or later immediately.

Proactive Monitoring: Review web server access logs for requests targeting the Advanced Reviews feature or suspicious file paths containing double extensions (e.g., .php.woff2).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing prohibited extensions or suspicious patterns in request parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute arbitrary code makes this a top-priority remediation item. Administrators must verify their current plugin version and apply the update without delay to prevent potential site takeovers.

---METADATA---
VENDOR: Dan-in-CA
PRODUCT: Sustainable Irrigation Platform (SIP)
AFFECTED_VERSIONS: 0 through 5.2.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Sustainable Irrigation Platform (SIP) contains a command injection vulnerability in the cli_control plugin that allows unauthenticated attackers to execute arbitrary OS commands.

Executive Summary:
A critical command injection vulnerability in the Sustainable Irrigation Platform (SIP) allows unauthenticated attackers to achieve remote code execution on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-58479

Affected Software: Dan-in-CA Sustainable Irrigation Platform (SIP)

Affected Versions: 0 through 5.2.16

Vulnerability: This vulnerability is a command injection flaw (CWE-78) located within the optional cli_control plugin. By sending a malicious payload to the plugin's HTTP endpoint, an unauthenticated attacker can trigger arbitrary OS command execution, particularly when default or missing passphrase protections are present.

Business Impact

The exploitation of this vulnerability results in full system compromise, as the attacker gains the ability to execute arbitrary commands with the privileges of the application. Given the CVSS score of 9.8, this poses a severe risk of data theft, lateral movement within the network, and the potential for complete operational disruption of the irrigation management infrastructure.

Remediation Plan

Immediate Action: Update Dan-in-CA SIP to the latest available version to address the command injection flaw in the cli_control plugin.

Proactive Monitoring: Monitor network traffic for unusual HTTP requests targeting the cli_control endpoint and review system logs for unauthorized command execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input strings and ensure that administrative interfaces are not exposed to the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

This vulnerability represents a critical risk to the availability and integrity of the host environment. Administrators must prioritize patching the affected software immediately to prevent potential remote code execution.

---METADATA---
VENDOR: topoteretes
PRODUCT: cognee
AFFECTED_VERSIONS: 0 up to (excluding) 1.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cognee contains an improper access control vulnerability allowing unauthenticated attackers to overwrite global LLM provider settings via the API, enabling wide-scale data exfiltration.

Executive Summary:
An unauthenticated access control vulnerability in topoteretes cognee allows attackers to hijack global LLM configurations, posing a critical risk of widespread data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-58473

Affected Software: topoteretes cognee

Affected Versions: 0 up to (excluding) 1.2.0

Vulnerability: This vulnerability involves a missing authorization and authentication check on the settings endpoint, allowing unauthenticated attackers to overwrite the system's global LLM provider configuration. By manipulating the process-wide singleton configuration cache, an attacker can redirect all LLM operations to a malicious endpoint to capture sensitive data.

Business Impact

The ability for an unauthenticated user to intercept and redirect LLM traffic poses a catastrophic risk to data confidentiality and integrity. With a CVSS score of 9.1, this vulnerability allows for the exfiltration of prompts, proprietary documents, and knowledge graph content, potentially leading to severe reputational damage and the compromise of sensitive organizational intelligence.

Remediation Plan

Immediate Action: Upgrade to topoteretes cognee version 1.2.0 or later, which includes the necessary authorization checks on the settings endpoint.

Proactive Monitoring: Monitor API traffic for unusual requests to the settings endpoint and audit LLM provider configuration changes for unauthorized modifications.

Compensating Controls: Implement strict network-level access controls to restrict access to the API and utilize a Web Application Firewall (WAF) to block unauthorized requests to administrative or settings-related endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security failure in the application's core configuration management. Administrators must prioritize updating to version 1.2.0 immediately to prevent potential unauthorized access to sensitive LLM data streams.

---METADATA---
VENDOR: EstrellaXD
PRODUCT: Auto_Bangumi
AFFECTED_VERSIONS: Before 3.2.8
---END_METADATA---

Description Summary:
Auto_Bangumi contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrative access.

Executive Summary:
Auto_Bangumi is susceptible to an authentication bypass via hard-coded default credentials, enabling unauthorized administrative access to the application.

Vulnerability Details

CVE-ID: CVE-2026-58466

Affected Software: EstrellaXD Auto_Bangumi

Affected Versions: Before 3.2.8

Vulnerability: The application seeds default credentials during initial startup when the user table is empty. An unauthenticated attacker can leverage these known credentials to authenticate as an administrator and gain full control over the application.

Business Impact

A CVSS score of 9.8 reflects the critical nature of this flaw, as it permits full administrative takeover of the application. This could result in the unauthorized modification of downloader configurations, interception of RSS feeds, and exposure of sensitive API endpoints, potentially leading to a complete compromise of the automated media management workflow.

Remediation Plan

Immediate Action: Update the application to version 3.2.8 or later, which addresses the insecure default user creation process.

Proactive Monitoring: Review system logs for multiple failed or anomalous login attempts and verify the list of authorized users within the application’s administrative interface.

Compensating Controls: Ensure the instance is not exposed to the public internet and require access via a secure VPN or an authenticated reverse proxy to limit the attack surface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of hard-coded credentials represents a significant security oversight that facilitates immediate unauthorized access. Administrators must update the software and verify that no unauthorized user accounts were created during the period the application was exposed. Access control policies should be strictly enforced to prevent unauthorized actors from reaching the login endpoint.

---METADATA---
VENDOR: ajith-ab
PRODUCT: react-native-receive-sharing-intent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in the react-native-receive-sharing-intent library allows malicious co-resident applications to overwrite files outside the intended cache directory.

Executive Summary:
A path traversal vulnerability in the react-native-receive-sharing-intent library allows malicious co-resident applications to conduct unauthorized file system operations.

Vulnerability Details

CVE-ID: CVE-2026-58460

Affected Software: ajith-ab react-native-receive-sharing-intent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a path traversal vulnerability where a malicious application on the same device can supply a crafted _display_name value containing directory traversal sequences. This allows the attacker to write files to arbitrary locations outside the application’s designated cache directory via the ContentProvider.

Business Impact

The CVSS score of 7.7 reflects the risk of privilege escalation and potential data destruction on mobile devices. If exploited, a malicious application could overwrite critical files or configuration data, leading to application instability or the exfiltration of sensitive information stored within the mobile environment.

Remediation Plan

Immediate Action: Update the react-native-receive-sharing-intent dependency in all affected mobile applications to the version containing the security fix.

Proactive Monitoring: Review application logs for unexpected file write errors or anomalous path components in content provider interactions.

Compensating Controls: Implement strict input validation for all data received via ContentProviders to ensure that file names do not contain path traversal characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers should immediately audit their mobile application dependencies and update the affected library. Given the risk of local file system manipulation, ensuring that inputs are properly sanitized is critical for maintaining the security posture of the mobile application.

---METADATA---
VENDOR: NTPsec
PRODUCT: gpsd
AFFECTED_VERSIONS: 0 through 3.27.5, 0 through 4c06658e988f4ced1a7a574ce082a22ef625df56
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
NTPsec gpsd is vulnerable to OS command injection via the gnuplot plot title subtype field, allowing for arbitrary code execution.

Executive Summary:
A critical OS command injection vulnerability in NTPsec gpsd allows attackers to execute arbitrary commands with the privileges of the service.

Vulnerability Details

CVE-ID: CVE-2026-58459

Affected Software: NTPsec gpsd

Affected Versions: 0 through 3.27.5, 0 through 4c06658e988f4ced1a7a574ce082a22ef625df56

Vulnerability: This vulnerability is an OS command injection (CWE-78) flaw triggered via the gnuplot plot title subtype field. The attack vector is local with user interaction required, though the potential impact on system integrity and availability is severe.

Business Impact

Successful exploitation of this vulnerability could grant an attacker the ability to execute unauthorized commands on the host system. Given the CVSS score of 7.8, this poses a significant risk to system integrity, potentially leading to full system compromise, unauthorized data access, or service disruption.

Remediation Plan

Immediate Action: Review the provided vendor references and update to the latest patched version of gpsd once available.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns or unexpected gnuplot activity originating from the gpsd service.

Compensating Controls: Restrict access to the gpsd service and ensure it runs with the minimum necessary privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this command injection vulnerability necessitates immediate attention. Administrators should prioritize identifying instances of the affected software and applying updates as soon as they are released by the vendor to prevent potential system-level compromise.

---METADATA---
VENDOR: Shenzhen Aitemi E Commerce Co.
PRODUCT: M300 Wi-Fi Repeater
AFFECTED_VERSIONS: Hardware model MT02
---END_METADATA---

Description Summary:
The Shenzhen Aitemi M300 Wi-Fi Repeater is vulnerable to unauthenticated OS command injection via the smacfilter_conf handler, allowing remote attackers to execute arbitrary shell commands as root.

Executive Summary:
A critical OS command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater allows unauthenticated attackers to achieve full root-level device compromise.

Vulnerability Details

CVE-ID: CVE-2026-58457

Affected Software: Shenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater

Affected Versions: Hardware model MT02

Vulnerability: This is an OS command injection vulnerability triggered by the lack of sanitization in the smacfilter_conf web backend handler. An unauthenticated, network-adjacent attacker can inject malicious shell commands into specific GET parameters, which are then executed with root privileges.

Business Impact

Successful exploitation grants an attacker full root-level control over the affected Wi-Fi repeater. This allows for persistent unauthorized access to the local network, traffic interception, and potential lateral movement into internal systems. Given the CVSS score of 9.8, the risk of total device takeover and subsequent network compromise is extreme.

Remediation Plan

Immediate Action: Update the firmware of the Shenzhen Aitemi M300 Wi-Fi Repeater to the latest version provided by the manufacturer.

Proactive Monitoring: Review web access logs for unusual GET requests containing semicolon-delimited payloads directed at the smacfilter_conf handler.

Compensating Controls: Restrict access to the device management interface to trusted administrative subnets or disable remote management features until the firmware is updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk due to the potential for unauthenticated root access. Administrators should prioritize the application of firmware updates immediately to prevent unauthorized device control and potential network-wide security breaches.