---METADATA---
VENDOR: WSO2
PRODUCT: Universal Gateway, Traffic Manager, API Control Plane, API Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The throttling event handling mechanism in multiple WSO2 products fails to properly validate user-supplied JSON payloads, leading to potential denial-of-service conditions.

Executive Summary:
Improper validation of JSON payloads in WSO2 product throttling mechanisms allows unauthenticated attackers to cause a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2026-4249

Affected Software: WSO2 Universal Gateway, Traffic Manager, API Control Plane, and API Manager

Affected Versions: Multiple versions, including WSO2 API Manager 3.2.0 through 4.5.0 and associated gateway/control plane components. Please refer to the vendor advisory for specific patch levels.

Vulnerability: The vulnerability (CWE-707) exists in the throttling event handling mechanism. An unauthenticated attacker can send malformed or malicious JSON payloads that bypass validation, resulting in system instability or a denial-of-service (A).

Business Impact

With a CVSS score of 8.6, this vulnerability poses a significant risk to the availability of critical API infrastructure. Successful exploitation could paralyze API management and traffic routing capabilities, leading to widespread service outages for any applications relying on the WSO2 gateway, resulting in severe business disruption.

Remediation Plan

Immediate Action: Apply the specific security updates provided by WSO2 for your respective product version as detailed in the official security advisory.

Proactive Monitoring: Monitor API Manager and Gateway logs for malformed JSON requests or unexpected error spikes within the throttling event handling processes.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and filter incoming JSON traffic for structural anomalies before it reaches the WSO2 throttling engine.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on WSO2 for API management makes this a high-priority update. Administrators should immediately audit their WSO2 environments against the provided advisory and apply the necessary patches to prevent potential service-impacting attacks.

---METADATA---
VENDOR: Automotive Grade Linux (AGL)
PRODUCT: agl-service-can-low-level
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The AGL agl-service-can-low-level service contains a stack buffer overflow vulnerability within its dependency, the uds-c library.

Executive Summary:
A stack buffer overflow within the AGL CAN service could allow for unauthorized control over vehicle communication buses, posing a severe safety risk.

Vulnerability Details

CVE-ID: CVE-2026-42485

Affected Software: AGL agl-service-can-low-level

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability originates in the underlying uds-c library used by the CAN service. An attacker could exploit this overflow to gain control of the service, potentially injecting malicious commands into the vehicle's CAN bus.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to the functional safety and security of automotive environments. Unauthorized access to the CAN bus can lead to the manipulation of vehicle components, impacting both the operation and safety of the vehicle.

Remediation Plan

Immediate Action: Update the agl-service-can-low-level service and the associated uds-c dependency to the latest secure versions.

Proactive Monitoring: Monitor CAN bus traffic for unexpected or malformed diagnostic messages that could indicate an exploitation attempt.

Compensating Controls: Apply strict input validation at the CAN gateway to ensure only authorized diagnostic requests are processed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability demands immediate attention from automotive software teams. The potential impact on vehicle systems necessitates a rigorous patching cycle and thorough validation of the service's communication interfaces.

---METADATA---
VENDOR: Hashcat
PRODUCT: Hashcat
AFFECTED_VERSIONS: v7.1.2
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the PKZIP hash parser of Hashcat v7.1.2 allows attackers to cause a denial of service or execute arbitrary code via a crafted hash file.

Executive Summary:
A critical heap-based buffer overflow in Hashcat v7.1.2 allows attackers to exploit the PKZIP hash parser for potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-42484

Affected Software: Hashcat Hashcat

Affected Versions: v7.1.2

Vulnerability: This vulnerability affects multiple PKZIP-related modules where user-supplied hex data is decoded into a fixed-size buffer without sufficient length validation. This permits an attacker to overflow the buffer during the hex_to_binary process.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability. Successful exploitation could lead to total system compromise, rendering the machine used for password auditing a target for further lateral movement within a secure network.

Remediation Plan

Immediate Action: Update to the latest version of Hashcat to address the missing input length validation.

Proactive Monitoring: Monitor the Hashcat execution environment for unauthorized file access or unexpected process termination following the ingestion of PKZIP hash files.

Compensating Controls: Implement input validation at the pipeline level to ensure that hash files conform to expected length constraints before being ingested by Hashcat.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability as high priority and update their Hashcat installations immediately. Ensuring all software is at the latest patch level is essential to defending against heap-based memory corruption exploits.

---METADATA---
VENDOR: Hashcat
PRODUCT: Hashcat
AFFECTED_VERSIONS: v7.1.2
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Kerberos hash parser of Hashcat v7.1.2 allows for potential arbitrary code execution via a crafted hash file.

Executive Summary:
A critical heap-based buffer overflow in Hashcat's Kerberos hash parser enables potential arbitrary code execution when processing malicious hash input.

Vulnerability Details

CVE-ID: CVE-2026-42483

Affected Software: Hashcat Hashcat

Affected Versions: v7.1.2

Vulnerability: The vulnerability exists in the module_hash_decode function within Kerberos-related modules. It arises from a lack of upper-bound validation on the account_info_len parameter, leading to a heap-based buffer overflow when data is copied into a fixed-size buffer.

Business Impact

With a CVSS score of 9.8, this vulnerability carries significant risk for security teams using Hashcat for password auditing. An attacker providing a malicious Kerberos hash file could trigger a crash (DoS) or gain unauthorized code execution, compromising the security of the analysis environment.

Remediation Plan

Immediate Action: Update Hashcat to the latest version, which includes the required input validation for hash parsing.

Proactive Monitoring: Review security logs for anomalous behavior in the Hashcat process, particularly when loading Kerberos-formatted hash files.

Compensating Controls: Use strict file input controls to ensure that only trusted, validated hash files are processed by the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Hashcat must apply the vendor-supplied update immediately. By ensuring the software is updated, administrators can mitigate the risk of memory corruption vulnerabilities that could be leveraged for system exploitation.

---METADATA---
VENDOR: Hashcat
PRODUCT: Hashcat
AFFECTED_VERSIONS: v7.1.2
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Hashcat v7.1.2 allows remote code execution or denial of service via crafted rule files or specific rule options.

Executive Summary:
A critical stack-based buffer overflow in Hashcat v7.1.2 poses a severe risk of arbitrary code execution for users processing untrusted rule files or password candidates.

Vulnerability Details

CVE-ID: CVE-2026-42482

Affected Software: Hashcat Hashcat

Affected Versions: v7.1.2

Vulnerability: This vulnerability is a stack-based buffer overflow located in the mangle_to_hex_lower() and mangle_to_hex_upper() functions. It occurs due to inadequate bounds checking when handling password candidates of 128 characters or more, which causes memory corruption during hexadecimal conversion.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to achieve arbitrary code execution on the host running the hash-cracking software. Given the CVSS score of 9.8, this represents a critical risk to system integrity and confidentiality, potentially leading to a full system compromise if the Hashcat process runs with elevated privileges.

Remediation Plan

Immediate Action: Upgrade to the latest version of Hashcat immediately to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor system logs for unexpected process crashes or segmentation faults during hash-cracking operations, which may indicate attempted exploitation.

Compensating Controls: Ensure Hashcat is executed within a containerized or sandboxed environment with restricted permissions to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to the latest version of Hashcat. Organizations should prioritize patching to prevent potential remote code execution scenarios stemming from the processing of malicious rule sets or password lists.

---METADATA---
VENDOR: MixPHP
PRODUCT: Framework
AFFECTED_VERSIONS: 2.x thru 2.2.17
---END_METADATA---

Description Summary:
The MixPHP Framework is vulnerable to unsafe deserialization of session and cache data stored on the filesystem, potentially allowing remote code execution.

Executive Summary:
An unsafe deserialization vulnerability in the MixPHP Framework allows attackers to execute arbitrary code by manipulating session or cache files on the server.

Vulnerability Details

CVE-ID: CVE-2026-42473

Affected Software: MixPHP Framework

Affected Versions: 2.x thru 2.2.17

Vulnerability: This is an unsafe deserialization vulnerability occurring in the FileHandler object. The application performs unserialize() on data retrieved from the filesystem; if an attacker can write malicious serialized objects to these files, they can achieve remote code execution.

Business Impact

Similar to other deserialization flaws, this vulnerability is rated 9.8 on the CVSS scale. It creates a significant risk of full system compromise, where an attacker can execute arbitrary commands, leading to data theft and unauthorized administrative access to the server.

Remediation Plan

Immediate Action: Update to the latest patched version of the MixPHP Framework and ensure all filesystem-based storage is restricted to trusted processes.

Proactive Monitoring: Monitor server logs and file integrity for unauthorized modifications to session or cache files.

Compensating Controls: Use file system permissions to ensure only the application service account can read or write to the specific session/cache directories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of deserialization vulnerabilities, immediate patching is required. Security teams should verify that the application environment is hardened against unauthorized file access to mitigate the risk until the update is deployed.

---METADATA---
VENDOR: MixPHP
PRODUCT: Framework
AFFECTED_VERSIONS: 2.x thru 2.2.17
---END_METADATA---

Description Summary:
The MixPHP Framework is vulnerable to unsafe deserialization of session and cache data stored in Redis, potentially allowing remote code execution.

Executive Summary:
An unsafe deserialization flaw in the MixPHP Framework allows unauthenticated attackers to execute arbitrary code via manipulated Redis cache data.

Vulnerability Details

CVE-ID: CVE-2026-42472

Affected Software: MixPHP Framework

Affected Versions: 2.x thru 2.2.17

Vulnerability: This is an unsafe deserialization vulnerability where the RedisHandler object uses unserialize() on data retrieved from Redis. An attacker with the ability to influence the cache or session data in Redis can trigger this flaw to achieve remote code execution.

Business Impact

The CVSS score of 9.8 highlights the severity of this issue, as remote code execution allows an attacker to gain full control over the application server. This could lead to massive data breaches, destruction of corporate assets, and total loss of system confidentiality and integrity.

Remediation Plan

Immediate Action: Update to the latest version of the MixPHP Framework and verify that session/cache handlers are configured to use secure serialization methods.

Proactive Monitoring: Monitor Redis traffic for suspicious keys or data structures that deviate from standard application usage.

Compensating Controls: Implement strict network access control lists (ACLs) for the Redis instance to prevent unauthorized entities from modifying cached data.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk. Organizations utilizing the MixPHP Framework must prioritize upgrading their software immediately. Furthermore, ensure that the underlying storage (Redis) is properly secured and isolated from untrusted network segments.

---METADATA---
VENDOR: vCluster
PRODUCT: vCluster Platform
AFFECTED_VERSIONS: Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0
---END_METADATA---

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the vCluster Platform allows attackers to execute arbitrary scripts and potentially escalate privileges.

Executive Summary:
A critical XSS vulnerability in the vCluster Platform allows an attacker to execute arbitrary scripts and potentially escalate to Global-Admin privileges.

Vulnerability Details

CVE-ID: CVE-2026-42457

Affected Software: vCluster Platform

Affected Versions: Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0

Vulnerability: The platform fails to sanitize the name field of a templateRef, allowing an attacker with namespace creation permissions to inject malicious scripts that execute in the browser context of other users.

Business Impact

This flaw can be leveraged to compromise administrative sessions, potentially leading to the creation of new Global-Admin users. With a CVSS score of 9.0, this represents a major threat to the multi-tenant security architecture of the Kubernetes platform.

Remediation Plan

Immediate Action: Upgrade the vCluster Platform to the versions listed in the advisory (4.4.3, 4.5.5, 4.6.2, 4.7.1, or 4.8.0).

Proactive Monitoring: Audit platform logs for suspicious activity within the template management UI and monitor for unauthorized creation of administrative accounts.

Compensating Controls: Implement strict RBAC policies to limit the number of users with namespace creation privileges until the platform can be patched.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The potential for privilege escalation makes this a high-priority update. Platform administrators must apply the security patches immediately to maintain the integrity of their multi-tenancy environment.

---METADATA---
VENDOR: Termix
PRODUCT: Termix
AFFECTED_VERSIONS: Prior to 2.1.0
---END_METADATA---

Description Summary:
Termix is vulnerable to OS command injection in its Docker management endpoints, leading to remote code execution.

Executive Summary:
An authenticated remote code execution vulnerability in Termix allows attackers to execute arbitrary OS commands on remote managed servers.

Vulnerability Details

CVE-ID: CVE-2026-42454

Affected Software: Termix

Affected Versions: Prior to 2.1.0

Vulnerability: The application fails to sanitize containerId parameters and WebSocket messages before passing them to shell commands, allowing an authenticated attacker to inject malicious commands.

Business Impact

With a CVSS score of 9.9, this vulnerability grants an authenticated attacker the ability to achieve full remote code execution on all managed servers. This is a catastrophic risk that could lead to widespread system compromise across the entire infrastructure.

Remediation Plan

Immediate Action: Update Termix to version 2.1.0 or later immediately.

Proactive Monitoring: Monitor managed servers for unauthorized shell processes or unusual command execution patterns originating from Termix.

Compensating Controls: Implement strict command allow-lists and sanitize all inputs before they reach the shell execution layer in the Termix backend.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely critical vulnerability that requires immediate remediation. Administrators should ensure that all instances of Termix are patched to prevent the risk of remote server compromise.

---METADATA---
VENDOR: Academy Software Foundation
PRODUCT: OpenColorIO
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the OpenColorIO framework may allow for unauthorized actions during the processing of color management data.

Executive Summary:
The OpenColorIO color management framework is affected by a high-severity vulnerability that could impact the integrity of visual effects and animation workflows.

Vulnerability Details

CVE-ID: CVE-2026-42450

Affected Software: Academy Software Foundation OpenColorIO

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw involves the OpenColorIO framework and may be triggered through the processing of specific data structures; authentication requirements remain dependent on the implementation environment.

Business Impact

Exploitation of this vulnerability could lead to the corruption of color management workflows, potentially impacting production pipelines for visual effects and animation. With a CVSS score of 8.4, the vulnerability poses a risk of service disruption and unauthorized system interaction within high-end creative environments.

Remediation Plan

Immediate Action: Identify all instances of OpenColorIO within the production environment and apply the latest security updates provided by the Academy Software Foundation.

Proactive Monitoring: Monitor system performance and application logs for crashes or unexpected behaviors during the ingestion of complex color profile files.

Compensating Controls: Isolate workstations or render nodes running OpenColorIO from untrusted networks and enforce strict input validation for all files processed by the framework.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should coordinate with IT and creative departments to ensure that all software using the OpenColorIO library is updated. Due to the high severity, proactive patching is essential to prevent potential exploitation in complex production environments.

---METADATA---
VENDOR: Apache
PRODUCT: OpenNLP
AFFECTED_VERSIONS: Before 2
---END_METADATA---

Description Summary:
A Denial of Service (DoS) vulnerability in Apache OpenNLP allows for memory exhaustion via unbounded array allocation during model processing.

Executive Summary:
An unbounded array allocation flaw in Apache OpenNLP creates a risk of Denial of Service, requiring an immediate update to version 2 or later.

Vulnerability Details

CVE-ID: CVE-2026-42440

Affected Software: Apache OpenNLP AbstractModelReader

Affected Versions: Before 2

Vulnerability: The vulnerability exists in the AbstractModelReader component of Apache OpenNLP, which fails to properly validate input, leading to unbounded array allocation. This causes an Out-of-Memory (OOM) condition when processing malicious input files.

Business Impact

With a CVSS score of 7.5, this vulnerability presents a significant risk to the availability of applications utilizing OpenNLP. Successful exploitation could crash services, leading to downtime for systems that rely on the library for natural language processing tasks.

Remediation Plan

Immediate Action: Update the Apache OpenNLP library to version 2 or higher immediately to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor application memory usage for sudden spikes or OOM errors when processing model files from untrusted sources.

Compensating Controls: Implement strict file size and type validation for any inputs processed by the OpenNLP library to prevent the processing of malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers should prioritize upgrading to the latest version of Apache OpenNLP to eliminate this DoS vector. Ensuring that all dependencies are current is essential for maintaining application stability and security.

---METADATA---
VENDOR: CloudSecure
PRODUCT: CloudSecure WP Security
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A broken authentication vulnerability in the CloudSecure WP Security plugin allows unauthenticated attackers to bypass security controls.

Executive Summary:
An unauthenticated broken authentication vulnerability in the CloudSecure WP Security plugin poses a critical risk of unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-42411

Affected Software: CloudSecure WP Security

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin suffers from a broken authentication mechanism that can be exploited by unauthenticated users. This flaw allows attackers to bypass standard login requirements, potentially gaining administrative or elevated privileges within the WordPress environment.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a high risk of total site compromise. An attacker gaining administrative access can exfiltrate sensitive data, inject malicious code, or take full control of the website, leading to significant financial and reputational loss.

Remediation Plan

Immediate Action: Apply the latest security patch or update provided by the vendor for the CloudSecure WP Security plugin.

Proactive Monitoring: Review user account creation logs and login attempts for suspicious activity, particularly from unknown or unauthorized IP addresses.

Compensating Controls: Implement multi-factor authentication (MFA) and restrict administrative access to known IP addresses via server configuration.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Broken authentication is a severe security failure. All administrators using the CloudSecure WP Security plugin must ensure the software is updated to a patched version immediately to prevent unauthorized access and maintain the integrity of their WordPress installation.

---METADATA---
VENDOR: YITH
PRODUCT: WooCommerce Product Add-Ons
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, versions
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability exists in the YITH WooCommerce Product Add-Ons plugin due to improper neutralization of special elements in SQL commands.

Executive Summary:
A critical SQL injection vulnerability in the YITH WooCommerce Product Add-Ons plugin could allow an attacker to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-42383

Affected Software: YITH WooCommerce Product Add-Ons

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, specifically facilitating Blind SQL Injection. This flaw allows an attacker to interact with the backend database in an unauthorized manner.

Business Impact

This vulnerability poses a significant risk to data confidentiality, as attackers could potentially exfiltrate customer data, credentials, or sensitive business information. With a CVSS score of 7.6, the risk is classified as High, necessitating rapid remediation to prevent unauthorized data exposure and potential regulatory compliance violations.

Remediation Plan

Immediate Action: Update the YITH WooCommerce Product Add-Ons plugin to the latest version provided by the vendor.

Proactive Monitoring: Enable database query logging and monitor for anomalous patterns or large volumes of unexpected queries that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection remains a primary vector for data theft in web applications. Administrators are strongly urged to verify their current plugin version and apply the vendor patch immediately to mitigate the risk of data compromise.

---METADATA---
VENDOR: Elated-Themes
PRODUCT: Audrey
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated Local File Inclusion (LFI) vulnerability in the Audrey theme allows remote attackers to read arbitrary files from the server's filesystem.

Executive Summary:
A critical Local File Inclusion vulnerability in the Elated-Themes Audrey theme allows unauthenticated attackers to access sensitive server files, threatening overall system integrity.

Vulnerability Details

CVE-ID: CVE-2026-42382

Affected Software: Elated-Themes Audrey

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability consists of a Local File Inclusion (LFI) flaw that can be triggered by unauthenticated users. The vulnerability allows an attacker to access files outside the intended web directory, potentially exposing sensitive application logic or environment variables.

Business Impact

The ability for an unauthenticated user to read arbitrary files presents a significant security risk, including the compromise of sensitive credentials and configuration data. With a CVSS score of 8.1, the potential for unauthorized data disclosure and subsequent escalation of privileges warrants immediate attention to protect business assets.

Remediation Plan

Immediate Action: Update the Audrey theme to the latest version provided by Elated-Themes to patch the underlying file inclusion vulnerability.

Proactive Monitoring: Monitor server logs for suspicious URL patterns, specifically those attempting to navigate the file system using path traversal characters.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that exhibit signs of path traversal or unauthorized file access attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a high-risk entry point into the server environment. It is imperative that security teams prioritize updating the affected theme to the most recent version to mitigate the risk of unauthorized file access and potential further exploitation.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-456U
AFFECTED_VERSIONS: Hardware Revision A1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-456U Rev A1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-456U allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42376

Affected Software: D-Link DIR-456U

Affected Versions: Hardware Revision A1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-456U device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-600L
AFFECTED_VERSIONS: Hardware Revision A1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-600L Rev A1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-600L allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42375

Affected Software: D-Link DIR-600L

Affected Versions: Hardware Revision A1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-600L device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-600L
AFFECTED_VERSIONS: Hardware Revision B1 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-600L Rev B1 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full root administrative control.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-600L allows unauthorized remote attackers to gain full root-level administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-42374

Affected Software: D-Link DIR-600L

Affected Versions: Hardware Revision B1 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor utilizing a static username and password combination. This allows an unauthenticated attacker on the local network to bypass authentication mechanisms and execute commands with root privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Because the device has reached End-of-Life (EOL), it will not receive security updates, leaving the network permanently exposed to potential lateral movement, data interception, or the use of the device as a persistent foothold for attackers within the internal network.

Remediation Plan

Immediate Action: As this product is EOL and no patch will be provided, the only effective remediation is to retire and decommission the affected D-Link DIR-600L device immediately.

Proactive Monitoring: Monitor network traffic for unauthorized telnet connections (port 23) originating from or directed toward the device.

Compensating Controls: If immediate replacement is not possible, place the device on an isolated, restricted VLAN and disable all telnet access via firewall rules to block unauthorized inbound connections.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—a hardcoded credential accessible to any local network user—the potential for exploitation is extremely high.

Analyst Recommendation

Given that the vendor has declared this device End-of-Life, there is no path to remediation through patching. Organizations must prioritize the replacement of this hardware with a supported product to eliminate the risk of unauthorized administrative access and potential network-wide compromise.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-605L
AFFECTED_VERSIONS: Hardware Revision B2 (End-of-Life)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
D-Link DIR-605L revision B2 contains a hardcoded telnet backdoor, allowing unauthenticated attackers on the local network to gain full administrative root access.

Executive Summary:
A critical hardcoded backdoor in the D-Link DIR-605L router exposes the device to complete administrative compromise by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-42373

Affected Software: D-Link DIR-605L

Affected Versions: Hardware Revision B2 (End-of-Life)

Vulnerability: The device features a hardcoded telnet backdoor with static credentials, enabling an unauthenticated attacker on the local network to obtain a root shell via the telnet daemon.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker full administrative control over the network gateway, potentially leading to total network interception, internal reconnaissance, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Given the device has reached End-of-Life (EOL) and will not receive a patch, the only effective remediation is to retire and replace the hardware immediately.

Proactive Monitoring: Monitor network traffic for unexpected telnet (port 23) connections and audit logs for successful logins originating from unauthorized internal IP addresses.

Compensating Controls: If immediate replacement is impossible, disable the telnet service via the device management interface or use an access control list (ACL) to strictly limit network access to the router’s management ports.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the lack of vendor support, the potential for exploitation is high.

Analyst Recommendation

The presence of a hardcoded backdoor in network infrastructure represents an unacceptable security risk. We strongly recommend decommissioning all affected D-Link DIR-605L units immediately to eliminate this vector of compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-VMS
AFFECTED_VERSIONS: 20.0.2
---END_METADATA---

Description Summary:
A stack overflow in the WebCam Server Login functionality of GeoVision GV-VMS 20.0.2 allows unauthenticated remote attackers to achieve arbitrary code execution.

Executive Summary:
A critical stack overflow vulnerability in the GeoVision GV-VMS WebCam Server allows unauthenticated attackers to execute arbitrary code via a crafted HTTP request.

Vulnerability Details

CVE-ID: CVE-2026-42370

Affected Software: GeoVision GV-VMS

Affected Versions: 20.0.2

Vulnerability: This is a stack overflow vulnerability found in the WebCam Server's login process. An attacker can send a malicious, unauthenticated HTTP request that triggers the overflow, leading to potential code execution.

Business Impact

A CVSS score of 9.0 confirms the critical nature of this flaw. Successful exploitation allows an attacker to gain control over the GV-VMS system, which could result in unauthorized surveillance access, system disruption, or lateral movement into the network.

Remediation Plan

Immediate Action: Upgrade to the latest version of GeoVision GV-VMS to remediate the stack overflow vulnerability.

Proactive Monitoring: Monitor for abnormal traffic patterns targeting the WebCam Server login page and check for service instability or unexpected process restarts.

Compensating Controls: Use a WAF to restrict access to the WebCam Server interface and block requests containing unusually large payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated remote code execution, this vulnerability poses a severe risk. Organizations should prioritize updating their GV-VMS deployments and ensure that management interfaces are not exposed to untrusted networks.