---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Open WebUI platform that may expose the system to unauthorized access or manipulation.

Executive Summary:
The Open WebUI platform is vulnerable to a high-severity security flaw that could potentially compromise the integrity and confidentiality of the self-hosted AI environment.

Vulnerability Details

CVE-ID: CVE-2026-45350

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Open WebUI platform; however, specific technical details regarding the entry point and authentication requirements remain pending further vendor disclosure. Users should treat this as a potentially exploitable flaw requiring immediate attention to prevent unauthorized system interaction.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to sensitive AI models, configuration data, or internal system resources. Given the CVSS score of 7.1, this is classified as a High-severity risk that could result in significant operational disruption or data exfiltration if left unaddressed.

Remediation Plan

Immediate Action: Review the official Open WebUI security advisory to identify and apply the latest security patches or configuration updates.

Proactive Monitoring: Monitor system and application access logs for unusual patterns, unauthorized login attempts, or anomalous administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rule sets to filter suspicious traffic directed at the Open WebUI instance until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Open WebUI must prioritize the monitoring of vendor channels for official remediation guidance. Given the high-severity classification, administrators should prepare for an emergency patch cycle to mitigate potential unauthorized access to the AI platform.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Open WebUI platform that may expose the system to unauthorized access or manipulation.

Executive Summary:
The Open WebUI platform is vulnerable to a high-severity security flaw that could potentially compromise the integrity and confidentiality of the self-hosted AI environment.

Vulnerability Details

CVE-ID: CVE-2026-45349

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Open WebUI platform; however, specific technical details regarding the entry point and authentication requirements remain pending further vendor disclosure. Users should treat this as a potentially exploitable flaw requiring immediate attention to prevent unauthorized system interaction.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to sensitive AI models, configuration data, or internal system resources. Given the CVSS score of 7.1, this is classified as a High-severity risk that could result in significant operational disruption or data exfiltration if left unaddressed.

Remediation Plan

Immediate Action: Review the official Open WebUI security advisory to identify and apply the latest security patches or configuration updates.

Proactive Monitoring: Monitor system and application access logs for unusual patterns, unauthorized login attempts, or anomalous administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rule sets to filter suspicious traffic directed at the Open WebUI instance until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Open WebUI must prioritize the monitoring of vendor channels for official remediation guidance. Given the high-severity classification, administrators should prepare for an emergency patch cycle to mitigate potential unauthorized access to the AI platform.

---METADATA---
VENDOR: pyLoad
PRODUCT: pyLoad
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists within the pyLoad download manager that may allow for unauthorized system access or compromise.

Executive Summary:
A high-severity vulnerability in the pyLoad download manager presents a critical risk to systems hosting the service.

Vulnerability Details

CVE-ID: CVE-2026-45348

Affected Software: pyLoad

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the pyLoad download manager, an open-source Python-based application. Given the nature of download managers, this may involve file system traversal, remote code execution, or authentication bypass, though specific technical details are currently sparse.

Business Impact

The CVSS score of 8.7 reflects the high risk posed by this vulnerability. If successfully exploited, an attacker could potentially gain unauthorized control over the server hosting the pyLoad instance, leading to data exfiltration or the installation of persistent malicious payloads.

Remediation Plan

Immediate Action: Immediately update the pyLoad installation to the latest available version provided by the project maintainers.

Proactive Monitoring: Monitor server logs for unauthorized process execution or unexpected outbound network connections originating from the pyLoad service.

Compensating Controls: Ensure the pyLoad service is running with the least privilege necessary and is isolated from sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of the pyLoad download manager should verify their current version and update immediately. Given the high severity rating, administrators must assume the risk is significant and apply patches as soon as they are made available by the maintainers.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Open WebUI contains a security vulnerability within its self-hosted artificial intelligence platform that may expose the system to unauthorized access or manipulation.

Executive Summary:
A security vulnerability identified in the Open WebUI platform creates a high-risk exposure for self-hosted AI environments.

Vulnerability Details

CVE-ID: CVE-2026-45338

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Open WebUI platform, though the specific technical mechanism is not detailed in the provided data. Administrators should assume that the flaw could allow unauthorized interaction with the AI model or the underlying host system.

Business Impact

The CVSS score of 7.7 underscores a High severity risk, which could facilitate unauthorized access to AI-driven workflows and data. Successful exploitation could lead to data exfiltration or the manipulation of AI responses, causing potential operational and compliance risks for the organization.

Remediation Plan

Immediate Action: Consult the official Open WebUI documentation and security advisories to determine if an update is available for your specific deployment.

Proactive Monitoring: Review application and system access logs for unauthorized attempts to access administrative functions within the WebUI.

Compensating Controls: Ensure that the Open WebUI instance is isolated from the public internet and require VPN or Zero Trust access for all users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the platform suggests that rapid remediation is necessary to prevent potential exploitation.

Analyst Recommendation

Administrators must prioritize the security of their Open WebUI environment by restricting access and monitoring for updates. The High severity rating requires proactive patching as soon as the vendor provides a corrected version.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Open WebUI platform, an AI interface designed for self-hosted, offline environments.

Executive Summary:
The Open WebUI platform contains a high-severity vulnerability that could allow unauthorized actors to compromise the integrity and confidentiality of self-hosted AI services.

Vulnerability Details

CVE-ID: CVE-2026-45331

Affected Software: Open WebUI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of the vulnerability is currently undergoing technical validation. Until further details are disclosed by the vendor, it is treated as a high-risk flaw requiring authenticated or unauthenticated access depending on deployment configuration.

Business Impact

Successful exploitation of this vulnerability carries significant risk to organizational AI assets, potentially leading to unauthorized data access or service disruption. With a CVSS score of 8.5, this high-severity rating necessitates immediate attention to prevent the compromise of local AI models and sensitive training data.

Remediation Plan

Immediate Action: Consult the official Open WebUI repository and vendor security advisories to identify and apply the latest security patches.

Proactive Monitoring: Review system and application access logs for anomalous behavior, particularly requests targeting the AI interface or backend API endpoints.

Compensating Controls: Implement strict network segmentation and restrict access to the WebUI interface behind a VPN or authenticated proxy to mitigate exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, administrators must prioritize this issue. Ensure that all instances of Open WebUI are isolated from public exposure and apply all vendor-supplied updates as soon as they become available to minimize the attack surface.

---METADATA---
VENDOR: GitHub
PRODUCT: Actions OIDC
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
GitHub Actions OIDC was exploited to publish malicious npm packages by chaining multiple vulnerabilities, including cache poisoning and token extraction.

Executive Summary:
An attacker successfully compromised the GitHub Actions OIDC trusted-publisher binding to inject malicious code into legitimate npm packages.

Vulnerability Details

CVE-ID: CVE-2026-45321

Affected Software: GitHub Actions OIDC

Affected Versions: See vendor advisory

Vulnerability: This is a supply chain compromise involving the chaining of a pull_request_target misconfiguration, GitHub Actions cache poisoning, and OIDC token theft from the runner process. This allowed the attacker to masquerade as a trusted identity to publish malicious versions of @tanstack/* packages.

Business Impact

This vulnerability represents a severe supply chain threat, potentially affecting any downstream software that relies on the compromised packages. With a CVSS score of 9.6, the incident highlights the risks associated with CI/CD pipeline trust boundaries.

Remediation Plan

Immediate Action: Audit all CI/CD workflows for pull_request_target usage and implement hardened OIDC token handling.

Proactive Monitoring: Monitor for unexpected package publications and scan dependencies for signs of tampering or unauthorized code.

Compensating Controls: Implement strict environment variable access controls and use ephemeral, short-lived tokens for all CI/CD operations.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of May 12, 2026, this vulnerability has been actively exploited in the wild, as demonstrated by the malicious publication of 84 package versions.

Analyst Recommendation

This incident serves as a critical reminder of CI/CD pipeline security. Organizations must review their GitHub Actions configurations, particularly regarding OIDC and pull request triggers, to prevent similar supply chain attacks.

---METADATA---
VENDOR: Open WebUI
PRODUCT: Open WebUI
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in Open WebUI that may allow for unauthorized access or system impact.

Executive Summary:
Open WebUI is affected by a security vulnerability that could potentially allow for unauthorized access or compromise of the system.

Vulnerability Details

CVE-ID: CVE-2026-45315

Affected Software: Open WebUI

Affected Versions: See vendor advisory for affected versions

Vulnerability: The specific technical nature of this vulnerability is currently being addressed by the vendor; users should consult official documentation for the exact mechanism of compromise.

Business Impact

With a CVSS score of 8.7, this vulnerability presents a high-severity risk to organizational security, potentially enabling unauthorized access to AI models or sensitive user data.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor as soon as they become available.

Proactive Monitoring: Monitor for anomalous traffic and ensure that all access to the platform is authenticated and logged.

Compensating Controls: Utilize network-level security measures to isolate the platform until the appropriate patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize monitoring the vendor's security updates. Once the patch is available, it must be deployed immediately to ensure the continued security of the Open WebUI environment.

---METADATA---
VENDOR: RAGFlow
PRODUCT: RAGFlow
AFFECTED_VERSIONS: 0.24.0 and earlier
---END_METADATA---

Description Summary:
A Jinja2 template injection vulnerability in RAGFlow's prompt generator allows authenticated users to execute arbitrary OS commands on the server.

Executive Summary:
An SSTI vulnerability in RAGFlow allows authenticated users to achieve remote code execution via malicious prompt generation workflows.

Vulnerability Details

CVE-ID: CVE-2026-45312

Affected Software: RAGFlow

Affected Versions: 0.24.0 and earlier

Vulnerability: The prompt generator (rag/prompts/generator.py) contains a Jinja2 template injection flaw. Authenticated users can create a specially crafted workflow, such as a Canvas workflow with a DuckDuckGo + LLM component chain, to trigger the injection and execute arbitrary OS commands.

Business Impact

With a CVSS score of 9.9, this vulnerability is critical. While it requires authentication, the ability for any standard user to gain remote code execution on the server poses a significant threat to the platform's security, potentially leading to total system compromise.

Remediation Plan

Immediate Action: Update to the latest version of RAGFlow.

Proactive Monitoring: Monitor server-side logs for unusual process creation or shell command activity originating from the RAGFlow service.

Compensating Controls: Enforce strict controls on user permissions and limit the ability of regular users to create complex workflows or access sensitive prompt generation features.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their RAGFlow installation to the latest available version immediately. Additionally, audit all user-created workflows for suspicious patterns that might indicate an attempt to leverage this injection point.

---METADATA---
VENDOR: Dozzle
PRODUCT: Dozzle
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Dozzle, a realtime log viewer for Docker containers, contains a security vulnerability requiring immediate attention.

Executive Summary:
A high-severity vulnerability in the Dozzle log viewer for Docker containers poses a significant risk to containerized infrastructure security.

Vulnerability Details

CVE-ID: CVE-2026-45298

Affected Software: Dozzle

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific technical nature of this vulnerability is currently underspecified in available documentation. Further analysis is required to determine the authentication requirements and the specific attack vector targeting the log viewing functionality.

Business Impact

With a CVSS score of 8.6, this vulnerability is categorized as High severity. Exploitation could potentially allow unauthorized access to sensitive application logs, leading to the exposure of credentials, environment variables, or other proprietary data stored within container streams, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Consult the official Dozzle project repository or vendor security advisories to identify and apply the latest security patches.

Proactive Monitoring: Review container access logs for anomalous request patterns or unauthorized attempts to access the log viewer interface.

Compensating Controls: Implement network-level restrictions or authentication proxies to limit access to the Dozzle interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity score, organizations utilizing Dozzle should treat this as a priority update. Administrators must verify their current deployment version against the vendor’s security advisory and apply the necessary patches as soon as they become available to mitigate the risk of unauthorized log exposure.

---METADATA---
VENDOR: D-Link
PRODUCT: DHP-1320
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical security vulnerability has been identified in the D-Link DHP-1320 router. This flaw may allow for remote exploitation and unauthorized device control.

Executive Summary:
A high-severity vulnerability in the D-Link DHP-1320 powerline router could allow attackers to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2026-4529

Affected Software: D-Link DHP-1320

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists within the D-Link DHP-1320 hardware/firmware stack. Given the CVSS score of 8.8, this flaw likely involves a remote, unauthenticated attack vector targeting the device's management interface or network services.

Business Impact

Compromise of a network gateway like the DHP-1320 allows an attacker to perform man-in-the-middle (MitM) attacks, pivot to other devices on the internal network, and disrupt internet connectivity. The CVSS score of 8.8 justifies a high-priority response, as the vulnerability poses a direct threat to the confidentiality and integrity of all data passing through the affected hardware.

Remediation Plan

Immediate Action: Update the D-Link DHP-1320 firmware to the latest available version immediately; if the device is end-of-life (EoL), replace it with a supported model.

Proactive Monitoring: Review network traffic for anomalous outbound connections originating from the router and monitor for unauthorized changes to DNS settings.

Compensating Controls: Ensure the router’s management interface is not accessible from the Wide Area Network (WAN) and use strong, unique administrative passwords.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, D-Link devices are frequent targets for automated botnets, making the potential for exploitation very high.

Analyst Recommendation

This vulnerability carries a high severity rating and affects critical networking infrastructure. It is imperative that administrators verify the firmware status of all DHP-1320 units and apply updates or decommission vulnerable hardware to prevent network-wide compromise.

---METADATA---
VENDOR: JasperFx
PRODUCT: Marten
AFFECTED_VERSIONS: < 8.36.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Marten, a .NET transactional document database, is vulnerable to SQL injection because it fails to properly parameterize the regConfig parameter in full-text search APIs.

Executive Summary:
A critical SQL injection vulnerability in the Marten .NET library allows attackers to execute arbitrary database commands via unsanitized full-text search inputs.

Vulnerability Details

CVE-ID: CVE-2026-45288

Affected Software: JasperFx Marten

Affected Versions: < 8.36.1

Vulnerability: The vulnerability stems from improper neutralization of special elements in the regConfig parameter of full-text search APIs. This allows for SQL injection when untrusted user input is passed into these functions without adequate validation.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and confidentiality. Exploitation could allow an attacker to bypass application logic, exfiltrate sensitive data from the underlying PostgreSQL database, or cause significant system disruption.

Remediation Plan

Immediate Action: Upgrade the JasperFx Marten library to version 8.36.1 or later to ensure the regConfig parameter is properly parameterized.

Proactive Monitoring: Inspect application logs for anomalous database queries or unexpected syntax errors originating from search functionality. Monitor PostgreSQL server logs for unusual query patterns.

Compensating Controls: Utilize input validation and sanitization routines at the application layer to block malicious payloads from reaching the database driver.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of exploitation in SQL injection flaws necessitates immediate patching.

Analyst Recommendation

This vulnerability represents a significant risk to any application utilizing the affected versions of Marten. Development teams must prioritize the transition to version 8.36.1 to eliminate the SQL injection vector and protect the underlying database infrastructure.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The FreeBSD KTLS receive path improperly decrypts records in place, leading to potential memory corruption due to unsafe mbuf modification.

Executive Summary:
A critical vulnerability in the FreeBSD Kernel TLS (KTLS) subsystem allows for potential memory corruption, posing a significant risk to system stability and security.

Vulnerability Details

CVE-ID: CVE-2026-45257

Affected Software: FreeBSD FreeBSD

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists in the KTLS receive path, which incorrectly assumes that mbufs holding received data are anonymous and safe to modify during in-place decryption. This flaw can be triggered by an attacker to cause memory corruption, potentially leading to a kernel panic or unauthorized information disclosure.

Business Impact

With a CVSS score of 7.8, this high-severity vulnerability represents a significant risk to the availability and integrity of FreeBSD systems. Successful exploitation could lead to system crashes (Denial of Service) or potential privilege escalation, directly impacting business operations and the confidentiality of processed network data.

Remediation Plan

Immediate Action: Monitor official FreeBSD security advisories and apply the provided kernel patches or system updates as soon as they become available.

Proactive Monitoring: Review system logs for kernel-related errors or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the affected services where possible and ensure that intrusion detection systems are configured to flag anomalous traffic patterns targeting the kernel network stack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects the core kernel network stack, the risk of system-wide compromise is elevated. Administrators should prioritize the deployment of vendor-supplied patches as soon as they are released to ensure the continued integrity and stability of their FreeBSD environments.

---METADATA---
VENDOR: FreeBSD
PRODUCT: bsdinstall / bsdconfig
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in bsdinstall and bsdconfig allows for improper handling of Wi-Fi network names when using bsddialog(1) to prompt users for network selection.

Executive Summary:
A vulnerability in the FreeBSD bsdinstall and bsdconfig utilities may allow for improper input handling during Wi-Fi network scanning, posing a risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-45255

Affected Software: FreeBSD bsdinstall and bsdconfig

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in how the utilities process lists of discovered Wi-Fi network names before passing them to bsddialog(1). This flaw likely requires an attacker to be in physical or wireless proximity to influence the scan results, potentially leading to command injection or display manipulation.

Business Impact

Successful exploitation could allow an attacker to disrupt the installation process or execute arbitrary commands with the privileges of the user running the configuration utility. With a CVSS score of 7.5, this is considered a High-severity issue that could lead to unauthorized system access or complete compromise of the affected machine during the setup phase.

Remediation Plan

Immediate Action: Consult the official FreeBSD security advisories to identify and apply the latest system updates that address this utility-specific flaw.

Proactive Monitoring: Review system logs for unusual activity during the execution of system configuration tools or Wi-Fi setup procedures.

Compensating Controls: Restrict access to system configuration utilities to authorized administrators only and ensure physical security of systems during the initial installation phase.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of this vulnerability, administrators should prioritize patching FreeBSD systems where bsdinstall or bsdconfig are utilized. Follow the vendor’s guidance strictly to ensure that the underlying bsddialog libraries are correctly secured against malicious input.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A parameter validation error in the ptrace(PT_SC_REMOTE) function within the FreeBSD kernel allows for improper handling of syscall(2) and __syscall(2) meta-system calls.

Executive Summary:
A critical parameter validation vulnerability in the FreeBSD kernel ptrace implementation could lead to privilege escalation or system instability.

Vulnerability Details

CVE-ID: CVE-2026-45253

Affected Software: FreeBSD Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The ptrace(PT_SC_REMOTE) function fails to adequately validate input parameters for syscall(2) and __syscall(2), which may allow an authenticated user to perform unauthorized system operations. This is a kernel-level flaw that bypasses standard security checks.

Business Impact

With a CVSS score of 8.4, this vulnerability represents a significant risk, potentially enabling local privilege escalation where an unprivileged user could gain administrative control. This could lead to full system compromise, data exfiltration, or the installation of persistent rootkits within the kernel environment.

Remediation Plan

Immediate Action: Update the FreeBSD kernel to the latest version provided by the vendor to ensure proper syscall parameter validation is enforced.

Proactive Monitoring: Monitor system audit logs for suspicious ptrace activity or unexpected syscall failures that might indicate an attempt to exploit this kernel flaw.

Compensating Controls: Limit access to ptrace and debugging capabilities to trusted administrative accounts only to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel-level vulnerabilities are critical and require immediate attention. Organizations running FreeBSD should apply the necessary security patches across all production environments as soon as they are made available by the vendor to prevent local exploitation.

---METADATA---
VENDOR: FreeBSD
PRODUCT: FreeBSD Kernel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A race condition exists in the FreeBSD kernel where a file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call.

Executive Summary:
A race condition in the FreeBSD kernel file descriptor handling could result in system crashes or potential security bypasses.

Vulnerability Details

CVE-ID: CVE-2026-45251

Affected Software: FreeBSD Kernel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves the improper synchronization of file descriptors when a thread is blocked in a poll(2) or select(2) system call. This race condition can lead to an inconsistent state within the kernel, potentially allowing for unexpected behavior or memory corruption.

Business Impact

The CVSS score of 7.8 indicates a high risk to system availability and integrity. Successful exploitation could lead to kernel panics (denial of service) or potentially be leveraged by an attacker to manipulate file descriptor references for malicious purposes.

Remediation Plan

Immediate Action: Apply the vendor-provided kernel updates immediately to patch the synchronization logic within the file descriptor management subsystem.

Proactive Monitoring: Monitor system stability and kernel logs for crashes or unexpected errors related to descriptor handling or system call failures.

Compensating Controls: Use kernel hardening settings if available, and ensure that untrusted applications are isolated using jails or other containment technologies to limit the impact of potential crashes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel-level race conditions are complex and dangerous; they should be addressed by applying the official vendor patches as soon as they are released. Maintaining an up-to-date kernel is the only reliable way to mitigate risks associated with these low-level synchronization flaws.

---METADATA---
VENDOR: Unknown
PRODUCT: setcred(2) system call
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The setcred(2) system call lacks sufficient privilege enforcement, potentially exposing sensitive credential management functions to unauthorized access.

Executive Summary:
A critical vulnerability in the setcred(2) system call may allow unauthorized privilege escalation or credential manipulation.

Vulnerability Details

CVE-ID: CVE-2026-45250

Affected Software: Unknown / setcred(2) system call

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This issue involves improper access control within the setcred(2) system call, which fails to adequately restrict execution to privileged users. This allows for potential exploitation by authenticated, low-privileged local users.

Business Impact

The exploitation of this vulnerability could lead to total system compromise, as credential management is a core security function. With a CVSS score of 7.8, the risk is significant, potentially allowing an attacker to bypass security boundaries, escalate privileges, and gain unauthorized access to sensitive data or administrative controls.

Remediation Plan

Immediate Action: Audit systems for the use of the setcred(2) call and apply vendor-provided security patches immediately once available.

Proactive Monitoring: Review system call logs for anomalous usage patterns or unauthorized attempts to invoke the setcred(2) function.

Compensating Controls: Implement strict local user access controls and follow the principle of least privilege to limit the number of users who can interact with sensitive system calls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of core system call flaws, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability poses a severe threat to system integrity. Security teams should prioritize identifying affected instances within their environment and apply vendor-supplied patches as soon as they are released to prevent local privilege escalation.

---METADATA---
VENDOR: Mirasvit
PRODUCT: Full Page Cache Warmer for Magento 2
AFFECTED_VERSIONS: Before 1.11.12
---END_METADATA---

Description Summary:
Mirasvit Full Page Cache Warmer for Magento 2 contains a PHP object injection vulnerability allowing unauthenticated RCE via the CacheWarmer cookie.

Executive Summary:
An unauthenticated PHP object injection vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 enables remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-45247

Affected Software: Mirasvit, Full Page Cache Warmer for Magento 2

Affected Versions: Before 1.11.12

Vulnerability: The vulnerability stems from an insecure call to PHP's unserialize() function using user-controlled input from the CacheWarmer cookie. This allows an unauthenticated attacker to inject malicious serialized objects, triggering gadget chains that result in remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to Magento-based e-commerce environments. Exploitation leads to total server compromise, potentially exposing customer PII, payment information, and administrative credentials. This could result in significant financial loss and severe regulatory compliance violations.

Remediation Plan

Immediate Action: Update the Mirasvit Full Page Cache Warmer plugin to version 1.11.12 or higher immediately.

Proactive Monitoring: Inspect web server access logs for suspicious cookie values containing serialized PHP objects or anomalous requests directed at the cache warming mechanism.

Compensating Controls: Deploy WAF rules to detect and block serialized PHP objects in incoming HTTP headers and cookies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of required authentication. Organizations utilizing Magento 2 with the Mirasvit Full Page Cache Warmer must apply the vendor-provided patch immediately to prevent unauthorized code execution and potential data exfiltration.

---METADATA---
VENDOR: Prior
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the Prior software suite that requires immediate attention and remediation to prevent unauthorized system impact.

Executive Summary:
A high-severity vulnerability in the Prior product suite poses a significant risk to organizational infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-45245

Affected Software: Prior Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the "Summarize" function within the application. Due to the lack of specific technical details, the authentication requirements for exploitation remain indeterminate.

Business Impact

With a CVSS score of 7.4, this vulnerability represents a high risk to business operations. Exploitation could lead to unauthorized system access or compromise of sensitive data, potentially resulting in operational downtime or loss of system integrity.

Remediation Plan

Immediate Action: Consult the official vendor advisory immediately to identify if your specific deployment is affected and to apply the necessary security updates.

Proactive Monitoring: Review system and application access logs for anomalous behavior or unauthorized attempts to interact with the "Summarize" functionality.

Compensating Controls: Implement strict network segmentation and ensure that Web Application Firewalls (WAF) are configured to detect and block suspicious request patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, it is critical that administrators prioritize the review of vendor guidance. Organizations should apply all provided security patches as soon as they become available to mitigate the risk of potential exploitation.

---METADATA---
VENDOR: Prior
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability identified in the Prior software suite requires urgent review and patching by security teams.

Executive Summary:
A high-severity security flaw in the Prior product suite mandates immediate investigation to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-45242

Affected Software: Prior Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the "Summarize" functionality within the affected software. Detailed authentication requirements are currently unknown, necessitating a cautious approach until full vendor documentation is released.

Business Impact

The CVSS score of 7.1 underscores a significant security risk. Successful exploitation could compromise the confidentiality and availability of the affected systems, leading to potential data exposure and disruption of critical business processes.

Remediation Plan

Immediate Action: Regularly monitor the vendor’s security portal for updates and apply all relevant patches immediately upon release.

Proactive Monitoring: Analyze audit logs for unexpected system activity or unauthorized access attempts targeting the application's core functions.

Compensating Controls: Utilize WAF rules to filter malicious traffic and restrict access to the affected service to authorized internal network segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority. We recommend establishing a patch management plan to deploy vendor-supplied updates as soon as they are published to ensure the continued security of the environment.

---METADATA---
VENDOR: HTMLy
PRODUCT: CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in HTMLy CMS through version 3, which may allow for unauthorized system access or information disclosure.

Executive Summary:
An identified vulnerability in HTMLy CMS through version 3 poses a high risk to the security and integrity of web-hosted content.

Vulnerability Details

CVE-ID: CVE-2026-45233

Affected Software: HTMLy CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the HTMLy CMS platform, potentially exposing the system to unauthorized interactions. The flaw may allow attackers to bypass security controls and interact with the CMS in an unauthorized manner.

Business Impact

An exploit of this CMS vulnerability could lead to unauthorized content modification, administrative account takeover, or the exposure of sensitive site data. With a CVSS score of 8.1, this high-severity vulnerability could result in severe reputational damage and the compromise of web-based assets.

Remediation Plan

Immediate Action: Update the HTMLy CMS installation to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor site traffic for unusual administrative access attempts or modifications to site configuration files.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and restrict access to the CMS administrative dashboard to known, trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Web administrators should treat this vulnerability with high priority to prevent unauthorized access to their CMS-managed sites. Updating the software to a patched version is the most effective way to eliminate this risk and ensure the continued security of web content.

---METADATA---
VENDOR: DumbAssets
PRODUCT: DumbAssets
AFFECTED_VERSIONS: Through 1.0.11
---END_METADATA---

Description Summary:
DumbAssets contains a path traversal vulnerability in the file deletion API that allows unauthenticated attackers to delete arbitrary files, resulting in denial of service.

Executive Summary:
A critical path traversal vulnerability in DumbAssets allows unauthenticated attackers to delete essential system files, leading to a complete denial of service.

Vulnerability Details

CVE-ID: CVE-2026-45230

Affected Software: DumbAssets

Affected Versions: Through 1.0.11

Vulnerability: The POST /api/delete-file endpoint fails to validate the filesToDelete array, allowing an attacker to use ../ sequences to traverse outside the intended directory and delete critical files like server.js.

Business Impact

The CVSS score of 9.1 highlights the severity of this vulnerability. While it primarily results in a denial of service, the ability to delete arbitrary files can be used to disrupt critical business operations or potentially clear evidence of other malicious activities.

Remediation Plan

Immediate Action: Update to the latest version of DumbAssets and check the vendor advisory for specific patch details.

Proactive Monitoring: Monitor API access logs for suspicious input patterns, specifically repeated use of directory traversal sequences.

Compensating Controls: Implement strict path validation and ensure the application runs with the minimum file system permissions required.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

---METADATA---
VENDOR: StoreApps
PRODUCT: Smart Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An incorrect privilege assignment vulnerability in StoreApps Smart Manager allows for unauthorized privilege escalation.

Executive Summary:
A privilege escalation flaw in StoreApps Smart Manager may allow authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-45216

Affected Software: StoreApps Smart Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is categorized as an Incorrect Privilege Assignment, where the application fails to properly enforce access control boundaries. This allows an authenticated user to escalate their permissions beyond their intended role.

Business Impact

Successful exploitation allows attackers to bypass intended security constraints, potentially gaining administrative control over the application. This risks the confidentiality and integrity of sensitive store data. The CVSS score of 8.8 highlights the severity of the privilege escalation risk.

Remediation Plan

Immediate Action: Update the Smart Manager plugin to the latest version provided by the vendor.

Proactive Monitoring: Review application access logs for accounts performing actions outside their assigned privilege levels.

Compensating Controls: Utilize Web Application Firewall (WAF) rules to filter suspicious requests that may be attempting to trigger privilege escalation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize updating the Smart Manager plugin to mitigate this escalation risk. Regular audits of user roles and permissions are recommended to ensure that no unauthorized privilege changes have already occurred.

---METADATA---
VENDOR: Apex
PRODUCT: Apex One/SEP agent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
A time-of-check time-of-use (TOCTOU) vulnerability in the Apex One/SEP agent allows local attackers to achieve privilege escalation through race conditions.

Executive Summary:
A TOCTOU race condition in the Apex One/SEP agent enables local attackers to escalate privileges on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-45208

Affected Software: Apex Apex One/SEP agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a time-of-check time-of-use (TOCTOU) vulnerability within the agent's internal processes. It permits an authenticated local attacker to manipulate file or process states during the window between a security check and the subsequent action, leading to privilege escalation.

Business Impact

Successful exploitation allows a local user to gain elevated permissions, potentially resulting in full system compromise. With a CVSS score of 7.8, this flaw represents a significant risk to endpoint security, as it undermines the protective capabilities of the security agent itself.

Remediation Plan

Immediate Action: Deploy the latest security updates provided by Apex to address the identified race condition.

Proactive Monitoring: Monitor endpoint logs for suspicious process creation or unusual file modification patterns originating from low-privileged user accounts.

Compensating Controls: Enforce strict application whitelisting and limit local user permissions to minimize the surface area available for race condition exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the Apex One/SEP agent must treat this as a high-priority update. Patching the agent software is the only reliable method to eliminate the TOCTOU flaw and prevent local escalation attacks.

---METADATA---
VENDOR: Apex
PRODUCT: Apex One/SEP agent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An origin validation vulnerability in the Apex One/SEP agent allows local attackers to bypass security checks and escalate privileges.

Executive Summary:
Improper origin validation in the Apex One/SEP agent allows local attackers to perform unauthorized actions and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-45207

Affected Software: Apex Apex One/SEP agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the failure of the Apex One/SEP agent to properly validate the origin of requests or data. An authenticated local attacker can leverage this to bypass internal security controls and execute privileged operations.

Business Impact

By exploiting this origin validation flaw, an attacker can subvert the agent's security logic, potentially leading to unauthorized access to the host system. The CVSS score of 7.8 confirms that this is a high-severity issue capable of compromising the confidentiality, integrity, and availability of affected endpoints.

Remediation Plan

Immediate Action: Update the Apex One/SEP agent to the latest version released by the vendor to ensure proper origin validation is enforced.

Proactive Monitoring: Review security agent logs for irregular communication patterns or unauthorized inter-process requests that deviate from established baselines.

Compensating Controls: Utilize host-based intrusion prevention systems (HIPS) to detect and block unauthorized attempts to interact with security agent services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights a critical failure in the agent's ability to verify the source of requests. Administrators are strongly advised to apply vendor-provided patches immediately to close the validation gap and mitigate the risk of local privilege escalation.

---METADATA---
VENDOR: Apex
PRODUCT: Apex One/SEP agent
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
An origin validation vulnerability in the Apex One/SEP agent allows a local attacker to escalate privileges on affected system installations.

Executive Summary:
A local privilege escalation vulnerability in the Apex One/SEP agent poses a significant risk to system integrity by allowing unauthorized users to gain elevated permissions.

Vulnerability Details

CVE-ID: CVE-2026-45206

Affected Software: Apex Apex One/SEP agent

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an origin validation flaw within the agent software that can be leveraged by a local user to bypass security controls and escalate privileges. The attack requires local access to the affected machine.

Business Impact

Successful exploitation allows a low-privileged local user to execute commands with higher privileges, potentially leading to full system compromise. With a CVSS score of 7.8, this flaw represents a High severity risk that could result in unauthorized data access, the installation of malicious software, or persistent backdoors within the enterprise environment.

Remediation Plan

Immediate Action: Identify all instances of the Apex One/SEP agent within the environment and apply the latest security patches provided by the vendor.

Proactive Monitoring: Audit system logs for unexpected privilege changes, unauthorized service executions, or anomalous process creation events originating from local user accounts.

Compensating Controls: Restrict local user access to sensitive directories and enforce the principle of least privilege to minimize the potential impact of a local escalation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation, organizations should prioritize the identification of all vulnerable agents. Administrators must verify patch availability through official vendor channels and apply updates to mitigate the risk of local system compromise.

---METADATA---
VENDOR: Imagination
PRODUCT: Graphics DDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical memory vulnerability in the Imagination Graphics DDK allows improper GPU commands to trigger out-of-bounds memory access.

Executive Summary:
A high-severity vulnerability in the Imagination Graphics DDK enables a guest VM to perform unauthorized memory reads or writes on the host kernel.

Vulnerability Details

CVE-ID: CVE-2026-45195

Affected Software: Imagination Graphics DDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the interface between the virtual machine and GPU firmware, where improper command validation allows a malicious actor to perform out-of-bounds memory operations. This represents a significant security boundary violation between the guest VM and the host kernel.

Business Impact

The CVSS score of 7.8 underscores the severity of this vulnerability, as it allows for potential guest-to-host breakout. Successful exploitation could lead to full system compromise, data exfiltration, or complete loss of control over the affected virtualization host, posing a severe threat to multi-tenant environments.

Remediation Plan

Immediate Action: Identify all systems utilizing Imagination Graphics DDK and apply the latest vendor-provided security patches to the GPU firmware and driver stack.

Proactive Monitoring: Monitor virtual machine hypervisor logs for unexpected GPU firmware interactions or unauthorized attempts to access restricted memory regions.

Compensating Controls: Where patching is delayed, limit the exposure of sensitive virtualized workloads by isolating systems that rely on affected GPU drivers until the remediation is complete.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the nature of this vulnerability involving kernel-level memory access, immediate patching is essential to prevent VM escape scenarios. System administrators should prioritize this update in all virtualized environments utilizing Imagination graphics hardware.

---METADATA---
VENDOR: Exim
PRODUCT: Exim
AFFECTED_VERSIONS: 4.97 up to (excluding) 4.99.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Exim versions before 4.99.3 contain a use-after-free vulnerability in the BDAT body parsing path, allowing unauthenticated remote code execution via specifically crafted TLS close_notify sequences.

Executive Summary:
A critical use-after-free vulnerability in Exim allows unauthenticated remote attackers to achieve arbitrary code execution, posing a severe risk to mail infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-45185

Affected Software: Exim

Affected Versions: 4.97 up to (excluding) 4.99.3

Vulnerability: This vulnerability is a use-after-free flaw triggered during BDAT body parsing when a client sends a TLS close_notify mid-transfer. An unauthenticated attacker can exploit this memory corruption to execute arbitrary code on the affected server.

Business Impact

The exploitation of this vulnerability results in full system compromise, allowing attackers to gain complete control over the mail transfer agent. Given the CVSS score of 9.8, this poses an extreme risk of data exfiltration, service disruption, and potential lateral movement into the internal network.

Remediation Plan

Immediate Action: Upgrade Exim to version 4.99.3 or later immediately to resolve the memory corruption vulnerability.

Proactive Monitoring: Monitor server logs for unusual BDAT traffic patterns and unexpected segmentation faults or crashes in the Exim process.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection system configured to drop malformed TLS chunks or suspicious SMTP traffic patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which allows for unauthenticated remote code execution, the potential for exploitation is high.

Analyst Recommendation

Organizations running Exim must prioritize patching to version 4.99.3 or above. Given the critical severity and the ease of exploitation, failure to update will leave the infrastructure vulnerable to complete compromise by remote, unauthenticated actors.

---METADATA---
VENDOR: Anchor
PRODUCT: Anchor
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability exists within the Anchor framework, a toolset used for developing Solana blockchain programs.

Executive Summary:
The Anchor framework for Solana development is affected by a high-severity vulnerability that could jeopardize the integrity of smart contract development.

Vulnerability Details

CVE-ID: CVE-2026-45137

Affected Software: Anchor

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Anchor framework, which provides developer tools for Solana programs. The technical details regarding the specific vulnerable component and authentication requirements are currently unavailable.

Business Impact

The CVSS score of 8.2 classifies this as a High-severity vulnerability. Exploitation could lead to compromised smart contract code or unauthorized deployment activities, potentially resulting in significant financial loss or the introduction of backdoors into blockchain-based applications.

Remediation Plan

Immediate Action: Monitor official Anchor project channels and documentation to identify the patched version and upgrade the framework dependencies in your development environment.

Proactive Monitoring: Audit recent deployments and code commits for any unauthorized changes that may have occurred if the development environment was potentially exposed.

Compensating Controls: Utilize code signing and rigorous CI/CD pipeline security checks to ensure that only verified and authorized code is deployed to the production Solana environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and security teams must prioritize checking their project dependencies for the affected Anchor versions. Given the critical nature of blockchain development tools, applying updates promptly is essential to maintain the security and integrity of the development lifecycle.

---METADATA---
VENDOR: Caddy
PRODUCT: Caddy Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Caddy server platform. The specific technical details regarding the nature of the flaw remain under investigation.

Executive Summary:
The Caddy server platform is affected by a high-severity vulnerability that could potentially expose the system to unauthorized access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-45135

Affected Software: Caddy Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Caddy server platform. Due to limited disclosure at this time, the exact vector and authentication requirements remain pending further vendor clarification.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a significant risk to the availability and integrity of web services. Successful exploitation could lead to unauthorized system access or the compromise of sensitive data handled by the Caddy server, potentially resulting in severe operational downtime and reputational damage.

Remediation Plan

Immediate Action: Administrators should monitor the official Caddy security advisory page and apply the latest security patches as soon as they are released.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unauthorized administrative attempts that deviate from established traffic baselines.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict ingress filtering to mitigate potential exploitation attempts while awaiting official vendor patches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation remains a critical concern for organizations relying on this software.

Analyst Recommendation

Given the high severity rating, it is imperative that security teams prioritize this issue within their vulnerability management lifecycle. Immediately review the vendor's security bulletins and prepare for an emergency patching cycle to ensure the integrity of your network perimeter.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts exposes Personal Access Tokens and SSH signing keys to untrusted code.

Executive Summary:
Unsafe credential handling in CloudPirates Helm Charts exposes sensitive signing and access keys, creating an immediate risk of repository compromise.

Vulnerability Details

CVE-ID: CVE-2026-45132

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The generate-schema.yaml workflow uses unsafe checkout practices that allow fork-controlled code to access and exfiltrate Personal Access Tokens and SSH signing keys.

Business Impact

The theft of signing keys and access tokens allows an attacker to impersonate the project maintainers and push malicious code or sign fraudulent commits. With a CVSS score of 10.0, this represents a critical threat to the integrity of the entire software lifecycle.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to correct the workflow checkout and credential management practices.

Proactive Monitoring: Review repository logs for unauthorized commit activity or unusual use of the compromised SSH signing keys.

Compensating Controls: Immediately revoke and rotate all Personal Access Tokens and SSH keys that were configured for use within this workflow.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of secret exposure, users must treat this as a high-urgency remediation. Beyond updating the workflow, a full rotation of all exposed secrets is required to ensure the security of the repository and its associated assets.

---METADATA---
VENDOR: CloudPirates
PRODUCT: Open Source Helm Charts
AFFECTED_VERSIONS: Prior to commit fcf9302
---END_METADATA---

Description Summary:
A GitHub Actions workflow in CloudPirates Helm Charts executes attacker-controlled code from forks, exposing repository secrets.

Executive Summary:
A critical configuration flaw in CloudPirates Helm Charts exposes sensitive repository credentials to unauthorized actors via GitHub Actions.

Vulnerability Details

CVE-ID: CVE-2026-45131

Affected Software: CloudPirates Open Source Helm Charts

Affected Versions: Prior to commit fcf9302

Vulnerability: The pull-request.yaml GitHub Actions workflow runs code from untrusted forks in a privileged context, exposing Docker Hub credentials and other repository secrets without requiring approval.

Business Impact

Exposure of credentials allows attackers to access private container registries and potentially inject malicious code into the software supply chain. With a CVSS score of 10.0, this vulnerability presents a catastrophic risk to the security of the build pipeline and downstream software users.

Remediation Plan

Immediate Action: Update to commit fcf9302 or later to secure the GitHub Actions workflow and isolate untrusted code execution.

Proactive Monitoring: Audit repository secret usage logs and verify if any credentials have been accessed or used by unauthorized parties.

Compensating Controls: Rotate all secrets (Docker Hub credentials, tokens) that were exposed or potentially accessible during the vulnerable period.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant supply chain risk. Organizations using these Helm charts must update to the patched version and treat all previously stored secrets as compromised, necessitating a mandatory rotation of all affected credentials.

---METADATA---
VENDOR: Microsoft
PRODUCT: Himmelblau
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Himmelblau, an interoperability suite designed for Microsoft Azure Entra ID and Intune.

Executive Summary:
A high-severity vulnerability in the Himmelblau interoperability suite threatens the security integration between Microsoft Azure Entra ID and Intune.

Vulnerability Details

CVE-ID: CVE-2026-45108

Affected Software: Microsoft Himmelblau

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts the Himmelblau suite, which facilitates interoperability between identity and device management services. The specific technical mechanism of the vulnerability remains undisclosed at this time.

Business Impact

With a CVSS score of 8.4, this vulnerability carries a High-severity rating. Successful exploitation could lead to unauthorized access to identity management or device configuration services, potentially allowing an attacker to escalate privileges or bypass security policies enforced by Entra ID and Intune.

Remediation Plan

Immediate Action: Review official Microsoft or relevant product security bulletins to obtain the necessary updates for the Himmelblau suite.

Proactive Monitoring: Inspect Azure Entra ID and Intune audit logs for suspicious administrative activity or unusual authentication patterns involving the interoperability suite.

Compensating Controls: Apply the principle of least privilege to service accounts used by the Himmelblau suite to minimize the potential blast radius of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators managing Azure environments should treat this advisory with urgency. Patching the Himmelblau suite is the primary method to mitigate the risk of identity and device management compromise; ensure that all security updates are validated and deployed according to your organizational change management policy.

---METADATA---
VENDOR: OneUptime
PRODUCT: OneUptime
AFFECTED_VERSIONS: Prior to 10.0.98
---END_METADATA---

Description Summary:
OneUptime is vulnerable to a sandbox escape in its Node.js environment due to the improper use of the vm module.

Executive Summary:
A critical sandbox escape vulnerability in OneUptime allows for remote code execution by bypassing the Node.js vm module isolation.

Vulnerability Details

CVE-ID: CVE-2026-45102

Affected Software: OneUptime OneUptime

Affected Versions: Prior to 10.0.98

Vulnerability: The application utilizes the Node.js vm module for code isolation, which is not designed for security; attackers can escape this sandbox via error objects and recursion.

Business Impact

With a CVSS score of 9.9, this vulnerability permits an attacker to escape the intended execution environment and perform arbitrary code execution on the host. This poses a critical threat to the security and stability of the OneUptime platform.

Remediation Plan

Immediate Action: Upgrade OneUptime to version 10.0.98 or later to remediate the sandbox escape vulnerability.

Proactive Monitoring: Monitor for abnormal system calls or unauthorized filesystem access originating from the OneUptime application process.

Compensating Controls: Run the application with restricted OS-level permissions (e.g., using containers or sandboxing technologies) to mitigate the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The use of the vm module for security isolation is inherently flawed. Administrators must update to the latest version immediately to ensure that more robust security primitives are in place.

---METADATA---
VENDOR: sealed-env
PRODUCT: sealed-env
AFFECTED_VERSIONS: 0.1.0-alpha.1 through 0.1.0-alpha.3
---END_METADATA---

Description Summary:
The sealed-env library incorrectly embeds literal TOTP secrets in unencrypted JWS payloads, allowing unauthorized parties to extract sensitive credentials.

Executive Summary:
A critical security flaw in the sealed-env library exposes TOTP secrets in plaintext, allowing unauthorized access to sensitive authentication tokens.

Vulnerability Details

CVE-ID: CVE-2026-45091

Affected Software: sealed-env

Affected Versions: 0.1.0-alpha.1 through 0.1.0-alpha.3

Vulnerability: The library embeds the operator's TOTP secret within a base64-encoded JWS payload that is not encrypted. Any entity with access to the minted tokens, such as log aggregators or CI/CD systems, can extract the secret in plaintext.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk of credential compromise. Exposure of TOTP secrets effectively invalidates the multi-factor authentication mechanism for the affected environment, potentially granting attackers persistent access to critical systems and data.

Remediation Plan

Immediate Action: Update the sealed-env library to version 0.1.0-alpha.4 or later immediately.

Proactive Monitoring: Review CI/CD logs, container logs, and monitoring tools for the presence of leaked TOTP secrets and rotate all affected secrets immediately.

Compensating Controls: Implement secret scanning and log sanitization procedures to prevent sensitive tokens from being stored in cleartext in logs or environment variables.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant failure in secure secret management. It is imperative that affected organizations upgrade to the latest version of the library and immediately rotate any TOTP secrets that may have been exposed through logs or build environments.

---METADATA---
VENDOR: Dalfox
PRODUCT: Dalfox XSS Scanner
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
Dalfox, an open-source XSS scanner, is susceptible to a security vulnerability that may impact automated scanning workflows.

Executive Summary:
The Dalfox XSS scanner is affected by a security vulnerability that poses a significant risk to the integrity of automated security testing environments.

Vulnerability Details

CVE-ID: CVE-2026-45089

Affected Software: Dalfox Dalfox XSS Scanner

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation lacks specific technical details regarding the vulnerability type or the authentication requirements for exploitation. Given the nature of the tool, potential flaws could involve improper input handling or configuration-based exploits.

Business Impact

A successful exploit of this vulnerability could lead to the compromise of security scanning infrastructure, potentially allowing attackers to manipulate scan results or gain unauthorized access to the host environment. With a CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and integrity of development and testing pipelines.

Remediation Plan

Immediate Action: Consult the official Dalfox project repository or vendor security advisories to identify and apply the latest security patches.

Proactive Monitoring: Audit logs for the Dalfox utility to detect anomalous command execution or unexpected outbound network traffic originating from the scanner.

Compensating Controls: Restrict access to the machine running Dalfox and ensure it operates within a hardened, isolated container or virtual machine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation remains significant and requires prompt attention.

Analyst Recommendation

Organizations utilizing Dalfox for automated security testing should prioritize identifying the affected versions in their environments. Until a specific patch is verified, ensure that the utility is not exposed to untrusted input or external network connections to mitigate potential risks.

---METADATA---
VENDOR: Dalfox
PRODUCT: Dalfox
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
Dalfox contains an unauthenticated remote code execution vulnerability in its REST API server mode due to insecure deserialization of scan options.

Executive Summary:
An unauthenticated remote code execution vulnerability in Dalfox allows attackers to execute arbitrary shell commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-45087

Affected Software: Dalfox Dalfox

Affected Versions: Prior to 2.13.0

Vulnerability: The server mode deserializes attacker-supplied JSON directly into scan options, allowing an unauthenticated user to inject arbitrary shell commands that the Dalfox process will execute.

Business Impact

With a CVSS score of 10, this is a critical vulnerability that allows an unauthenticated attacker to gain full control over the host running the Dalfox server. This could lead to complete system compromise, data exfiltration, or the use of the host as a pivot point for further attacks.

Remediation Plan

Immediate Action: Update Dalfox to version 2.13.0 or later to ensure proper validation and stripping of scan options.

Proactive Monitoring: Monitor for unauthorized requests to the Dalfox API and check for unexpected child processes spawned by the Dalfox service.

Compensating Controls: If the Dalfox server must be exposed, implement strong authentication via an API key and restrict access to the service port (6664) using network-level controls.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and trivial to exploit if the service is exposed to a network. Immediate updates are required, and the service should not be exposed without authentication.

---METADATA---
VENDOR: ClipBucket
PRODUCT: ClipBucket
AFFECTED_VERSIONS: Prior to version 5.5.3 - #129
---END_METADATA---

Description Summary:
The ClipBucket video sharing platform is vulnerable to unauthenticated blind SQL injection, allowing attackers to execute unauthorized database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in ClipBucket allows remote attackers to exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-45060

Affected Software: ClipBucket

Affected Versions: Prior to version 5.5.3 - #129

Vulnerability: The actions/progress_video.php endpoint fails to properly sanitize the ids parameter, leading to a blind SQL injection vulnerability. This flaw allows an unauthenticated attacker to inject malicious SQL queries to interact with the database.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it requires no authentication to execute. Successful exploitation could result in the full exfiltration of user databases, administrative credentials, or proprietary video content, leading to significant data breaches and potential loss of platform integrity.

Remediation Plan

Immediate Action: Update ClipBucket to version 5.5.3 - #129 or higher to patch the SQL injection vulnerability.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected UNION operations, or high volumes of suspicious requests targeting the progress_video.php endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block SQL injection patterns in incoming HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, it presents a significant risk to data confidentiality. Organizations running ClipBucket must apply the provided update immediately to prevent unauthorized database access and potential data exfiltration.