---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 1
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
An integer underflow vulnerability exists in the dsi_writeinit() function of Netatalk 1, which may lead to memory corruption.

Executive Summary:
An integer underflow vulnerability in Netatalk 1 could allow attackers to trigger memory corruption, potentially leading to service compromise.

Vulnerability Details

CVE-ID: CVE-2026-44060

Affected Software: Netatalk Netatalk 1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an integer underflow occurring within the dsi_writeinit() function. The flaw may allow an attacker to disrupt service stability or execute arbitrary code depending on the memory layout.

Business Impact

With a CVSS score of 7.5, this high-severity vulnerability represents a significant threat to infrastructure availability and data integrity. Organizations relying on Netatalk for file sharing services may face operational downtime or unauthorized data access if the service is successfully compromised.

Remediation Plan

Immediate Action: Verify the version of Netatalk 1 in use and apply security updates provided by the vendor or relevant distribution maintainers.

Proactive Monitoring: Monitor server logs for DSI-related errors and unusual process termination events.

Compensating Controls: Deploy a WAF or intrusion detection system to monitor and drop malformed packets that might attempt to trigger the integer underflow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency due to its impact on system memory. Ensure that all affected Netatalk instances are updated to a secure version as soon as the vendor makes a patch available.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Netatalk 2 allows unauthorized users to access restricted resources.

Executive Summary:
An authentication bypass vulnerability in Netatalk 2 allows unauthorized access, posing a critical threat to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-44058

Affected Software: Netatalk Netatalk 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an authentication bypass vulnerability allowing unauthenticated attackers to interact with the service as if they were legitimate users. This flaw effectively negates the security controls intended to protect shared file resources.

Business Impact

The CVSS score of 7.2 reflects the high risk associated with unauthorized access to file systems. Successful exploitation could lead to the theft of sensitive proprietary data, unauthorized modification of files, and a complete loss of confidence in the security of the file-sharing environment.

Remediation Plan

Immediate Action: Identify all instances of Netatalk 2 and apply the latest security patches provided by the vendor immediately.

Proactive Monitoring: Audit access logs for suspicious account activity or logins originating from unauthorized or unexpected IP addresses.

Compensating Controls: Restrict network access to the Netatalk service using firewall rules, ensuring only trusted clients can communicate with the server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypass vulnerabilities are extremely dangerous as they provide direct access to protected systems. It is critical to patch this vulnerability immediately to prevent unauthorized data access and ensure the integrity of your file-sharing services.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A logic error involving bitwise OR operations exists in Netatalk 3, potentially leading to unauthorized system behavior.

Executive Summary:
A logic error in Netatalk 3 poses a significant risk to system integrity and may allow for unauthorized operations.

Vulnerability Details

CVE-ID: CVE-2026-44055

Affected Software: Netatalk 3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a logic error within the bitwise OR operations of the Netatalk 3 software. The authentication requirements for this flaw are currently unspecified, necessitating a review of the vendor's technical documentation.

Business Impact

Successful exploitation of this logic error could result in unauthorized access or manipulation of data processed by the Netatalk service. With a CVSS score of 7.5, this vulnerability is classified as High, indicating that it could facilitate significant disruption to file sharing services or compromise the security of the underlying host.

Remediation Plan

Immediate Action: Monitor vendor communication channels and apply the appropriate security patches as soon as they are made available by the maintainers.

Proactive Monitoring: Review system and application logs for unusual bitwise operation errors or unexpected service behavior.

Compensating Controls: Implement network segmentation to limit exposure of the Netatalk service to untrusted network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity score, organizations utilizing Netatalk 3 must prioritize this issue. Administrators should actively track the vendor’s security advisory page to ensure prompt application of patches once released to mitigate the risk of exploitation.

---METADATA---
VENDOR: LG
PRODUCT: Netatalk 1
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Netatalk 1 implementation used within LG products.

Executive Summary:
A vulnerability in Netatalk 1 within LG products presents a security risk that requires immediate vendor guidance.

Vulnerability Details

CVE-ID: CVE-2026-44053

Affected Software: LG Netatalk 1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability pertains to the Netatalk 1 service, though specific technical details regarding the vector or authentication requirements are currently sparse. Further investigation is required to determine the precise nature of the flaw.

Business Impact

With a CVSS score of 7.4, this vulnerability is categorized as High, suggesting the potential for significant security impact. Unauthorized exploitation could lead to service instability or potential data exposure within the affected LG environment.

Remediation Plan

Immediate Action: Check the LG security portal or vendor advisory page for specific firmware updates or software patches.

Proactive Monitoring: Monitor system logs for anomalous activity specifically originating from the Netatalk service.

Compensating Controls: Restrict access to the affected service via firewall rules until a validated patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should maintain a high state of alert and verify the presence of Netatalk 1 in their environment. Prompt application of vendor-supplied updates is essential to maintaining the security posture of the affected infrastructure.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability exists within the Netatalk 2 software suite, requiring investigation by system administrators.

Executive Summary:
A vulnerability in Netatalk 2 presents a significant risk to systems relying on this file-sharing service.

Vulnerability Details

CVE-ID: CVE-2026-44052

Affected Software: Netatalk 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Netatalk 2, though specific technical details regarding the nature of the flaw are not currently provided. Authentication requirements remain unclear at this stage of analysis.

Business Impact

The CVSS score of 7.5 indicates a High severity level, which suggests that successful exploitation could lead to unauthorized access or system-wide disruption. Ensuring the integrity of file-sharing services is critical to preventing broader unauthorized access to sensitive data.

Remediation Plan

Immediate Action: Monitor official Netatalk security bulletins for patch releases and apply updates immediately upon availability.

Proactive Monitoring: Review access logs and service performance metrics for deviations from baseline behavior.

Compensating Controls: Utilize network-level access controls to minimize the attack surface of the Netatalk 2 service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must prioritize the identification of Netatalk 2 instances across their network. Given the high CVSS score, it is imperative to apply official vendor patches as soon as they are published to mitigate potential threats.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Netatalk 3. The specific technical mechanics of this flaw remain under investigation.

Executive Summary:
A security vulnerability in Netatalk 3 poses a significant risk to organizational infrastructure, necessitating prompt security review and update management.

Vulnerability Details

CVE-ID: CVE-2026-44051

Affected Software: Netatalk 3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a security-related vulnerability affecting the Netatalk 3 software suite. The authentication requirements for triggering this flaw are currently unknown.

Business Impact

With a CVSS score of 8.1, this vulnerability is classified as High. Exploitation may result in critical system compromise, potentially leading to unauthorized data exposure or total service instability for users relying on the file server.

Remediation Plan

Immediate Action: Closely monitor the Netatalk project's official security advisories and deploy provided patches as soon as they are released.

Proactive Monitoring: Analyze network traffic and authentication logs for suspicious activity associated with the Netatalk service.

Compensating Controls: Implement firewall rules to minimize the attack surface by limiting access to the Netatalk service to known, authorized internal IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The CVSS score of 8.1 indicates a significant risk that warrants immediate administrative attention. It is highly recommended that security teams verify their current versioning and prepare for a rapid deployment once a patch is issued by the vendor.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.0 through 4.4.2
---END_METADATA---

Description Summary:
Netatalk contains a heap-based buffer overflow vulnerability within the cnid daemon's comm_rcv() function.

Executive Summary:
A heap buffer overflow in the Netatalk cnid daemon could allow a remote attacker to execute arbitrary code or crash the service.

Vulnerability Details

CVE-ID: CVE-2026-44050

Affected Software: Netatalk

Affected Versions: 2.0.0 through 4.4.2

Vulnerability: This is a heap buffer overflow in the cnid daemon. It occurs during the comm_rcv() process, which can be triggered by an attacker sending malformed data to the service.

Business Impact

A successful exploit may result in arbitrary code execution with the privileges of the Netatalk service, leading to full system compromise or a persistent denial-of-service condition. The 9.9 CVSS score highlights the extreme urgency of this vulnerability for any environment utilizing Netatalk for file sharing.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later immediately.

Proactive Monitoring: Monitor system logs for service crashes or unusual memory usage associated with the cnid daemon.

Compensating Controls: Restrict access to the Netatalk service to authorized client IP addresses via firewall rules to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize updating all Netatalk instances to version 4.4.3. This will eliminate the buffer overflow condition and secure the communication interface.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
Netatalk 2 contains an out-of-bounds write vulnerability in the convert_charset() function due to improper null termination.

Executive Summary:
A critical out-of-bounds write vulnerability in Netatalk 2 may allow for memory corruption and potential arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-44049

Affected Software: Netatalk 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an out-of-bounds write within the convert_charset() function, caused by improper null termination. The authentication requirements for this flaw are currently unspecified, necessitating a review of the vendor's security documentation.

Business Impact

The potential for an out-of-bounds write is severe, as it can lead to application crashes or the execution of arbitrary code with the privileges of the Netatalk service. Given the CVSS score of 7.5, this is considered a High-severity issue that could lead to unauthorized system access or significant service disruption if exploited.

Remediation Plan

Immediate Action: Monitor official Netatalk security channels and apply the recommended software updates immediately upon release.

Proactive Monitoring: Review system and application logs for unusual crashes or attempts to access restricted memory segments.

Compensating Controls: Implement network segmentation to isolate the Netatalk service from untrusted networks, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Netatalk 2 should treat this vulnerability with high priority. We recommend monitoring the vendor's advisory closely and deploying patches as soon as they become available to prevent potential memory corruption and unauthorized system compromise.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Netatalk 2. Technical details regarding the impact and mechanism are currently limited.

Executive Summary:
A critical-severity vulnerability in Netatalk 2 requires immediate administrative oversight to prevent potential unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44048

Affected Software: Netatalk 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Netatalk 2, though specific technical details regarding the entry point or authentication requirements are currently unavailable from the provided source.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as High, bordering on Critical. Successful exploitation could have severe consequences, including total loss of confidentiality or availability of the affected file server, potentially disrupting business operations.

Remediation Plan

Immediate Action: Prioritize the identification of all instances of Netatalk 2 within the network and prepare to apply vendor-supplied patches immediately upon release.

Proactive Monitoring: Monitor logs for irregular authentication patterns or unexpected service process crashes that could indicate probing or exploitation.

Compensating Controls: Utilize a Web Application Firewall or network-level access control list to restrict access to the affected service until a permanent patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability should be treated as a high-priority item. Administrators must ensure they are subscribed to vendor security notifications to receive notice of the official patch and proceed with remediation as soon as it is available.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the cnid backend of Netatalk 3, potentially allowing for unauthorized system interactions.

Executive Summary:
The Netatalk 3 cnid backend is affected by a high-severity vulnerability that could lead to unauthorized system access or compromise.

Vulnerability Details

CVE-ID: CVE-2026-44047

Affected Software: Netatalk Netatalk 3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the cnid backend component of Netatalk 3. Due to the limited information provided, the specific authentication requirements for exploitation cannot be determined at this time.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the integrity and availability of network-attached storage services. Successful exploitation could lead to unauthorized data access or disruption of critical file services, potentially resulting in data exfiltration or operational downtime.

Remediation Plan

Immediate Action: Consult the official Netatalk security advisories to identify patched versions and apply updates immediately.

Proactive Monitoring: Monitor system logs for unusual authentication attempts or anomalous activity directed at the cnid backend services.

Compensating Controls: Implement network segmentation and restrict access to the affected service to authorized IP addresses only until a patch can be deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Netatalk 3 should prioritize identifying their exposure level immediately. Ensure that security teams are tracking the vendor's release notes to apply the necessary patches as soon as they become available to mitigate potential unauthorized access.

---METADATA---
VENDOR: Harbor
PRODUCT: Harbor (GoHarbor)
AFFECTED_VERSIONS: 2.15.0 and below
---END_METADATA---

Description Summary:
GoHarbor Harbor version 2.15.0 and below uses hard-coded credentials, allowing unauthenticated attackers to gain administrative access to the web user interface.

Executive Summary:
Harbor container registries are at critical risk of unauthorized access due to the use of hard-coded default credentials, potentially leading to the compromise of private container images.

Vulnerability Details

CVE-ID: CVE-2026-4404

Affected Software: Harbor (GoHarbor)

Affected Versions: 2.15.0 and below

Vulnerability: This vulnerability involves the use of hard-coded credentials in the Harbor software. This allows an attacker who knows the default password to log into the web UI with administrative privileges without needing to bypass any other security layers.

Business Impact

The impact is severe, as an attacker with administrative access to a container registry can steal proprietary source code, inject malicious code into container images (supply chain attack), or delete critical infrastructure components. The CVSS score of 9.4 reflects the high impact on confidentiality and integrity resulting from this authentication failure.

Remediation Plan

Immediate Action: Update Harbor to the latest version and immediately change all default administrative passwords.

Proactive Monitoring: Review Harbor access logs for logins using the default "admin" account, especially from unknown or external IP addresses.

Compensating Controls: Ensure the Harbor UI is not exposed to the public internet and implement Multi-Factor Authentication (MFA) if supported by your identity provider integration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, hard-coded credentials are among the easiest vulnerabilities for attackers to exploit once the default values are identified.

Analyst Recommendation

Immediate password rotation is the most critical step. Following that, upgrading to a version that enforces password changes or removes hard-coded defaults is essential to maintain a secure container supply chain.

---METADATA---
VENDOR: Docling-project
PRODUCT: Docling
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Docling, a tool for document processing and AI integration, contains a high-severity vulnerability that could be leveraged to compromise document parsing workflows.

Executive Summary:
A high-severity vulnerability in the Docling document processing library threatens the integrity of AI-integrated data pipelines and document parsing workflows.

Vulnerability Details

CVE-ID: CVE-2026-44016

Affected Software: Docling-project Docling

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the document parsing functionality of Docling. Attackers could potentially trigger this flaw by submitting malicious documents, leading to unauthorized code execution or system instability within the processing environment.

Business Impact

A successful exploit could result in the compromise of data processed by AI pipelines, potentially leading to data leakage or the corruption of training datasets. Given the CVSS score of 8.2, this vulnerability represents a critical risk to organizations relying on Docling for automated document ingestion and generative AI integrations.

Remediation Plan

Immediate Action: Update the Docling library to the latest secure version once released by the vendor.

Proactive Monitoring: Monitor document processing logs for errors, crashes, or unexpected execution patterns that may indicate a malformed input attack.

Compensating Controls: Implement strict file validation and sandboxing for all documents processed by Docling to prevent unauthorized payloads from interacting with the host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Docling in production workflows should prioritize identifying all instances where this library is implemented. Apply the vendor-provided patches as soon as they become available to mitigate the risk of document-based attacks against your AI ecosystem.

---METADATA---
VENDOR: Node.js (OpenJS Foundation)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox library for Node.js is vulnerable to sandbox escape, potentially allowing arbitrary command execution on the host system.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library for Node.js poses a significant risk of arbitrary code execution on host systems.

Vulnerability Details

CVE-ID: CVE-2026-44009

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: This is a sandbox breakout vulnerability that allows an attacker to bypass the isolation mechanisms of the vm2 environment, leading to full system compromise. The vulnerability can be triggered by an unauthenticated attacker providing malicious input to the sandbox.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and data integrity. Successful exploitation allows an attacker to break out of the intended sandbox environment and execute arbitrary commands on the underlying host, potentially leading to unauthorized access to sensitive data, system takeover, or the deployment of ransomware.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for unusual process execution or attempts to access restricted file paths originating from Node.js applications.

Compensating Controls: Implement strict containerization and principle-of-least-privilege policies for all Node.js environments to limit the blast radius if the sandbox is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of sandbox escapes, organizations utilizing vm2 must prioritize this update. Ensure that all dependencies are audited and that the patching process is completed across all production and development environments to prevent potential host-level exploitation.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to an array species batch neutralization flaw, allowing attackers to escape the sandbox and execute arbitrary commands.

Executive Summary:
A critical sandbox escape in the vm2 library allows attackers to access host functions and execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44008

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: The neutralizeArraySpeciesBatch method improperly handles objects across the sandbox boundary. Attackers can leverage this to retrieve host objects, including the host Function object, and escape the sandbox.

Business Impact

The CVSS score of 9.8 underscores the severe risk of host system compromise. Successful exploitation grants the attacker the ability to escape the sandbox and execute arbitrary commands on the underlying host, leading to full system takeover.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately.

Proactive Monitoring: Monitor for unexpected system-level processes or unusual file system activity originating from the Node.js application.

Compensating Controls: Enforce strict process-level security, such as using seccomp profiles to block unauthorized system calls if a sandbox escape occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the persistent issues with vm2 sandbox escapes, users should ensure they are on the latest version (3.11.2+) and consider if the use of a sandbox is sufficient for their security requirements or if additional defense-in-depth measures are needed.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype access, allowing attackers to reach arbitrary prototypes and escape the sandbox.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access arbitrary prototypes and gain control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-44006

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to restrict access to BaseHandler.getPrototypeOf. By reaching this handler, an attacker can retrieve arbitrary prototypes, enabling a sandbox escape and subsequent host-level execution.

Business Impact

The CVSS score of 10.0 confirms this as a critical risk. Successful exploitation grants the attacker full control over the host system, potentially leading to unauthorized data access, service disruption, and compromise of the entire Node.js application environment.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to patch the prototype access handler.

Proactive Monitoring: Monitor for unusual JavaScript execution patterns or attempts to reflect on object prototypes within the application.

Compensating Controls: Implement strict resource limits and process isolation for any Node.js application that processes untrusted code.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a severe threat to any system relying on vm2 for isolation. Upgrading to the latest version is the only effective mitigation and must be performed immediately.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: 3.9.6 to 3.10.5
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype pollution, allowing sandboxed code to mutate host-realm objects and escape the environment.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to mutate host-realm objects and execute code outside the intended environment.

Vulnerability Details

CVE-ID: CVE-2026-44005

Affected Software: Node.js vm2

Affected Versions: 3.9.6 to 3.10.5

Vulnerability: The library incorrectly exposes mutable proxies for host-realm intrinsic prototypes. This allows sandboxed JavaScript to modify critical objects such as Object.prototype, facilitating a sandbox escape.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Exploitation allows an attacker to break out of the Node.js sandbox, leading to arbitrary code execution on the underlying host system, full server compromise, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to address the proxy exposure issue.

Proactive Monitoring: Monitor for anomalous process behavior or unexpected file system modifications originating from Node.js applications utilizing the vm2 library.

Compensating Controls: Ensure that Node.js applications are running with the principle of least privilege, utilizing containerization or restricted service accounts to limit the blast radius of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this sandbox escape, users must upgrade to version 3.11.0 immediately. Organizations should conduct a thorough audit of all Node.js applications relying on vm2 for isolation to ensure they are updated and secure.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js contains a bypass in its builtin allowlist, enabling unauthorized access to restricted modules and arbitrary code execution.

Executive Summary:
A critical sandbox bypass in the vm2 library allows attackers to load forbidden modules and execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-43999

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox's builtin allowlist can be bypassed by abusing the module builtin. This allows sandboxed code to access Node.js Module._load() to load restricted modules like child_process, resulting in host-level code execution.

Business Impact

The CVSS score of 9.9 highlights the extreme severity of this flaw. By achieving remote code execution outside the sandbox, an attacker can gain full control over the host, leading to data loss, system destruction, or persistent unauthorized access.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later to ensure the builtin allowlist is properly enforced.

Proactive Monitoring: Audit Node.js application logs for attempts to load sensitive modules such as child_process, fs, or net from within sandboxed environments.

Compensating Controls: Use strict environment variable configurations to restrict the capabilities of the Node.js process and prevent the spawning of child processes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that effectively nullifies the isolation provided by vm2. It is imperative to update the library immediately and review all code that relies on this sandbox for security purposes.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to a host object escape, allowing attackers to access the host environment by leveraging native symbols.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access host objects and bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-43997

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to properly restrict access to the host Object. Attackers can use HostObject.getOwnPropertySymbols to obtain sensitive references, enabling a full escape from the sandbox.

Business Impact

A CVSS score of 10.0 signifies an extremely high risk of compromise. Successful exploitation grants the attacker the ability to interact with the host environment, leading to full system control, sensitive data exposure, and potential compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately.

Proactive Monitoring: Monitor system logs for unusual Node.js activity that deviates from standard application behavior, specifically looking for attempts to access non-sandboxed modules or system functions.

Compensating Controls: Employ robust system-level isolation, such as running Node.js processes within hardened containers or gVisor, to minimize the impact if the sandbox is breached.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe security failure in the isolation mechanism. All systems utilizing versions of vm2 prior to 3.11.0 must be patched immediately to prevent complete host system compromise.

---METADATA---
VENDOR: Juno Network
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < 0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw exposes sensitive BIP-39 mnemonic seeds in LLM tool-call JSON data, risking credential theft via telemetry or logging surfaces.

Executive Summary:
JunoClaw versions prior to 0.x.y-security-1 are vulnerable to credential exposure, allowing unauthorized access to BIP-39 seed phrases through system logs and telemetry.

Vulnerability Details

CVE-ID: CVE-2026-43992

Affected Software: Juno Network JunoClaw

Affected Versions: < 0.x.y-security-1

Vulnerability: The platform included the BIP-39 mnemonic seed as an explicit parameter in MCP tool-call JSON strings. This practice exposes the recovery seed to any intermediate system, including logging, telemetry, and external LLM providers.

Business Impact

The exposure of BIP-39 seed phrases essentially grants an attacker full control over the associated wallets or contract assets. With a CVSS score of 9.8, the potential for total financial loss and unauthorized contract manipulation is extreme, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the JunoClaw platform to version 0.x.y-security-1 or higher to remove the inclusion of sensitive mnemonic data in tool calls.

Proactive Monitoring: Review logs, telemetry data, and LLM interaction history for any instances where mnemonic seeds may have been inadvertently recorded or stored.

Compensating Controls: If immediate patching is not possible, rotate all keys or wallets that may have been handled by the platform and isolate the platform from logging systems that store sensitive JSON payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the exposure of cryptographic keys is a high-severity incident that requires immediate attention.

Analyst Recommendation

The exposure of root-level credentials like BIP-39 seeds is a catastrophic failure. Organizations must treat this as a high-priority incident, update the software immediately, and assume that any credentials processed by previous versions are compromised.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: Prior to 2.17.1
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Tautulli allows unauthenticated attackers to force the server to fetch arbitrary URLs.

Executive Summary:
Tautulli is affected by a critical SSRF vulnerability that allows unauthenticated attackers to perform arbitrary server-side requests.

Vulnerability Details

CVE-ID: CVE-2026-43986

Affected Software: Tautulli

Affected Versions: Prior to 2.17.1

Vulnerability: The application exposes a public endpoint that resolves attacker-controlled image hashes, transforming an authenticated SSRF primitive into an unauthenticated SSRF gadget.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe risk. Attackers can leverage the server's internal network access to interact with internal services that are otherwise unreachable from the public internet, potentially leading to sensitive information disclosure or internal service exploitation.

Remediation Plan

Immediate Action: Upgrade Tautulli to version 2.17.1 or later immediately.

Proactive Monitoring: Inspect server logs for outbound requests to suspicious external URLs or internal network segments originating from the Tautulli host.

Compensating Controls: Ensure the Tautulli host is isolated from sensitive internal network zones and implement egress filtering to restrict unauthorized outbound connections.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the ease of unauthenticated exploitation. Organizations running Tautulli must upgrade to version 2.17.1 immediately to close the SSRF vector and prevent potential internal network probing.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability that could be exploited by an attacker.

Executive Summary:
An additional high-severity security vulnerability in Tautulli requires immediate remediation to maintain the security of the monitoring environment.

Vulnerability Details

CVE-ID: CVE-2026-43985

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Tautulli, a Python-based monitoring tool. It represents a significant security weakness that could be used by an attacker to facilitate unauthorized actions within the scope of the application.

Business Impact

The CVSS score of 8.8 justifies a high-severity rating, indicating that the vulnerability is easily exploitable or carries significant impact. Successful exploitation could lead to unauthorized system access or information leakage regarding the Plex media environment.

Remediation Plan

Immediate Action: Apply the latest security update released by the Tautulli project.

Proactive Monitoring: Check application access logs for unusual patterns and ensure that monitoring accounts have the minimum necessary privileges.

Compensating Controls: Place the Tautulli dashboard behind a secure VPN or an authenticated reverse proxy to reduce the risk of direct exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Tautulli must maintain a proactive patching schedule, especially given the high-severity nature of this entry. Immediate updates, combined with network-level access restrictions, are essential for mitigating the risk posed by this vulnerability.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability requiring immediate attention to prevent unauthorized access.

Executive Summary:
A high-severity vulnerability in Tautulli, a Plex monitoring tool, exposes the underlying system to significant risk of unauthorized access or exploitation.

Vulnerability Details

CVE-ID: CVE-2026-43984

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a security flaw within the Tautulli monitoring and tracking tool for Plex Media Server. While specific technical details are pending, the severity indicates a critical weakness in the application's security posture.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a substantial risk to any organization or home user relying on Tautulli. Exploitation could allow an attacker to compromise the host system, potentially leading to unauthorized access to the Plex Media Server environment.

Remediation Plan

Immediate Action: Update Tautulli to the latest version immediately.

Proactive Monitoring: Review application logs for suspicious activity and monitor the system for unauthorized configuration changes.

Compensating Controls: Ensure the Tautulli interface is not exposed to the public internet and use a reverse proxy with authentication to provide an additional layer of security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Tautulli users should prioritize updating their software to the latest release to address this high-severity flaw. Limiting exposure by restricting network access to the application is highly recommended as a baseline defense.

---METADATA---
VENDOR: wger-project
PRODUCT: wger
AFFECTED_VERSIONS: < 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error in wger's gym-scope authorization check allows unprivileged users to perform full account takeovers of other users via password resets.

Executive Summary:
wger versions prior to 2.6 contain an authorization bypass vulnerability that allows an attacker to perform a full account takeover of other users.

Vulnerability Details

CVE-ID: CVE-2026-43948

Affected Software: wger-project wger

Affected Versions: < 2.6

Vulnerability: The application incorrectly performs a Python object comparison that evaluates None != None as False. This allows an attacker with gym.manage_gym permissions and no gym assignment to bypass authorization checks and reset the passwords of other users without a gym assignment.

Business Impact

This flaw permits one-shot full account takeover, granting attackers unauthorized access to sensitive user data and effectively locking out legitimate users. Given the near-perfect CVSS score of 9.9, the risk of data compromise and loss of system integrity is critical.

Remediation Plan

Immediate Action: Update the wger application to version 2.6 or later to correct the faulty authorization logic.

Proactive Monitoring: Monitor application logs for unusual password reset activity or unauthorized access attempts to user accounts.

Compensating Controls: Deploy a WAF to monitor for suspicious POST requests targeting password reset or user management endpoints.

Exploitation Status

Public Exploit Available: Not explicitly stated (PoC exists per SSVC)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the existence of a PoC and the simplicity of the logic error make this a high-risk target for automated attacks.

Analyst Recommendation

This vulnerability is highly critical due to the ease of account takeover. Organizations must update wger to version 2.6 immediately. Failure to patch will leave user accounts exposed to complete compromise by any user meeting the minor prerequisite conditions.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: 3.0.6 to 3.8.14
---END_METADATA---

Description Summary:
The electerm client is vulnerable to local code execution via maliciously crafted deep links or command-line options.

Executive Summary:
A critical local code execution vulnerability in electerm allows attackers to execute arbitrary commands by tricking users into opening malicious links.

Vulnerability Details

CVE-ID: CVE-2026-43944

Affected Software: electerm

Affected Versions: 3.0.6 to 3.8.14

Vulnerability: The application fails to sanitize inputs provided via deep links or CLI arguments, allowing an attacker to inject and execute arbitrary OS commands when the application is launched.

Business Impact

With a CVSS score of 9.6, this vulnerability allows for local system compromise. An attacker gaining code execution on a user's machine can steal local credentials, access SSH keys, or pivot into internal network segments, causing significant security breaches.

Remediation Plan

Immediate Action: Update electerm to version 3.8.15 or later immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution spawned by the electerm application.

Compensating Controls: Implement endpoint protection (EDR) to detect and block abnormal command-line execution patterns originating from terminal/SSH clients.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires urgent attention, especially for users who frequently interact with external links or handle remote systems. Patching is the only effective way to mitigate the risk of command injection.

---METADATA---
VENDOR: Electerm
PRODUCT: Electerm
AFFECTED_VERSIONS: 3.8.15 and prior
---END_METADATA---

Description Summary:
A vulnerability in Electerm's terminal hyperlink handler allows arbitrary code execution or local file access when a user clicks a malicious link.

Executive Summary:
A critical vulnerability in Electerm allows attackers to achieve arbitrary code execution via a malicious terminal hyperlink, requiring immediate user caution.

Vulnerability Details

CVE-ID: CVE-2026-43941

Affected Software: Electerm

Affected Versions: 3.8.15 and prior

Vulnerability: The application passes terminal output links directly to shell.openExternal without protocol validation, allowing attackers to trigger arbitrary execution or file access.

Business Impact

With a CVSS score of 9.6, this flaw poses a severe risk to end-user workstations. Successful exploitation allows an attacker to gain control over the user's local machine, potentially leading to the theft of SSH keys, configuration files, or other sensitive local information.

Remediation Plan

Immediate Action: Users should exercise extreme caution and avoid clicking untrusted links in terminal outputs until a patch is released.

Proactive Monitoring: Monitor for unusual file access or process execution linked to the terminal application.

Compensating Controls: Use a different terminal client if possible or disable terminal hyperlink features if the application configuration permits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there are no public patches available. This significantly elevates the risk, as the vulnerability is currently unmitigated.

Analyst Recommendation

Maintain heightened vigilance when interacting with terminal sessions. If the software is used in a high-security environment, consider migrating to an alternative terminal client until the vendor releases a security update.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: >= 0.6.10, < 0.8.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
FOSSBilling is susceptible to a code injection vulnerability, allowing an authenticated administrator to execute arbitrary code within the application environment.

Executive Summary:
An authenticated code injection vulnerability in FOSSBilling poses a severe risk of full system compromise for affected installations.

Vulnerability Details

CVE-ID: CVE-2026-43921

Affected Software: FOSSBilling FOSSBilling

Affected Versions: >= 0.6.10, < 0.8.0

Vulnerability: This vulnerability is a Code Injection (CWE-94) flaw that occurs due to improper control of code generation. It requires the attacker to have high-level administrative (PR:H) privileges to successfully trigger the injection.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server, leading to a complete compromise of the billing system and sensitive client data. With a CVSS score of 8.9, this is a high-severity issue that could result in unauthorized data exfiltration, service disruption, and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade to version 0.8.0 or the latest available release as specified by the vendor to remediate this code injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual execution patterns or unauthorized administrative activity that may indicate an attempt to leverage these high-level privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common code injection payloads, limiting the potential for exploitation until an update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the administrative privileges required, this vulnerability represents a significant risk of internal system takeover. Administrators should prioritize upgrading their FOSSBilling instances to the patched version immediately to ensure the integrity and security of the billing environment.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: < 0.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FOSSBilling suffers from an insufficient session expiration vulnerability, which may allow attackers to maintain unauthorized access to user sessions.

Executive Summary:
A critical session management vulnerability in FOSSBilling permits the persistence of unauthorized access due to insufficient session expiration controls.

Vulnerability Details

CVE-ID: CVE-2026-43918

Affected Software: FOSSBilling FOSSBilling

Affected Versions: < 0.8.0

Vulnerability: The application fails to properly expire sessions (CWE-613), allowing an authenticated attacker or a malicious actor who has hijacked a session to maintain access longer than intended. This flaw effectively bypasses standard security logout procedures.

Business Impact

With a CVSS score of 8.7, this vulnerability presents a high risk for unauthorized account takeover and long-term persistence in the system. The inability to reliably terminate sessions means that compromised accounts remain vulnerable until manually invalidated or purged by administrators, increasing the likelihood of unauthorized data access and fraudulent billing transactions.

Remediation Plan

Immediate Action: Update the FOSSBilling installation to version 0.8.0 or later to ensure robust session lifecycle management.

Proactive Monitoring: Monitor for active sessions that persist beyond expected timeframes and inspect logs for concurrent or anomalous login activity from suspicious IP addresses.

Compensating Controls: Enforce short session timeouts and require re-authentication for sensitive operations to mitigate the window of opportunity for session-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining secure session management is fundamental to platform security. Administrators must treat this as a high-priority update to prevent session hijacking and unauthorized persistence. Applying the 0.8.0 patch is the only definitive way to resolve the underlying session expiration defect.