---METADATA---
VENDOR: JFrog
PRODUCT: Artifactory
AFFECTED_VERSIONS: 7.161.0 up to (excluding) 7.161.19, 7.146.0 up to (excluding) 7.146.36
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory allows authenticated users to manipulate VCS repository configurations and data URLs.

Executive Summary:
An authenticated Server-Side Request Forgery vulnerability in JFrog Artifactory allows low-privileged users to potentially access sensitive internal resources or perform unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-70551

Affected Software: JFrog Artifactory

Affected Versions: 7.161.0 up to (excluding) 7.161.19, 7.146.0 up to (excluding) 7.146.36

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability where an authenticated user with read access to a remote VCS repository can replace the configured origin or supply an absolute VCS data URL to force the server to initiate unintended network requests.

Business Impact

The vulnerability carries a CVSS score of 8.5, indicating a high severity risk. Successful exploitation could allow an attacker to pivot into internal networks, scan private infrastructure, or access metadata and configuration files that are otherwise inaccessible, leading to potential data exfiltration or service disruption.

Remediation Plan

Immediate Action: Update JFrog Artifactory instances to version 7.161.19, 7.146.36, or the latest available maintenance release provided by the vendor.

Proactive Monitoring: Review access logs for unusual repository configuration changes or unexpected outbound network connections originating from the Artifactory server.

Compensating Controls: Implement strict egress filtering on the Artifactory host to restrict communication to known, trusted VCS endpoints and block access to internal private IP ranges.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent risk is elevated due to the potential for SSRF to bypass perimeter security controls.

Analyst Recommendation

Given the high CVSS score and the potential for internal network exposure, organizations should prioritize patching affected Artifactory installations. Immediate application of the vendor-supplied updates is the only effective way to neutralize the underlying logic flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359628","name":"VDB-359628 | Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359628/cti","name":"VDB-359628 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798457","name":"Submit #798457 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_126/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.727Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows authenticated remote attackers to cause a denial of service or execute arbitrary code via the /goform/VirtualSer endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F456 router allows authenticated remote attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7055

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The flaw resides in the fromVirtualSer function within the httpd component, where the page parameter is copied into a stack-based buffer without sufficient length validation. This vulnerability requires the attacker to be authenticated with low privileges to trigger the overflow through a crafted HTTP POST request.

Business Impact

The ability to execute arbitrary code on networking equipment poses a severe risk to organizational security, as it grants attackers a foothold to intercept traffic, pivot into internal network segments, or disrupt critical connectivity. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the potential for total system compromise. Successful exploitation could lead to unauthorized access to sensitive data and significant operational downtime for users relying on the affected hardware.

Remediation Plan

Immediate Action: Since a specific patch version is not currently available, administrators should restrict network access to the management interface of the Tenda F456 to trusted administrative IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for suspicious POST requests targeting the /goform/VirtualSer endpoint, particularly those containing unusually long string parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules or network-level access control lists (ACLs) to filter traffic and block malformed requests directed at the vulnerable router interface.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the security researcher's technical write-up on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of boundary checks on user-supplied input in the HTTP handler.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat to internal infrastructure. Organizations should immediately isolate the management interfaces of affected Tenda F456 devices and monitor for vendor updates to address this memory corruption flaw as soon as they become available.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359627","name":"VDB-359627 | Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359627/cti","name":"VDB-359627 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798456","name":"Submit #798456 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_125/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote, authenticated attackers to achieve remote code execution or a denial of service via the /goform/PPTPDClient endpoint.

Executive Summary:
A stack-based buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7054

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromPptpUserAdd function of the httpd component. By sending a crafted POST request to the /goform/PPTPDClient endpoint with an overly long username parameter while opttype is set to 1, an authenticated attacker can trigger a stack-based buffer overflow.

Business Impact

The potential for remote code execution (RCE) allows an attacker to gain full control over the affected network device. This level of compromise can lead to complete network traffic interception, unauthorized access to internal resources, and significant system instability. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could severely impact the security and integrity of the local network environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the device management interface to trusted IP addresses only and disable unnecessary services like PPTP if not required.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/PPTPDClient endpoint, specifically looking for unusually large payloads in the username field.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to inspect and block excessively long input strings sent to router administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a functional Proof of Concept (PoC) is publicly available via a researcher write-up hosted on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-provided input, which allows for direct memory corruption.

Analyst Recommendation

Due to the critical nature of this memory corruption vulnerability and the availability of a public exploit, immediate defensive measures are required. Organizations should prioritize isolating affected Tenda F456 units from untrusted networks and monitor for vendor-provided firmware updates to address the underlying code defect.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359626","name":"VDB-359626 | Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359626/cti","name":"VDB-359626 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798455","name":"Submit #798455 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_124/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda F456 httpd component, allowing remote attackers to trigger a denial of service or execute arbitrary code via the page parameter in /goform/L7Prot.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 may allow remote attackers to achieve remote code execution or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-7053

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-120) triggered within the frmL7ProtForm function of the httpd service. An attacker with low-level access can send a crafted POST request to the /goform/L7Prot endpoint containing an overly long page parameter to corrupt memory.

Business Impact

The exploitation of this vulnerability poses a severe risk to network integrity and availability. Successful execution allows for unauthorized remote code execution, which could lead to full device compromise, data exfiltration, or the establishment of a persistent foothold in the local network. With a CVSS score of 8.8, this flaw represents a High severity risk that could result in significant operational downtime or the total loss of confidentiality and integrity for the affected device.

Remediation Plan

Immediate Action: As no official patch version is currently identified, users should restrict network access to the management interface of the Tenda F456 device. Ensure the device is not exposed to the public internet and limit access to trusted administrative subnets only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/L7Prot endpoint. Additionally, watch for unexpected device reboots or service instability, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming HTTP requests that contain excessively long strings within the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up provided by the vulnerability reporter.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on the user-provided input before passing it to the sprintf function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability demands immediate attention. Administrators must prioritize isolating the affected hardware from untrusted networks and contact the vendor for information regarding a firmware update. Until a formal patch is released, the device should be considered high-risk and monitored closely for any signs of compromise.

---METADATA---
VENDOR: Red Hat
PRODUCT: Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A flaw in the search-v2-operator allows for privilege escalation due to a ClusterRole granting excessive permissions, including the ability to manage RBAC configurations and approve CSRs.

Executive Summary:
A critical privilege escalation vulnerability exists in the Red Hat Advanced Cluster Management search-v2-operator that could allow an attacker to gain cluster administrator privileges.

Vulnerability Details

CVE-ID: CVE-2026-70496

Affected Software: Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an instance of CWE-250, where the operator utilizes a ClusterRole with excessive permissions. An authenticated attacker with low privileges can leverage this misconfiguration to impersonate entities, modify RBAC rules, and manage critical cluster resources.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the Kubernetes cluster environment. Given the CVSS score of 9.9, the impact on confidentiality, integrity, and availability is total, potentially resulting in unauthorized data access, service disruption, and the loss of entire containerized workloads.

Remediation Plan

Immediate Action: Consult the official Red Hat security advisory to identify and apply the latest security updates or configuration workarounds for the search-v2-operator.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious activities related to RBAC changes, CSR approvals, and unauthorized use of the search-v2-operator service account.

Compensating Controls: Implement restrictive network policies and limit the scope of service accounts to adhere to the principle of least privilege, reducing the potential impact of a compromised operator.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the broad scope of the permissions granted to the vulnerable operator.

Analyst Recommendation

This vulnerability represents a severe risk to cluster security. Administrators should prioritize reviewing the security advisory provided by Red Hat and apply all necessary updates or hardening steps to restrict the operator's privileges immediately.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat Advanced Cluster Management for Kubernetes
AFFECTED_VERSIONS: 2
CONFIDENCE: medium
MISSING: versions
---END_METADATA---

Description Summary:
A privilege management flaw in the search-v2-operator of Red Hat Advanced Cluster Management for Kubernetes may lead to unauthorized privilege escalation.

Executive Summary:
An improper privilege management vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows local authenticated users to escalate privileges and impact cluster security.

Vulnerability Details

CVE-ID: CVE-2026-70495

Affected Software: Red Hat Advanced Cluster Management for Kubernetes

Affected Versions: 2

Vulnerability: This is a privilege management issue within the search-v2-operator that allows a local user with low privileges to gain unauthorized control over cluster resources.

Business Impact

Successful exploitation allows an attacker to escalate privileges, potentially leading to full cluster compromise, unauthorized access to sensitive data, and the ability to modify or delete infrastructure resources. The CVSS score of 8.8 reflects the high risk of this vulnerability to the integrity and confidentiality of the entire Kubernetes cluster environment.

Remediation Plan

Immediate Action: Consult the Red Hat security advisory and apply the necessary patches or configuration changes to the search-v2-operator component immediately.

Proactive Monitoring: Monitor Kubernetes audit logs for suspicious activity involving operator service accounts or unexpected privilege changes.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) policies to limit the potential impact if a local account is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the environment suggests that exploitation requires prior local access to the cluster.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be treated as a priority. Administrators should audit their current cluster configurations and apply vendor-provided security updates to the affected operator components as soon as possible.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: >= 0.10.0, < 0.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Open WebUI suffers from missing and incorrect authorization flaws that allow authenticated users to perform unauthorized actions.

Executive Summary:
Open WebUI versions 0.10.0 through 0.10.x contain authorization vulnerabilities that could allow authenticated users to exceed their intended privileges and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-70494

Affected Software: Open WebUI Open WebUI

Affected Versions: >= 0.10.0, < 0.11.0

Vulnerability: The software fails to properly enforce authorization checks (CWE-862 and CWE-863), allowing an authenticated user to perform restricted operations.

Business Impact

With a CVSS score of 8.1, these authorization flaws pose a significant threat to the security of the AI platform. A malicious or compromised authenticated user could manipulate system settings or trigger unauthorized actions, leading to a loss of data integrity and potential service disruption.

Remediation Plan

Immediate Action: Update Open WebUI to version 0.11.0 or later to apply the necessary authorization fixes.

Proactive Monitoring: Monitor audit logs for unusual administrative activity or unauthorized modifications performed by standard user accounts.

Compensating Controls: Restrict access to the Open WebUI instance to trusted networks and enforce the principle of least privilege for all platform users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authorization bypasses of this nature are often targeted by internal threats or compromised accounts.

Analyst Recommendation

The update to version 0.11.0 is essential to restore proper access control enforcement. Administrators should verify the patch deployment across all instances and review user permissions to ensure no unauthorized configurations were established prior to the update.

---METADATA---
VENDOR: open-webui
PRODUCT: open-webui
AFFECTED_VERSIONS: >= 0.10.0, < 0.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in Open WebUI allows authenticated attackers with low privileges to execute arbitrary scripts in the context of other users' sessions.

Executive Summary:
A high-severity cross-site scripting vulnerability in Open WebUI allows authenticated attackers to compromise user sessions and perform unauthorized actions through malicious script injection.

Vulnerability Details

CVE-ID: CVE-2026-70492

Affected Software: open-webui open-webui

Affected Versions: >= 0.10.0, < 0.11.0

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) resulting from improper neutralization of user-supplied input during web page generation. The vulnerability requires the attacker to be authenticated (PR:L) and involves user interaction (UI:R) to execute the malicious payload.

Business Impact

An attacker successfully exploiting this XSS vulnerability could hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of other users, including administrative accounts. With a CVSS score of 8.7, this flaw poses a substantial risk to data integrity and confidentiality within the AI platform, potentially leading to unauthorized access to proprietary data or AI model configurations.

Remediation Plan

Immediate Action: Update Open WebUI to version 0.11.0 or later to patch the input sanitization flaw.

Proactive Monitoring: Inspect application logs for unusual request patterns, particularly those involving script tags or unexpected encoded characters in input fields.

Compensating Controls: Ensure that Content Security Policy (CSP) headers are strictly configured to prevent the execution of unauthorized scripts within the browser.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. XSS vulnerabilities in collaborative platforms are highly effective for lateral movement and account takeover.

Analyst Recommendation

Administrators must perform an immediate update to the latest patched version of Open WebUI. Given the potential for session compromise, organizations should also review recent audit logs for any suspicious account activity that may have occurred prior to patching.

---METADATA---
VENDOR: PixelYourSite
PRODUCT: PixelYourSite Pro
AFFECTED_VERSIONS: 0 through 12.5.0.1
CONFIDENCE: high
MISSING: none
CREDITS: Osvaldo Noe Gonzalez Del Rio (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/273e25aa-4c00-4463-afc5-d8b2433af064?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/trunk/includes/events/EmbeddedVideo.php#L83","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/tags/12.5.0/includes/events/EmbeddedVideo.php#L83","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/trunk/includes/events/EmbeddedVideo.php#L66","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/tags/12.5.0/includes/events/EmbeddedVideo.php#L66","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/trunk/includes/events/EmbeddedVideo.php#L92","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/tags/12.5.0/includes/events/EmbeddedVideo.php#L92","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/pixelyoursite-pro/tags/12.4.1.1/includes/events/EmbeddedVideo.php#L83","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.635Z
---END_METADATA---

Description Summary:
The PixelYourSite Pro WordPress plugin is vulnerable to unauthenticated blind Server-Side Request Forgery via the scan_video function, allowing attackers to probe internal network services.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in the PixelYourSite Pro WordPress plugin allows unauthenticated attackers to perform unauthorized requests against internal infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-7049

Affected Software: PixelYourSite PixelYourSite Pro

Affected Versions: 0 through 12.5.0.1

Vulnerability: This flaw is a Server-Side Request Forgery (CWE-918) occurring in the scan_video function. An unauthenticated attacker can force the web application to make requests to arbitrary URLs, enabling the discovery and interaction with internal services that are otherwise inaccessible from the public internet.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to internal network security. Because the application can act as a proxy, an attacker may bypass perimeter firewalls to scan, query, or modify sensitive data within internal services, potentially leading to unauthorized information disclosure or service disruption. With a CVSS score of 7.2, this vulnerability is classified as High severity due to its potential to facilitate lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update the PixelYourSite Pro plugin to the latest available version that addresses this vulnerability.

Proactive Monitoring: Monitor server access logs and outbound network traffic for suspicious requests originating from the web server to internal IP addresses or unusual external domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious outbound requests or restricted access to the vulnerable scan_video endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is blind, meaning the attacker cannot see the direct output, the ability to interact with internal APIs or services remains a significant security concern for enterprise environments.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention, especially for WordPress installations that reside within secured internal networks. Administrators should verify the current version of the PixelYourSite Pro plugin and apply the latest update provided by the vendor without delay to neutralize the risk of unauthorized internal network access.

---METADATA---
VENDOR: open-webui
PRODUCT: open-webui
AFFECTED_VERSIONS: >= 0.9.0, < 0.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Open WebUI is susceptible to Cross-site Scripting and UI layer restriction flaws that could allow an authenticated attacker to execute malicious scripts or manipulate the interface.

Executive Summary:
An authenticated vulnerability in the Open WebUI platform could allow attackers to perform Cross-site Scripting and UI manipulation, potentially leading to unauthorized actions within the application.

Vulnerability Details

CVE-ID: CVE-2026-70486

Affected Software: open-webui open-webui

Affected Versions: >= 0.9.0, < 0.11.0

Vulnerability: This issue encompasses CWE-79 and CWE-1021, involving improper neutralization of input and insufficient restriction of UI layers. These vulnerabilities require the attacker to possess low-level privileges (authenticated) to trigger the malicious payload.

Business Impact

Successful exploitation allows an attacker to inject scripts that execute in the context of a user session, leading to potential data theft, session hijacking, or unauthorized interface interactions. With a CVSS score of 8.2, this vulnerability represents a significant risk to the integrity and confidentiality of the AI platform, especially in environments where users trust the generated output.

Remediation Plan

Immediate Action: Upgrade open-webui to version 0.11.0 or later to incorporate the security patches provided by the vendor.

Proactive Monitoring: Monitor application logs for suspicious script injections or unusual UI-related behavior originating from authenticated user accounts.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's reliance on authenticated access limits the attack surface, but the high severity score warrants prompt patching.

Analyst Recommendation

The vulnerabilities identified in Open WebUI present a high risk to organizational data and platform integrity. Administrators should prioritize the update to version 0.11.0 to ensure these security flaws are fully remediated and to prevent potential unauthorized access or script execution.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: >= 0.8.0, < 0.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Open WebUI is susceptible to an improper authentication flaw that can be exploited by an attacker via user interaction.

Executive Summary:
Open WebUI versions 0.8.0 through 0.10.x are vulnerable to an improper authentication flaw that could allow an attacker to gain unauthorized access to sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-70482

Affected Software: Open WebUI Open WebUI

Affected Versions: >= 0.8.0, < 0.11.0

Vulnerability: This is an improper authentication vulnerability (CWE-287) that requires user interaction and is exploitable by an unauthenticated attacker.

Business Impact

The CVSS score of 8.1 reflects the high potential for data compromise or unauthorized administrative actions. Successful exploitation could allow an attacker to intercept sensitive data or perform actions on behalf of a victim, resulting in severe reputational or operational impact.

Remediation Plan

Immediate Action: Update Open WebUI to version 0.11.0 or later to resolve the underlying authentication weakness.

Proactive Monitoring: Review application logs for suspicious authentication events or unexpected redirects that might indicate an attempt to exploit user-interaction-based vulnerabilities.

Compensating Controls: Educate users on the risks of clicking suspicious links and utilize browser-based security extensions to mitigate potential cross-site or interception-based attacks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction adds a layer of complexity to the attack, but it remains a critical risk for high-traffic environments.

Analyst Recommendation

Upgrading to version 0.11.0 is the only reliable way to eliminate this risk. Due to the high CVSS score and the potential for unauthorized data access, this update should be prioritized in the next maintenance cycle.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: < 3.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Flowise contains an improper access control vulnerability, enabling unauthenticated attackers to bypass authorization checks via user-controlled keys.

Executive Summary:
A high-severity access control vulnerability in Flowise allows unauthenticated attackers to bypass authorization, potentially leading to unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-70476

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.2

Vulnerability: The application fails to properly enforce access controls (CWE-284) and is subject to authorization bypass through user-controlled keys (CWE-639). This vulnerability is accessible by unauthenticated attackers.

Business Impact

With a CVSS score of 8.3, this vulnerability presents a significant risk to the security of the Flowise environment. Unauthenticated access allows attackers to bypass security boundaries, potentially leading to unauthorized modification of LLM flows and system data, which could result in service disruption or loss of control over model outputs.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to ensure all access control and authorization bypass vulnerabilities are addressed.

Proactive Monitoring: Review application access logs for anomalous requests or unauthorized attempts to access protected endpoints.

Compensating Controls: Utilize a Web Application Firewall to block suspicious traffic patterns directed at the application API until the update is deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is dangerous due to the lack of authentication required to trigger the access control failure.

Analyst Recommendation

The severity of this flaw, combined with the lack of required authentication, necessitates immediate action. Organizations must upgrade to Flowise version 3.1.3 or higher immediately to mitigate the risk of unauthorized access and data manipulation.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: < 3.1.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Flowise contains a vulnerability involving missing authorization and improper information exposure, allowing authenticated users to access unauthorized sensitive data.

Executive Summary:
Flowise versions prior to 3.1.3 are vulnerable to an authorization bypass that exposes sensitive information to authenticated users, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-70473

Affected Software: FlowiseAI Flowise

Affected Versions: < 3.1.3

Vulnerability: This vulnerability involves missing authorization controls and the exposure of sensitive information through data queries. It requires the attacker to have low-level authenticated access to the system to exploit the flaw.

Business Impact

The ability for an authenticated user to bypass authorization checks and access sensitive LLM flow data can lead to the compromise of proprietary workflows, API keys, or private configuration data. With a CVSS score of 8.3, this high-severity vulnerability represents a substantial risk to organizational data security, potentially leading to unauthorized data exfiltration and loss of integrity in customized AI deployments.

Remediation Plan

Immediate Action: Update Flowise to version 3.1.3 or later to apply the necessary authorization patches.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or unexpected API requests originating from standard user accounts.

Compensating Controls: Implement strict network access controls and ensure that the Flowise instance is not exposed to the public internet without an identity-aware proxy or VPN.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally an authorization failure, which is typically straightforward to weaponize once a target endpoint is identified.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of proof-of-concept material, necessitates immediate action. Administrators must prioritize updating to version 3.1.3 to remediate the authorization bypass and prevent unauthorized access to sensitive LLM data.

---METADATA---
VENDOR: Jenkins
PRODUCT: Multijob Plugin
AFFECTED_VERSIONS: 0 through 669.v9d96a_d9c71b_0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A cross-site request forgery (CSRF) vulnerability in the Jenkins Multijob Plugin allows attackers to perform unauthorized actions on behalf of authenticated users.

Executive Summary:
A CSRF vulnerability in the Jenkins Multijob Plugin could allow attackers to execute unauthorized commands by leveraging an authenticated user session.

Vulnerability Details

CVE-ID: CVE-2026-70432

Affected Software: Jenkins Multijob Plugin

Affected Versions: 0 through 669.v9d96a_d9c71b_0

Vulnerability: This is a cross-site request forgery (CSRF) vulnerability affecting the Jenkins Multijob Plugin. An attacker can trick an authenticated user into performing unintended actions within the plugin, potentially leading to unauthorized configuration changes or job executions.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue, as it could lead to the hijacking of administrative actions within Jenkins. Successful exploitation may result in unauthorized modifications to build processes or the exposure of internal system configurations, significantly impacting development security.

Remediation Plan

Immediate Action: Consult the Jenkins security advisory for the latest guidance and apply the necessary plugin updates as soon as they are released.

Proactive Monitoring: Review web server and Jenkins application logs for suspicious requests that originate from unexpected sources or referrers.

Compensating Controls: Ensure all users are logged out of active sessions when not in use and consider implementing a Web Application Firewall (WAF) to filter malicious cross-site requests.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Due to the nature of CSRF attacks, this vulnerability is highly dependent on user interaction. Security teams should prioritize patching and ensure that users are educated on the risks of accessing external links while maintaining active administrative sessions.

---METADATA---
VENDOR: Jenkins
PRODUCT: Multijob Plugin
AFFECTED_VERSIONS: 0 through 669.v9d96a_d9c71b_0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A security vulnerability in the Jenkins Multijob Plugin allows for unauthorized actions or information disclosure, affecting versions up to 669.v9d96a_d9c71b_0.

Executive Summary:
A high-severity vulnerability in the Jenkins Multijob Plugin could allow authenticated attackers to gain unauthorized access or influence system operations.

Vulnerability Details

CVE-ID: CVE-2026-70431

Affected Software: Jenkins Multijob Plugin

Affected Versions: 0 through 669.v9d96a_d9c71b_0

Vulnerability: The vulnerability exists within the Jenkins Multijob Plugin and requires the attacker to have authenticated access to the Jenkins environment. It allows for potential unauthorized actions due to insufficient security controls within the plugin functions.

Business Impact

With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of CI/CD pipelines. Exploitation could allow an attacker to disrupt development workflows, inject malicious code into build processes, or access sensitive build artifacts, leading to potential supply chain compromise.

Remediation Plan

Immediate Action: Review the official Jenkins security advisory and apply the recommended plugin update or configuration change.

Proactive Monitoring: Monitor Jenkins audit logs for unusual job executions or configuration changes initiated by unexpected user accounts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) within Jenkins to limit the number of users who can interact with the Multijob Plugin and associated job configurations.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Jenkins administrators should treat this vulnerability with high urgency given the potential for CI/CD pipeline compromise. Ensure the Multijob Plugin is updated to the latest secure version once available.

---METADATA---
VENDOR: Jenkins
PRODUCT: Jenkins
AFFECTED_VERSIONS: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Jenkins is vulnerable to an improper handling of case-insensitivity in user and group names, which could allow unauthorized impersonation.

Executive Summary:
A vulnerability in Jenkins regarding case-insensitive name handling could allow attackers to impersonate existing users or groups.

Vulnerability Details

CVE-ID: CVE-2026-70429

Affected Software: Jenkins

Affected Versions: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier

Vulnerability: The vulnerability involves the inconsistent handling of case-insensitivity for user and group names. This flaw enables attackers to create new entities that match existing ones, potentially leading to unauthorized privilege grants or identity impersonation.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a significant risk to the integrity of the CI/CD pipeline. An attacker who successfully exploits this flaw could gain unauthorized administrative access, modify build configurations, or inject malicious code into the development lifecycle, leading to severe downstream security consequences.

Remediation Plan

Immediate Action: Update Jenkins to version 2.576 or the LTS version to 2.568.2 immediately.

Proactive Monitoring: Audit the Jenkins user and group database for any names that appear to be duplicates or variations of existing high-privilege accounts.

Compensating Controls: Implement strict identity and access management policies, and ensure that Jenkins instances are not exposed to the public internet where unauthenticated attackers might attempt to register new accounts.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw was discovered through a bug bounty program, suggesting it is a complex logic error rather than a trivial entry point.

Analyst Recommendation

The severity of this issue demands prompt attention to prevent identity-based attacks within the development environment. Administrators should verify their current version and apply the recommended patches to secure the Jenkins instance against potential impersonation attacks.

---METADATA---
VENDOR: 666ghj
PRODUCT: MiroFish
AFFECTED_VERSIONS: 0.1.0, 0.1.1, 0.1.2
CONFIDENCE: high
MISSING: patch
CREDITS: Yu_Bao (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359621","name":"VDB-359621 | 666ghj MiroFish REST API Endpoint init.py create_app missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359621/cti","name":"VDB-359621 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798583","name":"Submit #798583 | 666ghj MiroFish 0.1.2 Missing Authentication for Critical Functions","tags":["third-party-advisory"]},{"url":"https://github.com/666ghj/MiroFish/issues/487","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://github.com/666ghj/MiroFish/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
MiroFish versions up to 0.1.2 contain a missing authentication vulnerability in multiple REST API endpoints, allowing unauthenticated remote attackers to access, modify, or delete sensitive data.

Executive Summary:
The MiroFish application is vulnerable to a critical missing authentication flaw that allows unauthenticated remote attackers to perform destructive operations and exfiltrate sensitive project data.

Vulnerability Details

CVE-ID: CVE-2026-7042

Affected Software: 666ghj MiroFish

Affected Versions: 0.1.0, 0.1.1, 0.1.2

Vulnerability: The application fails to implement any authentication or authorization middleware for its REST API blueprints, specifically within the backend/app/init.py file. This allows any unauthenticated network-reachable user to interact with sensitive endpoints, including those that execute destructive file system operations or trigger expensive external API calls.

Business Impact

Successful exploitation poses a severe risk to data integrity and business continuity. An attacker can permanently delete all project files, reports, and simulation data, leading to significant data loss. Furthermore, the ability to trigger unauthorized simulation processes and LLM API calls can result in substantial financial damage through resource exhaustion and service disruption. While the CVSS score is 7.3, the potential for total data destruction and unauthorized process control suggests a higher operational risk.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the MiroFish API, ensuring it is not exposed to the public internet or untrusted networks.

Proactive Monitoring: Review application access logs for unexpected requests to /api/ endpoints, particularly those utilizing the DELETE or POST methods, which may indicate unauthorized attempts to delete projects or trigger processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway in front of the application to enforce authentication and block unauthorized requests to the vulnerable API routes until a permanent code-level fix is implemented.

Exploitation Status

Public Exploit Available: Yes, a detailed technical write-up containing reproduction steps and specific API endpoints has been published via the official project GitHub issue tracker.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the complete absence of session management or token validation across the application API.

Analyst Recommendation

The risk associated with this vulnerability is extreme due to the lack of any access control mechanisms. Organizations currently utilizing MiroFish must treat this as a high-priority incident and isolate the application from network access immediately. Continuous monitoring for unauthorized API activity is essential until the vendor provides a formal security update that implements mandatory authentication for all API endpoints.

---METADATA---
VENDOR: RRWO
PRODUCT: Text::Minify::XS
AFFECTED_VERSIONS: 0.3.0 up to (excluding) 0.7.8
CONFIDENCE: high
MISSING: none
CREDITS: CPANSec (finder)
SOURCES_JSON: [{"url":"https://github.com/robrwo/Text-Minify-XS/security/advisories/GHSA-jqhf-vv4h-77h2","name":null,"tags":["vendor-advisory"]},{"url":"https://metacpan.org/release/RRWO/Text-Minify-XS-v0.7.8/changes","name":null,"tags":["release-notes"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.707Z
---END_METADATA---

Description Summary:
Text::Minify::XS is vulnerable to a heap-based buffer overflow when processing malformed UTF-8 characters, potentially leading to a denial of service.

Executive Summary:
A heap-based buffer overflow in the Text::Minify::XS Perl module allows unauthenticated attackers to cause a denial of service through specifically crafted malformed UTF-8 input.

Vulnerability Details

CVE-ID: CVE-2026-7040

Affected Software: RRWO Text::Minify::XS

Affected Versions: 0.3.0 up to (excluding) 0.7.8

Vulnerability: The vulnerability is a heap-based buffer overflow (CWE-122) caused by the improper handling of malformed Unicode encoding (CWE-176) within the minify functions. An unauthenticated attacker can trigger this flaw by providing malicious UTF-8 input to the affected Perl module.

Business Impact

Successful exploitation of this vulnerability results in heap corruption, which typically leads to an application crash or service instability. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to the availability of systems relying on this module for data processing. Organizations should prioritize patching to prevent potential service disruptions or instability caused by malicious input.

Remediation Plan

Immediate Action: Update the Text::Minify::XS Perl module to version 0.7.8 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Monitor application error logs for frequent crashes or segmentation faults occurring during data processing tasks.

Compensating Controls: Implement strict input validation or sanitization layers to filter malformed UTF-8 characters before they reach the Text::Minify::XS processing functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to cause memory corruption, but it currently lacks confirmed public exploit code.

Analyst Recommendation

This vulnerability represents a significant risk to application availability due to the nature of heap-based memory corruption. System administrators must prioritize upgrading to version 0.7.8 immediately to eliminate the underlying flaw. Failure to patch may leave systems susceptible to denial of service attacks through simple malformed input vectors.

---METADATA---
VENDOR: Erlang
PRODUCT: OTP
AFFECTED_VERSIONS: OTP 17.0 up to 27.3.4.17, 28.0 up to 28.5.0.6, 29.0 up to 29.0.6; Inets 5.10 up to 9.3.2.7, 9.4 up to 9.6.2.3, 9.7 up to 9.7.2
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:10:54.890Z
CREDITS: Lukas Backström / Erlang Solutions (finder); Lukas Backström / Erlang Solutions (remediation developer); Konrad Pietrzak / Ericsson (remediation reviewer)
SOURCES_JSON: [{"url":"https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5","name":null,"tags":["vendor-advisory","related"]},{"url":"https://cna.erlef.org/cves/CVE-2026-70399.html","name":null,"tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-70399","name":null,"tags":["related"]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","name":null,"tags":["x_version-scheme"]},{"url":"https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612","name":null,"tags":["patch"]},{"url":"https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7","name":null,"tags":["patch"]},{"url":"https://github.com/erlang/otp/commit/e0050fc00c500a4fa9ba1f594603c787ff6d20b2","name":null,"tags":["patch"]}]
---END_METADATA---

Description Summary:
Erlang/OTP inets httpd fails to enforce the max_clients limit when it is not explicitly configured, allowing unauthenticated remote attackers to cause a denial of service via connection exhaustion.

Executive Summary:
An unauthenticated remote denial of service vulnerability in Erlang/OTP allows attackers to exhaust system resources by opening unlimited connections, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-70399

Affected Software: Erlang OTP

Affected Versions: OTP 17.0 up to 27.3.4.17, 28.0 up to 28.5.0.6, 29.0 up to 29.0.6; Inets 5.10 up to 9.3.2.7, 9.4 up to 9.6.2.3, 9.7 up to 9.7.2

Vulnerability: The vulnerability is an allocation of resources without limits (CWE-770) within the inets httpd component. Due to a logic error in the connection manager, the server fails to apply the default connection limit of 150 when the max_clients option is absent, allowing an unauthenticated attacker to exhaust memory and file descriptors.

Business Impact

Successful exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption by rendering the Erlang application unresponsive. With a CVSS score of 8.7, the severity is high because the attack vector is network-based, requires no authentication, and is trivial to execute against unconfigured servers.

Remediation Plan

Immediate Action: Update your Erlang/OTP installation to the patched versions (OTP 27.3.4.17, 28.5.0.6, 29.0.6 or later) as specified in the vendor advisory. If an immediate update is not feasible, explicitly configure the max_clients option in your inets httpd configuration to enforce the intended connection limits.

Proactive Monitoring: Monitor system logs and process telemetry for sudden spikes in socket connections or memory usage associated with the Erlang node.

Compensating Controls: Deploy a Web Application Firewall or load balancer in front of the Erlang service to rate-limit incoming connections and block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by any unauthenticated remote host without requiring specialized knowledge or authentication, making it a high-priority target for automated scanning.

Analyst Recommendation

The risk posed by this vulnerability is significant due to the ease of exploitation and the potential for complete service unavailability. Organizations utilizing Erlang/OTP should verify their current configuration to see if max_clients is explicitly set, but must prioritize upgrading to the provided patched versions to permanently resolve the underlying logic error.

---METADATA---
VENDOR: tufantunc
PRODUCT: ssh-mcp
AFFECTED_VERSIONS: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5.0
CONFIDENCE: high
MISSING: patch
CREDITS: BlackBird_BB (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359619","name":"VDB-359619 | tufantunc ssh-mcp index.ts shell.write command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359619/cti","name":"VDB-359619 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798528","name":"Submit #798528 | tufantunc ssh-mcp 1.5 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/tufantunc/ssh-mcp/issues/44","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://github.com/tufantunc/ssh-mcp/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the ssh-mcp utility allows local attackers to execute arbitrary commands as root by injecting line breaks into the description field when su mode is active.

Executive Summary:
The ssh-mcp utility contains a critical command injection vulnerability that permits local privilege escalation to root, requiring immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-7039

Affected Software: tufantunc ssh-mcp

Affected Versions: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5.0

Vulnerability: The application fails to properly sanitize the description field in the exec tool, which is processed by the shell.write function in src/index.ts. When the su shell mode is enabled, an attacker with local access can inject newline characters into the description parameter to terminate the intended command and execute arbitrary commands with root privileges.

Business Impact

Successful exploitation of this vulnerability leads to full system compromise, as it grants the attacker root-level access to the host machine. Given the CVSS score of 7.8, this represents a significant risk to data integrity, confidentiality, and availability, particularly in environments where ssh-mcp manages sensitive infrastructure or automated shell sessions.

Remediation Plan

Immediate Action: As no official patch is currently available, users should immediately disable the su mode functionality or restrict access to the ssh-mcp tool to trusted local users only.

Proactive Monitoring: Review system audit logs for unexpected process execution, particularly commands originating from the ssh-mcp process, and monitor /root directory for the creation of unauthorized files.

Compensating Controls: Implement strict file system permissions and host-based access controls to limit the ability of non-privileged users to interact with the ssh-mcp process or its configuration files.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the GitHub issue tracker for the project).

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via a simple JSON-RPC call if the suPassword is configured.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for trivial privilege escalation to root. Administrators must prioritize restricting the use of the affected software and closely monitor for any signs of unauthorized command execution until a security update is released and applied.

---METADATA---
VENDOR: Estonian Information System Authority (RIA)
PRODUCT: DigiDoc4
AFFECTED_VERSIONS: 4.0.0 up to (excluding) 4.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the DigiDoc4 client allows attackers to bypass directory restrictions, potentially leading to unauthorized file access and system compromise.

Executive Summary:
A path traversal vulnerability in the DigiDoc4 client could allow an attacker to bypass file system restrictions and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-70383

Affected Software: Estonian Information System Authority (RIA) DigiDoc4

Affected Versions: 4.0.0 up to (excluding) 4.11.0

Vulnerability: This is a path traversal vulnerability (CWE-22) that permits an attacker to access restricted directory paths. It requires user interaction to exploit and does not require prior authentication.

Business Impact

With a CVSS score of 8.4, this vulnerability presents a significant threat to data confidentiality and integrity. An attacker could exploit this flaw to read or overwrite sensitive files on the host machine, potentially leading to identity theft or the compromise of digital signatures handled by the application.

Remediation Plan

Immediate Action: Upgrade the DigiDoc4 client to version 4.11.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit file access logs for unexpected attempts to access system directories by the DigiDoc4 process.

Compensating Controls: Restrict the application environment to a least-privilege user account to limit the impact of a successful path traversal attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Path traversal flaws are often leveraged by attackers to exfiltrate configuration files or sensitive credentials stored on the local file system.

Analyst Recommendation

The DigiDoc4 path traversal vulnerability poses a severe risk to users who rely on the software for secure document handling. Administrators and individual users must update to version 4.11.0 immediately to ensure that file system boundaries are correctly enforced and to prevent unauthorized data access.

---METADATA---
VENDOR: pluck-cms
PRODUCT: Pluck CMS
AFFECTED_VERSIONS: 0 up to 4.7.21
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Pluck CMS lacks robust CSRF protection, allowing attackers to force authenticated administrators to perform sensitive actions including remote code execution.

Executive Summary:
Pluck CMS is vulnerable to cross-site request forgery, which can be leveraged by an attacker to force an administrator to execute malicious code or compromise the entire system.

Vulnerability Details

CVE-ID: CVE-2026-70376

Affected Software: pluck-cms Pluck CMS

Affected Versions: 0 up to 4.7.21

Vulnerability: This is a cross-site request forgery vulnerability (CWE-352). The application relies solely on the Referer header for CSRF protection, which can be easily bypassed by an attacker by suppressing the header in forged requests.

Business Impact

A successful exploit allows an attacker to perform administrative actions on behalf of a logged-in user, such as installing malicious modules or themes. Given the CVSS score of 9.6, the potential for remote code execution and stored cross-site scripting poses a severe threat to the confidentiality and integrity of the application.

Remediation Plan

Immediate Action: Update to the latest version of Pluck CMS to implement proper anti-CSRF token mechanisms.

Proactive Monitoring: Monitor for unexpected administrative changes, such as the installation of new modules or unauthorized page modifications, which may indicate a successful CSRF attack.

Compensating Controls: Ensure that administrative users are not browsing untrusted sites while authenticated, and consider implementing stricter HTTP Referrer-Policy headers on the server.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable because the security mechanism depends entirely on a client-side header that can be stripped by the attacker.

Analyst Recommendation

Administrators must update to version 4.7.21 or later to secure the administrative panel. Until an update is applied, administrators should be cautious when accessing the admin panel and ensure they are not simultaneously visiting potentially malicious websites.

---METADATA---
VENDOR: HashBrownCMS
PRODUCT: hashbrown-cms
AFFECTED_VERSIONS: 0 through 1.4.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
HashBrown CMS contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
HashBrown CMS versions 1.4.6 and earlier are vulnerable to authenticated OS command injection, which could result in full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-70375

Affected Software: HashBrownCMS hashbrown-cms

Affected Versions: 0 through 1.4.6

Vulnerability: This vulnerability, categorized as CWE-78, allows an authenticated user to perform OS command injection. The flaw exists due to inadequate validation of input handled by the system, enabling the injection of malicious commands at the operating system level.

Business Impact

The CVSS score of 8.8 indicates a high severity level that could lead to severe business disruption. Successful exploitation allows an attacker to bypass intended security controls, potentially leading to unauthorized data access, server-side code execution, and persistent malware installation.

Remediation Plan

Immediate Action: As no fix is currently available, administrators must limit access to the CMS to trusted users only and isolate the server from untrusted networks.

Proactive Monitoring: Monitor server logs for unusual spikes in resource usage or unexpected child processes spawned by the CMS service.

Compensating Controls: Utilize a WAF to filter incoming traffic and block requests containing suspicious shell command syntax.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This issue requires authenticated access, which serves as a primary, though not sufficient, security layer.

Analyst Recommendation

Given the high impact of command injection, this vulnerability should be prioritized for remediation as soon as an update becomes available. Until that time, maintain strict access controls and monitor the environment for signs of exploitation.

---METADATA---
VENDOR: HashBrownCMS
PRODUCT: hashbrown-cms
AFFECTED_VERSIONS: 0 through 1.4.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
HashBrown CMS is susceptible to OS command injection, allowing authenticated attackers to execute unauthorized commands via improper handling of system inputs.

Executive Summary:
An authenticated OS command injection vulnerability in HashBrown CMS versions 1.4.6 and earlier presents a significant risk of remote code execution on the server.

Vulnerability Details

CVE-ID: CVE-2026-70374

Affected Software: HashBrownCMS hashbrown-cms

Affected Versions: 0 through 1.4.6

Vulnerability: This is an OS command injection vulnerability identified as CWE-78. The application fails to properly sanitize input, which allows an authenticated user with low privileges to manipulate backend processes and execute arbitrary system commands.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a critical risk to the confidentiality, integrity, and availability of the CMS environment. Exploitation could allow an attacker to pivot into the internal network, steal sensitive content, or gain administrative control over the underlying server infrastructure.

Remediation Plan

Immediate Action: No official patch is currently available. Administrators should restrict access to the affected CMS instance and monitor for unauthorized administrative actions.

Proactive Monitoring: Review application and system access logs for anomalous command execution patterns or unauthorized changes to CMS settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common shell injection patterns in HTTP requests directed at the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if an attacker can authenticate to the platform.

Analyst Recommendation

The potential for remote code execution via command injection necessitates immediate defensive action. Users should ensure the application is not exposed to the public internet and continue to monitor vendor communication channels for a security patch.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A8000RU router via the pptpPassThru argument in the setVpnPassCfg function.

Executive Summary:
An unauthenticated OS command injection vulnerability in the Totolink A8000RU router allows remote attackers to execute arbitrary system commands, posing a critical risk of total device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7037

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection flaw within the setVpnPassCfg function of the /cgi-bin/cstecgi.cgi component. Attackers can reach this endpoint without authentication to inject malicious commands that run with system-level privileges.

Business Impact

The CVSS score of 9.8 reflects the ease of exploitation and the severity of the impact. Successful exploitation grants an attacker full control over the network device, which can be used to intercept sensitive traffic, pivot into internal network segments, or deploy persistent malware, leading to severe data breaches and operational downtime.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet or restrict access to the management interface to trusted IP addresses only until a firmware patch is applied.

Proactive Monitoring: Inspect system logs for unusual command executions or attempts to access the cstecgi.cgi file from unauthorized external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) configured to block malicious patterns targeting CGI scripts and command injection sequences.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of April 26, 2026, public exploit code is available for this vulnerability. Given the ease of remote execution and the availability of proof-of-concept material, the likelihood of active exploitation is extremely high.

Analyst Recommendation

This vulnerability represents a critical threat to network integrity. Organizations using the Totolink A8000RU should prioritize immediate isolation of the device. If an official firmware update is unavailable, ensure the device is not accessible from the public internet and evaluate replacement options if the vendor does not provide a timely fix.

---METADATA---
VENDOR: Tenda
PRODUCT: i9
AFFECTED_VERSIONS: 1.0.0.5(2204)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359616","name":"VDB-359616 | Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359616/cti","name":"VDB-359616 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798479","name":"Submit #798479 | Tenda i9 V1.0.0.5(2204) Absolute Path Traversal","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/M3/vul_80/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Tenda i9 HTTP handler allows unauthenticated remote attackers to bypass security whitelists and access sensitive administrative resources.

Executive Summary:
A critical path traversal vulnerability in Tenda i9 firmware version 1.0.0.5(2204) allows unauthenticated remote attackers to bypass authentication and access sensitive administrative pages.

Vulnerability Details

CVE-ID: CVE-2026-7036

Affected Software: Tenda i9

Affected Versions: 1.0.0.5(2204)

Vulnerability: The vulnerability exists in the R7WebsSecurityHandler function of the HTTP server, which fails to properly validate URL paths after verifying whitelisted prefixes. By using directory traversal sequences, such as "../", an unauthenticated attacker can circumvent the whitelist and access restricted administrative files.

Business Impact

Successful exploitation grants an unauthenticated attacker direct access to administrative interfaces and sensitive system files. This exposure can lead to full device compromise, unauthorized configuration changes, or the exfiltration of sensitive network information, presenting a significant security risk to the integrity of the managed infrastructure. The CVSS score of 7.3 reflects the high impact of unauthorized access to critical administrative functions.

Remediation Plan

Immediate Action: Contact the vendor for available firmware updates and apply them immediately to the affected hardware. If no patch is currently available, restrict management interface access to trusted administrative networks only.

Proactive Monitoring: Monitor network traffic for HTTP requests containing directory traversal patterns, such as sequences of "../", directed at the device management interface. Review server access logs for requests to sensitive files that do not originate from authorized internal IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge security appliance configured to inspect and block HTTP requests containing directory traversal sequences. Ensure the device management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up by Li Tengzheng.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no user interaction or prior authentication to bypass the security gatekeeper.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate attention. Administrators must prioritize isolating the affected Tenda i9 devices from untrusted networks and coordinating with the vendor to obtain the necessary firmware updates to remediate this authentication bypass flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1202
AFFECTED_VERSIONS: 1.2.0.14
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359615","name":"VDB-359615 | Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359615/cti","name":"VDB-359615 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798477","name":"Submit #798477 | Tenda FH1202 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_20/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda FH1202 httpd component allows remote attackers to execute arbitrary code or trigger a denial of service via the GO parameter in the WrlclientSet function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda FH1202 firmware version 1.2.0.14 poses a high risk of remote code execution or system denial of service for affected network devices.

Vulnerability Details

CVE-ID: CVE-2026-7035

Affected Software: Tenda FH1202

Affected Versions: 1.2.0.14

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the formWrlclientSet function of the httpd component. An attacker with low-level access can trigger the vulnerability by sending a maliciously crafted POST request to the /goform/WrlclientSet endpoint, specifically manipulating the GO argument, which lacks adequate length validation.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system compromise. Successful exploitation allows an attacker to achieve remote code execution, which could lead to unauthorized access to the local network, sensitive data interception, or a complete denial of service. The ability to execute arbitrary code on networking infrastructure is a severe threat that compromises the integrity of the entire connected environment.

Remediation Plan

Immediate Action: Since no vendor-supplied patch is currently available, administrators should immediately isolate affected Tenda FH1202 devices from public-facing interfaces to prevent remote exploitation.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/WrlclientSet endpoint and review device logs for signs of service crashes or unexpected process restarts.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to known, trusted internal IP addresses only. A Web Application Firewall may be configured to drop POST requests containing excessively long payloads in the GO parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-provided input.

Analyst Recommendation

Given the severity of this remote code execution flaw and the public availability of a proof-of-concept, immediate mitigation is required. Organizations should treat these devices as high-risk assets and enforce network-level access restrictions until a formal firmware update is released and applied.

---METADATA---
VENDOR: Tenda
PRODUCT: FH1202
AFFECTED_VERSIONS: 1.2.0.14(408)
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359614","name":"VDB-359614 | Tenda FH1202 httpd WrlExtraSet stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359614/cti","name":"VDB-359614 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798476","name":"Submit #798476 | Tenda FH1202 1.2.0.14(408) Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/FH1202/vul_19/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Tenda FH1202 web server component, allowing remote attackers to trigger memory corruption via the GO argument in the WrlExtraSet function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda FH1202 routers may allow remote attackers to achieve remote code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7034

Affected Software: Tenda FH1202

Affected Versions: 1.2.0.14(408)

Vulnerability: This vulnerability is a stack-based buffer overflow triggered by improper bounds checking within the WrlExtraSet function of the httpd service. By submitting a specially crafted long string to the GO parameter, an authenticated attacker can overwrite stack memory to execute arbitrary code or crash the device.

Business Impact

The potential for remote code execution on network infrastructure poses a severe threat to internal network integrity. Successful exploitation could lead to full device compromise, allowing attackers to intercept traffic, pivot into the local network, or render the router inoperable, resulting in significant service downtime. The CVSS score of 8.8 reflects the high severity of this impact.

Remediation Plan

Immediate Action: Since no official patch is currently listed, users should restrict administrative access to the web interface from untrusted networks and disable remote management features immediately. Contact Tenda support or check the official vendor website for firmware updates that address this buffer overflow.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/WrlExtraSet endpoint and watch for unexpected device reboots or performance degradation.

Compensating Controls: Implement access control lists (ACLs) on the network perimeter to restrict traffic to the router management interface to known, trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's technical write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists via the researcher's technical documentation, which provides the necessary parameters to trigger the overflow. The vulnerability is inherently exploitable due to the absence of length validation before the data is processed by the sprintf function.

Analyst Recommendation

Given the availability of public proof-of-concept code and the critical nature of a buffer overflow in router firmware, this vulnerability must be treated with high urgency. Administrators should isolate affected devices from public-facing exposure until a vendor-supplied firmware update is applied to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Microsoft
PRODUCT: PowerShell
AFFECTED_VERSIONS: PowerShell 7.4 (7.4.0 to 7.4.18), 7.5 (7.5.0 to 7.5.9), 7.6 (7.6.0 to 7.6.4)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A relative path traversal vulnerability in Microsoft PowerShell Core allows an unauthenticated attacker to achieve remote code execution over a network.

Executive Summary:
A relative path traversal vulnerability in Microsoft PowerShell Core could allow an unauthenticated attacker to execute arbitrary code, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-70337

Affected Software: Microsoft PowerShell

Affected Versions: 7.4.0 up to 7.4.19, 7.5.0 up to 7.5.10, and 7.6.0 up to 7.6.5

Vulnerability: This vulnerability involves a relative path traversal flaw where an attacker can manipulate file paths to execute unauthorized code. The attack vector is network-based and does not require prior authentication, although it relies on user interaction.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host system, potentially leading to a complete compromise of the affected environment. Given the CVSS score of 8.8, this is a high-severity issue that could result in unauthorized data access, system disruption, or lateral movement within the network.

Remediation Plan

Immediate Action: Update all instances of Microsoft PowerShell to the latest patched versions (7.4.19, 7.5.10, or 7.6.5) immediately.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected file access requests originating from the PowerShell environment.

Compensating Controls: Implement network-level access controls to restrict exposure of management services and ensure that users operate with the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, it currently lacks evidence of widespread exploit weaponization.

Analyst Recommendation

The potential for remote code execution makes this a critical security concern for any organization utilizing PowerShell Core. Administrators should prioritize patching these specific versions to eliminate the underlying path traversal flaw and prevent unauthorized system access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Visual Studio Code
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.132.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in Visual Studio Code allows an unauthenticated attacker to execute arbitrary code over a network via malicious user interaction.

Executive Summary:
A code injection vulnerability in Visual Studio Code could enable an unauthenticated attacker to execute arbitrary code on a user's machine.

Vulnerability Details

CVE-ID: CVE-2026-70336

Affected Software: Microsoft Visual Studio Code

Affected Versions: 1.0.0 up to (excluding) 1.132.1

Vulnerability: This vulnerability is a code injection flaw, identified as CWE-94. It permits an unauthenticated attacker to execute code, typically requiring the user to open a specially crafted project or file.

Business Impact

The CVSS score of 8.8 reflects the high potential impact of this vulnerability. If exploited, an attacker could gain full control over the developer's local machine, leading to the theft of source code, credentials, or lateral movement within the developer's network environment.

Remediation Plan

Immediate Action: Update Visual Studio Code to version 1.132.1 or later immediately.

Proactive Monitoring: Monitor developer workstations for unusual execution patterns or unauthorized modifications to sensitive configuration files.

Compensating Controls: Advise developers to exercise caution when opening projects from untrusted sources and maintain up-to-date endpoint security software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While code injection flaws are inherently dangerous, this requires user interaction, which reduces the immediate probability of widespread exploitation.

Analyst Recommendation

Visual Studio Code is a high-value target for attackers aiming to compromise development environments. Organizations should mandate the update to version 1.132.1 to ensure that developer workstations remain protected against potential code injection attacks.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359613","name":"VDB-359613 | Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359613/cti","name":"VDB-359613 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798454","name":"Submit #798454 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_123/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.731Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the Tenda F456 router, specifically within the fromSafeClientFilter function, allowing remote attackers to trigger memory corruption.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 firmware, version 1.0.0.5, poses a severe risk of remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-7033

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the fromSafeClientFilter function within the /goform/SafeClientFilter endpoint. An authenticated attacker can supply an overly long string to the menufacturer parameter, which is then concatenated without bounds checking, leading to a stack-based buffer overflow.

Business Impact

The potential for remote code execution represents a significant security risk, as it grants unauthorized actors control over network infrastructure. Given the CVSS score of 8.8, this vulnerability is classified as high severity, potentially leading to full system compromise, lateral movement within the network, or persistent denial of service. Such an event would severely impact business continuity and compromise the integrity of the local network environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators must restrict access to the device management interface and disable remote administration features until the vendor provides a firmware update.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/SafeClientFilter endpoint, particularly those containing unusually large payloads in the menufacturer parameter.

Compensating Controls: Implement strict firewall rules to ensure the device management interface is only accessible from trusted internal management subnets rather than the public internet.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in the researcher's technical write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of length validation in the strcat function, making the device trivial to crash or compromise.

Analyst Recommendation

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Because Tenda has not yet released a patch, organizations utilizing the F456 router must prioritize network-level isolation of the device. Administrators should monitor for vendor firmware updates daily and apply them immediately upon release to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office Outlook
AFFECTED_VERSIONS: Microsoft 365 Apps for Enterprise (16.0.1 up to excluding 16.0.x), Office 2019 (19.0.0 up to excluding 19.0.x), Office LTSC 2021 (16.0.1 up to excluding 16.0.x), Office LTSC 2024 (16.0.0 up to excluding 16.0.x), Outlook 2016 (16.0.0.0 up to excluding 16.0.5565.1000)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow vulnerability in Microsoft Outlook allows an unauthenticated attacker to achieve arbitrary code execution over a network via user interaction.

Executive Summary:
A critical integer overflow vulnerability in Microsoft Outlook could allow an unauthenticated attacker to execute arbitrary code on an affected system.

Vulnerability Details

CVE-ID: CVE-2026-70329

Affected Software: Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Outlook 2016

Affected Versions: See metadata for specific version ranges.

Vulnerability: This vulnerability is an integer overflow or wraparound flaw, identified as CWE-190. It allows an unauthenticated attacker to trigger remote code execution, provided the user interacts with malicious content.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security. Successful exploitation could result in full system compromise, allowing an attacker to install programs, view, change, or delete sensitive data, or create new accounts with full user rights.

Remediation Plan

Immediate Action: Deploy the latest security updates provided by Microsoft for all affected versions of Outlook and Office.

Proactive Monitoring: Monitor endpoint systems for suspicious process spawning or unexpected network connections originating from the Outlook application.

Compensating Controls: Utilize email filtering solutions to scan for and block malicious attachments or links that could serve as vectors for this vulnerability.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction acts as a partial barrier, but the potential for remote code execution makes this a high-priority patch.

Analyst Recommendation

Due to the remote code execution nature of this flaw, administrators must ensure that all instances of Microsoft Office and Outlook are updated across the enterprise. Timely patch management is critical to protecting against this high-severity threat.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint Server Subscription Edition
AFFECTED_VERSIONS: 16.0.0 up to (excluding) 16.0.19725.20522
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to perform unauthorized actions and elevate privileges over a network.

Executive Summary:
An authenticated server-side request forgery vulnerability in Microsoft SharePoint Server Subscription Edition poses a significant risk of privilege escalation and unauthorized network access.

Vulnerability Details

CVE-ID: CVE-2026-70326

Affected Software: Microsoft SharePoint Server Subscription Edition

Affected Versions: 16.0.0 up to (excluding) 16.0.19725.20522

Vulnerability: This vulnerability is a Server-Side Request Forgery (SSRF) flaw, identified as CWE-918. It requires an authenticated user with low-level privileges to initiate the attack, which can then be leveraged to escalate privileges within the network environment.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high severity. Successful exploitation could allow an attacker to bypass security controls, leading to potential data exfiltration, service disruption, or full system compromise by interacting with internal resources that are normally inaccessible to the attacker.

Remediation Plan

Immediate Action: Update Microsoft SharePoint Server Subscription Edition to build 16.0.19725.20522 or later immediately.

Proactive Monitoring: Review SharePoint audit logs for unusual request patterns, particularly those originating from internal service accounts or unexpected internal endpoints.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the server from reaching unauthorized internal or external resources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for prior authentication.

Analyst Recommendation

Given the high CVSS score and the potential for privilege escalation, organizations should prioritize patching their SharePoint environments. Applying the vendor-provided update is the only effective way to neutralize the risk of this SSRF vulnerability.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint
AFFECTED_VERSIONS: SharePoint Enterprise Server 2016 (16.0.0-16.0.5565.1001), SharePoint Server 2019 (16.0.0-16.0.10417.20198), SharePoint Server Subscription Edition (16.0.0-16.0.19725.20522)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Microsoft SharePoint is susceptible to a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to elevate privileges over a network.

Executive Summary:
An SSRF vulnerability in Microsoft SharePoint allows an authenticated attacker to achieve privilege escalation, posing a significant risk to internal infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-70324

Affected Software: Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition

Affected Versions: See metadata for specific version ranges

Vulnerability: The vulnerability involves improper handling of server-side requests (CWE-918), allowing an authenticated attacker to perform unauthorized actions. This SSRF flaw can be leveraged to interact with internal services that are otherwise inaccessible, resulting in privilege escalation.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a high risk to the confidentiality and integrity of the SharePoint environment. By escalating privileges, an attacker could gain unauthorized access to sensitive documents, administrative functions, or other internal resources, potentially leading to a broader compromise of the enterprise network.

Remediation Plan

Immediate Action: Apply the relevant security updates for your specific SharePoint version as detailed in the Microsoft Security Update Guide.

Proactive Monitoring: Inspect network traffic logs for unusual outbound requests originating from the SharePoint server to internal resources or sensitive endpoints.

Compensating Controls: Restrict the server's ability to initiate arbitrary outbound connections to internal network segments using host-based firewalls or network access control lists.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the initial entry point, but the impact of privilege escalation makes this a high-priority item for remediation.

Analyst Recommendation

Organizations running Microsoft SharePoint must prioritize the deployment of these security patches. Given the potential for privilege escalation, failure to remediate this vulnerability could allow an attacker to bypass security controls and gain deeper access to the organization's critical data infrastructure.

---METADATA---
VENDOR: Microsoft
PRODUCT: SharePoint
AFFECTED_VERSIONS: SharePoint Server Subscription Edition (16.0.0 to 16.0.19725.20522)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization of untrusted data vulnerability in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to execute code over a network.

Executive Summary:
This high-severity vulnerability in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to execute arbitrary code, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-70321

Affected Software: Microsoft SharePoint

Affected Versions: SharePoint Server Subscription Edition (up to 16.0.19725.20522)

Vulnerability: The vulnerability involves improper deserialization of untrusted data (CWE-502). It is exploitable by an authenticated attacker over a network, requiring low privileges to execute code on the host server.

Business Impact

A successful exploit grants the attacker the ability to execute commands with the privileges of the SharePoint service, which often holds high-level access. With a CVSS score of 8.8, this flaw represents a significant risk to organizational data security and system stability, potentially allowing for lateral movement or data theft.

Remediation Plan

Immediate Action: Update the affected Microsoft SharePoint Server Subscription Edition instance to version 16.0.19725.20522 or higher as specified by the vendor.

Proactive Monitoring: Monitor server-side logs for signs of unauthorized code execution or unusual behavior in SharePoint service accounts.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to identify and block unauthorized child processes spawned by the SharePoint web service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access necessitates that security teams also focus on credential hygiene and robust access control policies.

Analyst Recommendation

The severity of this deserialization vulnerability necessitates immediate attention. IT administrators should verify their SharePoint server versions and apply the necessary security patches provided by Microsoft to eliminate the risk of remote code execution.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359612","name":"VDB-359612 | Tenda F456 SafeEmailFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359612/cti","name":"VDB-359612 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798453","name":"Submit #798453 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_122/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.507Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 SafeEmailFilter function allows remote authenticated attackers to achieve code execution or denial of service via a crafted page parameter.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, permits remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-7032

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow (CWE-120) triggered by the SafeEmailFilter function within the /goform/SafeEmailFilter endpoint. An authenticated attacker can exploit this by sending a specially crafted page parameter to the HTTP interface, which lacks sufficient length validation during memory operations.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for full system compromise. Successful exploitation allows an attacker to execute arbitrary code or force a denial of service, potentially leading to unauthorized access to internal network traffic, loss of router control, and significant operational disruption.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict management access to the router to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/SafeEmailFilter endpoint. Any signs of service instability or unexpected reboots should be investigated as potential exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or similar network security appliance to inspect inbound HTTP traffic for unusually long parameter strings in requests destined for the router management interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via a published researcher write-up at the referenced GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of bounds checking in the vulnerable function, which provides a straightforward path for memory corruption.

Analyst Recommendation

Given the high severity and the existence of a public proof-of-concept, users of the Tenda F456 should treat this vulnerability with extreme urgency. Until a vendor-supplied firmware update is released, prioritize isolating the management interface from all untrusted networks to prevent unauthorized access and exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359611","name":"VDB-359611 | Tenda F456 SafeMacFilter fromSafeMacFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359611/cti","name":"VDB-359611 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798452","name":"Submit #798452 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_121/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the page parameter in the fromSafeMacFilter function.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda F456 router, version 1.0.0.5, poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7031

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow occurring in the fromSafeMacFilter function within the /goform/SafeMacFilter endpoint. The vulnerability is triggered by sending a specially crafted, oversized value to the page parameter, which allows an attacker with low privileges to achieve remote code execution or trigger a denial of service.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. This facilitates unauthorized access to local network traffic, potential interception of sensitive data, or complete disruption of internet connectivity, leading to significant operational downtime. Given the CVSS score of 8.8, this flaw represents a high risk to organizational security integrity.

Remediation Plan

Immediate Action: As no vendor patch is currently confirmed, administrators should immediately restrict access to the web management interface of affected devices to trusted internal IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for abnormal POST requests directed at the /goform/SafeMacFilter endpoint, particularly those containing excessively long string parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control lists to block or sanitize traffic directed at the router's management web interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's GitHub write-up.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and published researcher findings, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-supplied input.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Organizations utilizing Tenda F456 hardware should prioritize isolating these devices from external network exposure until an official firmware update is released and verified. Failure to mitigate this risk leaves critical network infrastructure vulnerable to compromise by remote actors.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359610","name":"VDB-359610 | Tenda F456 RouteStatic fromRouteStatic buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359610/cti","name":"VDB-359610 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798451","name":"Submit #798451 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_120/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the page parameter in the fromRouteStatic function.

Executive Summary:
A buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a critical risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7030

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow flaw located in the fromRouteStatic function within the /goform/RouteStatic endpoint. The vulnerability is triggered when the application fails to perform length validation on the user-provided page parameter, allowing an authenticated attacker to corrupt memory and potentially execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution, which could lead to full device compromise and unauthorized access to network traffic. Given the CVSS score of 8.8, the potential for significant disruption to business operations and the loss of data confidentiality is high. The ability to execute arbitrary code on network infrastructure devices creates a severe risk of persistent unauthorized access within the local environment.

Remediation Plan

Immediate Action: Contact the vendor for an official security patch or firmware update, as there is currently no publicly confirmed fix available for version 1.0.0.5.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed toward the /goform/RouteStatic endpoint, particularly those containing unusually long string inputs in the page parameter.

Compensating Controls: Implement access control lists on the management interface to restrict access to trusted administrative IP addresses only, and deploy a Web Application Firewall or intrusion prevention system to detect and block oversized HTTP payloads.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the research references.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking on the page parameter during the execution of the fromRouteStatic function.

Analyst Recommendation

Given the severity of this remote code execution vulnerability and the availability of a public proof-of-concept, users of the Tenda F456 device should prioritize securing their hardware. Until an official patch is released, administrators must isolate the device from external network exposure and restrict access to the web management interface to mitigate the risk of exploitation.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359609","name":"VDB-359609 | Tenda F456 addressNat fromaddressNat buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359609/cti","name":"VDB-359609 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/798450","name":"Submit #798450 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_119/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.519Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows remote attackers to execute arbitrary code or cause a denial of service via the fromaddressNat function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda F456 firmware version 1.0.0.5 poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7029

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow vulnerability triggered by improper length validation within the fromaddressNat function. An authenticated attacker can send a crafted POST request to the /goform/addressNat endpoint to corrupt memory and potentially execute arbitrary code on the device.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk, primarily due to the potential for total system compromise. Successful exploitation allows an attacker to gain full control over the network device, which can be leveraged for unauthorized data access, network interception, or persistent presence within the local area network.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor releases a firmware update.

Proactive Monitoring: Review web access logs for unusual POST requests directed at the /goform/addressNat endpoint, particularly those containing excessively long parameter strings in the mitInterface field.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) rule to drop HTTP requests containing abnormally large payloads targeted at the vulnerable management URI.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-provided input in the affected function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents an urgent threat to network integrity. Organizations utilizing the Tenda F456 should implement immediate network segmentation or restrictive access controls to mitigate exposure while awaiting an official firmware patch from the vendor.

---METADATA---
VENDOR: Typecho
PRODUCT: Blog Platform
AFFECTED_VERSIONS: 1.0, 1.1, 1.2, 1.3.0
CONFIDENCE: high
MISSING: patch
CREDITS: wang1r (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359605","name":"VDB-359605 | Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359605/cti","name":"VDB-359605 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797772","name":"Submit #797772 | Typecho 1.3.0 and earlier Server-Side Request Forgery","tags":["third-party-advisory"]},{"url":"https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF/","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.523Z
---END_METADATA---

Description Summary:
Typecho versions up to 1.3.0 contain a Server-Side Request Forgery vulnerability in the Pingback service, allowing unauthenticated attackers to perform unauthorized requests to internal network resources.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in Typecho allows unauthenticated attackers to perform unauthorized requests to internal network services, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7025

Affected Software: Typecho Blog Platform

Affected Versions: 1.0, 1.1, 1.2, 1.3.0

Vulnerability: The vulnerability exists in the Service::sendPingHandle function within var/Widget/Service.php, where weak token validation allows an unauthenticated attacker to bypass security checks and trigger a two-stage SSRF attack. By manipulating the pingback argument, an attacker can force the server to issue arbitrary POST requests to internal infrastructure, including support for protocols like gopher, dict, and file.

Business Impact

The ability to perform SSRF against internal network resources poses a severe risk to organizational security. An attacker can interact with internal services that are not exposed to the internet, such as Redis, Memcached, or databases, potentially leading to unauthorized data access, remote code execution, or internal network scanning. With a CVSS score of 7.3, this flaw represents a significant threat to the confidentiality and integrity of the internal environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately disable the Pingback functionality or restrict access to the /action/service?do=ping endpoint via a web application firewall or server configuration.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /action/service endpoint, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement strict egress filtering on the web server to prevent it from initiating connections to internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: Yes — a detailed technical write-up and proof-of-concept are available via the researcher's blog (wang1rrr.github.io).

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the bypassable token validation and the ability to leverage multiple protocols for internal service interaction.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for internal network compromise, this vulnerability should be prioritized for mitigation. Organizations running Typecho must immediately restrict access to the vulnerable endpoint or disable the Pingback feature entirely until a security update is released by the vendor.

---METADATA---
VENDOR: SmythOS
PRODUCT: SRE
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in SmythOS SRE, affecting versions up to 0.

Executive Summary:
A high-severity security vulnerability in the SmythOS SRE product could expose organizations to unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-7022

Affected Software: SmythOS SRE

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects SmythOS SRE up to version 0. While technical details are emerging, the vulnerability represents a significant security oversight that could be exploited to compromise the underlying system's security posture.

Business Impact

Exploitation of this flaw could lead to the unauthorized access of sensitive system management functions, potentially resulting in full system compromise. The CVSS score of 7.3 confirms the high severity of this vulnerability, which poses a substantial risk to the availability and security of the affected infrastructure.

Remediation Plan

Immediate Action: Immediately update the SmythOS SRE component to the latest vendor-provided release.

Proactive Monitoring: Monitor system logs for unauthorized authentication attempts or unexpected changes in service configuration.

Compensating Controls: Apply strict firewall rules to restrict access to the SRE management interface to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this vulnerability with high priority. We strongly advise updating the affected software immediately and ensuring that management interfaces are secured against unauthorized external access.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359598","name":"VDB-359598 | Tenda F456 P2pListFilter fromP2pListFilter buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359598/cti","name":"VDB-359598 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797473","name":"Submit #797473 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_118/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.523Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Tenda F456 router allows authenticated attackers to potentially execute arbitrary code or cause a denial of service via the P2pListFilter function.

Executive Summary:
A critical stack-based buffer overflow in the Tenda F456 router, version 1.0.0.5, poses a significant risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-7019

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists within the fromP2pListFilter function of the /goform/P2pListFilter endpoint. An authenticated attacker can trigger a stack-based buffer overflow by providing an excessively long string to the page parameter, as the application fails to perform adequate length validation before passing the input to the sprintf function.

Business Impact

Successful exploitation of this flaw allows an attacker to achieve remote code execution on the affected device, potentially leading to a full compromise of the router. Given the CVSS score of 8.8, this vulnerability is classified as High, indicating a severe risk to network integrity. Compromise of network infrastructure can facilitate lateral movement within the environment, data interception, and total loss of device control.

Remediation Plan

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict access to the web management interface and ensure that only trusted users have authenticated access to the device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/P2pListFilter endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall or network-level access control lists to prevent unauthorized or suspicious traffic from reaching the device management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability references.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it involves a classic memory corruption flaw in a widely used administrative function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS severity, this vulnerability presents a credible threat to the Tenda F456 router. Organizations should prioritize restricting administrative access to the device and monitor for any vendor announcements regarding a firmware update. Until a formal patch is released, the device should be considered at risk of compromise if exposed to untrusted network segments.

---METADATA---
VENDOR: KLiK
PRODUCT: SocialMediaWebsite
AFFECTED_VERSIONS: 1.0.0, 1.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: g111 (VulDB User) (reporter); VulDB Vulnerability Moderation Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359561","name":"VDB-359561 | KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359561/cti","name":"VDB-359561 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797302","name":"Submit #797302 | SourceCodester SourceCodester KLiK Social Media Website v1.0.1 SQL Injection","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
KLiK SocialMediaWebsite contains an unauthenticated SQL injection vulnerability in the Private Message Handler component via the c_id argument.

Executive Summary:
A critical SQL injection vulnerability in KLiK SocialMediaWebsite allows unauthenticated remote attackers to manipulate database queries through the Private Message Handler.

Vulnerability Details

CVE-ID: CVE-2026-7002

Affected Software: KLiK SocialMediaWebsite

Affected Versions: 1.0.0, 1.0.1

Vulnerability: The application is susceptible to SQL injection within the /includes/get_message_ajax.php file, where the c_id parameter is not properly sanitized. This vulnerability is remotely exploitable by unauthenticated users.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant threat to data confidentiality and integrity. Given the CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to private user messages or sensitive database contents, resulting in potential data breaches and loss of user trust.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the /includes/get_message_ajax.php endpoint via network controls or disable the Private Message functionality if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the c_id parameter in the identified file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its remote, unauthenticated nature and the direct exposure of the database interface.

Analyst Recommendation

The high CVSS score reflects the serious risk posed by this SQL injection vulnerability. Organizations utilizing KLiK SocialMediaWebsite versions 1.0.0 or 1.0.1 must prioritize implementing the suggested compensating controls immediately to prevent unauthorized database access while awaiting official vendor remediation.

---METADATA---
VENDOR: Linksys
PRODUCT: MR9600
AFFECTED_VERSIONS: 2.0.6.206937
CONFIDENCE: high
MISSING: patch
CREDITS: wuuu (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359544","name":"VDB-359544 | Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359544/cti","name":"VDB-359544 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797086","name":"Submit #797086 | Linksys MR9600 Firmware 2.0.6.206937 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/utmost3/cve/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.linksys.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Linksys MR9600 JNAP Action Handler allows authenticated remote attackers to execute arbitrary OS commands via the pin argument in BTRequestGetSmartConnectStatus.

Executive Summary:
A critical OS command injection vulnerability in Linksys MR9600 firmware allows authenticated attackers to execute arbitrary system commands, posing a risk of total device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6992

Affected Software: Linksys MR9600

Affected Versions: 2.0.6.206937

Vulnerability: This vulnerability resides in the BTRequestGetSmartConnectStatus function within the /etc/init.d/run_central2.sh script. It is triggered by improper input validation of the pin argument, allowing an authenticated remote attacker to perform OS command injection.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system of the router. This level of access typically results in complete device control, potentially allowing for network interception, traffic redirection, or the use of the device as a pivot point into the internal network. With a CVSS score of 7.2, the impact is considered High, reflecting the potential for total system compromise and loss of confidentiality, integrity, and availability of the gateway device.

Remediation Plan

Immediate Action: As there is no official patch currently available, users should restrict administrative access to the router management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous activity, specifically looking for unexpected command executions or requests directed at the JNAP interface that contain shell metacharacters.

Compensating Controls: Implement a strict firewall policy that limits access to the router's web management interface to a dedicated, secure management VLAN or specific administrator workstations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the JNAP Action Handler.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of command injection on network infrastructure, this vulnerability represents a significant risk. Administrators are strongly urged to monitor vendor communications for a firmware update and apply it immediately upon release. Until a fix is provided, reduce the attack surface by ensuring the management interface is not exposed to the public internet or untrusted network segments.

---METADATA---
VENDOR: Tenda
PRODUCT: HG10
AFFECTED_VERSIONS: HG7_HG9_HG10re_300001138_en_xpon
CONFIDENCE: high
MISSING: patch
CREDITS: xuanyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359540","name":"VDB-359540 | Tenda HG10 Boa Service formRouting formRoute buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359540/cti","name":"VDB-359540 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/796427","name":"Submit #796427 | Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/xyh4ck/iot_poc/blob/main/Tenda/HG10/01_Buffer_Overflow_nextHop/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda HG10 web management interface allows unauthenticated remote attackers to crash the device or potentially execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow in Tenda HG10 firmware enables unauthenticated remote attackers to trigger a denial of service or potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6988

Affected Software: Tenda HG10

Affected Versions: HG7_HG9_HG10re_300001138_en_xpon

Vulnerability: The Boa web service fails to perform boundary checks on the nextHop parameter within the formRoute function, leading to a stack-based buffer overflow that can be triggered by an unauthenticated attacker via a crafted HTTP POST request.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service of the affected router, disrupting critical network connectivity for all connected users and systems. Furthermore, because the Boa process operates with root privileges on the device, there is a significant risk that an attacker could leverage this memory corruption to achieve remote code execution, granting full control over the networking hardware. Given the CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately isolate the management interface from the public internet and restrict access to trusted management networks only.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP POST requests directed at the /boaform/formRouting endpoint, specifically looking for abnormally long payloads in the nextHop parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and drop HTTP requests containing excessive data within the nextHop parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers as it requires no authentication and targets a standard web management endpoint.

Analyst Recommendation

Due to the ease of exploitation and the potential for full system compromise, this vulnerability must be treated with high urgency. Organizations utilizing Tenda HG10 devices must ensure the web management interface is not exposed to the internet. Monitor vendor communication channels closely for the release of an official firmware update and apply it immediately upon availability.

---METADATA---
VENDOR: Sipeed
PRODUCT: PicoClaw
AFFECTED_VERSIONS: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4
CONFIDENCE: high
MISSING: patch
CREDITS: AiSec (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359530","name":"VDB-359530 | PicoClaw Web Launcher Management Plane restart command injection","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/359530/cti","name":"VDB-359530 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/796336","name":"Submit #796336 | PicoClaw V0.2.4 Command execution","tags":["third-party-advisory"]},{"url":"https://github.com/sipeed/picoclaw/issues/2307","name":null,"tags":["issue-tracking"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the Web Launcher Management Plane component of PicoClaw via the /api/gateway/restart endpoint, allowing for unauthenticated remote code execution.

Executive Summary:
PicoClaw versions 0.2.4 and earlier are vulnerable to a remote command injection flaw that allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6987

Affected Software: Sipeed PicoClaw

Affected Versions: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4

Vulnerability: The application is susceptible to command injection (CWE-77) within the /api/gateway/restart function of the Web Launcher Management Plane, which does not properly sanitize user-supplied input. The vulnerability is remotely exploitable by an unauthenticated attacker.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the host operating system, potentially leading to full system compromise. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and system integrity. Unauthorized access to the management plane could facilitate further lateral movement within the network or the deployment of malicious payloads.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the Web Launcher Management Plane and disable the affected service if it is not business-critical.

Proactive Monitoring: Monitor server logs and system process activity for unexpected execution of shell commands or suspicious network connections originating from the PicoClaw instance.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious payloads targeting the /api/gateway/restart endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered inherently dangerous due to its remote, unauthenticated nature and the lack of a vendor-provided fix.

Analyst Recommendation

Given the severity of a command injection vulnerability and the current lack of a vendor patch, organizations should prioritize isolating the affected PicoClaw instances from untrusted network segments. Continuous monitoring for indicators of compromise is essential until a secure version is released by the project maintainers.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Cosmos DB
AFFECTED_VERSIONS: Microsoft Azure Cosmos DB: -
CONFIDENCE: medium
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-04T09:06:49.542Z
SOURCES_JSON: [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69857","name":"Azure Cosmos DB Spoofing Vulnerability","tags":["vendor-advisory","patch"]}]
---END_METADATA---

Description Summary:
An authorization bypass vulnerability in Microsoft Azure Cosmos DB allows an authenticated attacker with low privileges to perform network spoofing via a user-controlled key.

Executive Summary:
A high-severity authorization bypass vulnerability in Microsoft Azure Cosmos DB allows authenticated attackers to manipulate keys and perform network spoofing.

Vulnerability Details

CVE-ID: CVE-2026-69857

Affected Software: Microsoft Azure Cosmos DB

Affected Versions: Microsoft Azure Cosmos DB: -

Vulnerability: This flaw, identified as CWE-639, involves an authorization bypass where a user-controlled key allows an attacker to circumvent intended access controls. The CVSS vector indicates that the attacker must already possess low-level privileges (PR:L) to trigger this condition.

Business Impact

Successful exploitation of this vulnerability permits an attacker to perform spoofing, potentially leading to unauthorized data access, integrity compromise, or service disruption within the Azure ecosystem. With a CVSS score of 8.5, this vulnerability represents a significant risk to cloud infrastructure, necessitating prompt attention to maintain the security posture of enterprise data environments.

Remediation Plan

Immediate Action: Review the Microsoft Security Response Center (MSRC) update guide for this CVE to identify specific service-side mitigations or configuration requirements provided by Microsoft.

Proactive Monitoring: Monitor Azure activity logs and Cosmos DB access logs for unusual patterns involving key management or unexpected authentication behavior associated with low-privileged service accounts.

Compensating Controls: Implement strict identity and access management (IAM) policies to limit the scope of permissions granted to users and ensure that least-privilege principles are strictly enforced across all database operations.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authenticated access, the ability to spoof over a network makes it a dangerous escalation vector for malicious actors already present within the environment.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Azure Cosmos DB should treat this advisory with urgency. Administrators must consult the official Microsoft update guide immediately to verify if any manual configuration changes are required to close the authorization bypass, as the nature of cloud-based services may require vendor-side implementation or specific tenant-level updates.

---METADATA---
VENDOR: Microsoft
PRODUCT: Microsoft Entra ID
AFFECTED_VERSIONS: Microsoft Entra ID
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A deserialization vulnerability in Microsoft Entra ID allows unauthorized remote code execution and has been actively exploited in the wild.

Executive Summary:
Microsoft Entra ID is affected by a critical deserialization vulnerability that has been confirmed as actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-69836

Affected Software: Microsoft Entra ID

Affected Versions: Microsoft Entra ID

Vulnerability: The vulnerability involves the deserialization of untrusted data, which allows an unauthenticated attacker to execute code over a network.

Business Impact

The CVSS score of 10.0 underscores the extreme severity of this flaw. As this impacts an identity management platform, a successful exploit could grant an attacker complete control over identity infrastructure, leading to massive data breaches and widespread unauthorized access across the enterprise.

Remediation Plan

Immediate Action: No customer action is required as Microsoft has already deployed the necessary patches to its managed cloud infrastructure.

Proactive Monitoring: Organizations should review identity logs for anomalous activity or unauthorized administrative actions that may have occurred during the exploitation window.

Compensating Controls: Utilize existing identity protection features and audit logs within Entra ID to detect and investigate any suspicious authentication or privilege escalation events.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of Aug 20, 2026. The risk is mitigated by the fact that Microsoft manages the underlying infrastructure and has applied the fix.

Analyst Recommendation

While the vendor has addressed the vulnerability on their end, security teams must treat this as a high-priority incident for internal audit. Review access logs and identity activity to ensure that no unauthorized changes were made while the platform was vulnerable.

---METADATA---
VENDOR: Divyanshu-hash
PRODUCT: GitPilot-MCP
AFFECTED_VERSIONS: 9ed9f153ba4158a2ad230ee4871b25130da29ffd
CONFIDENCE: high
MISSING: patch
CREDITS: BigW (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359523","name":"VDB-359523 | Divyanshu-hash GitPilot-MCP main.py repo_path command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359523/cti","name":"VDB-359523 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/795502","name":"Submit #795502 | Divyanshu-hash GitPilot-MCP 9ed9f153ba4158a2ad230ee4871b25130da29ffd Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/wing3e/public_exp/issues/38","name":null,"tags":["exploit","issue-tracking"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:38.527Z
---END_METADATA---

Description Summary:
GitPilot-MCP contains an OS command injection vulnerability in the run_tests function of main.py, allowing unauthenticated remote attackers to execute arbitrary shell commands.

Executive Summary:
A critical OS command injection vulnerability in GitPilot-MCP allows unauthenticated remote attackers to execute arbitrary commands on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-6980

Affected Software: Divyanshu-hash GitPilot-MCP

Affected Versions: 9ed9f153ba4158a2ad230ee4871b25130da29ffd

Vulnerability: The application utilizes the subprocess.run function with shell=True to execute the command argument in the run_tests tool without validation, enabling unauthenticated command injection.

Business Impact

A successful exploit grants the attacker full control over the host environment where the GitPilot-MCP service is running. This leads to complete loss of confidentiality, integrity, and availability, as attackers can read sensitive files, modify source code repositories, or disrupt critical CI/CD workflows. While the CVSS score is 7.3, the potential for arbitrary code execution and the presence of public exploit material warrant immediate attention.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should disable the affected tool or restrict network access to the MCP interface using strict firewall rules or mTLS authentication.

Proactive Monitoring: Review application logs for suspicious entries in the command argument of the run_tests tool, specifically looking for shell metacharacters such as semicolons, pipes, or backticks.

Compensating Controls: Deploy a Web Application Firewall or an API gateway to intercept and block incoming MCP JSON-RPC requests containing suspicious command strings or unexpected shell syntax.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced security report (https://github.com/wing3e/public_exp/issues/38).

Analyst Notes: As of April 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication for the affected tool interface.

Analyst Recommendation

Given the ease of exploitation and the severity of command injection, organizations currently utilizing GitPilot-MCP must prioritize the implementation of compensating controls. Since the vendor has not provided a security update, disabling the vulnerable functionality is the only reliable way to eliminate the risk of remote code execution until a secure version is released.

---METADATA---
VENDOR: Vanna-AI
PRODUCT: Vanna
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Vanna-AI Vanna framework, affecting versions up to 2.

Executive Summary:
A high-severity vulnerability in the Vanna-AI Vanna framework could allow for unauthorized system interactions.

Vulnerability Details

CVE-ID: CVE-2026-6977

Affected Software: Vanna-AI Vanna

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Vanna-AI Vanna up to version 2. The specific nature of the flaw remains under investigation, but it represents a security weakness that could be leveraged by an attacker to gain unauthorized access or influence the AI-driven data retrieval processes.

Business Impact

A successful exploit could result in unauthorized access to sensitive data processed by the Vanna AI framework, leading to potential information disclosure. With a CVSS score of 7.3, this high-severity issue necessitates a prompt response to maintain the confidentiality and integrity of AI-assisted data workflows.

Remediation Plan

Immediate Action: Upgrade the Vanna library to the latest stable version provided by Vanna-AI to remediate the vulnerability.

Proactive Monitoring: Review access logs for unusual queries or unauthorized API calls directed at the Vanna integration.

Compensating Controls: Use network segmentation to isolate systems running Vanna from critical internal databases until the software is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately identify all instances of Vanna-AI Vanna within their environment. Applying the latest vendor updates is critical to neutralizing the risk of exploitation and ensuring the security of AI-driven analytical platforms.