---METADATA---
VENDOR: GeoVision
PRODUCT: GV-VMS
AFFECTED_VERSIONS: V20
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the GV-VMS WebCam Server gvapi endpoint allows remote attackers to gain SYSTEM-level code execution via a specially crafted HTTP Authorization header.

Executive Summary:
A critical stack-based buffer overflow in GeoVision GV-VMS allows unauthenticated remote attackers to achieve full code execution as SYSTEM due to the absence of ASLR.

Vulnerability Details

CVE-ID: CVE-2026-42369

Affected Software: GeoVision GV-VMS

Affected Versions: V20

Vulnerability: The vulnerability occurs in the gvapi endpoint, which fails to perform bounds checking when processing base64-decoded strings from the HTTP Authorization header. This allows an attacker to overwrite the stack, leading to arbitrary code execution.

Business Impact

Given the CVSS score of 10, this is a maximum-severity vulnerability. Exploitation allows an attacker to gain full control over the host running the GV-VMS service with SYSTEM privileges, enabling data theft, lateral movement, and complete compromise of the surveillance network.

Remediation Plan

Immediate Action: Apply the vendor-provided security update for GV-VMS V20 immediately.

Proactive Monitoring: Monitor for anomalous spikes in traffic to the gvapi endpoint and review host logs for unauthorized binary execution or service crashes.

Compensating Controls: If a patch cannot be applied, disable the "WebCam Server" feature if it is not strictly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires urgent remediation. The lack of ASLR in the affected component makes exploitation highly reliable; therefore, administrators must prioritize updating the GV-VMS software to prevent potential system-wide compromise.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: 1.10
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in the GeoVision LPC2011/LPC2211 web interface allows an attacker to execute privileged operations via a crafted HTTP request.

Executive Summary:
A critical privilege escalation vulnerability in GeoVision LPC2011/LPC2211 devices allows unauthorized users to perform administrative actions, potentially leading to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-42368

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: 1.10

Vulnerability: This is a privilege escalation flaw in the web interface. By sending a specially crafted HTTP request, an attacker can bypass standard access controls to execute administrative or privileged functions.

Business Impact

With a CVSS score of 9.9, this vulnerability presents a critical risk. If exploited, an attacker could change device settings, disable security features, or gain unauthorized administrative access, compromising the integrity of the surveillance feed and the device itself.

Remediation Plan

Immediate Action: Update the firmware for the GeoVision LPC2011/LPC2211 to the latest version to address the privilege escalation flaw.

Proactive Monitoring: Review access logs for unauthorized administrative requests and monitor for changes to device configurations that were not performed by authorized personnel.

Compensating Controls: Limit access to the device web management interface to internal, trusted networks and implement multi-factor authentication where supported.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must treat this privilege escalation vulnerability with high urgency. Patching the device firmware is the only reliable way to ensure that administrative functions remain protected from unauthorized access.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A guessable session cookie vulnerability in the GeoVision LPC2011/LPC2211 web interface allows unauthorized access to administrative sessions.

Executive Summary:
A high-severity session management flaw in GeoVision LPC2011/LPC2211 devices allows attackers to hijack administrative sessions, potentially leading to complete device compromise.

Vulnerability Details

CVE-ID: CVE-2026-42365

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: See vendor advisory for affected versions

Vulnerability: The web interface employs guessable session cookies, which can be exploited by an attacker to bypass authentication mechanisms and impersonate an active administrative user.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a high risk to organizational security. Successful session hijacking grants the attacker full control over the device configuration, allowing them to manipulate settings and compromise the device's intended function.

Remediation Plan

Immediate Action: Update the firmware for the affected GeoVision devices to the latest version to address the session management weakness.

Proactive Monitoring: Review web access logs for unusual session cookie patterns or multiple logins from the same session ID.

Compensating Controls: Restrict access to the web interface to trusted management networks and, where possible, use a WAF to monitor for suspicious cookie activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should act promptly to update their GeoVision devices. Session hijacking is a common attack vector, and remediating this flaw is essential to ensuring that administrative sessions remain secure and private.

---METADATA---
VENDOR: GeoVision
PRODUCT: LPC2011/LPC2211
AFFECTED_VERSIONS: 1.10
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 allows arbitrary command execution via crafted DDNS configuration.

Executive Summary:
A critical OS command injection vulnerability in GeoVision LPC2011/LPC2211 devices allows unauthenticated attackers to execute arbitrary commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-42364

Affected Software: GeoVision LPC2011/LPC2211

Affected Versions: 1.10

Vulnerability: This vulnerability is an OS command injection flaw located within the DdnsSetting.cgi script. By providing a specially crafted DDNS configuration value, an attacker can bypass input validation to execute system-level commands.

Business Impact

Successful exploitation of this vulnerability grants the attacker the ability to execute arbitrary commands on the affected hardware, which can result in full system takeover, data exfiltration, or the inclusion of the device into a botnet. Given the CVSS score of 9.9, this represents an extreme risk to network integrity and operational continuity, as compromised surveillance equipment can serve as an entry point into the wider corporate network.

Remediation Plan

Immediate Action: Upgrade the GeoVision LPC2011/LPC2211 firmware to the latest version provided by the vendor to patch the injection vector.

Proactive Monitoring: Inspect system and web access logs for unusual requests directed at DdnsSetting.cgi or unexpected shell execution commands.

Compensating Controls: Implement strict network segmentation for IoT and surveillance devices and utilize a Web Application Firewall (WAF) to filter malicious input strings from configuration requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Organizations utilizing these GeoVision devices must prioritize firmware updates to close the command injection vector and prevent unauthorized remote code execution.

---METADATA---
VENDOR: GeoVision
PRODUCT: GV-IP Device Utility
AFFECTED_VERSIONS: 9.0.5
---END_METADATA---

Description Summary:
GeoVision GV-IP Device Utility 9.0.5 uses insufficient encryption for administrative credentials, allowing attackers to intercept and decrypt sensitive data over local broadcast traffic.

Executive Summary:
An insufficient encryption flaw in the GeoVision GV-IP Device Utility allows local network attackers to intercept and decrypt administrative credentials, potentially leading to full unauthorized device control.

Vulnerability Details

CVE-ID: CVE-2026-42363

Affected Software: GeoVision GV-IP Device Utility

Affected Versions: 9.0.5

Vulnerability: The utility broadcasts administrative credentials over UDP using a weak, obfuscated cryptographic scheme where the symmetric key is transmitted within the same packet. An attacker on the same local network can capture this traffic and easily derive the credentials to gain unauthorized access to the device.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a significant risk to the physical and logical security of the network. An attacker capturing these credentials gains full administrative access to GeoVision devices, enabling them to modify configurations, change network settings, or disable security monitoring, which directly impacts physical site security and system availability.

Remediation Plan

Immediate Action: Update the GV-IP Device Utility to the latest version provided by GeoVision and transition to more secure management protocols if available.

Proactive Monitoring: Monitor local network broadcast traffic for suspicious UDP packets directed toward or originating from management utilities.

Compensating Controls: Implement network segmentation to isolate devices and management workstations, limiting the ability of unauthorized entities to sniff traffic on the same LAN.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw is easily reproducible by an attacker on the same network, the potential for exploitation is high.

Analyst Recommendation

The reliance on security through obscurity for credential transmission is a critical design failure. Administrators should immediately restrict access to the broadcast domain where these devices reside and apply the vendor’s security patches as soon as they are made available to protect administrative credentials from interception.

---METADATA---
VENDOR: Apache
PRODUCT: Airflow
AFFECTED_VERSIONS: Apache Airflow versions from (including) 3.2.0 up to (excluding) 3.2.2.
---END_METADATA---

Description Summary:
A deserialization vulnerability in the Apache Airflow XCom PATCH endpoint allows authenticated users to achieve remote code execution by bypassing key validation.

Executive Summary:
An authenticated remote code execution vulnerability in Apache Airflow 3.2.x requires immediate patching to prevent unauthorized code execution on the triggerer service.

Vulnerability Details

CVE-ID: CVE-2026-42359

Affected Software: Apache Airflow

Affected Versions: Apache Airflow versions from (including) 3.2.0 up to (excluding) 3.2.2.

Vulnerability: This is a deserialization flaw in the PATCH /api/v2/xcomEntries/{key} endpoint. An authenticated user with XCom write permissions can inject reserved key names, bypassing validation to trigger remote code execution on the Airflow triggerer.

Business Impact

The CVSS score of 8.8 reflects the high risk of this vulnerability. As an RCE, it allows a malicious user with legitimate but restricted access to escalate their privileges and execute arbitrary commands on the system. This can lead to the theft of workflow secrets, manipulation of data pipelines, and total compromise of the Airflow environment, which is often a central point of control in data infrastructure.

Remediation Plan

Immediate Action: Upgrade to Apache Airflow version 3.2.2 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Review API access logs for attempts to call the xcomEntries endpoint with reserved keys and monitor the triggerer service for anomalous child processes or unexpected execution patterns.

Compensating Controls: Restrict access to the Airflow API to only trusted identities and network segments, and implement strict RBAC to ensure only necessary users have XCom write permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a fix-bypass for a previous issue, highlighting the need for a robust and updated Airflow installation. Organizations should prioritize updating to 3.2.2 as soon as possible to mitigate the risk of RCE and protect their data pipeline infrastructure.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry
AFFECTED_VERSIONS: 21.12.0 to 26.4.0
---END_METADATA---

Description Summary:
Sentry's SAML SSO implementation is vulnerable to an account takeover flaw when using a malicious SAML Identity Provider.

Executive Summary:
A critical vulnerability in Sentry's SAML SSO implementation allows attackers to take over user accounts by exploiting cross-organization trust.

Vulnerability Details

CVE-ID: CVE-2026-42354

Affected Software: Sentry

Affected Versions: 21.12.0 through 26.4.0

Vulnerability: The SAML SSO logic fails to properly isolate organizations, allowing a malicious SAML Identity Provider to impersonate users from another organization on the same instance.

Business Impact

With a CVSS score of 9.1, this allows attackers to gain unauthorized access to sensitive Sentry data, including API keys and performance metrics. This is a severe threat to the confidentiality of organizational data stored within Sentry.

Remediation Plan

Immediate Action: Update Sentry to version 26.4.1 or later immediately.

Proactive Monitoring: Audit SAML configuration and review logs for suspicious SSO login events, particularly those involving multiple organizations.

Compensating Controls: If immediate patching is not possible, temporarily disable SAML SSO and enforce strong multi-factor authentication for all users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Account takeover vulnerabilities in SSO providers are high-impact events. Organizations should prioritize this update to ensure the integrity of their identity and access management.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: >= 0.6.0, < 0.8.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FOSSBilling contains an unauthenticated payment bypass vulnerability in the IPN callback endpoint, allowing attackers to mark invoices as paid without actual payment.

Executive Summary:
An unauthenticated payment bypass vulnerability in FOSSBilling allows attackers to manipulate invoice statuses and credit accounts without completing financial transactions.

Vulnerability Details

CVE-ID: CVE-2026-42341

Affected Software: FOSSBilling FOSSBilling

Affected Versions: >= 0.6.0, < 0.8.0

Vulnerability: This is a critical authentication bypass and validation error in the IPN callback endpoint. The vulnerability allows an unauthenticated remote attacker to send a crafted HTTP request to mark invoices as paid when the Custom payment adapter is enabled.

Business Impact

The CVSS score of 9.2 highlights the severe financial and operational impact of this vulnerability. Attackers can gain services or products without payment, leading to direct financial loss and potential manipulation of client account records, which could undermine the integrity of the billing and customer management system.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later to implement the necessary authentication checks for payment callbacks.

Proactive Monitoring: Monitor invoice payment logs for anomalies or batches of payments marked as "paid" that lack corresponding transaction records from legitimate payment gateways.

Compensating Controls: Disable the "Custom" payment gateway if it is not strictly required, or restrict access to the /ipn.php endpoint via web server rules to trusted IP addresses only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the attack vector makes it an attractive target for financial fraud.

Analyst Recommendation

This vulnerability represents a significant financial risk to any organization using FOSSBilling for revenue collection. Immediate application of the 0.8.0 update is required to prevent unauthorized service provisioning and financial fraud.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: < 0.8.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
FOSSBilling is susceptible to missing authentication and incorrect authorization vulnerabilities, potentially allowing unauthenticated attackers to manipulate critical system functions.

Executive Summary:
A critical authentication and authorization flaw in FOSSBilling versions prior to 0.8.0 exposes the billing and client management system to unauthorized administrative actions by unauthenticated users.

Vulnerability Details

CVE-ID: CVE-2026-42331

Affected Software: FOSSBilling FOSSBilling

Affected Versions: < 0.8.0

Vulnerability: This vulnerability involves missing authentication for critical functions (CWE-306) and incorrect authorization (CWE-863). These flaws allow unauthenticated remote attackers to perform sensitive operations within the billing system that should be restricted to authorized users.

Business Impact

The ability for unauthenticated users to bypass security controls poses a significant risk to the integrity of client data and billing operations. With a CVSS score of 7.7, this high-severity vulnerability could lead to unauthorized administrative modifications, potentially resulting in financial discrepancies, data exfiltration, or complete loss of control over the application environment.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later immediately to address these security defects.

Proactive Monitoring: Review application access logs for unusual administrative activity or unauthorized requests originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting administrative endpoints until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative access. Administrators should prioritize upgrading to version 0.8.0 to ensure the security and integrity of the FOSSBilling platform.

---METADATA---
VENDOR: Jelmer Vernooij (Dulwich)
PRODUCT: Dulwich
AFFECTED_VERSIONS: 0.20.15-1 (bullseye), 0.21.2-1 (bookworm), 0.22.7-1 (trixie), 1.2.1-1 (forky)
---END_METADATA---

Description Summary:
Dulwich contains an arbitrary file write vulnerability via NTFS-hostile tree entries, enabling remote code execution when checking out malicious Git repositories.

Executive Summary:
A high-severity arbitrary file write vulnerability in the Dulwich library allows for remote code execution when processing untrusted Git repositories on Windows.

Vulnerability Details

CVE-ID: CVE-2026-42305

Affected Software: Dulwich (Python Git implementation)

Affected Versions: 0.20.15-1 (bullseye), 0.21.2-1 (bookworm), 0.22.7-1 (trixie), 1.2.1-1 (forky)

Vulnerability: The vulnerability is an arbitrary file write caused by improper handling of NTFS-hostile tree entries. An unauthenticated attacker can achieve remote code execution when a user performs a clone, fetch, or checkout of a malicious Git repository.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to developers and build systems. Exploitation can lead to full system compromise, as arbitrary code execution allows an attacker to install backdoors, steal source code, or exfiltrate sensitive environment credentials.

Remediation Plan

Immediate Action: Update the Dulwich library to version 1.2.5-1 or later across all affected development environments and CI/CD pipelines.

Proactive Monitoring: Audit Git repository cloning activities and monitor for unusual file system modifications in directory paths associated with version control operations.

Compensating Controls: Avoid cloning or checking out repositories from untrusted or unverified sources, especially when using Windows-based development environments.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 11, 2026, a public exploit is available for this vulnerability. Organizations should consider this an active and high-priority threat.

Analyst Recommendation

Given the existence of a public exploit, the risk of exploitation is immediate. Development teams must prioritize updating the Dulwich package to version 1.2.5-1. Any system currently utilizing older versions to process external Git repositories should be considered at risk of remote code execution.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: 4.14.10 to 4.14.12
---END_METADATA---

Description Summary:
An unauthenticated RCE vulnerability in FastGPT's agent-sandbox component stems from insecure default configurations in the startup script.

Executive Summary:
An unauthenticated remote code execution vulnerability in the FastGPT agent-sandbox allows attackers to gain full control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-42302

Affected Software: FastGPT

Affected Versions: 4.14.10 through 4.14.12

Vulnerability: The entrypoint.sh script incorrectly initializes code-server with --auth none and binds it to all network interfaces, allowing unauthenticated remote access to the sandbox environment.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete system compromise, enabling attackers to execute arbitrary code, steal sensitive data, or pivot into internal infrastructure. This poses a catastrophic risk to confidentiality, integrity, and availability of the platform.

Remediation Plan

Immediate Action: Upgrade FastGPT to version 4.14.13 or later to ensure proper authentication is enforced on the agent-sandbox.

Proactive Monitoring: Review system and network access logs for unauthorized connections to port 8080 or suspicious process execution originating from the sandbox.

Compensating Controls: Immediately restrict network access to the sandbox port (8080) via firewall rules to allow only authorized administrative IPs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of exploitation for this RCE makes it a priority for immediate remediation. Administrators should treat this as a high-urgency update to prevent unauthorized code execution and complete system takeover.

---METADATA---
VENDOR: Postiz
PRODUCT: Postiz
AFFECTED_VERSIONS: Prior to commit da44801
---END_METADATA---

Description Summary:
A "Pwn Request" vulnerability in Postiz allows unauthenticated users to execute arbitrary code via malicious pull requests, leading to credential exfiltration.

Executive Summary:
An unauthenticated arbitrary code execution vulnerability in the Postiz CI/CD workflow allows attackers to exfiltrate highly privileged tokens.

Vulnerability Details

CVE-ID: CVE-2026-42298

Affected Software: Postiz

Affected Versions: Prior to commit da44801

Vulnerability: The Docker build workflow fails to safely handle external inputs, allowing an unauthenticated attacker to inject malicious code during the build process and exfiltrate the GITHUB_TOKEN.

Business Impact

The ability to steal write-access tokens grants attackers control over the repository and potentially the entire software supply chain. Given the CVSS score of 10, this is a critical threat that could lead to widespread unauthorized code commits and severe reputational damage.

Remediation Plan

Immediate Action: Update the affected workflow files to the version provided in commit da44801 or later.

Proactive Monitoring: Audit recent pull requests and review repository audit logs for any unauthorized access or unusual CI/CD pipeline behavior.

Compensating Controls: Implement stricter branch protection rules and limit the permissions of the GITHUB_TOKEN used in automated workflows.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely severe supply chain vulnerability. Security teams must ensure all CI/CD pipelines are patched and that access tokens are rotated if there is any suspicion of compromise.

---METADATA---
VENDOR: Argo
PRODUCT: Workflows
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Argo Workflows contains a high-severity vulnerability that could impact the security of container-native job orchestration on Kubernetes.

Executive Summary:
A security vulnerability in Argo Workflows may allow attackers to compromise the integrity of containerized job orchestration on Kubernetes clusters.

Vulnerability Details

CVE-ID: CVE-2026-42296

Affected Software: Argo Workflows

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects Argo Workflows, an engine used for orchestrating parallel jobs on Kubernetes. The exact technical nature of the exploit is currently being detailed by the vendor.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a high risk to Kubernetes-based operations. Compromise of the workflow engine could allow an attacker to execute arbitrary jobs, steal secrets from the cluster, or disrupt critical business processes that rely on parallel job execution.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to the Argo Workflows controller and associated components.

Proactive Monitoring: Review Kubernetes audit logs for suspicious job submissions, unexpected container executions, or unauthorized access attempts to the Argo API.

Compensating Controls: Implement Kubernetes Network Policies to restrict the communication capabilities of the Argo Workflows pods and minimize the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of Argo Workflows in orchestrating containerized jobs, this vulnerability must be treated with high priority. Administrators should monitor vendor channels for patches and prepare for an urgent deployment to secure their Kubernetes environments.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ChurchCRM is vulnerable to pre-authentication remote code execution via an unsanitized database password in the setup wizard.

Executive Summary:
An incomplete fix for a critical pre-authentication remote code execution vulnerability in ChurchCRM allows unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-42288

Affected Software: ChurchCRM

Affected Versions: Prior to 7.3.2

Vulnerability: This is a pre-authentication remote code execution vulnerability occurring in the setup wizard, caused by improper sanitization of the DB_PASSWORD field; it represents an incomplete fix for CVE-2026-39337.

Business Impact

With a CVSS score of 10, this vulnerability is of the highest severity, enabling an unauthenticated attacker to execute arbitrary code on the underlying server. Successful exploitation could lead to total system compromise, including the theft of sensitive congregant data, unauthorized modification of records, and the use of the server as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.3.2 or later immediately to resolve the incomplete patch.

Proactive Monitoring: Monitor server logs for suspicious process execution or unauthorized attempts to access the setup wizard or database configuration files.

Compensating Controls: If an immediate update is not possible, restrict access to the web interface to trusted IP addresses using a Web Application Firewall (WAF) or network ACLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw as an incomplete patch for a critical RCE makes it a highly attractive target for attackers.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to remote code execution without requiring authentication. Administrators must treat this as a high-priority remediation task and deploy version 7.3.2 without delay.

---METADATA---
VENDOR: LiteLLM
PRODUCT: LiteLLM
AFFECTED_VERSIONS: From version 1.74.2 to before version 1.83.7
---END_METADATA---

Description Summary:
LiteLLM contains a command injection vulnerability in its MCP server test endpoints that, when chained with a host header bypass, enables unauthenticated remote code execution.

Executive Summary:
Actively exploited in the wild, this command injection vulnerability in LiteLLM allows attackers to achieve remote code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-42271

Affected Software: LiteLLM

Affected Versions: From version 1.74.2 to before version 1.83.7

Vulnerability: This is a command injection vulnerability within the MCP server test endpoints. Authenticated users can execute arbitrary commands on the host, and when chained with a Starlette host header validation bypass (CVE-2026-48710), it results in unauthenticated remote code execution.

Business Impact

With a CVSS score of 8.8 and confirmed active exploitation, this vulnerability poses an extreme business risk. Attackers can gain complete control over the AI gateway infrastructure, leading to potential lateral movement, data theft, and the deployment of malicious payloads.

Remediation Plan

Immediate Action: Update LiteLLM to version 1.83.7 immediately to mitigate the command injection risk.

Proactive Monitoring: Monitor system logs for unauthorized process execution and unexpected network outbound connections originating from the LiteLLM service.

Compensating Controls: Use a WAF or reverse proxy to strictly validate host headers and sanitize incoming requests to the MCP server endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jun 9, 2026, there is evidence of active exploitation in the wild. CISA has added this flaw to the KEV catalog, and researchers have confirmed a chained exploit path enabling remote code execution.

Analyst Recommendation

Given the active exploitation and the severity of the impact, this update is critical. All affected organizations should treat this as a top-tier security priority and verify system integrity for signs of previous unauthorized access.

---METADATA---
VENDOR: Jupyter
PRODUCT: JupyterLab
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in JupyterLab, an extensible environment for interactive computing.

Executive Summary:
A critical security vulnerability in JupyterLab requires immediate attention to prevent unauthorized access to interactive computing environments.

Vulnerability Details

CVE-ID: CVE-2026-42266

Affected Software: JupyterLab

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are developing, the vulnerability affects the JupyterLab environment. Such environments are frequent targets due to their ability to execute arbitrary code within the context of the user's session.

Business Impact

An exploit could allow an attacker to gain unauthorized access to an organization's data science environment, potentially exposing proprietary algorithms, sensitive datasets, or credentials stored within notebooks. The 8.8 CVSS score highlights the high-risk nature of this vulnerability.

Remediation Plan

Immediate Action: Update JupyterLab to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor for anomalous notebook activity, unauthorized access to Jupyter instances, or suspicious outbound network connections from the host.

Compensating Controls: Use containerization to isolate individual JupyterLab instances and enforce strict authentication mechanisms for access to the interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this update with high priority to protect sensitive research and data analytics environments. Ensuring that JupyterLab instances are updated and properly isolated is essential to mitigating this risk.

---METADATA---
VENDOR: Avo
PRODUCT: Avo Framework
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Avo framework for Ruby on Rails admin panels contains a security vulnerability that could impact administrative access controls.

Executive Summary:
A high-severity vulnerability within the Avo framework poses a significant risk to the integrity and confidentiality of Ruby on Rails administrative interfaces.

Vulnerability Details

CVE-ID: CVE-2026-42205

Affected Software: Avo (Ruby on Rails Admin Framework)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Avo framework, which is utilized for constructing administrative panels. The flaw potentially allows for unauthorized access or privilege escalation within the admin interface, likely requiring authenticated access to the application.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical as it targets the management layer of business applications. Successful exploitation grants attackers administrative control over the underlying Ruby on Rails application, leading to total data compromise or unauthorized system configuration changes.

Remediation Plan

Immediate Action: Update the Avo framework to the latest patched version identified in the vendor security documentation.

Proactive Monitoring: Audit access logs for the admin panel to identify any suspicious user activity or unauthorized elevation of privileges.

Compensating Controls: Restrict access to administrative panels by IP address or require multi-factor authentication (MFA) at the network or application level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates immediate attention to prevent targeted attacks against administrative backends.

Analyst Recommendation

Given the sensitivity of administrative panels, this vulnerability must be treated with extreme urgency. Administrators should verify their Avo dependency versions and apply the necessary patches to maintain the security posture of their Ruby on Rails infrastructure.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: >= 4.0.0-beta.471, < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to OS command injection, allowing authenticated attackers to execute arbitrary system commands via improper neutralization of special elements.

Executive Summary:
A high-severity OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system-level commands, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-42204

Affected Software: CoolLabs Coolify

Affected Versions: >= 4.0.0-beta.471, < 4.0.0-beta.474

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. It requires an authenticated user to provide malicious input that is not properly sanitized, enabling the execution of unauthorized commands on the underlying host operating system.

Business Impact

The exploitation of this flaw allows an attacker to gain full control over the server hosting Coolify. Given the CVSS score of 8.8, this represents a high risk of total system compromise, including unauthorized data access, modification of application databases, and potential lateral movement into the broader network infrastructure.

Remediation Plan

Immediate Action: Update the Coolify instance to version 4.0.0-beta.474 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution, unexpected shell commands, or unauthorized modifications to critical configuration files.

Compensating Controls: Implement strict network segmentation and ensure the Coolify service runs with the least-privileged user account necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to execute arbitrary OS commands is a critical security failure. Administrators must prioritize upgrading to version 4.0.0-beta.474 without delay. Failure to patch this vulnerability leaves the underlying server environment exposed to full administrative takeover.