---METADATA---
VENDOR: Shahjada
PRODUCT: WPDM – Premium Packages
AFFECTED_VERSIONS: up to and including 6.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WPDM Premium Packages WordPress plugin contains an unauthenticated SQL injection vulnerability in versions 6.2.0 and prior, permitting remote database query execution.

Executive Summary:
The WPDM Premium Packages plugin is susceptible to an unauthenticated SQL injection, creating a critical path for attackers to compromise database security.

Vulnerability Details

CVE-ID: CVE-2026-61948

Affected Software: Shahjada WPDM – Premium Packages

Affected Versions: up to and including 6.2.0

Vulnerability: The plugin fails to properly neutralize special elements in SQL commands (CWE-89), enabling unauthenticated attackers to perform malicious database operations.

Business Impact

Successful exploitation allows an attacker to bypass authentication and manipulate or extract data from the database. A CVSS score of 9.3 underscores the critical severity, which could result in significant data breaches or unauthorized access to sensitive digital assets managed by the plugin.

Remediation Plan

Immediate Action: Update the WPDM – Premium Packages plugin to version 7.0.0 or higher.

Proactive Monitoring: Analyze application server logs for anomalous database interactions and monitor for unexpected administrative account activity.

Compensating Controls: Utilize a WAF to inspect incoming traffic for SQL injection payloads, which can provide an interim layer of protection if patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable due to the lack of required authentication.

Analyst Recommendation

This vulnerability represents a significant security risk to the integrity of the WordPress site. Administrators must upgrade to version 7.0.0 immediately to remediate the flaw and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: dj-extensions.com
PRODUCT: jDownloads extension for Joomla
AFFECTED_VERSIONS: 4.1.0-4.1.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The jDownloads extension for Joomla contains an unauthenticated file upload vulnerability that allows a remote attacker to achieve full remote code execution on the server.

Executive Summary:
The jDownloads extension for Joomla is vulnerable to unauthenticated file uploads, which can lead to complete server compromise through remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-61900

Affected Software: dj-extensions.com jDownloads extension for Joomla

Affected Versions: 4.1.0-4.1.5

Vulnerability: This is an unrestricted file upload flaw (CWE-434) that allows an unauthenticated attacker to upload malicious files. By successfully executing this, the attacker gains full remote code execution (RCE) on the underlying Joomla host.

Business Impact

Exploitation of this vulnerability grants the attacker full control over the Joomla application and the underlying server environment. Given the CVSS score of 10, the impact is severe, potentially leading to the theft of site data, long-term persistence in the network, and significant reputational damage.

Remediation Plan

Immediate Action: Update the jDownloads extension for Joomla to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor server logs for HTTP requests involving suspicious file uploads or access to newly created files in document directories.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict file upload capabilities and block known malicious payloads targeting the jDownloads component.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit available).

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of unauthenticated access and file upload functionality makes this a high-priority target for automated scanning.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to patch the jDownloads extension. Security teams should ensure that all instances are updated to the latest supported version to eliminate the risk of remote code execution and unauthorized system access.

---METADATA---
VENDOR: Apache
PRODUCT: Apache Tapestry
AFFECTED_VERSIONS: 5.5.0 up to (excluding) 5.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the tapestry-core component of Apache Tapestry 5 allows for the unauthorized exposure of sensitive information to unauthenticated actors.

Executive Summary:
A high-severity information disclosure vulnerability in Apache Tapestry 5 enables unauthenticated remote attackers to access sensitive system data.

Vulnerability Details

CVE-ID: CVE-2026-61899

Affected Software: Apache Tapestry

Affected Versions: 5.5.0 up to (excluding) 5.9.1

Vulnerability: This is an exposure of sensitive information to an unauthorized actor (CWE-200) within the tapestry-core module. The vulnerability permits an unauthenticated attacker to gain access to information that should be protected.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to application security. Successful exploitation could allow attackers to harvest sensitive data, potentially leading to further reconnaissance or unauthorized access to backend systems.

Remediation Plan

Immediate Action: Update Apache Tapestry to version 5.9.1 or later to resolve the information disclosure flaw.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or requests targeting sensitive system files and configuration endpoints.

Compensating Controls: Implement strict access control lists at the network or application level to limit exposure of the tapestry-core components to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is remotely exploitable, it currently lacks evidence of active weaponization.

Analyst Recommendation

Organizations utilizing Apache Tapestry should audit their environments to identify all instances within the vulnerable version range. Applying the update to version 5.9.1 is the only effective way to remediate this information disclosure risk.

---METADATA---
VENDOR: Weintek
PRODUCT: cMT3092X firmware
AFFECTED_VERSIONS: cMT3092X firmware: 0 up to (excluding) 20210218; EasyWeb: 0 up to (excluding) v2.1.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Weintek cMT3092X HMI devices are vulnerable to privilege escalation due to improper token modification by authenticated users.

Executive Summary:
A critical privilege escalation vulnerability in Weintek cMT3092X HMI firmware allows an authenticated, non-privileged user to gain unauthorized elevated access.

Vulnerability Details

CVE-ID: CVE-2026-61892

Affected Software: Weintek cMT3092X firmware

Affected Versions: cMT3092X firmware: 0 up to (excluding) 20210218; EasyWeb: 0 up to (excluding) v2.1.20

Vulnerability: The device suffers from improper restriction of operations within the bounds of a memory buffer or object (CWE-732), allowing a low-privileged authenticated user to modify tokens and perform administrative actions.

Business Impact

Successful exploitation allows an attacker to bypass standard authorization controls, potentially leading to full control over the industrial HMI system. Given the CVSS score of 8.8, this poses a high risk to operational technology environments where unauthorized configuration changes could result in safety hazards, process disruption, or permanent equipment damage.

Remediation Plan

Immediate Action: Obtain and apply the patch package cmt_typeB_20260316_007, which updates EasyWeb to version 2.3.17-typeb, by contacting Weintek support or your local distributor.

Proactive Monitoring: Audit device access logs for unusual administrative activity or unauthorized attempts to modify system tokens.

Compensating Controls: Restrict network access to the HMI device to known, trusted IP addresses using internal firewalls or VLAN segmentation to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an authorization oversight that requires initial low-level access to the device.

Analyst Recommendation

This vulnerability represents a significant security risk to industrial control systems. Administrators must prioritize the acquisition and application of the provided patch from Weintek to prevent unauthorized privilege escalation and ensure the integrity of the HMI environment.

---METADATA---
VENDOR: Tycon Systems
PRODUCT: TPDIN-Monitor-WEB2
AFFECTED_VERSIONS: 2.3.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The web interface of Tycon Systems TPDIN-Monitor-WEB2 fails to validate credentials, allowing unauthenticated remote attackers to bypass login and obtain administrative access.

Executive Summary:
An unauthenticated authentication bypass vulnerability in the Tycon Systems TPDIN-Monitor-WEB2 web interface allows full administrative control over power and network settings.

Vulnerability Details

CVE-ID: CVE-2026-61884

Affected Software: Tycon Systems TPDIN-Monitor-WEB2

Affected Versions: 2.3.9

Vulnerability: This vulnerability stems from a lack of server-side credential validation (CWE-288) during the login process. By submitting empty values, an attacker can bypass authentication entirely and establish an administrative session, granting them unrestricted control over the device.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for trivial, unauthenticated remote control of critical infrastructure. An attacker could remotely reboot equipment, modify network settings, or disable power relays, potentially causing physical damage or operational outages in the environments where these devices are deployed.

Remediation Plan

Immediate Action: Contact Tycon Systems for the latest security updates and apply them immediately. In the absence of a direct patch, consider isolating the device management interface from all external networks.

Proactive Monitoring: Review web access logs for unusual login patterns or multiple requests with empty credentials, which may indicate an attempt to exploit this flaw.

Compensating Controls: Deploy a Web Application Firewall (WAF) or place the device behind a secure VPN to prevent direct access to the management interface by unauthorized entities.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of any required authentication, making it a high priority for mitigation.

Analyst Recommendation

Due to the critical severity and the ease of exploitation, this device should be removed from public-facing networks immediately. Ensure that the device management interface is only accessible via trusted internal networks until a formal firmware update is applied.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: LuCI to 3.0.0 (exclusive)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stored XSS vulnerability in OpenWrt LuCI allows adjacent network attackers to inject malicious HTML via DHCPv6 lease hostnames.

Executive Summary:
A stored cross-site scripting vulnerability in OpenWrt LuCI allows adjacent network attackers to execute malicious scripts in the browser of an administrator.

Vulnerability Details

CVE-ID: CVE-2026-61876

Affected Software: OpenWrt LuCI

Affected Versions: LuCI to 3.0.0 (exclusive)

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability caused by the failure to properly encode DHCPv6 lease hostnames. An attacker on the local network can inject malicious HTML/JavaScript tags into the hostname, which will be executed in the administrator's browser when the status table is viewed.

Business Impact

This vulnerability carries a CVSS score of 8.8, representing a High severity risk. By exploiting this, an adjacent attacker can perform malicious actions in the context of the administrator’s session, such as stealing session cookies, redirecting the user to malicious sites, or performing unauthorized administrative actions, which could ultimately lead to full network compromise.

Remediation Plan

Immediate Action: Update the LuCI web interface to version 3.0.0 or later as indicated in the vendor advisory at https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh.

Proactive Monitoring: Review DHCPv6 lease tables and web access logs for any evidence of malformed hostnames or unusual administrative activity.

Compensating Controls: Restrict access to the administrative web interface by limiting the networks or specific IP addresses allowed to reach the management console.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable by any device capable of communicating on the local network segment.

Analyst Recommendation

Administrators should update the LuCI interface immediately to version 3.0.0 or newer to remediate this flaw. Given the ease with which adjacent attackers can inject malicious payloads, ensuring that the management interface is not exposed to untrusted clients is a critical defensive measure.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: All versions of luci-app-upnp are affected.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the OpenWrt luci-app-upnp package allows unauthenticated LAN attackers to execute malicious JavaScript via UPnP IGD AddPortMapping requests.

Executive Summary:
A critical stored XSS vulnerability in OpenWrt's luci-app-upnp component allows unauthenticated attackers to execute arbitrary code in the context of an administrator session.

Vulnerability Details

CVE-ID: CVE-2026-61875

Affected Software: OpenWrt LuCI

Affected Versions: All versions of luci-app-upnp are affected.

Vulnerability: This is a stored cross-site scripting (XSS) flaw occurring when the application fails to sanitize input within the NewPortMappingDescription field. An unauthenticated attacker on the local network can inject malicious payloads that execute when an administrator views the affected UPnP or Status pages.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an authenticated administrator. This can lead to unauthorized configuration changes, session hijacking, or further compromise of the network gateway. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and security of the administrative interface.

Remediation Plan

Immediate Action: Update your OpenWrt firmware to the latest available version, which includes a patched luci-app-upnp package.

Proactive Monitoring: Review web interface access logs for unusual activity or requests containing unexpected script tags in UPnP-related parameters.

Compensating Controls: If immediate patching is not feasible, restrict network access to the LuCI administrative interface and disable the UPnP service if it is not required for network operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger the payload storage.

Analyst Recommendation

Given the ease of exploitation and the potential for full administrative compromise, organizations should prioritize updating their OpenWrt instances. Administrators must ensure that the luci-app-upnp package is patched to the latest version to prevent potential session hijacking and unauthorized gateway manipulation.

---METADATA---
VENDOR: Directus
PRODUCT: Directus
AFFECTED_VERSIONS: < 12.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Directus is vulnerable to unauthorized information disclosure and authorization bypass due to improper handling of sensitive cached data and user-controlled keys.

Executive Summary:
Directus versions prior to 12.0.0 contain a critical vulnerability that allows unauthenticated attackers to bypass authorization controls and access sensitive cached information.

Vulnerability Details

CVE-ID: CVE-2026-61836

Affected Software: Directus

Affected Versions: < 12.0.0

Vulnerability: This vulnerability involves the use of a cache containing sensitive information and an authorization bypass through user-controlled keys. The flaw is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated attacker to bypass authorization and access sensitive data poses a severe risk to organizational confidentiality. Because Directus manages SQL database content, this vulnerability could lead to the unauthorized exposure of proprietary business data, customer information, or administrative credentials. The CVSS score of 8.6 reflects the high potential for significant data compromise.

Remediation Plan

Immediate Action: Upgrade to Directus version 12.0.0 or later immediately.

Proactive Monitoring: Review application logs for unusual access patterns or unauthorized API requests that deviate from established user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious requests targeting the API dashboard.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to its automatable nature and lack of required authentication.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for unauthorized access to sensitive database content, administrators should prioritize patching immediately. Upgrading to version 12.0.0 is the only effective way to remediate the underlying authorization and cache-handling flaws.

---METADATA---
VENDOR: NixOS
PRODUCT: nixpkgs
AFFECTED_VERSIONS: < 25.11, >= 26.05-beta, < 26.05
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nixpkgs contains an incorrect default permissions vulnerability that may expose sensitive files or system components to unauthorized access.

Executive Summary:
Nixpkgs versions within the specified ranges suffer from incorrect default permissions, which could lead to unauthorized access to sensitive system information.

Vulnerability Details

CVE-ID: CVE-2026-61828

Affected Software: NixOS nixpkgs

Affected Versions: < 25.11, >= 26.05-beta, < 26.05

Vulnerability: The vulnerability stems from incorrect default permissions assigned to software packages. This issue can be exploited by an authenticated local user to gain unauthorized access to system files or escalate privileges.

Business Impact

Successful exploitation could result in a total compromise of the affected system's security posture. With a CVSS score of 8.5, this vulnerability represents a severe risk to environments relying on Nixpkgs for software deployment, as local users could potentially bypass system restrictions.

Remediation Plan

Immediate Action: Update the Nixpkgs collection to a secure version as directed by the official NixOS security advisory.

Proactive Monitoring: Regularly audit file system permissions for critical packages and monitor for unauthorized attempts to access restricted directories by non-privileged users.

Compensating Controls: Employ system-level hardening and the principle of least privilege to ensure that local users have restricted access to sensitive software environments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for privilege escalation on the host system.

Analyst Recommendation

Given the potential for system-wide impact, it is imperative that administrators using Nixpkgs apply the relevant security updates immediately. Ensure all package channels are synchronized with the latest secure versions to prevent exploitation of these permission flaws.

---METADATA---
VENDOR: HKUDS
PRODUCT: LightRAG
AFFECTED_VERSIONS: < 1.5.5rc1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
LightRAG versions through 1.5.4 expose an unauthenticated API server, allowing remote attackers to manipulate knowledge graphs, access documents, and consume LLM resources.

Executive Summary:
The LightRAG API server is vulnerable to unauthenticated access, allowing remote attackers to read, modify, or delete sensitive data and consume infrastructure resources.

Vulnerability Details

CVE-ID: CVE-2026-61808

Affected Software: HKUDS LightRAG

Affected Versions: < 1.5.5rc1

Vulnerability: The application binds its API server to all network interfaces with authentication disabled by default. This missing authentication vulnerability allows any unauthenticated network attacker to perform administrative actions, including data manipulation and resource exhaustion.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to data confidentiality and availability. Unauthorized access to RAG-based systems can lead to the exposure of sensitive indexed documents, corruption of the underlying knowledge base, and significant financial loss due to the unauthorized consumption of LLM API resources.

Remediation Plan

Immediate Action: Update HKUDS LightRAG to version 1.5.5rc1 or later to enforce mandatory authentication on the API server.

Proactive Monitoring: Audit network configurations to ensure the API server is not exposed to untrusted networks and monitor logs for unauthorized API calls.

Compensating Controls: Implement strict network-level access controls or VPN requirements to restrict access to the LightRAG API to authorized internal entities only.

Exploitation Status

Public Exploit Available: Unknown — there is no confirmed public exploit in the available data.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the default configuration of disabling authentication on a critical network service.

Analyst Recommendation

Organizations utilizing LightRAG must treat this as a high-priority remediation task. Ensure that the software is updated to the fixed version and verify that the API is not exposed to the public internet until authentication controls are properly implemented and validated.

---METADATA---
VENDOR: Labring
PRODUCT: FastGPT
AFFECTED_VERSIONS: 4.15.0-beta4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FastGPT contains hard-coded credentials, which may allow an unauthenticated attacker to gain unauthorized access to sensitive information.

Executive Summary:
Hard-coded credentials within FastGPT expose the platform to potential unauthorized access by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-61684

Affected Software: Labring FastGPT

Affected Versions: 4.15.0-beta4

Vulnerability: The application utilizes hard-coded credentials (CWE-798), which can be leveraged by an unauthenticated attacker to gain unauthorized access. This vulnerability simplifies the attack path, as no complex exploitation is required to bypass authentication.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality of knowledge-based AI platforms. Unauthorized access to the platform could lead to the theft of proprietary data, sensitive AI training sets, or the manipulation of application logic, causing substantial business disruption.

Remediation Plan

Immediate Action: Update FastGPT to version 4.15.0-beta5 or later to eliminate the hard-coded credentials.

Proactive Monitoring: Monitor authentication logs for suspicious login attempts and inspect configuration files for signs of credential tampering.

Compensating Controls: Ensure the instance is not exposed to the public internet and use a Web Application Firewall to filter out requests that attempt to exploit known credential patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of hard-coded credentials makes the system inherently easy to compromise if reachable.

Analyst Recommendation

The reliance on hard-coded credentials represents a fundamental security flaw that must be addressed immediately. Organizations currently running FastGPT version 4.15.0-beta4 must upgrade to version 4.15.0-beta5 to secure the platform against unauthorized access.

---METADATA---
VENDOR: faye
PRODUCT: websocket-driver-ruby
AFFECTED_VERSIONS: faye websocket-driver-ruby < 0.8.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in faye websocket-driver-ruby allows an unauthenticated attacker to cause a denial of service via an uncaught exception.

Executive Summary:
A high-severity denial of service vulnerability in the faye websocket-driver-ruby library could allow an unauthenticated attacker to crash the application.

Vulnerability Details

CVE-ID: CVE-2026-61666

Affected Software: faye websocket-driver-ruby

Affected Versions: faye websocket-driver-ruby < 0.8.2

Vulnerability: The library is susceptible to an uncaught exception (CWE-248) during WebSocket protocol handling. This flaw is remotely exploitable without authentication, potentially causing the application to hang or terminate unexpectedly.

Business Impact

The primary impact of this vulnerability is service availability. With a CVSS score of 8.9, the ability for an unauthenticated attacker to remotely trigger a crash presents a significant threat to business continuity, particularly for services heavily dependent on WebSocket communication.

Remediation Plan

Immediate Action: Update the faye websocket-driver-ruby dependency to version 0.8.2 or later in your project's Gemfile.

Proactive Monitoring: Monitor application logs for recurring stack traces or sudden service restarts that may indicate attempted exploitation of this exception-based vulnerability.

Compensating Controls: Utilize a robust load balancer or ingress controller to manage traffic and potentially mitigate the impact of service-level disruptions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While it is remotely exploitable, the technical impact is focused on service availability.

Analyst Recommendation

Due to the high CVSS score and the ease of remote exploitation, developers should prioritize upgrading the websocket-driver-ruby library to version 0.8.2 immediately to prevent potential service-disruption attacks.

---METADATA---
VENDOR: goauthentik
PRODUCT: authentik
AFFECTED_VERSIONS: < 2026.2.6, >= 2026.5.0, < 2026.5.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The goauthentik identity provider contains authorization bypass vulnerabilities, allowing authenticated users to perform unauthorized actions due to improper key handling.

Executive Summary:
An authorization bypass vulnerability in goauthentik allows authenticated users to perform unauthorized actions by manipulating user-controlled keys.

Vulnerability Details

CVE-ID: CVE-2026-61574

Affected Software: goauthentik authentik

Affected Versions: < 2026.2.6, >= 2026.5.0, < 2026.5.5

Vulnerability: The application suffers from authorization bypass (CWE-639) and incorrect authorization (CWE-863) flaws, where user-controlled keys are not correctly validated during authorization checks.

Business Impact

As an identity provider, a compromise of authentik is critical, potentially allowing attackers to escalate privileges or access resources they are not entitled to. The CVSS score of 8.8 underscores the severity of this access control failure, which could lead to widespread unauthorized access across integrated services.

Remediation Plan

Immediate Action: Update goauthentik to version 2026.2.6 or 2026.5.5, depending on the current branch in use, to resolve the authorization logic errors.

Proactive Monitoring: Review audit logs for anomalous authorization decisions or users accessing resources outside of their expected scope.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for unusual API request patterns that might indicate an attempt to exploit authorization keys.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability stems from flaws in the authorization layer, which is a high-value target for attackers.

Analyst Recommendation

Given the central role of authentik in identity management, this patch should be applied with high urgency. Failure to remediate could allow authenticated users to circumvent security controls and gain unauthorized access to protected enterprise resources.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU allows remote OS command injection via the setIpQosRules function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU permits remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6156

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setIpQosRules function in /cgi-bin/cstecgi.cgi fails to sanitize the Comment argument, allowing an unauthenticated attacker to inject and execute OS commands.

Business Impact

The CVSS score of 9.8 highlights the critical threat of this vulnerability. Successful exploitation provides the attacker with full control over the device, facilitating further network penetration and data interception.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update immediately to patch the vulnerable CGI function.

Proactive Monitoring: Monitor system logs for unusual behavior or unauthorized command execution.

Compensating Controls: Ensure the router's management interface is not accessible from the public internet by configuring appropriate firewall rules.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploit code is available. The risk of exploitation is extremely high given the remote nature of the flaw.

Analyst Recommendation

Immediate firmware updates are required to mitigate this critical risk. Restricting access to the device management interface is a necessary secondary measure to prevent unauthorized exploitation.

---METADATA---
VENDOR: Harttle
PRODUCT: LiquidJS
AFFECTED_VERSIONS: >= 10.26.0, < 10.27.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
LiquidJS is vulnerable to an infinite loop via a template processing flaw, which can lead to a denial of service.

Executive Summary:
A vulnerability in the LiquidJS template engine allows unauthenticated attackers to cause a denial of service through an infinite loop condition.

Vulnerability Details

CVE-ID: CVE-2026-61556

Affected Software: Harttle LiquidJS

Affected Versions: >= 10.26.0, < 10.27.1

Vulnerability: This is an infinite loop vulnerability (CWE-835) occurring within the template processing logic. An unauthenticated attacker can supply specifically crafted input that prevents the engine from reaching a termination condition, exhausting system resources.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting its high impact on system availability. Successful exploitation results in a denial of service, rendering the affected application unresponsive to legitimate users and potentially causing significant operational downtime for services relying on this template engine.

Remediation Plan

Immediate Action: Update the LiquidJS package to version 10.27.1 or later to incorporate the necessary fix for the infinite loop condition.

Proactive Monitoring: Monitor application logs for spikes in CPU usage or unusually long response times associated with template rendering functions.

Compensating Controls: Implement request rate limiting or timeouts on services that process user-supplied templates to mitigate the impact of potential resource exhaustion attacks.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor capable of submitting templates to the engine.

Analyst Recommendation

Given the high severity of this denial of service vulnerability, organizations using LiquidJS should prioritize updating their dependencies immediately. Ensuring the engine is patched to version 10.27.1 will eliminate the underlying logic flaw and restore service stability.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313
---END_METADATA---

Description Summary:
Totolink A7100RU is vulnerable to remote OS command injection via the setWanCfg function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote attackers to execute arbitrary commands with full system privileges.

Vulnerability Details

CVE-ID: CVE-2026-6155

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313

Vulnerability: The setWanCfg function in /cgi-bin/cstecgi.cgi does not properly sanitize the pppoeServiceName argument, allowing for remote OS command injection by an unauthenticated attacker.

Business Impact

A CVSS score of 9.8 signifies a critical risk of full system compromise. Attackers can gain control over network configuration and traffic, potentially leading to man-in-the-middle attacks or full internal network access.

Remediation Plan

Immediate Action: Update to the latest firmware version as provided by Totolink to address the identified command injection vulnerability.

Proactive Monitoring: Monitor for suspicious network configuration changes or unusual outbound traffic from the router.

Compensating Controls: Use firewall rules to block internet-facing access to the device's web management interface.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits are available. The severity and ease of exploitation necessitate immediate action.

Analyst Recommendation

This is a high-priority issue. Administrators should update affected devices immediately and ensure that management interfaces are not exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU allows remote OS command injection via the setWizardCfg function within the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6154

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWizardCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wizard argument, enabling an unauthenticated attacker to inject and execute OS commands.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation grants the attacker full control over the router, which can be used to compromise all traffic passing through the device and potentially infiltrate internal resources.

Remediation Plan

Immediate Action: Install the latest firmware update provided by the vendor to remediate the command injection flaw.

Proactive Monitoring: Review system and audit logs for signs of arbitrary command execution or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to prevent external access to the device's CGI management endpoints.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits have been identified. The potential for malicious use is high, and immediate patching is required.

Analyst Recommendation

Administrators must prioritize the firmware update for all affected devices. Until an update is applied, ensure that access to the device is limited to trusted, internal-only networks.

---METADATA---
VENDOR: ISPConfig
PRODUCT: ispconfig3
AFFECTED_VERSIONS: 3.2.0 and later, 3.3.0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
ISPConfig contains an authenticated SQL injection vulnerability within its Remote API, allowing attackers to manipulate database queries via the primary ID parameter.

Executive Summary:
An authenticated SQL injection vulnerability in the ISPConfig Remote API could allow an attacker with low privileges to execute arbitrary database commands, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-61518

Affected Software: ISPConfig ispconfig3

Affected Versions: 3.2.0 and later, 3.3.0 and later

Vulnerability: The software fails to properly sanitize user supplied input in the Remote API, which is susceptible to SQL injection (CWE-89). This vulnerability requires the attacker to be authenticated with low privileges to the API.

Business Impact

A successful exploitation of this flaw allows an attacker to interact directly with the underlying database. This could lead to unauthorized data exfiltration, modification of administrative records, or a complete compromise of the application data layer. Given the CVSS score of 8.8, this is a high severity issue that should be prioritized to prevent potential database-level breaches.

Remediation Plan

Immediate Action: Monitor official vendor channels for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Enable detailed logging for all Remote API requests and monitor database logs for anomalous queries or syntax errors that may indicate injection attempts.

Compensating Controls: Implement strict firewall rules to restrict access to the API interface to authorized IP addresses only, and apply input validation at the application firewall level where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full database control via the API.

Analyst Recommendation

Organizations utilizing ISPConfig must treat this vulnerability with high urgency. While a formal patch status is currently unknown, administrators should verify their current version against the affected releases and restrict API access to trusted segments until a vendor-supplied update is deployed.

---METADATA---
VENDOR: Puwell Technology
PRODUCT: IP Camera
AFFECTED_VERSIONS: 2.x through 4.x
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Puwell IP Camera firmware versions 2.x through 4.x contain an unauthenticated command injection vulnerability in the DebugShell interface on TCP port 34567.

Executive Summary:
An unauthenticated command injection vulnerability in Puwell IP Cameras allows remote attackers to achieve root-level code execution and complete device compromise.

Vulnerability Details

CVE-ID: CVE-2026-61515

Affected Software: Puwell Technology IP Camera

Affected Versions: 2.x through 4.x

Vulnerability: This vulnerability involves a hidden DebugShell functionality (CWE-912) that fails to perform authentication or input sanitization on incoming JSON payloads. Unauthenticated remote attackers can inject and execute arbitrary operating system commands at the root level.

Business Impact

The ability to execute arbitrary commands at the root level provides an attacker with complete control over the device. With a CVSS score of 9.8, the impact includes total system compromise, potential inclusion of the device in a botnet, and the ability to pivot into the internal network from the compromised camera.

Remediation Plan

Immediate Action: Update the camera firmware to the latest available version provided by the manufacturer. If no patch is available, disable the DebugShell interface or isolate the device from all public-facing networks.

Proactive Monitoring: Inspect system logs for unexpected process execution or modifications to the device configuration.

Compensating Controls: Use a Web Application Firewall or network access control list to restrict access to TCP port 34567 to authorized administrative IP addresses only.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of Aug 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly critical due to the lack of authentication required to reach the vulnerable command execution interface.

Analyst Recommendation

The potential for root-level command execution makes this a high-priority risk. Administrators should immediately isolate affected devices from the internet and monitor for any unauthorized connections until a firmware update is applied.

---METADATA---
VENDOR: Puwell Technology
PRODUCT: IP Camera
AFFECTED_VERSIONS: 2.x through 4.x
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Puwell IP Camera firmware versions 2.x through 4.x contain an authentication bypass vulnerability, allowing unauthenticated attackers to control device functions via TCP port 23456.

Executive Summary:
An authentication bypass vulnerability in Puwell IP Cameras allows unauthenticated attackers to remotely hijack device functions and access video streams.

Vulnerability Details

CVE-ID: CVE-2026-61514

Affected Software: Puwell Technology IP Camera

Affected Versions: 2.x through 4.x

Vulnerability: This is a missing authentication for critical function flaw (CWE-306) in the proprietary control protocol. Unauthenticated attackers can manipulate the Session field in the packet header to gain unauthorized administrative control over hardware components, including pan and tilt motors and audio output.

Business Impact

Successful exploitation poses a severe risk to physical security and operational privacy. With a CVSS score of 9.8, the vulnerability allows for complete unauthorized control over surveillance hardware, which could lead to unauthorized monitoring of sensitive areas or the disabling of security systems.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware update that addresses this authentication flaw. If a firmware update is not yet available, restrict network access to the device to trusted internal management segments only.

Proactive Monitoring: Monitor network traffic directed to TCP port 23456 for anomalous packet structures or unauthorized connection attempts.

Compensating Controls: Deploy a network firewall to block inbound traffic on TCP port 23456 from untrusted sources.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of Aug 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of the device control plane without requiring any valid credentials.

Analyst Recommendation

Given the critical severity and the existence of a proof-of-concept, organizations using affected Puwell IP Cameras must prioritize restricting access to these devices immediately. Apply vendor-provided patches as soon as they become available to remediate the underlying authentication failure.

---METADATA---
VENDOR: vBulletin
PRODUCT: vBulletin
AFFECTED_VERSIONS: 5.0.0 through 5.7.5, 6.0.0 through 6.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
vBulletin contains an eval injection vulnerability in the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code via the pagenav[pagenumber] parameter.

Executive Summary:
A critical eval injection vulnerability in vBulletin allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-61511

Affected Software: vBulletin vBulletin

Affected Versions: 5.0.0 through 5.7.5, 6.0.0 through 6.2.1

Vulnerability: This is an eval injection vulnerability occurring in the vB5_Template_Runtime::runMaths() method. Unauthenticated attackers can bypass weak regex filters using specific character encoding to inject and execute arbitrary PHP code via the ajax/render route.

Business Impact

The CVSS score of 9.8 reflects the high potential for total system compromise, including unauthorized data access, modification, and complete loss of server control. Successful exploitation allows remote attackers to execute commands with the privileges of the web server, leading to severe reputational damage and operational downtime.

Remediation Plan

Immediate Action: Upgrade to vBulletin version 6.2.2 or later, which contains the necessary security fixes for this flaw.

Proactive Monitoring: Review web server and application logs for suspicious requests targeting the ajax/render template path or containing encoded PHP syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block malicious input patterns, specifically targeting template parameters that utilize mathematical functions.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of July 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the ease of remote code execution without authentication.

Analyst Recommendation

Given the critical severity and the availability of public proof-of-concept code, immediate action is required. Administrators should prioritize upgrading to the patched version of vBulletin to eliminate the injection vector and secure the application environment.

---METADATA---
VENDOR: Rejetto
PRODUCT: HFS
AFFECTED_VERSIONS: 3.0.0 up to (excluding) 3.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Rejetto HFS uses a predictable PRNG for session-cookie signing, allowing unauthenticated attackers to forge administrator session cookies and achieve remote code execution.

Executive Summary:
A critical vulnerability in Rejetto HFS allows unauthenticated remote attackers to forge administrative session cookies and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-61500

Affected Software: Rejetto HFS

Affected Versions: 3.0.0 up to (excluding) 3.2.1

Vulnerability: The application utilizes a non-cryptographic PRNG (Math.random()) to derive session-cookie signing keys, which are disclosed to unauthenticated users during the login process. This flaw enables an attacker to reconstruct the generator state, forge valid administrator cookies, and gain unauthorized control over the application.

Business Impact

Successful exploitation grants an attacker full administrative access to the HFS instance, leading to complete system compromise. Given the CVSS score of 9.8, this vulnerability poses an extreme risk, as it allows for trivial Remote Code Execution (RCE) without requiring prior authentication, potentially exposing sensitive data and allowing for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Rejetto HFS to version 3.2.1 or later immediately to implement a cryptographically secure key generation process.

Proactive Monitoring: Monitor server logs for an unusual frequency of login requests or failed authentication patterns that might indicate an attacker attempting to sample the PRNG output.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious administrative access patterns, though patching remains the only effective mitigation.

Exploitation Status

Public Exploit Available: No (No confirmed weaponized exploit or public PoC identified).

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the reliance on weak randomness for session security, which is a foundational failure in cryptographic implementation.

Analyst Recommendation

This is a critical-severity flaw that requires immediate attention. Because the vulnerability allows for unauthenticated RCE, administrators should prioritize updating to version 3.2.1 without delay. If the instance is exposed to the internet, ensure access is restricted via VPN or firewall until the patch is successfully applied and verified.

---METADATA---
VENDOR: VITEC
PRODUCT: Flamingo
AFFECTED_VERSIONS: 4.12.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Vitec Flamingo 4.12.2 is susceptible to unauthenticated OS command injection via the admin/ajax/gen_graphs.php endpoint due to insufficient input sanitization.

Executive Summary:
A critical unauthenticated OS command injection vulnerability in Vitec Flamingo 4.12.2 allows remote attackers to gain root-level code execution.

Vulnerability Details

CVE-ID: CVE-2026-61498

Affected Software: VITEC Flamingo

Affected Versions: 4.12.2

Vulnerability: The application suffers from OS command injection (CWE-78) within the admin/ajax/gen_graphs.php script. Unauthenticated attackers can inject malicious shell metacharacters into multiple HTTP GET parameters, which are then passed to a system passthru() call with root privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to infrastructure security. An attacker can achieve complete system takeover, potentially leading to the compromise of sensitive IPTV distribution configurations and persistent unauthorized access to the underlying operating system.

Remediation Plan

Immediate Action: Update the affected VITEC Flamingo software to the latest version provided by the vendor.

Proactive Monitoring: Audit web server logs for suspicious GET requests containing shell special characters targeting the gen_graphs.php script.

Compensating Controls: Deploy WAF rules to filter out requests containing shell syntax or unexpected characters in the start, end, key, or format parameters.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of unauthenticated access and high-privilege execution context.

Analyst Recommendation

The severity of this issue necessitates immediate attention. Administrators must verify their software version and apply the vendor's recommended security patches as soon as they are released to prevent potential exploitation of the command injection vector.

---METADATA---
VENDOR: Code-projects
PRODUCT: Vehicle Showroom Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A security flaw has been identified in version 1 of the Code-projects Vehicle Showroom Management System, requiring immediate attention.

Executive Summary:
The Code-projects Vehicle Showroom Management System contains a security flaw in version 1 that requires immediate administrative action to mitigate potential risks.

Vulnerability Details

CVE-ID: CVE-2026-6149

Affected Software: Code-projects, Vehicle Showroom Management System

Affected Versions: 1

Vulnerability: This vulnerability involves a flaw within the Vehicle Showroom Management System. The issue potentially allows for unauthorized interaction with the application, necessitating a review of current security controls to prevent exploitation of the underlying system logic.

Business Impact

The CVSS score of 7.3 highlights a significant risk, particularly regarding the integrity of business data and the availability of the management system. Unauthorized access could result in the compromise of sensitive showroom data and the disruption of critical business functions.

Remediation Plan

Immediate Action: Ensure the application is behind a secure VPN and not directly accessible via the public internet while awaiting a vendor patch.

Proactive Monitoring: Audit access logs for anomalous behavior, particularly requests originating from unauthorized or unexpected IP ranges.

Compensating Controls: Implement strict input validation and session management policies via a WAF to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the security of the Vehicle Showroom Management System. Given the identified vulnerability, it is imperative to apply security updates as soon as they are released by the vendor and maintain a defensive security posture to prevent unauthorized access.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Lucy
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in Apache Lucy, potentially allowing attackers to execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow in the retired Apache Lucy project exposes systems to remote code execution and total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-61486

Affected Software: Apache Software Foundation Apache Lucy

Affected Versions: All versions

Vulnerability: The vulnerability is a stack-based buffer overflow, which occurs when the software writes more data to a buffer than it can hold. This flaw is remotely exploitable by an unauthenticated attacker, potentially leading to memory corruption and arbitrary code execution.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this vulnerability. Successful exploitation permits an attacker to gain full control over the affected system, resulting in severe data breaches or complete service disruption. The lack of vendor support for this retired project renders traditional remediation impossible.

Remediation Plan

Immediate Action: Since no patch will be released, organizations must decommission and replace Apache Lucy with a secure, supported alternative. If the software cannot be immediately removed, isolate affected systems from all external network access.

Proactive Monitoring: Review system logs for segmentation faults or abnormal application crashes that may indicate an attempted buffer overflow exploit.

Compensating Controls: Utilize memory protection mechanisms or host-based intrusion detection systems to monitor for anomalous process behavior.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The Apache Lucy project is retired, and no further security patches will be issued.

Analyst Recommendation

Given the critical nature of this vulnerability and the project's retired status, there is no path to a vendor-provided fix. Security teams must prioritize the immediate removal of Apache Lucy from their infrastructure to prevent potential exploitation of this high-impact flaw.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Lucy
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Apache Lucy is vulnerable to a deserialization of untrusted data issue, potentially allowing remote code execution due to improper input handling.

Executive Summary:
A critical deserialization vulnerability in the retired Apache Lucy project poses a severe risk of remote code execution for any remaining deployments.

Vulnerability Details

CVE-ID: CVE-2026-61484

Affected Software: Apache Software Foundation Apache Lucy

Affected Versions: All versions

Vulnerability: This vulnerability involves the deserialization of untrusted data, which occurs without sufficient validation. The flaw is exploitable by an unauthenticated remote attacker who can send malicious payloads to the application.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation could lead to full system compromise, including unauthorized data access and complete loss of system integrity or availability. Because the project is retired and no longer supported, the risk is permanent and cannot be remediated through standard vendor patches.

Remediation Plan

Immediate Action: Since there is no patch available, immediately migrate away from Apache Lucy to a supported alternative. If immediate migration is impossible, restrict network access to the affected instances to prevent external exploitation.

Proactive Monitoring: Monitor network traffic and application logs for unusual deserialization patterns or unexpected process execution.

Compensating Controls: Deploy a Web Application Firewall to filter malicious traffic, although this may not provide comprehensive protection against deserialization attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The software is officially retired and moved to the Apache Attic, meaning no security updates will be provided.

Analyst Recommendation

The Apache Lucy project is deprecated and no longer receives security maintenance. Organizations still utilizing this software should prioritize an immediate transition to a modern, supported search engine or data processing library to eliminate this critical risk.

---METADATA---
VENDOR: Code-projects
PRODUCT: Vehicle Showroom Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A security vulnerability has been detected in version 1 of the Code-projects Vehicle Showroom Management System.

Executive Summary:
A high-severity vulnerability in the Code-projects Vehicle Showroom Management System exposes the platform to potential unauthorized access and compromise.

Vulnerability Details

CVE-ID: CVE-2026-6148

Affected Software: Code-projects, Vehicle Showroom Management System

Affected Versions: 1

Vulnerability: This vulnerability affects the Vehicle Showroom Management System. The nature of the flaw suggests potential weaknesses in the application's authentication or session management, which may allow attackers to interact with the system without sufficient authorization.

Business Impact

With a CVSS score of 7.3, the vulnerability poses a substantial risk to sensitive customer and showroom data. Exploitation could lead to data exfiltration, unauthorized modification of records, and potential compromise of the administrative interface, impacting business operations and customer trust.

Remediation Plan

Immediate Action: Immediately isolate the application from public-facing networks until a vendor-supplied security patch is applied.

Proactive Monitoring: Monitor database query logs for evidence of unauthorized data retrieval or administrative command execution.

Compensating Controls: Use a Web Application Firewall (WAF) to validate incoming requests and block attempts to bypass authentication mechanisms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. If an update is not immediately available, the system should be restricted to internal use only to minimize exposure to external threats until remediation is complete.

---METADATA---
VENDOR: WordPress
PRODUCT: LightSync Pro
AFFECTED_VERSIONS: 0 through 2.1.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function.

Executive Summary:
A critical arbitrary file upload vulnerability in the LightSync Pro plugin for WordPress allows authenticated attackers to execute malicious code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-6147

Affected Software: WordPress LightSync Pro

Affected Versions: 0 through 2.1.6

Vulnerability: The plugin contains a vulnerability in the rest_replace_media() function that fails to validate file types during upload. This flaw allows an authenticated attacker with low privileges to upload arbitrary files, potentially leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability could result in a complete compromise of the WordPress site. An attacker may upload web shells or malicious scripts, leading to unauthorized data access, site defacement, or the use of the server as a pivot point for further network attacks. Given the CVSS score of 8.8, this poses a significant risk to organizational security and business continuity.

Remediation Plan

Immediate Action: Update the LightSync Pro plugin to version 2.1.7 or the latest available version provided by the vendor to implement proper file validation.

Proactive Monitoring: Review server logs for unusual POST requests directed at the WordPress REST API or unexpected file creation events in the media upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file extensions or unauthorized REST API calls to the vulnerable plugin functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it bypasses standard file type restrictions, facilitating the injection of malicious server-side scripts.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention. Administrators should verify the current version of LightSync Pro in use and apply the vendor patch immediately. If an update is not immediately feasible, consider temporarily deactivating the plugin to prevent potential exploitation.

---METADATA---
VENDOR: go-shiori
PRODUCT: shiori
AFFECTED_VERSIONS: 0 up to (excluding) 1.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Shiori is vulnerable to a privilege escalation flaw in the account update endpoint, allowing authenticated users to modify the owner field without proper authorization checks.

Executive Summary:
A privilege escalation vulnerability in Shiori allows authenticated users to gain unauthorized administrative control by modifying account ownership.

Vulnerability Details

CVE-ID: CVE-2026-61463

Affected Software: go-shiori shiori

Affected Versions: 0 up to (excluding) 1.8.0

Vulnerability: The vulnerability is an Improper Privilege Management (CWE-269) issue located in the account update API. An attacker with low-level authenticated access can manipulate the request to escalate their privileges by altering the owner field of an account.

Business Impact

The ability to elevate privileges to an owner level allows for total compromise of the application, including full access to all data and administrative settings. With a CVSS score of 8.8, this vulnerability represents a severe risk to data integrity and system confidentiality.

Remediation Plan

Immediate Action: Update Shiori to version 1.8.0 or later to ensure proper authorization checks are applied to the account update endpoint.

Proactive Monitoring: Review audit logs for unauthorized changes to user roles or modifications to the owner field of existing accounts.

Compensating Controls: If an immediate update is not feasible, restrict access to the account management API to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: No (Exploit status unknown)

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an initial low-privileged session is obtained.

Analyst Recommendation

Given the existence of a proof-of-concept and the high-impact nature of privilege escalation, organizations using Shiori must prioritize applying the 1.8.0 update. Failure to remediate this flaw exposes the system to complete administrative takeover by any authenticated user.

---METADATA---
VENDOR: zereight
PRODUCT: mcp-gitlab
AFFECTED_VERSIONS: 0 up to (excluding) 2.1.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The zereight mcp-gitlab package is susceptible to a path traversal vulnerability in the job_id parameter, enabling attackers to access arbitrary files on the system.

Executive Summary:
A path traversal vulnerability in zereight mcp-gitlab allows unauthenticated attackers to read sensitive files from the host system, posing a critical risk to system confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-61462

Affected Software: zereight mcp-gitlab

Affected Versions: 0 up to (excluding) 2.1.18

Vulnerability: This is a path traversal vulnerability (CWE-73) within the job_id parameter of the build/index function. It allows unauthenticated remote attackers to bypass directory restrictions and access files outside of the intended directory.

Business Impact

The CVSS score of 8.6 highlights the severity of this flaw, as it permits unauthorized file disclosure. Successful exploitation could allow an attacker to read sensitive configuration files, environment variables, or other private data stored on the filesystem, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Update the mcp-gitlab package to version 2.1.18 or later, which includes the necessary fix for the path traversal issue.

Proactive Monitoring: Inspect server logs for requests containing path traversal sequences (e.g., ../) targeting the build/index endpoint.

Compensating Controls: Configure file system permissions to follow the principle of least privilege, ensuring the application process cannot access sensitive files outside of its working directory.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable via direct web requests.

Analyst Recommendation

This path traversal vulnerability is a significant security concern due to its potential for unauthorized file access without authentication. Users of mcp-gitlab should treat the update to version 2.1.18 as a high-priority task to ensure the integrity and confidentiality of their infrastructure.