---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A race condition in the Linux kernel's RDMA/rxe component within the QP timer handler can lead to system instability.

Executive Summary:
A race condition in the Linux RDMA subsystem could lead to unpredictable system behavior or denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-45910

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a race condition occurring within the QP (Queue Pair) timer handlers in the rdma_rxe driver. This can be triggered by specific timing sequences during RDMA operations, potentially causing internal warnings or kernel panics.

Business Impact

This flaw poses a risk to service availability, particularly for high-throughput network environments relying on RDMA. With a CVSS score of 7.8, it is considered high-priority for data centers.

Remediation Plan

Immediate Action: Update the kernel to the latest version to include the fix for the race condition in the RDMA/rxe driver.

Proactive Monitoring: Monitor system logs for warnings related to rxe_task or other RDMA-related kernel warnings.

Compensating Controls: If immediate patching is not possible, avoid using the rdma_rxe software implementation in production environments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

We recommend applying the kernel patch immediately. Race conditions in kernel drivers are often difficult to debug and can lead to non-deterministic system failures; patching is the only reliable mitigation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A code initialization vulnerability in the Linux kernel's Mediatek clock driver could cause runtime errors due to incorrect memory marking.

Executive Summary:
Improper memory marking in the Linux Mediatek clock driver could lead to unpredictable behavior and system instability.

Vulnerability Details

CVE-ID: CVE-2026-45909

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the incorrect use of __initconst for clock gate structures that are required at runtime. This causes the kernel to treat initialization-time data as constant/disposable, leading to potential memory access issues when those structures are accessed later.

Business Impact

This flaw can result in kernel panics or system instability on devices utilizing Mediatek chips. While it has a CVSS score of 7.8, the real-world impact is largely dependent on the specific hardware/SoC implementation.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel update that removes the incorrect __initconst markers.

Proactive Monitoring: Monitor for kernel panics or hardware-related crashes on Mediatek-based devices.

Compensating Controls: There are no direct compensating controls for this internal code error; patching is the only viable remediation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations deploying Linux on Mediatek hardware should prioritize this update to ensure system stability and prevent potential exploitation of the memory access error.

---METADATA---
VENDOR: Intel
PRODUCT: VT-d
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An improper IOMMU configuration in Intel VT-d allows for a race condition when tearing down PASID entries.

Executive Summary:
A high-severity vulnerability in Intel VT-d hardware virtualization can lead to memory corruption or potential privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-45894

Affected Software: Intel VT-d (Linux Kernel implementation)

Affected Versions: See vendor advisory for affected versions.

Vulnerability: The vulnerability exists because the Present bit in the Intel VT-d Scalable Mode PASID table entry is not cleared before the entry is torn down. This leaves a window for invalid memory access.

Business Impact

A CVSS score of 7.8 reflects the severity of this hardware-level memory management issue. Exploitation could allow an attacker to bypass virtualization protections, leading to cross-VM information disclosure or system-level compromise.

Remediation Plan

Immediate Action: Apply the latest security patches for the Linux kernel that address Intel VT-d IOMMU management.

Proactive Monitoring: Monitor system health and virtualization logs for anomalies related to IOMMU or hardware-assisted virtualization.

Compensating Controls: Ensure that virtualization hosts are running fully patched firmware and kernels to maintain hardware isolation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Intel-based virtualization should treat this as a high-priority update. Updating the kernel and firmware is critical to maintaining the security boundary between virtualized instances.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A bounds-checking vulnerability in the Linux kernel's drm/amdkfd driver allows for potential memory corruption via improper watch_id handling.

Executive Summary:
An integer-related bounds-checking error in the Linux kernel AMD KFD driver could allow an attacker to corrupt memory.

Vulnerability Details

CVE-ID: CVE-2026-45878

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability occurs in the debug address watch code, where a signed/unsigned integer mismatch in watch_id leads to improper bounds checking. This can be exploited by a local user with access to the KFD device to perform out-of-bounds operations.

Business Impact

Exploitation of this vulnerability could lead to local privilege escalation or a denial-of-service condition. The CVSS score of 7.8 indicates a high risk to systems utilizing AMD GPU hardware for compute or graphical tasks.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest version to address the bounds-checking error in the AMD KFD driver.

Proactive Monitoring: Monitor for unusual activity or crashes associated with GPU compute tasks.

Compensating Controls: Restrict access to GPU device nodes to authorized users only to mitigate the risk of local exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

We recommend applying the kernel patch as soon as it becomes available for your distribution. Limiting access to the AMD KFD device interface is a necessary secondary control for high-security environments.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A cache-coherency vulnerability in the Linux kernel's IOMMU VT-d driver allows for potential memory access before proper initialization.

Executive Summary:
Improper cache management in the Linux kernel's IOMMU driver could lead to unauthorized memory access by hardware devices.

Vulnerability Details

CVE-ID: CVE-2026-45862

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw exists in the VT-d driver, where the PASID table is used before the CPU cache is flushed. This creates a window where the IOMMU hardware may read uninitialized or stale memory, potentially leading to security violations.

Business Impact

This vulnerability poses a risk to system integrity by allowing hardware devices to access potentially sensitive data in memory. With a CVSS score of 7.8, it represents a high-severity risk for virtualization hosts and systems leveraging IOMMU features.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel patch that corrects the order of cache flushing and PASID table usage.

Proactive Monitoring: Monitor for hardware-related memory faults or unexpected system resets on systems using Intel VT-d.

Compensating Controls: Disable IOMMU features if not strictly required, though this may impact performance and security features like device pass-through.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The complexity of this flaw necessitates a validated kernel update. Organizations using hardware-accelerated virtualization should treat this as a high-priority patch to protect against memory-based information leakage.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Linux kernel's GFS2 filesystem occurs when managing quota data objects during shutdown.

Executive Summary:
A use-after-free vulnerability in the Linux GFS2 filesystem could lead to system instability or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-45861

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The issue stems from the failure to properly remove quota data objects from the LRU list during filesystem shutdown, resulting in a slab-use-after-free in qd_put. This requires local access and specific filesystem operations to trigger.

Business Impact

This vulnerability could be leveraged by a local attacker to cause a kernel panic or potentially escalate privileges. With a CVSS score of 7.8, the risk is elevated for systems utilizing the GFS2 cluster filesystem, necessitating prompt attention.

Remediation Plan

Immediate Action: Update the kernel to a version containing the fix for the GFS2 quota data management issue.

Proactive Monitoring: Monitor for filesystem-related kernel warnings and logs indicating slab corruption or memory management errors.

Compensating Controls: Implement strict file system permissions and limit local access to systems utilizing GFS2 to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Systems running GFS2 should prioritize this patch. Given the nature of memory corruption vulnerabilities, ensuring the kernel is updated is the only effective way to eliminate the risk of exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A double-free vulnerability exists in the Linux kernel's RDMA/rxe component within the rxe_srq_from_init function.

Executive Summary:
A double-free vulnerability in the Linux kernel RDMA subsystem could allow an attacker to trigger memory corruption and system crashes.

Vulnerability Details

CVE-ID: CVE-2026-45852

Affected Software: Linux Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the rxe_srq_from_init function due to improper handling of the queue pointer during initialization. This flaw can be triggered by an authenticated user with access to RDMA interfaces, leading to a double-free condition.

Business Impact

The potential for memory corruption in the kernel can lead to system-wide instability, data corruption, or arbitrary code execution. With a CVSS score of 7.8, this flaw poses a high risk to environments utilizing RDMA/RoCE, potentially affecting high-performance computing clusters and data center infrastructure.

Remediation Plan

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor.

Proactive Monitoring: Review system logs for kernel panic events and memory allocation errors related to the RDMA subsystem.

Compensating Controls: If patching is delayed, restrict access to RDMA interfaces to trusted users and disable the rdma_rxe module if it is not required for production operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities involving memory management are critical. We recommend immediate remediation through verified vendor patches to prevent potential local privilege escalation or denial-of-service attacks against your infrastructure.

---METADATA---
VENDOR: Tiandy
PRODUCT: Easy7 Integrated Management Platform
AFFECTED_VERSIONS: Up to 7.17.0
---END_METADATA---

Description Summary:
Tiandy Easy7 Integrated Management Platform contains an OS command injection vulnerability in its Configuration Handler, allowing remote attackers to execute commands via the File argument.

Executive Summary:
The Tiandy Easy7 Integrated Management Platform is vulnerable to a critical remote OS command injection flaw that allows unauthenticated attackers to seize full control of the system.

Vulnerability Details

CVE-ID: CVE-2026-4585

Affected Software: Tiandy Easy7 Integrated Management Platform

Affected Versions: Up to 7.17.0

Vulnerability: The vulnerability exists in the Configuration Handler component within the /Easy7/apps/WebService/ImportSystemConfiguration.jsp file. By manipulating the "File" argument, a remote attacker can trigger an OS command injection without requiring valid credentials.

Business Impact

Impacted organizations face a total compromise of their management platform, which likely controls physical security or surveillance infrastructure. An attacker could disable security controls, access sensitive video feeds, or use the platform as a pivot point for further network attacks. The CVSS score of 9.8 underscores the high risk due to the ease of remote exploitation and the lack of vendor responsiveness.

Remediation Plan

Immediate Action: Since the vendor has not responded to disclosure, administrators should consider isolating the Easy7 platform from the internet and restricting internal access.

Proactive Monitoring: Monitor web server logs for suspicious requests directed at the ImportSystemConfiguration.jsp endpoint, specifically looking for shell-related syntax in the File parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block OS command injection patterns in HTTP POST requests.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 23, 2026, a public exploit has been disclosed for this vulnerability. Given the lack of a vendor patch and the availability of functional exploit code, active exploitation should be considered imminent or ongoing.

Analyst Recommendation

Due to the availability of a public exploit and the lack of a formal patch from Tiandy, this vulnerability represents an extreme risk. It is recommended to decommission the software or place it behind a strictly controlled VPN until a fix is verified.

---METADATA---
VENDOR: Linux
PRODUCT: kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Linux kernel SLIP implementation allows for improper memory access by failing to properly bound decode() reads against compressed packet lengths.

Executive Summary:
A memory access vulnerability in the Linux kernel SLIP subsystem poses a high security risk, potentially allowing local attackers to cause system instability or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-45843

Affected Software: Linux kernel

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists in the slhc_uncompress() function, which parses VJ-compressed TCP headers. By failing to correctly bound decode() and pull16() operations against the compressed packet length, the kernel is susceptible to out-of-bounds memory interactions.

Business Impact

With a CVSS score of 8.2 (High), this kernel-level flaw represents a major security concern. Exploitation could result in system-wide service disruption, denial-of-service, or potentially arbitrary code execution at the kernel level, which is a critical threat to data integrity and system availability.

Remediation Plan

Immediate Action: Update the Linux kernel to the latest patched version provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that systems are running with hardened kernel configurations and that untrusted users are restricted from accessing network-level interfaces that utilize SLIP.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities are inherently critical due to the level of privilege involved. Administrators should verify their current kernel version against vendor security bulletins and apply updates as part of standard patch management cycles to minimize risk.

---METADATA---
VENDOR: ChromaDB
PRODUCT: ChromaDB Python
AFFECTED_VERSIONS: ChromaDB Python project version 0.4.17 or later
---END_METADATA---

Description Summary:
A code injection vulnerability in ChromaDB allows authenticated attackers to execute arbitrary code by supplying a malicious model repository.

Executive Summary:
A code injection vulnerability in the ChromaDB Python project enables authenticated attackers to execute arbitrary code on the server, presenting a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-45833

Affected Software: ChromaDB Python

Affected Versions: ChromaDB Python project version 0.4.17 or later

Vulnerability: The vulnerability allows an authenticated attacker possessing the UPDATE_COLLECTION permission to trigger code execution. By submitting a malicious model repository with the trust_remote_code attribute set to true, the attacker can force the server to execute arbitrary instructions.

Business Impact

The CVSS score of 8.8 underscores the critical nature of this flaw. By allowing arbitrary code execution, an attacker can gain full control over the application server, leading to unauthorized data exfiltration and potential lateral movement within the network.

Remediation Plan

Immediate Action: Refer to the HiddenLayer security advisory to determine the necessary update path and apply the latest security patches.

Proactive Monitoring: Review application logs for suspicious API requests involving model repository updates or settings that enable remote code execution.

Compensating Controls: Restrict API access and enforce the principle of least privilege regarding the "UPDATE_COLLECTION" permission to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the risk of remote code execution, organizations utilizing ChromaDB should immediately review their current version and update accordingly. Ensure that access controls are strictly enforced to prevent unauthorized users from reaching the vulnerable API endpoint.

---METADATA---
VENDOR: ChromaDB
PRODUCT: ChromaDB
AFFECTED_VERSIONS: Unknown
---END_METADATA---

Description Summary:
A tenant-isolation bypass vulnerability exists in the V1 collection-level endpoints of the ChromaDB Python project.

Executive Summary:
A high-severity authorization bypass in ChromaDB allows authenticated attackers to circumvent tenant-isolation controls, potentially leading to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-45832

Affected Software: ChromaDB

Affected Versions: Unknown

Vulnerability: The vulnerability exists because V1 collection-level endpoints incorrectly pass null values for tenant and database parameters to the authorization layer. This is a post-authentication issue where an authenticated user can bypass intended tenant-isolation boundaries.

Business Impact

With a CVSS score of 8.8, this flaw presents a significant risk to data privacy and multi-tenant security. While it does not grant unauthenticated access or remote code execution, it allows attackers to access data belonging to other tenants, potentially leading to massive unauthorized data exposure within the database.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately to resolve the improper authorization handling.

Proactive Monitoring: Review API logs for unusual access patterns, specifically looking for requests that target collections outside of a user's assigned tenant.

Compensating Controls: Restrict network access to the ChromaDB instance to trusted clients only to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights a critical failure in authorization logic. Organizations hosting multi-tenant environments using ChromaDB must prioritize this update to ensure data integrity and tenant isolation. Immediate restriction of network access to trusted clients is strongly recommended as an interim measure.

---METADATA---
VENDOR: ChromaDB
PRODUCT: ChromaDB Python project
AFFECTED_VERSIONS: versions 0.5.0 or later
---END_METADATA---

Description Summary:
The SimpleRBACAuthorizationProvider in ChromaDB fails to validate the target tenant or collection, leading to cross-tenant authorization bypass.

Executive Summary:
A high-severity authorization logic error in the ChromaDB SimpleRBACAuthorizationProvider allows for cross-tenant unauthorized actions, potentially compromising sensitive multi-tenant data.

Vulnerability Details

CVE-ID: CVE-2026-45831

Affected Software: ChromaDB ChromaDB Python project

Affected Versions: versions 0.5.0 or later

Vulnerability: The SimpleRBACAuthorizationProvider correctly checks if a user has a specific permission but fails to verify if that permission is scoped to the correct tenant, database, or collection. This allows an authenticated attacker to perform actions outside their authorized scope.

Business Impact

The 8.8 CVSS score reflects the high risk of unauthorized data manipulation. By exploiting this flaw, an attacker could perform cross-tenant actions, leading to unauthorized modification or exfiltration of sensitive information belonging to other users or organizations, resulting in a total compromise of data trust.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor to ensure the authorization provider correctly validates target scopes.

Proactive Monitoring: Review authentication and authorization logs for signs of users attempting to perform operations on resources outside their assigned tenant or collection.

Compensating Controls: Utilize database-level access controls or external authorization proxies to enforce stricter resource scoping while waiting for the patch to be deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical breakdown in access control logic. Administrators should treat this as a high-priority update to prevent cross-tenant data corruption or exposure, ensuring the authorization provider is updated to correctly validate resource-specific permissions.

---METADATA---
VENDOR: ChromaDB
PRODUCT: ChromaDB Python project
AFFECTED_VERSIONS: version 0.4.17 or later
---END_METADATA---

Description Summary:
A broken access control vulnerability in ChromaDB allows authenticated users to perform unauthorized data operations across different tenants.

Executive Summary:
A critical authorization flaw in the ChromaDB Python project allows authenticated users to bypass tenant isolation, posing a severe risk of unauthorized data access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-45830

Affected Software: ChromaDB ChromaDB Python project

Affected Versions: version 0.4.17 or later

Vulnerability: This vulnerability stems from a lack of authorization validation, allowing any authenticated user to arbitrarily read, write, update, or delete data within any tenant's collection, regardless of their own tenant permissions.

Business Impact

With a CVSS score of 8.8, this high-severity vulnerability presents a significant risk to data confidentiality and integrity. Successful exploitation could lead to massive data breaches, cross-tenant data exposure, and potential destruction of database contents, causing severe reputational and operational damage to organizations relying on multi-tenant ChromaDB environments.

Remediation Plan

Immediate Action: Upgrade to a secure version of the ChromaDB Python project as identified in the vendor advisory to restore proper tenant isolation.

Proactive Monitoring: Audit database access logs for unusual patterns, such as a single user account accessing collections associated with multiple distinct tenant IDs.

Compensating Controls: Implement strict network-level segmentation or application-layer identity filtering to restrict user access to specific database instances where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for authenticated users to bypass security boundaries, immediate remediation is required. Organizations should prioritize updating their ChromaDB deployments to ensure that tenant isolation is correctly enforced and that unauthorized cross-tenant data access is blocked.

---METADATA---
VENDOR: Kestra
PRODUCT: Kestra
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Kestra orchestration platform, requiring immediate review of the vendor's security advisory.

Executive Summary:
A high-severity vulnerability in the Kestra orchestration platform poses a significant risk to the security and integrity of automated workflows.

Vulnerability Details

CVE-ID: CVE-2026-45807

Affected Software: Kestra Kestra

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Kestra event-driven orchestration platform. While technical specifics are pending further disclosure, vulnerabilities in orchestration platforms often involve unauthorized access or command execution. Users should assume the vulnerability requires authentication unless otherwise specified by the vendor.

Business Impact

Given the CVSS score of 7.7, this vulnerability is critical for environments where Kestra manages sensitive business workflows. Successful exploitation could lead to unauthorized workflow execution, data exposure, or the compromise of downstream systems integrated with the orchestration platform.

Remediation Plan

Immediate Action: Upgrade to the latest version of Kestra as specified in the official vendor security advisory.

Proactive Monitoring: Audit Kestra logs for unauthorized workflow executions, suspicious trigger events, or modifications to existing orchestration pipelines.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the Kestra control plane to authorized management subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Orchestration platforms serve as a centralized hub for business operations, making this vulnerability an attractive target. It is imperative to monitor Kestra's official security bulletins and apply recommended updates immediately to maintain the integrity of your automated environment.

---METADATA---
VENDOR: Termix
PRODUCT: Termix
AFFECTED_VERSIONS: prior to version 2.3.2
---END_METADATA---

Description Summary:
The Termix platform is vulnerable to persistent OS command injection via the tunnel connect endpoint due to improper input sanitization of host record fields.

Executive Summary:
A critical command injection vulnerability in Termix allows authenticated users to achieve persistent remote code execution on the source SSH host.

Vulnerability Details

CVE-ID: CVE-2026-45748

Affected Software: Termix

Affected Versions: prior to version 2.3.2

Vulnerability: The POST /ssh/tunnel/connect endpoint interpolates user-controlled host fields directly into shell commands without sufficient escaping. This allows an authenticated attacker to inject arbitrary commands that persist on the source SSH host.

Business Impact

With a CVSS score of 9.8, this flaw poses a catastrophic risk to the security of the management environment. The ability to inject persistent commands means that an attacker can establish long-term unauthorized access, potentially escalating privileges and compromising the integrity of the entire SSH tunnel infrastructure.

Remediation Plan

Immediate Action: Apply the update to Termix version 2.3.2 to resolve the command injection flaw.

Proactive Monitoring: Audit existing SSH tunnel configurations and host record fields for evidence of injected payloads or unauthorized modifications.

Compensating Controls: Employ network-level egress filtering to limit the impact of potential command execution and restrict access to the tunnel management interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw makes it a prime target for attackers seeking persistent access.

Analyst Recommendation

Given the potential for persistent command execution, immediate patching to version 2.3.2 is mandatory. Security teams should also perform a thorough audit of existing host records to ensure no malicious commands have already been injected into the system.

---METADATA---
VENDOR: Termix
PRODUCT: Termix
AFFECTED_VERSIONS: Prior to version 2.3.2
---END_METADATA---

Description Summary:
The Termix platform contains an OS command injection vulnerability in the resolvePath endpoint, allowing authenticated users with an active session to execute arbitrary commands on remote hosts.

Executive Summary:
A critical OS command injection vulnerability in Termix allows authenticated users to execute arbitrary commands on connected remote hosts.

Vulnerability Details

CVE-ID: CVE-2026-45744

Affected Software: Termix

Affected Versions: Prior to version 2.3.2

Vulnerability: The GET /ssh/file_manager/ssh/resolvePath endpoint fails to properly sanitize input for shell command construction. An authenticated user with an active File Manager SSH session can bypass quote escaping to inject and execute arbitrary OS commands on the connected remote host.

Business Impact

This vulnerability carries a CVSS score of 9.9, indicating an extremely high risk of full system compromise. Successful exploitation allows an attacker to gain remote code execution capabilities on the host infrastructure, potentially leading to total data exfiltration, lateral movement, or complete system takeover.

Remediation Plan

Immediate Action: Upgrade the Termix platform to version 2.3.2 or later immediately.

Proactive Monitoring: Review access logs for anomalous command patterns or unexpected shell executions originating from the File Manager SSH session context.

Compensating Controls: Implement strict session monitoring and restrict access to the File Manager SSH functionality to only essential administrative personnel.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of remote code execution, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates an immediate upgrade to version 2.3.2. Organizations should treat this as a high-priority incident, as the vulnerability effectively grants command-line access to the underlying infrastructure for any user with a valid session.

---METADATA---
VENDOR: n8n-io
PRODUCT: n8n
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the n8n workflow automation platform that may allow for unauthorized system interaction.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could permit unauthorized access or system manipulation.

Vulnerability Details

CVE-ID: CVE-2026-45732

Affected Software: n8n-io n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to flaws within the n8n automation framework that potentially expose sensitive workflow data or system execution capabilities to unauthorized parties. Given the nature of workflow automation tools, this often involves improper handling of authenticated requests or insecure configuration defaults.

Business Impact

Successful exploitation poses a severe risk to organizational operations, potentially leading to the compromise of automated workflows, unauthorized data exfiltration, or the execution of malicious tasks within the target environment. With a CVSS score of 8.3, this vulnerability is classified as High, indicating a significant potential for operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Update the n8n instance to the latest version provided by the vendor to ensure all security patches are applied.

Proactive Monitoring: Review audit logs for unusual workflow executions or unauthorized access attempts originating from unexpected IP addresses.

Compensating Controls: Implement strict network segmentation and ensure the n8n interface is not exposed to the public internet without robust authentication and WAF protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role workflow automation platforms play in modern infrastructure, the risk posed by this vulnerability is substantial. Organizations should prioritize patching their n8n deployments immediately to prevent potential exploitation.

---METADATA---
VENDOR: Budibase
PRODUCT: Low-code Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been identified in the Budibase low-code platform that requires immediate attention from security administrators to prevent potential unauthorized access or system impact.

Executive Summary:
The Budibase low-code platform is affected by a high-severity vulnerability that poses a significant risk to organizational data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-45717

Affected Software: Budibase Low-code Platform

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific technical nature of this vulnerability is currently underspecified, but it carries a CVSS score of 8.8, indicating a high-risk flaw that could potentially lead to significant security compromise. The authentication requirements for exploitation remain unclear; therefore, all instances should be treated as potentially reachable by unauthorized parties.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to internal applications, potential data leakage, or the execution of unauthorized actions within the low-code environment. With a CVSS score of 8.8, this flaw represents a significant risk to business operations, potentially leading to service disruption or the compromise of sensitive business data managed through the platform.

Remediation Plan

Immediate Action: Consult the official Budibase security advisory to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Review system access logs for anomalous behavior or unauthorized administrative requests directed at the platform.

Compensating Controls: Implement strict network access controls to limit exposure of the platform to trusted internal segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS rating, this vulnerability should be prioritized for remediation. Organizations using Budibase must monitor vendor channels for specific patch release information and deploy updates as soon as they become available to minimize the window of exposure.

---METADATA---
VENDOR: Budibase
PRODUCT: Low-code Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Budibase low-code platform, necessitating prompt review and remediation by security teams.

Executive Summary:
The Budibase low-code platform contains a critical security flaw with a high CVSS score, creating a substantial risk of unauthorized system exploitation.

Vulnerability Details

CVE-ID: CVE-2026-45716

Affected Software: Budibase Low-code Platform

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is characterized by a CVSS score of 8.8, reflecting its potential impact on system security. The specific technical vector remains undefined, requiring administrators to adopt a defensive posture until detailed vendor documentation is released.

Business Impact

Exploitation of this vulnerability could result in unauthorized administrative access, data compromise, or the degradation of critical business applications built on the Budibase platform. The high severity score underscores the need to mitigate this risk to protect organizational assets and maintain the confidentiality and integrity of platform-hosted applications.

Remediation Plan

Immediate Action: Identify the correct versioning information via the official Budibase security portal and apply the necessary security patches.

Proactive Monitoring: Monitor application logs for signs of suspicious activity, such as unexpected API calls or unauthorized configuration changes.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter traffic and block potentially malicious requests targeting the application infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability as a high priority. Until a patch is applied, ensure that access to the Budibase environment is restricted to authenticated and authorized users, and maintain heightened vigilance against potential exploitation attempts.

---METADATA---
VENDOR: Formie
PRODUCT: Craft CMS Plugin
AFFECTED_VERSIONS: Prior to 2.2.20 and 3.1.24
---END_METADATA---

Description Summary:
The Formie plugin for Craft CMS is vulnerable to remote code execution due to improper evaluation of user-supplied Twig templates within hidden form fields.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Formie Craft CMS plugin allows attackers to compromise the underlying server by injecting malicious Twig expressions.

Vulnerability Details

CVE-ID: CVE-2026-45697

Affected Software: Formie Craft CMS Plugin

Affected Versions: Prior to 2.2.20 and 3.1.24

Vulnerability: The plugin fails to properly sanitize user input in hidden form fields configured with "Custom" default values. An unauthenticated attacker can submit crafted values that are evaluated as Twig code during submission processing, leading to arbitrary code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to site integrity. Successful exploitation allows an attacker to execute arbitrary code on the hosting server, potentially leading to full site compromise, unauthorized data exfiltration, or complete system takeover.

Remediation Plan

Immediate Action: Upgrade the Formie plugin to version 2.2.20 or 3.1.24 immediately to patch the template evaluation logic.

Proactive Monitoring: Monitor server logs for unexpected execution errors or unauthorized file access attempts originating from the plugin's submission endpoints.

Compensating Controls: Implement strict input validation at the Web Application Firewall (WAF) level to block requests containing common Twig syntax or suspicious template injection patterns.

Exploitation Status

Public Exploit Available: No data available.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE, administrators should treat this as a high-priority update. Ensure that all instances of the Formie plugin are patched immediately to prevent attackers from leveraging this entry point to gain control over the Craft CMS environment.

---METADATA---
VENDOR: Rocket.Chat
PRODUCT: Rocket.Chat
AFFECTED_VERSIONS: Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11
---END_METADATA---

Description Summary:
An unauthenticated attacker can inject MongoDB operators into the OAuth token endpoint to steal valid access tokens for arbitrary users, including administrators.

Executive Summary:
An unauthenticated remote code execution vulnerability in Rocket.Chat allows attackers to hijack arbitrary user sessions, including those with administrative privileges, via malicious OAuth requests.

Vulnerability Details

CVE-ID: CVE-2026-45689

Affected Software: Rocket.Chat Rocket.Chat

Affected Versions: Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11

Vulnerability: This is an improper input validation vulnerability where the OAuth2 server fails to sanitize grant parameters before processing them in a MongoDB query. An unauthenticated attacker can supply NoSQL injection payloads to retrieve and iterate through valid bearer tokens.

Business Impact

The ability to hijack administrative sessions provides full control over the communication platform, leading to potential data exfiltration, unauthorized communication, and server-side code execution via the Apps-Engine. Given the CVSS score of 9.1, this vulnerability poses an extreme risk to organizational confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade to the latest patched version (8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11) immediately to resolve the injection flaw.

Proactive Monitoring: Audit access logs for anomalous HTTP POST requests to the /oauth/token endpoint, particularly those containing MongoDB query syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing common NoSQL injection patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security failure in the authentication layer of Rocket.Chat. Administrators must prioritize patching these instances immediately to prevent full administrative takeover. Delaying updates leaves the platform exposed to complete compromise and unauthorized access to sensitive internal communications.

---METADATA---
VENDOR: Rocket.Chat
PRODUCT: Rocket.Chat
AFFECTED_VERSIONS: Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11
---END_METADATA---

Description Summary:
An unauthenticated attacker can use NoSQL injection in the CAS login handler to bypass authentication and hijack active user sessions, including administrative accounts.

Executive Summary:
An unauthenticated NoSQL injection vulnerability in the Rocket.Chat CAS login handler allows attackers to bypass authentication and gain full unauthorized access to user accounts.

Vulnerability Details

CVE-ID: CVE-2026-45688

Affected Software: Rocket.Chat Rocket.Chat

Affected Versions: Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11

Vulnerability: The CAS login handler fails to validate the credentialToken parameter, allowing an unauthenticated attacker to inject NoSQL operators into the MongoDB query. This permits the attacker to match and hijack the authentication tokens of legitimate users currently performing SSO logins.

Business Impact

Successful exploitation results in total account takeover, granting the attacker the same permissions as the victim, including full administrative access to the platform. With a CVSS score of 9.1, this vulnerability represents an existential risk to the platform's security and the privacy of user data.

Remediation Plan

Immediate Action: Apply the vendor-provided patches (versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, or 7.10.11) as the primary mitigation.

Proactive Monitoring: Review application logs for unexpected DDP login activity or login sessions that deviate from standard patterns.

Compensating Controls: Implement strict ingress filtering or WAF rules to sanitize NoSQL query operators from incoming web traffic targeting the login service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of administrative compromise via this authentication bypass is significant. Security teams should treat this as a high-priority incident and ensure all Rocket.Chat instances are updated to the latest version to prevent unauthorized session hijacking.

---METADATA---
VENDOR: Rocket.Chat
PRODUCT: Rocket.Chat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in Rocket.Chat that could potentially allow for unauthorized access or system compromise.

Executive Summary:
Rocket.Chat is affected by a high-severity vulnerability that poses a significant risk to the confidentiality and integrity of communications infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-45687

Affected Software: Rocket.Chat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of this vulnerability involves a flaw in Rocket.Chat that may permit unauthorized operations; the exact authentication requirement is currently pending vendor clarification.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive internal communications, potentially resulting in data exfiltration or the compromise of administrative accounts. With a CVSS score of 8.5, this high-severity flaw represents a substantial threat to organizational security posture and operational continuity.

Remediation Plan

Immediate Action: Review the official Rocket.Chat security advisory and apply the latest security patches or configuration changes as soon as they are made available.

Proactive Monitoring: Monitor server access logs for anomalous behavior, specifically unexpected spikes in traffic or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict network segmentation and ensure the application is not exposed directly to the public internet without a Web Application Firewall (WAF) providing inspection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations deploying Rocket.Chat must prioritize this issue. Security teams should monitor vendor channels closely and be prepared to deploy emergency patches immediately upon release to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Rocket.Chat
PRODUCT: Rocket.Chat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Rocket.Chat communication platform, necessitating immediate administrative review.

Executive Summary:
The Rocket.Chat communication platform is impacted by a high-severity vulnerability that could permit unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-45677

Affected Software: Rocket.Chat Rocket.Chat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Rocket.Chat platform, a widely used collaboration tool. Given its function, the flaw likely involves unauthorized access to communication channels or administrative functions, potentially allowing an attacker to intercept sensitive internal discussions.

Business Impact

The CVSS score of 8.7 indicates a high potential for severe business impact, including the unauthorized interception of confidential internal communications and potential lateral movement within the network. Compromise of a collaboration platform can lead to significant data breaches, exposing proprietary information and damaging organizational trust.

Remediation Plan

Immediate Action: Update the Rocket.Chat server to the latest version immediately to incorporate the necessary security fixes.

Proactive Monitoring: Review platform audit logs for suspicious account activity, unusual login locations, or unauthorized changes to administrative settings.

Compensating Controls: Implement multi-factor authentication (MFA) across all user accounts and restrict access to the Rocket.Chat management interface to known internal IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on Rocket.Chat for internal communications must prioritize the deployment of the latest security patches. Failure to remediate this vulnerability could expose sensitive organizational data to external actors, making prompt action essential for maintaining a secure collaboration environment.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Open WebUI contains an unspecified vulnerability within its self-hosted artificial intelligence platform.

Executive Summary:
An unspecified security vulnerability in the Open WebUI artificial intelligence platform poses a significant risk to organizational data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-45675

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation lacks specific technical details regarding the vulnerability type or the authentication requirements necessary for exploitation. Administrators must consult the vendor's security advisory to determine the exact attack vector and required user privileges.

Business Impact

With a CVSS score of 8.1, this vulnerability is classified as High severity, indicating a substantial risk of system compromise. Successful exploitation could lead to unauthorized access to AI-driven workflows, data exfiltration, or potential service disruption of critical internal tooling.

Remediation Plan

Immediate Action: Consult the official Open WebUI vendor security portal immediately to identify and apply the necessary security updates.

Proactive Monitoring: Review system access logs for anomalous behavior and monitor for unusual outbound traffic originating from the AI platform.

Compensating Controls: Ensure the instance is not exposed to the public internet and implement strict network access controls (ACLs) to restrict interaction to trusted internal users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation remains significant.

Analyst Recommendation

Given the High severity rating, it is imperative that security teams prioritize the investigation of this vulnerability within their environment. Administrators should verify their current version against the vendor's documentation and apply all recommended patches immediately to mitigate potential unauthorized access.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.
---END_METADATA---

Description Summary:
Netty's DnsResolveContext fails to validate the origin of CNAME records, making applications using the framework vulnerable to DNS Cache Poisoning (Bailiwick Bypass).

Executive Summary:
Netty is vulnerable to DNS cache poisoning due to improper validation of CNAME records, which can lead to traffic redirection and potential man-in-the-middle attacks.

Vulnerability Details

CVE-ID: CVE-2026-45674

Affected Software: Netty

Affected Versions: Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.

Vulnerability: This is a DNS cache poisoning vulnerability. The DnsResolveContext fails to check if CNAME records originate from the correct bailiwick, allowing attackers to inject malicious DNS records into the cache of applications using the framework.

Business Impact

The CVSS score of 8.7 highlights the severity of this issue. Successful exploitation allows for DNS hijacking, which can redirect users to malicious servers, facilitate data interception, or cause significant disruption to network communications for any application relying on Netty for DNS resolution.

Remediation Plan

Immediate Action: Upgrade Netty to version 4.1.135, 4.2.15, or higher to implement proper CNAME bailiwick validation.

Proactive Monitoring: Monitor for anomalous DNS resolution patterns or unexpected traffic redirection within applications using the Netty framework.

Compensating Controls: Ensure that upstream DNS servers are configured to provide DNSSEC validation and consider using additional network-level security to verify DNS responses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

DNS integrity is foundational to network security. Organizations must prioritize upgrading to the recommended Netty versions to prevent cache poisoning attacks and ensure the reliability of their network communications.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in Open WebUI that may allow for unauthorized access or system impact.

Executive Summary:
Open WebUI is susceptible to a security vulnerability that could potentially expose the platform to unauthorized access or operational disruption.

Vulnerability Details

CVE-ID: CVE-2026-45672

Affected Software: Open WebUI

Affected Versions: See vendor advisory for affected versions

Vulnerability: The specific technical nature of this vulnerability is currently being addressed by the vendor; users should consult official documentation for the exact mechanism of compromise.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and availability of the AI platform, potentially leading to unauthorized data access or service degradation.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor as soon as they become available.

Proactive Monitoring: Review application logs for any unauthorized access attempts or unusual system behavior.

Compensating Controls: Ensure the instance is behind a secure firewall and limit external access to only necessary personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should monitor the vendor's security portal for upcoming patches. Once released, the update must be applied promptly to maintain the security posture of the Open WebUI platform.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Open WebUI contains an unspecified vulnerability within its self-hosted artificial intelligence platform.

Executive Summary:
An unspecified security vulnerability in the Open WebUI artificial intelligence platform poses a significant risk to organizational data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-45671

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation lacks specific technical details regarding the vulnerability type or the authentication requirements necessary for exploitation. Administrators must consult the vendor's security advisory to determine the exact attack vector and required user privileges.

Business Impact

With a CVSS score of 8.0, this vulnerability is classified as High severity, suggesting a severe risk to the confidentiality and availability of the platform. Exploitation could allow malicious actors to manipulate AI responses or gain unauthorized access to the underlying host environment.

Remediation Plan

Immediate Action: Consult the official Open WebUI vendor security portal immediately to identify and apply the necessary security updates.

Proactive Monitoring: Review system access logs for anomalous behavior and monitor for unusual outbound traffic originating from the AI platform.

Compensating Controls: Ensure the instance is not exposed to the public internet and implement strict network access controls (ACLs) to restrict interaction to trusted internal users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation remains significant.

Analyst Recommendation

Given the High severity rating, it is imperative that security teams prioritize the investigation of this vulnerability within their environment. Administrators should verify their current version against the vendor's documentation and apply all recommended patches immediately to mitigate potential unauthorized access.

---METADATA---
VENDOR: Tenda
PRODUCT: A15
AFFECTED_VERSIONS: 15.13.07.13
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda A15 UploadCfg function allows remote attackers to execute arbitrary code via a malicious File argument.

Executive Summary:
Tenda A15 WiFi extenders are vulnerable to a critical remote code execution flaw due to a buffer overflow in the configuration upload function.

Vulnerability Details

CVE-ID: CVE-2026-4567

Affected Software: Tenda A15

Affected Versions: 15.13.07.13

Vulnerability: A stack-based buffer overflow exists in the UploadCfg function within the /cgi-bin/UploadCfg file. A remote, unauthenticated attacker can manipulate the File argument to overflow the stack and gain control of the device.

Business Impact

Successful exploitation allows an attacker to gain full control over the Tenda A15 device. This can lead to the interception of network traffic, redirection of users to malicious websites (DNS hijacking), and use of the device as a pivot point for further attacks on the internal network. The CVSS score of 9.8 underscores the critical nature of this hardware vulnerability.

Remediation Plan

Immediate Action: Update the Tenda A15 firmware to the latest version provided by the vendor. If no patch is available, consider replacing the device.

Proactive Monitoring: Monitor for unusual outbound traffic from the device and review administrative logs for unauthorized configuration changes.

Compensating Controls: Disable the web management interface from being accessible over the WAN and ensure the device is behind a robust network firewall.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of March 23, 2026, the exploit for this vulnerability has been disclosed to the public. Active exploitation should be assumed for any devices exposed to the internet or untrusted local networks.

Analyst Recommendation

The public availability of an exploit for a CVSS 9.8 vulnerability makes this a critical priority. Administrators should apply the vendor-supplied firmware update immediately or decommission the affected hardware to prevent network compromise.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Open WebUI contains an unspecified vulnerability within its self-hosted artificial intelligence platform.

Executive Summary:
An unspecified security vulnerability in the Open WebUI artificial intelligence platform poses a significant risk to organizational data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-45665

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation lacks specific technical details regarding the vulnerability type or the authentication requirements necessary for exploitation. Administrators must consult the vendor's security advisory to determine the exact attack vector and required user privileges.

Business Impact

With a CVSS score of 8.1, this vulnerability is classified as High severity, indicating a substantial risk of system compromise. Successful exploitation could lead to unauthorized access to AI-driven workflows, data exfiltration, or potential service disruption of critical internal tooling.

Remediation Plan

Immediate Action: Consult the official Open WebUI vendor security portal immediately to identify and apply the necessary security updates.

Proactive Monitoring: Review system access logs for anomalous behavior and monitor for unusual outbound traffic originating from the AI platform.

Compensating Controls: Ensure the instance is not exposed to the public internet and implement strict network access controls (ACLs) to restrict interaction to trusted internal users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation remains significant.

Analyst Recommendation

Given the High severity rating, it is imperative that security teams prioritize the investigation of this vulnerability within their environment. Administrators should verify their current version against the vendor's documentation and apply all recommended patches immediately to mitigate potential unauthorized access.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.29.1 and earlier
---END_METADATA---

Description Summary:
Dokploy contains a command injection vulnerability in its Docker file upload functionality that allows authenticated users to execute arbitrary OS commands.

Executive Summary:
A critical command injection vulnerability in Dokploy allows authenticated users to execute arbitrary OS commands on the host by manipulating file upload paths.

Vulnerability Details

CVE-ID: CVE-2026-45663

Affected Software: Dokploy PaaS

Affected Versions: 0.29.1 and earlier

Vulnerability: The application fails to sanitize the destinationPath parameter during Docker file uploads, instead interpolating it directly into a shell command. An authenticated attacker can inject shell metacharacters (e.g., ;, ") to break out of the intended docker cp command and execute arbitrary commands on the host operating system.

Business Impact

With a CVSS score of 9.9, this vulnerability allows for total host compromise. An authenticated attacker can gain full control over the server hosting the Dokploy PaaS, potentially leading to unauthorized data access, service disruption, or further exploitation of the internal infrastructure.

Remediation Plan

Immediate Action: Upgrade Dokploy to the latest version immediately to resolve the improper parameter sanitization.

Proactive Monitoring: Monitor system logs for unexpected shell execution patterns or unauthorized changes to system files originating from the Dokploy service user.

Compensating Controls: Implement strict file path validation and limit the permissions of the user account running the Dokploy service to the minimum necessary to perform its functions.

Exploitation Status

Public Exploit Available: No data available.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant breach of isolation between the user and the host system. All organizations using Dokploy must patch immediately and audit their environments for any signs of unauthorized access or malicious command execution.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy (PaaS)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Dokploy, a self-hostable Platform as a Service (PaaS), is affected by a critical vulnerability that may allow unauthorized access or administrative control.

Executive Summary:
A critical security vulnerability in the Dokploy PaaS platform poses a significant risk of unauthorized system access and potential compromise.

Vulnerability Details

CVE-ID: CVE-2026-45662

Affected Software: Dokploy PaaS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of this vulnerability is currently under-disclosed, but the high CVSS score suggests a flaw in authentication or authorization mechanisms within the PaaS environment.

Business Impact

As a Platform as a Service, a compromise of Dokploy could grant an attacker control over all hosted applications and their associated data. The 8.8 CVSS score reflects the high potential for total system takeover and the resulting catastrophic business impact.

Remediation Plan

Immediate Action: Review the official Dokploy security advisories and apply the latest available patches or version upgrades.

Proactive Monitoring: Monitor platform logs for unauthorized administrative logins and verify the integrity of deployed container configurations.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and restrict exposure of the Dokploy dashboard to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the lack of granular technical detail, administrators should treat this vulnerability with high urgency. Immediately audit the Dokploy installation and apply any vendor-provided security updates to mitigate the risk of unauthorized platform access.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.26.5 and earlier
---END_METADATA---

Description Summary:
A path traversal vulnerability in Dokploy allows authenticated users to write arbitrary files to the host or remote servers during application deployment, leading to full system compromise.

Executive Summary:
A critical path traversal flaw in Dokploy allows authenticated users to overwrite files and execute arbitrary code on the host or remote servers.

Vulnerability Details

CVE-ID: CVE-2026-45661

Affected Software: Dokploy PaaS

Affected Versions: 0.26.5 and earlier

Vulnerability: The vulnerability allows path traversal during application deployment. By crafting malicious deployment packages, an authenticated user can write files to sensitive locations, enabling persistent backdoors, cron job manipulation, and arbitrary remote code execution on both the local host and remote deployment targets.

Business Impact

With a CVSS score of 9.9, this vulnerability is critical. It bypasses container isolation mechanisms, meaning even remote servers managed by Dokploy are at risk of total compromise. The ability to install backdoors and exfiltrate data represents a major threat to organizational infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy (check vendor advisory for available patches).

Proactive Monitoring: Monitor deployment logs for suspicious file paths and review server cron jobs for unauthorized entries or unexpected modifications.

Compensating Controls: Limit access to the deployment features and implement strict filesystem permissions to prevent unauthorized writes outside of expected application directories.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the entire managed infrastructure. Administrators must prioritize updating their Dokploy installation and auditing their deployment pipelines for any signs of unauthorized file modifications.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity flaw has been identified in the Belkin F9K1122 router, which could allow for unauthorized access or device compromise.

Executive Summary:
Belkin F9K1122 routers are affected by a high-severity vulnerability that could allow attackers to compromise the device and the network it manages.

Vulnerability Details

CVE-ID: CVE-2026-4566

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for affected versions

Vulnerability: A flaw has been discovered in the Belkin F9K1122 router. Although technical details are currently sparse, the CVSS score of 8.8 indicates a high-severity issue that likely allows for remote exploitation and significant control over the device.

Business Impact

Compromise of a perimeter router like the Belkin F9K1122 allows an attacker to intercept all network traffic, perform Man-in-the-Middle (MitM) attacks, and gain access to the internal network. This poses a critical risk to the privacy and security of all connected devices and data.

Remediation Plan

Immediate Action: Check the Belkin support website for the latest firmware updates for the F9K1122 and apply them immediately.

Proactive Monitoring: Monitor for unauthorized changes to router settings and unusual network traffic patterns originating from the device.

Compensating Controls: Ensure that remote management of the router is disabled and change all default administrative passwords to strong, unique values.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, router vulnerabilities are highly sought after by attackers for building botnets and conducting surveillance.

Analyst Recommendation

Given the high CVSS score, this vulnerability must be addressed urgently. If the device is end-of-life and no longer receiving security updates, it should be replaced with a modern, supported router immediately.

---METADATA---
VENDOR: Microsoft
PRODUCT: Office SharePoint
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An insecure deserialization vulnerability in Microsoft Office SharePoint allows an authorized attacker to execute arbitrary code over a network.

Executive Summary:
An insecure deserialization flaw in Microsoft Office SharePoint allows authorized attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45659

Affected Software: Microsoft Office SharePoint

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from the improper deserialization of untrusted data. An attacker with existing authorized access can manipulate input data to execute arbitrary code on the SharePoint server.

Business Impact

This vulnerability poses a severe risk to the confidentiality and integrity of data stored within SharePoint. Given the CVSS score of 8.8, successful exploitation could lead to full system compromise, data theft, or lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft to all SharePoint instances.

Proactive Monitoring: Review server-side application logs for suspicious deserialization patterns or unexpected execution of child processes.

Compensating Controls: Implement strict network segmentation and ensure that SharePoint servers are not exposed to unauthorized network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability allows for code execution, it is critical to prioritize the installation of security patches. Administrators should verify the integrity of their SharePoint environment and ensure that access controls are strictly enforced.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Kernel
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Windows Kernel allows unauthenticated attackers to execute arbitrary code over the network.

Executive Summary:
A critical use-after-free vulnerability in the Windows Kernel allows for unauthenticated remote code execution, threatening the integrity of the operating system.

Vulnerability Details

CVE-ID: CVE-2026-45657

Affected Software: Microsoft Windows Kernel

Affected Versions: See vendor advisory

Vulnerability: This is a use-after-free memory corruption vulnerability within the Windows Kernel. An unauthenticated attacker can leverage this flaw to execute code with kernel-level privileges, effectively bypassing all user-mode security controls.

Business Impact

The CVSS score of 9.8 highlights the extreme risk associated with kernel-level vulnerabilities. Exploitation results in full system control, allowing an attacker to bypass security software, install persistent rootkits, and exfiltrate sensitive data. The ability to trigger this over the network significantly increases the threat surface.

Remediation Plan

Immediate Action: Apply the latest Windows cumulative security updates to patch the kernel-level memory management flaw.

Proactive Monitoring: Utilize Endpoint Detection and Response (EDR) tools to identify and block suspicious kernel-level activity or unauthorized system calls.

Compensating Controls: Maintain the principle of least privilege and ensure all systems are running with modern security features such as Kernel Mode Code Signing (KMCS).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities of this magnitude represent the highest tier of security risk. It is imperative that all Windows assets are patched immediately to prevent potential exploitation. Organizations should prioritize systems with high availability requirements that are accessible via network interfaces.

---METADATA---
VENDOR: Microsoft
PRODUCT: Active Directory Domain Services
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Active Directory Domain Services allows an authenticated attacker to execute arbitrary code over a network.

Executive Summary:
A high-severity stack-based buffer overflow in Active Directory Domain Services could allow an authenticated attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45648

Affected Software: Microsoft Active Directory Domain Services

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a stack-based buffer overflow vulnerability within the Active Directory infrastructure. An authenticated attacker can leverage this flaw to send specifically crafted packets to the service, potentially resulting in remote code execution with elevated system privileges.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the domain controller, leading to total compromise of the enterprise identity management system. Given the CVSS score of 8.8, the impact is severe, as it threatens the confidentiality, integrity, and availability of the entire network architecture.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft as soon as they become available for the affected domain controllers.

Proactive Monitoring: Monitor system logs for unexpected service crashes or unusual memory patterns associated with AD services.

Compensating Controls: Restrict access to domain controllers to authorized personnel and utilize host-based intrusion detection systems to monitor for anomalous traffic patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Active Directory is the backbone of most corporate networks; therefore, any vulnerability affecting this service is of extreme importance. Administrators should prioritize the deployment of security patches to all domain controllers to prevent potential remote code execution and systemic compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Hyper-V
AFFECTED_VERSIONS: Windows 10 Version 21H2 and 22H2 on x64, Windows 11 Version 23H2/24H2/25H2/26H1 on x64, Windows Server 2022, and Windows Server 2025.
---END_METADATA---

Description Summary:
A type confusion vulnerability in Windows Hyper-V allows an authenticated attacker on a guest VM to execute arbitrary code on the host server.

Executive Summary:
A critical type confusion vulnerability in Windows Hyper-V could allow a guest VM attacker to execute code on the host server, necessitating an urgent security update.

Vulnerability Details

CVE-ID: CVE-2026-45641

Affected Software: Microsoft Windows Hyper-V

Affected Versions: Windows 10 Version 21H2 and 22H2 on x64 systems, Windows 11 Version 23H2, 24H2, 25H2, and 26H1 on x64 systems, plus Windows Server 2022 and Windows Server 2025, including Server Core installations.

Vulnerability: This is a type confusion flaw (CWE-843) occurring when an authenticated attacker on a guest VM sends specially crafted file operation requests to hardware resources, resulting in host-level RCE.

Business Impact

The potential for host-level code execution represents a severe security risk, as it allows attackers to bypass virtual machine boundaries. With a CVSS score of 8.4, this vulnerability could facilitate widespread system compromise and data exfiltration if left unpatched.

Remediation Plan

Immediate Action: Deploy the June 2026 cumulative updates across all identified Windows platforms and Server installations.

Proactive Monitoring: Review host-level audit logs for suspicious activity originating from guest VM hardware requests.

Compensating Controls: Utilize host-based security software to detect anomalous process behavior that may indicate an attempted breakout.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous because it allows an attacker to escape the guest environment. Organizations must treat this as a high-priority update and verify that all host systems are patched to the June 2026 baseline to maintain environment integrity.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.26.6 and earlier
---END_METADATA---

Description Summary:
Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint that allows authenticated users to execute arbitrary commands with root privileges.

Executive Summary:
A command injection vulnerability in Dokploy allows authenticated users to achieve root-level remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45633

Affected Software: Dokploy PaaS

Affected Versions: 0.26.6 and earlier

Vulnerability: The vulnerability exists in the /docker-container-logs WebSocket endpoint where the 'tail' and 'since' parameters are improperly validated before being concatenated into shell commands. This allows an authenticated user to escape the intended functionality and execute arbitrary commands with root privileges on the host system.

Business Impact

The exploitation of this vulnerability carries a CVSS score of 9.9, indicating a critical risk to the confidentiality, integrity, and availability of the hosting environment. Successful exploitation grants an attacker full root-level control over the server, facilitating complete system compromise, data theft, or the deployment of persistent backdoors.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.26.7 or later immediately.

Proactive Monitoring: Audit WebSocket traffic logs for unusual 'tail' or 'since' parameter values and monitor system logs for unexpected shell process spawning.

Compensating Controls: Implement strict network access controls to limit access to the Dokploy management interface to trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required to prevent unauthorized root-level access. Organizations utilizing Dokploy must prioritize upgrading to version 0.26.7 to eliminate the command injection vector.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.26.7 and earlier
---END_METADATA---

Description Summary:
A broken access control vulnerability in the Dokploy schedule router allows authenticated users to manage schedules belonging to other organizations, leading to RCE.

Executive Summary:
A lack of authorization checks in the Dokploy schedule router enables authenticated users to perform unauthorized actions, leading to potential RCE.

Vulnerability Details

CVE-ID: CVE-2026-45632

Affected Software: Dokploy PaaS

Affected Versions: 0.26.7 and earlier

Vulnerability: The schedule router fails to enforce organization and role-based access control. Any authenticated user can interact with schedules across the platform if they possess the relevant identifiers, allowing them to execute scripts on host or remote servers.

Business Impact

With a CVSS score of 9.9, this is a critical vulnerability. It facilitates cross-organization data and system access, enabling any authenticated user to gain Remote Code Execution (RCE) on both the central Dokploy host and any managed target server.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy.

Proactive Monitoring: Review audit logs for unauthorized schedule modifications or executions and verify that only authorized users have access to sensitive schedule identifiers.

Compensating Controls: Implement strict identity and access management (IAM) policies and limit access to the Dokploy instance to authorized organization members only.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to restore proper access control. Administrators should also conduct a review of existing schedules to ensure no malicious tasks were created during the period of exposure.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.27.0 to before 0.29.3
---END_METADATA---

Description Summary:
A hardcoded authentication secret in Dokploy allows unauthenticated attackers to forge JWTs, gain administrative access, and execute commands on the host system via SSH.

Executive Summary:
A hardcoded authentication secret in Dokploy enables unauthenticated attackers to bypass security controls and gain full administrative control over the host.

Vulnerability Details

CVE-ID: CVE-2026-45631

Affected Software: Dokploy PaaS

Affected Versions: 0.27.0 to before 0.29.3

Vulnerability: The application utilizes a hardcoded fallback secret ("better-auth-secret-123456789") for JWT signing. This flaw allows an unauthenticated attacker to forge email verification tokens, authenticate as an administrator, and leverage the built-in SSH terminal to execute arbitrary commands.

Business Impact

With a CVSS score of 10, this is a maximum-severity vulnerability. It allows any unauthenticated attacker to bypass all authentication mechanisms, leading to full unauthorized access to the PaaS environment and the underlying host server. This could result in total data loss, system destruction, or deep-seated persistence within the network.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.3 or later immediately.

Proactive Monitoring: Review all authentication logs for suspicious administrative sign-ins and investigate the creation of unauthorized SSH sessions or unexpected terminal activity.

Compensating Controls: Ensure the management interface is not exposed to the public internet and require VPN access for all administrative operations.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical and represents a complete security failure. Administrators must ensure the software is updated to the patched version 0.29.3 immediately to prevent potential account takeover and remote code execution.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.28.8 and earlier
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Dokploy /listen-deployment WebSocket endpoint allows authenticated users to execute arbitrary commands on remote servers.

Executive Summary:
An OS command injection flaw in the Dokploy WebSocket interface allows authenticated users to execute arbitrary code on managed remote servers.

Vulnerability Details

CVE-ID: CVE-2026-45629

Affected Software: Dokploy PaaS

Affected Versions: 0.28.8 and earlier

Vulnerability: The /listen-deployment WebSocket endpoint fails to properly sanitize user input, leading to OS command injection. Authenticated organization members can abuse this to execute commands on remote servers managed by the Dokploy instance.

Business Impact

This vulnerability carries a CVSS score of 9.9, reflecting the risk of full server compromise across the entire managed infrastructure. An attacker with standard user access can escalate to full control over remote servers, leading to lateral movement and widespread system disruption.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy.

Proactive Monitoring: Monitor WebSocket traffic for suspicious payloads and review remote server logs for unauthorized command execution.

Compensating Controls: Restrict access to the Dokploy management console to trusted personnel and implement network-level egress filtering on managed servers to block unauthorized outbound connections from injected processes.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their Dokploy instance immediately. Given the potential for lateral movement, a thorough audit of all managed remote servers is recommended to ensure no unauthorized persistence has been established.

---METADATA---
VENDOR: Arcane
PRODUCT: Docker Container Management Interface
AFFECTED_VERSIONS: Prior to 1.19.0
---END_METADATA---

Description Summary:
Arcane's REST API fails to enforce admin-level authorization on Git repository management endpoints, allowing authenticated users to exfiltrate sensitive credentials.

Executive Summary:
An authorization bypass in the Arcane management interface allows authenticated users to exfiltrate plaintext Git credentials by exploiting improperly protected API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-45625

Affected Software: Arcane Container Management Interface

Affected Versions: Prior to 1.19.0

Vulnerability: Multiple API endpoints related to Git repository management fail to invoke the checkAdmin(ctx) helper, and the authentication middleware only verifies the user role rather than admin privileges. An authenticated user can manipulate repository URLs to trick the system into leaking PATs or SSH keys to an attacker-controlled host.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe threat to organizations using GitOps workflows. Successful exploitation enables an attacker to steal highly sensitive credentials, potentially granting them access to private source code repositories, CI/CD pipelines, and internal infrastructure.

Remediation Plan

Immediate Action: Update the Arcane management interface to version 1.19.0 or later to enforce proper admin authorization checks.

Proactive Monitoring: Review audit logs for unusual activity on /api/customize/git-repositories or /api/git-repositories/sync endpoints, particularly from non-admin accounts.

Compensating Controls: Restrict access to the Arcane management interface to trusted internal networks and implement IP-based access control lists (ACLs) to limit the exposure of the API.

Exploitation Status

Public Exploit Available: No data available.

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the risk of inconsistent authorization enforcement. Organizations should immediately apply the update and rotate any credentials that may have been accessible via the Arcane interface to ensure the security of integrated Git repositories.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Hyper-V
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in Windows Hyper-V allows an authenticated attacker on a guest VM to execute arbitrary code on the host server.

Executive Summary:
A critical remote code execution (RCE) vulnerability in Windows Hyper-V poses a significant risk to host server integrity if exploited by an authenticated attacker.

Vulnerability Details

CVE-ID: CVE-2026-45607

Affected Software: Microsoft Windows Hyper-V

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an out-of-bounds read (CWE-125) flaw triggered when an authenticated attacker on a guest virtual machine sends specially crafted file operation requests to host hardware resources.

Business Impact

The exploitation of this vulnerability could lead to complete host server compromise, resulting in unauthorized data access, lateral movement within the network, and potential service disruption. With a CVSS score of 8.4, this high-severity flaw requires immediate remediation to prevent attackers from breaking out of the virtualized environment.

Remediation Plan

Immediate Action: Apply the June 2026 cumulative updates provided by Microsoft to all affected Hyper-V host servers.

Proactive Monitoring: Monitor virtual machine logs for unusual file operation requests and anomalous resource utilization on the host.

Compensating Controls: Ensure strict isolation of guest VMs and implement network segmentation to limit the impact of a potential host-level compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of RCE vulnerabilities in virtualization layers, administrators should prioritize patching all Hyper-V hosts. Applying the June 2026 cumulative updates is the only definitive way to mitigate this risk and prevent potential guest-to-host breakout scenarios.

---METADATA---
VENDOR: Microsoft
PRODUCT: Defender (Malware Protection Engine)
AFFECTED_VERSIONS: 1.1.0.0 up to (excluding) 1.1.26040.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Microsoft Malware Protection Engine allows an unauthorized attacker to execute arbitrary code over a network.

Executive Summary:
A heap-based buffer overflow in the Microsoft Malware Protection Engine could allow an unauthorized attacker to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-45584

Affected Software: Microsoft Defender (Malware Protection Engine)

Affected Versions: 1.1.0.0 up to (excluding) 1.1.26040.8

Vulnerability: This is a heap-based buffer overflow (CWE-122) in the Malware Protection Engine. An unauthorized attacker can trigger this vulnerability over a network, potentially leading to arbitrary code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a critical risk as it allows for remote code execution, which could result in full system takeover. The potential for unauthorized access to sensitive data and disruption of services makes this a high-priority remediation item.

Remediation Plan

Immediate Action: Ensure that the Microsoft Malware Protection Engine is updated to version 1.1.26040.8 or later immediately.

Proactive Monitoring: Monitor network traffic and endpoint telemetry for unusual process execution or attempts to exploit memory vulnerabilities.

Compensating Controls: Ensure standard endpoint protection policies are active and that the system is configured to receive automatic signature and engine updates from Microsoft.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution vulnerabilities in security products are extremely dangerous because they can be exploited before a user even interacts with a malicious file. Organizations must verify that their Microsoft Defender engines have been automatically updated to the patched version to mitigate this risk.