---METADATA---
VENDOR: Chartbrew
PRODUCT: Chartbrew
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability within the Chartbrew web application may allow attackers to exploit its database and API integration features.

Executive Summary:
A high-severity vulnerability in Chartbrew could potentially compromise the security of connected organizational data sources.

Vulnerability Details

CVE-ID: CVE-2026-40601

Affected Software: Chartbrew

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Chartbrew platform, which connects to various data sources. The flaw may permit unauthorized interactions with these sources, potentially leading to unauthorized data retrieval or administrative actions.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to the organization. Successful exploitation could lead to data breaches or the unauthorized modification of data, impacting both the security and the reliability of business analytics provided by the platform.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches immediately to address the underlying vulnerability.

Proactive Monitoring: Monitor for unusual query patterns or unexpected connections to external databases that deviate from normal operational baselines.

Compensating Controls: If patching is delayed, use a WAF to restrict traffic and monitor for anomalous behavior targeting the application's API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

System administrators must act quickly to update the Chartbrew application. Proactive maintenance and prompt application of security updates are essential to mitigating this high-severity risk.

---METADATA---
VENDOR: Chartbrew
PRODUCT: Chartbrew
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in Chartbrew that may allow unauthorized access or impact data integrity due to its direct integration with databases and APIs.

Executive Summary:
Chartbrew is affected by a high-severity vulnerability that could allow unauthorized actors to interact with sensitive connected databases and APIs.

Vulnerability Details

CVE-ID: CVE-2026-40600

Affected Software: Chartbrew

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an issue within the Chartbrew application framework, which acts as a bridge to various data sources. While specific authentication requirements are not detailed, the nature of the software suggests potential for unauthorized data access or manipulation if exploited.

Business Impact

Given the CVSS score of 8.1, this vulnerability poses a significant risk to the confidentiality and integrity of organizational data. Because Chartbrew connects directly to critical databases and APIs, a successful exploit could lead to unauthorized data exfiltration, service disruption, or complete compromise of the underlying data infrastructure.

Remediation Plan

Immediate Action: Review the official Chartbrew security advisories and apply the latest patches or version updates as soon as they become available.

Proactive Monitoring: Audit application access logs for unusual patterns, such as unauthorized API calls or unexpected queries originating from the Chartbrew service account.

Compensating Controls: Implement strict network segmentation and restrict database access credentials used by Chartbrew to the minimum necessary privileges required for operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the product's function as a data aggregator, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Chartbrew should prioritize this alert. Given the high CVSS score, immediate patching is recommended to prevent potential unauthorized access to sensitive backend data sources.

---METADATA---
VENDOR: Chartbrew
PRODUCT: Chartbrew
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An identified vulnerability in Chartbrew may expose connected databases or APIs to unauthorized access or manipulation.

Executive Summary:
Chartbrew is subject to a security vulnerability that requires prompt attention to protect sensitive data connected to the application.

Vulnerability Details

CVE-ID: CVE-2026-40595

Affected Software: Chartbrew

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the core functionality of the Chartbrew web application. It involves potential weaknesses in how the application manages connections to external databases and APIs, which could be exploited to gain unauthorized access.

Business Impact

The CVSS score of 7.5 indicates a high-severity risk. Exploitation of this flaw could result in unauthorized access to sensitive business intelligence data or the alteration of chart outputs, which could lead to incorrect decision-making and potential loss of data confidentiality.

Remediation Plan

Immediate Action: Upgrade to the latest version of Chartbrew as specified by the vendor's security documentation.

Proactive Monitoring: Review application and server logs for signs of suspicious activity or unexpected modifications to data connections.

Compensating Controls: Apply principle-of-least-privilege to all service accounts associated with Chartbrew to limit the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize patching this vulnerability to ensure that their data visualization pipelines remain secure. Immediate remediation is necessary to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: AWS
PRODUCT: excel-mcp-server
AFFECTED_VERSIONS: Up to and including 0.1.7
---END_METADATA---

Description Summary:
A path traversal vulnerability in excel-mcp-server allows unauthenticated remote attackers to read, write, and overwrite arbitrary files on the host filesystem.

Executive Summary:
An unauthenticated path traversal vulnerability in the AWS excel-mcp-server enables remote attackers to achieve full filesystem access, posing a critical threat to host integrity.

Vulnerability Details

CVE-ID: CVE-2026-40576

Affected Software: AWS excel-mcp-server

Affected Versions: Up to and including 0.1.7

Vulnerability: The application fails to properly validate file paths within its tool handlers, allowing an unauthenticated attacker to escape the designated directory and perform arbitrary file operations.

Business Impact

Successful exploitation allows an unauthenticated attacker to read sensitive configuration files, modify application logic, or overwrite system files, leading to a complete compromise of the host environment. Given the CVSS score of 9.4, this vulnerability represents an extreme risk to data confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade to version 0.1.8 or later immediately to resolve the path validation flaws.

Proactive Monitoring: Inspect server logs for unusual file access patterns or attempts to access system directories outside the intended EXCEL_FILES_PATH.

Compensating Controls: If immediate patching is not possible, restrict network access to the MCP server transport interface using firewall rules or ACLs to ensure only authorized clients can reach the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing the excel-mcp-server in SSE or Streamable-HTTP mode should prioritize the transition to version 0.1.8 to prevent unauthorized remote file manipulation.

---METADATA---
VENDOR: OAuth2 Proxy
PRODUCT: OAuth2 Proxy
AFFECTED_VERSIONS: 7.5.0 through 7.15.1
---END_METADATA---

Description Summary:
OAuth2 Proxy is vulnerable to authentication bypass when configured with specific headers and skip-auth rules, allowing unauthorized access to protected routes.

Executive Summary:
A header-spoofing vulnerability in OAuth2 Proxy allows unauthenticated attackers to bypass authentication and access protected backend resources.

Vulnerability Details

CVE-ID: CVE-2026-40575

Affected Software: OAuth2 Proxy

Affected Versions: 7.5.0 through 7.15.1

Vulnerability: The application trusts user-supplied X-Forwarded-Uri headers, allowing attackers to manipulate how the proxy evaluates authentication rules against backend routes.

Business Impact

This flaw permits unauthenticated access to sensitive backend applications, potentially exposing private data or administrative interfaces. The CVSS score of 9.1 underscores the critical risk to the security boundary of the protected application infrastructure.

Remediation Plan

Immediate Action: Upgrade OAuth2 Proxy to version 7.15.2 or later.

Proactive Monitoring: Review logs for suspicious header patterns where X-Forwarded-Uri does not match the intended request path.

Compensating Controls: Configure the upstream load balancer or reverse proxy to strip or overwrite any client-provided X-Forwarded-Uri headers before they reach the OAuth2 Proxy instance.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Upgrade to the latest version immediately. If an immediate upgrade is not feasible, implement the recommended configuration changes at the load balancer level to strip the untrusted header.

---METADATA---
VENDOR: NovumOS
PRODUCT: NovumOS
AFFECTED_VERSIONS: Prior to 0.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability exists in NovumOS versions prior to 0.24 due to insufficient memory mapping validation in the Syscall 15 interface.

Executive Summary:
A local privilege escalation vulnerability in NovumOS allows user-mode processes to overwrite critical kernel structures, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40572

Affected Software: NovumOS NovumOS

Affected Versions: Prior to 0.24

Vulnerability: The vulnerability exists in the MemoryMapRange (Syscall 15) implementation, which fails to validate memory mapping requests against restricted kernel address spaces. A local attacker can map sensitive structures like the IDT, GDT, or TSS into user space, allowing for unauthorized modification of kernel interrupt handlers.

Business Impact

With a CVSS score of 9.0, this vulnerability allows a local, unprivileged attacker to elevate to kernel-level privileges. This effectively bypasses all system security boundaries, enabling the attacker to install rootkits, steal sensitive kernel-mode data, or disable security auditing mechanisms, resulting in a total loss of system integrity.

Remediation Plan

Immediate Action: Update NovumOS to version 0.24 or later to implement proper memory range validation within the Syscall 15 interface.

Proactive Monitoring: Monitor system logs for unusual kernel-mode activity or unexpected modifications to system interrupt handlers that could indicate exploitation of memory mapping.

Compensating Controls: Restrict local access to systems running NovumOS to trusted users only, as the vulnerability requires local execution to trigger the privilege escalation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to escalate privileges to the kernel level makes this an extremely dangerous vulnerability. Organizations relying on NovumOS must update to version 0.24 immediately to patch the memory mapping flaw and prevent local attackers from gaining full control of the operating system.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Prior to 1.8.213
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeScout versions prior to 1.8.213 contain a mass assignment vulnerability in mailbox connection settings, allowing authenticated admins to overwrite sensitive configuration fields.

Executive Summary:
A mass assignment vulnerability in FreeScout allows an authenticated administrator to perform unauthorized mailbox modifications, leading to persistent email exfiltration and account compromise.

Vulnerability Details

CVE-ID: CVE-2026-40569

Affected Software: FreeScout

Affected Versions: Prior to 1.8.213

Vulnerability: The application fails to implement field allowlisting in connectionIncomingSave() and connectionOutgoingSave() methods, enabling an authenticated admin user to inject unauthorized parameters into the Mailbox model.

Business Impact

Successful exploitation allows an attacker to silently enable BCC forwarding, redirect SMTP traffic, or inject phishing content into email signatures. Given the CVSS score of 9.0, this vulnerability poses a severe risk of data exfiltration and loss of communication integrity, potentially leading to regulatory non-compliance and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade the FreeScout installation to version 1.8.213 or later immediately to enforce proper parameter validation.

Proactive Monitoring: Review application logs for unusual administrative activity and monitor outbound mail server configurations for unexpected BCC addresses or SMTP relay changes.

Compensating Controls: Implement strict administrative access controls and utilize a Web Application Firewall (WAF) to inspect POST requests for unexpected parameters in the mailbox settings endpoints.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security oversight in the application's configuration management. Administrators should prioritize updating to version 1.8.213 immediately to close the mass assignment vector, as the silent nature of the injection makes detection difficult without proactive audit logging.

---METADATA---
VENDOR: OpenViking
PRODUCT: VikingBot
AFFECTED_VERSIONS: Prior to commit c7bb167
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenViking VikingBot contains an authentication bypass in the OpenAPI route surface, allowing unauthenticated remote attackers to execute privileged bot-control functions.

Executive Summary:
An authentication bypass in OpenViking VikingBot permits unauthenticated remote attackers to execute privileged commands and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-40525

Affected Software: OpenViking VikingBot

Affected Versions: Prior to commit c7bb167

Vulnerability: This is an authentication bypass vulnerability where the API fails to enforce security checks when the api_key configuration is unset, allowing unauthenticated attackers to interact with the system as an administrator.

Business Impact

Successful exploitation allows an unauthorized party to manipulate bot sessions, submit arbitrary prompts, and access sensitive downstream integrations and secrets. With a CVSS score of 9.1, this vulnerability poses a significant risk of data exfiltration and unauthorized control over automated processes, potentially leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update VikingBot to the latest version or apply the fix provided in commit c7bb167 immediately.

Proactive Monitoring: Audit application logs for API requests missing the X-API-Key header or unexpected requests originating from unauthorized network segments.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests to the OpenAPI route surface that do not contain valid authentication headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security failure in access control. Administrators must ensure the application is updated immediately and that api_key configurations are verified as active and enforced to prevent unauthorized access to the bot-control surface.

---METADATA---
VENDOR: FrontAccounting
PRODUCT: FrontAccounting
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability in FrontAccounting before version 2 may facilitate unauthorized system impact or data access.

Executive Summary:
A high-severity vulnerability in FrontAccounting versions prior to 2 creates a significant security risk, necessitating immediate attention to prevent potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-40524

Affected Software: FrontAccounting FrontAccounting

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to an unspecified security weakness in the application logic that could be leveraged to bypass security controls. The flaw is rated high-severity, indicating a significant risk to the integrity and availability of the application.

Business Impact

The CVSS score of 8.1 reflects the serious nature of this flaw, which threatens the stability and security of the accounting system. Successful exploitation could lead to unauthorized modification of financial records, disruption of business operations, and unauthorized access to sensitive corporate information.

Remediation Plan

Immediate Action: Update the FrontAccounting installation to the most current version provided by the vendor to resolve the reported vulnerability.

Proactive Monitoring: Regularly audit user privileges and monitor system logs for suspicious activity that may indicate an attempt to exploit application-level vulnerabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) to provide virtual patching and to monitor for unauthorized requests aimed at the application's core modules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of an active exploit, the high CVSS score dictates that remediation should be performed as a matter of urgency.

Analyst Recommendation

Due to the sensitivity of the data managed by FrontAccounting, this vulnerability must be addressed immediately. IT administrators should verify their current version and apply the vendor-recommended security updates to ensure the environment remains protected against potential exploitation.

---METADATA---
VENDOR: FrontAccounting
PRODUCT: FrontAccounting
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in FrontAccounting before version 2 may expose the application to unauthorized access or security bypass.

Executive Summary:
FrontAccounting versions prior to 2 are vulnerable to a high-severity flaw that could lead to unauthorized system access and data exposure.

Vulnerability Details

CVE-ID: CVE-2026-40523

Affected Software: FrontAccounting FrontAccounting

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the application's security architecture that may allow an attacker to bypass authentication mechanisms. The specific entry point requires further investigation, but the potential for unauthorized access is confirmed by the high severity rating.

Business Impact

With a CVSS score of 8.1, this vulnerability presents a substantial risk to financial data integrity and system confidentiality. Unauthorized access could result in the exfiltration of sensitive accounting data, potential regulatory non-compliance, and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade FrontAccounting to the latest secure version immediately to eliminate the underlying security flaw.

Proactive Monitoring: Review application logs for anomalous login attempts or unusual administrative activities that deviate from standard user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated signatures to block common exploit patterns targeting accounting software frameworks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity score necessitates a proactive approach to patching and environment hardening.

Analyst Recommendation

Security teams must prioritize the remediation of this vulnerability to protect sensitive financial information. Immediate application of vendor-supplied updates is the only definitive way to mitigate this high-risk threat.

---METADATA---
VENDOR: FrontAccounting
PRODUCT: FrontAccounting
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in FrontAccounting versions prior to 2, which may allow for unauthorized access or system compromise.

Executive Summary:
A high-severity vulnerability in FrontAccounting versions prior to 2 exposes the application to potential unauthorized access and system-level exploitation.

Vulnerability Details

CVE-ID: CVE-2026-40522

Affected Software: FrontAccounting FrontAccounting

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an unauthenticated security flaw affecting versions of FrontAccounting prior to 2. The lack of proper input validation or access control mechanisms allows an attacker to interact with the system without valid credentials, potentially leading to full system compromise.

Business Impact

With a CVSS score of 7.1, this vulnerability poses a high risk to the confidentiality, integrity, and availability of accounting data stored within the system. Successful exploitation could allow an attacker to exfiltrate financial records or manipulate accounting entries, resulting in severe financial and regulatory consequences for the organization.

Remediation Plan

Immediate Action: Upgrade the FrontAccounting installation to version 2 or the latest stable release provided by the vendor.

Proactive Monitoring: Monitor system logs for unauthorized login attempts or unusual administrative activity that deviates from established user behavior baselines.

Compensating Controls: Implement strict network-level access controls to restrict exposure of the accounting portal to trusted internal networks or VPNs only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate action is required to upgrade the affected software. Given the critical nature of financial systems, organizations should perform a thorough audit of their instance to ensure that no unauthorized modifications have occurred prior to applying the security update.

---METADATA---
VENDOR: FrontAccounting
PRODUCT: FrontAccounting
AFFECTED_VERSIONS: FrontAccounting before 2.4.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler allowing authenticated remote code execution.

Executive Summary:
A critical path traversal vulnerability in FrontAccounting allows authenticated attackers to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-40521

Affected Software: FrontAccounting FrontAccounting

Affected Versions: FrontAccounting before 2.4.20

Vulnerability: This vulnerability exists in the attachment upload handler, where the application fails to properly sanitize the unique_name parameter. By supplying directory traversal sequences, an authenticated attacker can write arbitrary PHP files to the web root and execute them as the web server user.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the application server, leading to potential data exfiltration, total system compromise, and significant operational downtime.

Remediation Plan

Immediate Action: Upgrade FrontAccounting to version 2.4.20 or later to apply the necessary path validation fixes.

Proactive Monitoring: Monitor server logs for suspicious file upload activity or requests containing directory traversal patterns (e.g., ../) in the attachments directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal sequences and restrict file uploads to expected types/extensions.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 30, 2026, public Proof-of-Concept (PoC) code is available for this vulnerability. Given the ease of achieving remote code execution once authentication is obtained, immediate patching is mandatory.

Analyst Recommendation

The availability of public exploit code significantly increases the risk of active targeting. Organizations running FrontAccounting must prioritize upgrading to version 2.4.20 immediately to neutralize this threat and prevent unauthorized code execution.

---METADATA---
VENDOR: Creolabs
PRODUCT: Gravity
AFFECTED_VERSIONS: Before 0.9.6
---END_METADATA---

Description Summary:
Creolabs Gravity before 0.9.6 is vulnerable to a heap buffer overflow in the VM execution engine, allowing arbitrary code execution.

Executive Summary:
A critical heap buffer overflow in the Creolabs Gravity VM allows attackers to achieve arbitrary code execution through crafted scripts.

Vulnerability Details

CVE-ID: CVE-2026-40504

Affected Software: Creolabs Gravity

Affected Versions: Before 0.9.6

Vulnerability: Insufficient bounds checking in the 'gravity_fiber_reassign()' function and the 'gravity_vm_exec' function leads to heap memory corruption. Attackers can exploit this by providing crafted scripts to execute arbitrary code on the host system.

Business Impact

The CVSS score of 9.8 signifies a severe risk. If an application uses the Gravity engine to process untrusted scripts, an attacker could achieve complete system compromise, bypassing existing security boundaries.

Remediation Plan

Immediate Action: Upgrade to Creolabs Gravity version 0.9.6 or later.

Proactive Monitoring: Monitor applications utilizing the Gravity engine for anomalous crashes or unexpected script processing behavior.

Compensating Controls: If upgrading is not possible, implement strict sandboxing or restrict the types of scripts allowed for execution by the VM.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Memory corruption vulnerabilities in execution engines are high-priority. Organizations should update their dependencies to version 0.9.6 immediately to eliminate the risk of arbitrary code execution.

---METADATA---
VENDOR: SAIL
PRODUCT: SAIL library
AFFECTED_VERSIONS: Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The TGA codec in the SAIL image processing library contains an asymmetric bounds check error in the RLE decoder, leading to a heap-based buffer overflow.

Executive Summary:
A critical heap-based buffer overflow in the SAIL library TGA codec allows unauthenticated remote attackers to execute arbitrary code or crash applications.

Vulnerability Details

CVE-ID: CVE-2026-40494

Affected Software: SAIL library

Affected Versions: Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302

Vulnerability: This is a memory corruption vulnerability within the TGA codec's raw-packet path. An attacker can supply a malformed TGA image to trigger an out-of-bounds write of up to 496 bytes of controlled data to the heap.

Business Impact

The CVSS score of 9.8 reflects the high probability of successful exploitation and the potential for full system compromise. Successful execution of this vulnerability could lead to unauthorized data access, complete application failure, or the execution of malicious code within the context of the service processing the image.

Remediation Plan

Immediate Action: Update the SAIL library to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 or newer.

Proactive Monitoring: Monitor application logs for unexpected segmentation faults or service restarts, which may indicate attempted exploitation.

Compensating Controls: Deploy image scanning and validation tools at the perimeter to inspect incoming files for malformed TGA structures before processing.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this memory corruption flaw, organizations utilizing the SAIL library must prioritize patching. Update the library immediately to the provided commit to eliminate the risk of heap manipulation and potential remote code execution.

---METADATA---
VENDOR: SAIL
PRODUCT: SAIL library
AFFECTED_VERSIONS: Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The PSD codec in the SAIL image library incorrectly calculates buffer allocation for LAB mode images, resulting in a deterministic heap buffer overflow during pixel processing.

Executive Summary:
A critical heap buffer overflow in the SAIL library PSD codec allows unauthenticated remote attackers to trigger memory corruption via malformed LAB mode images.

Vulnerability Details

CVE-ID: CVE-2026-40493

Affected Software: SAIL library

Affected Versions: Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979

Vulnerability: The vulnerability stems from an incorrect calculation of bytes-per-pixel for specific PSD LAB mode configurations. This leads to an undersized allocation, causing every pixel write operation to overflow the allocated heap buffer.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to any system using the SAIL library to parse untrusted images. Exploitation likely results in application instability or arbitrary code execution, potentially leading to a total compromise of the host system.

Remediation Plan

Immediate Action: Update the SAIL library to commit c930284445ea3ff94451ccd7a57c999eca3bc979 or newer.

Proactive Monitoring: Review system logs for recurring crashes or abnormal memory usage patterns in services that handle user-uploaded PSD files.

Compensating Controls: Use a Web Application Firewall (WAF) or file sanitizer to block or validate PSD files before they reach the backend processing engine.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The deterministic nature of this overflow makes it a highly reliable target for exploitation. Administrators should treat this as a high-priority update and ensure all affected instances of the SAIL library are patched immediately to secure against potential memory-based attacks.

---METADATA---
VENDOR: SAIL
PRODUCT: SAIL library
AFFECTED_VERSIONS: Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error in the XWD codec of the SAIL image library causes a heap-based buffer overflow by using mismatched pixel depth and bit-swap logic.

Executive Summary:
A critical heap buffer overflow in the SAIL library XWD codec allows unauthenticated remote attackers to perform out-of-bounds memory access via malformed XWD files.

Vulnerability Details

CVE-ID: CVE-2026-40492

Affected Software: SAIL library

Affected Versions: Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02

Vulnerability: The XWD codec miscalculates memory access during byte-swapping when the pixmap_depth and bits_per_pixel values are inconsistent. This causes the application to read and write significantly beyond the allocated buffer boundaries.

Business Impact

The CVSS score of 9.8 highlights the severity of this memory corruption vulnerability. Successful exploitation could allow an attacker to read sensitive memory or execute arbitrary commands with the privileges of the application, leading to significant security breaches.

Remediation Plan

Immediate Action: Update the SAIL library to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 or newer.

Proactive Monitoring: Monitor for suspicious application behavior, such as unauthorized memory access errors or unexpected service termination when parsing image data.

Compensating Controls: Implement strict input validation or sandboxing for any process that handles XWD image formats to contain potential memory corruption attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity and availability of systems utilizing the SAIL library. Immediate patching is strongly advised to prevent exploitation through malformed XWD files, which could be easily delivered via standard user-upload vectors.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ChurchCRM's backup restore functionality allows authenticated administrators to upload malicious files, leading to remote code execution.

Executive Summary:
A critical remote code execution vulnerability in ChurchCRM allows authenticated administrators to execute arbitrary code via malicious backup archives.

Vulnerability Details

CVE-ID: CVE-2026-40484

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.2.0

Vulnerability: The application fails to sanitize file extensions during the restoration process, allowing an authenticated administrator to upload a PHP webshell. Furthermore, the absence of CSRF token validation permits attackers to trigger this process via cross-site request forgery.

Business Impact

Successful exploitation results in complete system compromise, enabling an attacker to execute arbitrary code with the privileges of the web server. Given the CVSS score of 9.1, this vulnerability poses a severe threat, potentially leading to unauthorized data access, lateral movement within the network, and total loss of system integrity.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 7.2.0 or later immediately to patch the file upload and CSRF vulnerabilities.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the Images/ directory or unusual patterns in backup restoration activity.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and verify the origin of administrative requests to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical risk to the confidentiality and integrity of the ChurchCRM platform. Administrators must prioritize applying the version 7.2.0 update to eliminate the code execution vector and secure the backup restoration endpoint.

---METADATA---
VENDOR: Thymeleaf
PRODUCT: Thymeleaf
AFFECTED_VERSIONS: 3.1.3.RELEASE and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Thymeleaf versions 3.1.3.RELEASE and prior are susceptible to Server-Side Template Injection (SSTI) due to insufficient neutralization of expression syntax.

Executive Summary:
A critical Server-Side Template Injection vulnerability in Thymeleaf allows unauthenticated remote attackers to execute unauthorized expressions.

Vulnerability Details

CVE-ID: CVE-2026-40478

Affected Software: Thymeleaf

Affected Versions: 3.1.3.RELEASE and prior

Vulnerability: This is an expression injection vulnerability where the engine fails to properly sanitize specific syntax patterns, allowing an unauthenticated remote attacker to bypass protections if the application passes unvalidated input to the engine.

Business Impact

An SSTI vulnerability allows for remote code execution, which can lead to complete server compromise and unauthorized access to backend data. With a CVSS score of 9.0, this represents a critical risk to the confidentiality, integrity, and availability of any web application utilizing the vulnerable library.

Remediation Plan

Immediate Action: Upgrade the Thymeleaf library to version 3.1.4.RELEASE or later to incorporate the necessary security fixes.

Proactive Monitoring: Review application logs for input strings containing suspicious template expression syntax and monitor for unexpected system process execution.

Compensating Controls: Implement strict input validation and sanitization routines at the application layer to ensure that user-supplied data cannot be interpreted as template expressions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of Server-Side Template Injection cannot be overstated. Developers must prioritize the library update to version 3.1.4.RELEASE and audit all areas of their application where user-supplied input is processed by the template engine to ensure no bypass vectors remain.

---METADATA---
VENDOR: Thymeleaf
PRODUCT: Java template engine
AFFECTED_VERSIONS: 3.1.3.RELEASE and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Thymeleaf versions 3.1.3.RELEASE and prior are vulnerable to Server-Side Template Injection (SSTI) due to insufficient restriction of accessible objects within the expression execution mechanism.

Executive Summary:
An unauthenticated remote attacker can exploit a template injection vulnerability in Thymeleaf versions 3.1.3.RELEASE and prior to execute arbitrary expressions.

Vulnerability Details

CVE-ID: CVE-2026-40477

Affected Software: Thymeleaf Java template engine

Affected Versions: 3.1.3.RELEASE and prior

Vulnerability: This vulnerability involves a flaw in expression execution mechanisms that allows an unauthenticated attacker to bypass object scope restrictions. By injecting malicious input into the template engine, an attacker can achieve Server-Side Template Injection (SSTI).

Business Impact

The ability to perform SSTI poses a critical risk to business operations, potentially leading to unauthorized data access, remote code execution, and total system compromise. With a CVSS score of 9.0, this vulnerability represents a severe threat to the confidentiality, integrity, and availability of any application utilizing the affected library.

Remediation Plan

Immediate Action: Upgrade Thymeleaf to version 3.1.4.RELEASE or later immediately to apply the necessary object scope restrictions.

Proactive Monitoring: Review web application logs for unusual expression patterns or unexpected characters within user-supplied input fields.

Compensating Controls: Implement strict input validation and sanitization for all user-provided data passed to the template engine to prevent malicious expression injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of SSTI vulnerabilities, organizations should prioritize patching Thymeleaf to the latest version. Failure to update significantly increases the risk of remote compromise and unauthorized access to sensitive application environments.

---METADATA---
VENDOR: Haskell
PRODUCT: hackage-server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The hackage-server application fails to sanitize user-controlled metadata from .cabal files, leading to a stored Cross-Site Scripting (XSS) vulnerability.

Executive Summary:
A stored Cross-Site Scripting vulnerability in hackage-server allows attackers to execute malicious scripts in the context of other users, potentially leading to session hijacking.

Vulnerability Details

CVE-ID: CVE-2026-40472

Affected Software: Haskell hackage-server

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is a stored Cross-Site Scripting (XSS) flaw where unsanitized metadata from .cabal files is rendered directly into HTML href attributes. An attacker can inject malicious payloads that execute when a victim views the affected package page.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a significant risk to the integrity of the development ecosystem. Successful exploitation allows for the theft of user sessions or the redirection of developers to malicious resources, undermining the trust required for software package management.

Remediation Plan

Immediate Action: Update the hackage-server instance to the version specified by the vendor that includes proper input sanitization.

Proactive Monitoring: Monitor server logs for unusually long or malformed metadata fields within package uploads that may indicate injection attempts.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts, providing a layer of defense against XSS.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity score necessitates immediate attention to prevent supply chain-related attacks.

Analyst Recommendation

All administrators of hackage-server infrastructure should verify their current version and apply the vendor-supplied security update immediately. Protecting the integrity of the package metadata is essential to maintaining a secure development pipeline.

---METADATA---
VENDOR: Hackage
PRODUCT: hackage-server
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
The hackage-server application lacks CSRF protection, allowing attackers to perform unauthorized administrative actions or create new user accounts via malicious scripts on external sites.

Executive Summary:
The lack of Cross-Site Request Forgery (CSRF) protection in hackage-server poses a critical risk of unauthorized administrative account manipulation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40471

Affected Software: Hackage hackage-server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to implement CSRF tokens or equivalent validation across its endpoints. This allows an attacker to trick authenticated users into executing unauthorized requests, such as package uploads, or to abuse unauthenticated endpoints to register unauthorized accounts.

Business Impact

The absence of CSRF protection creates a high-risk environment where administrative integrity is compromised. With a CVSS score of 9.6, this vulnerability could lead to unauthorized code distribution or full takeover of user management functions, resulting in severe reputational damage and the potential for supply chain attacks through malicious package uploads.

Remediation Plan

Immediate Action: Identify and apply the latest security update provided by the Hackage maintainers to enable robust CSRF mitigation.

Proactive Monitoring: Review access logs for anomalous account creation patterns or unauthorized package upload requests originating from unexpected referrers.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that SameSite cookie attributes are set to 'Strict' or 'Lax' to provide defense-in-depth.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical severity, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score, organizations utilizing hackage-server must prioritize this update. Administrators should immediately audit user account logs for suspicious activity and ensure that all administrative interfaces are protected by modern web security standards.

---METADATA---
VENDOR: Haskell.org
PRODUCT: Hackage Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Cross-Site Scripting (XSS) vulnerability in the Hackage server allows an attacker to hijack user sessions by serving malicious JavaScript via uploaded documentation or source packages.

Executive Summary:
A critical XSS vulnerability in the Hackage server allows attackers to hijack active user sessions, potentially leading to unauthorized package management and metadata alteration.

Vulnerability Details

CVE-ID: CVE-2026-40470

Affected Software: Haskell.org Hackage Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The server incorrectly handles HTML and JavaScript files within uploaded packages. A malicious maintainer can upload content that executes in the browser of a user with active credentials, resulting in full session hijacking.

Business Impact

The CVSS score of 9.9 represents a critical threat to the supply chain integrity of the Haskell ecosystem. Hijacking sessions allows attackers to inject malicious code into packages or alter project metadata, potentially poisoning downstream software consumers.

Remediation Plan

Immediate Action: Update the Hackage server software to the latest version provided by the Haskell community.

Proactive Monitoring: Monitor for unexpected changes to package metadata or suspicious package upload activities.

Compensating Controls: Users should clear browser sessions after interacting with the platform and maintain strict control over maintainer credentials.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a significant risk to the integrity of the software supply chain. Administrators of Hackage instances must apply the security patches immediately to prevent unauthorized session access and maintain the trust of the development community.

---METADATA---
VENDOR: GNU
PRODUCT: C Library (glibc)
AFFECTED_VERSIONS: Version 2 (See vendor advisory for specific sub-versions)
---END_METADATA---

Description Summary:
A vulnerability exists in the iconv() function of the GNU C Library (glibc) version 2. This flaw can lead to unexpected behavior or potential security bypasses during character set conversion.

Executive Summary:
A high-severity vulnerability in the GNU C Library (glibc) iconv() function poses a significant risk to Linux-based systems, potentially allowing for memory corruption or unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-4046

Affected Software: GNU C Library (glibc)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is located within the iconv() function, which is responsible for converting strings between different character encodings. While the specific exploit vector is not detailed in the summary, flaws in this function typically involve unauthenticated attackers providing specially crafted input to an application that utilizes glibc for encoding tasks.

Business Impact

The GNU C Library is a core component of nearly all Linux distributions. A flaw in iconv() can impact a wide range of applications, including web servers, mail servers, and database engines. The CVSS score of 7.5 indicates a high severity, as successful exploitation could lead to application crashes (denial of service) or potentially arbitrary code execution depending on how the affected application handles character conversion.

Remediation Plan

Immediate Action: Apply security updates provided by your Linux distribution vendor (e.g., Red Hat, Debian, Ubuntu) to update the glibc package to a patched version.

Proactive Monitoring: Review application logs for crashes or segmentation faults that occur during data processing or character encoding tasks.

Compensating Controls: Ensure applications use robust input validation before passing data to character conversion libraries and utilize memory protection features like ASLR and DEP.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the ubiquity of glibc, this vulnerability should be treated as a high-priority patching item.

Analyst Recommendation

System administrators should treat this as a critical infrastructure update. Because glibc is a foundational library, a patch will require a system reboot or a restart of all services utilizing the library to ensure the fix is fully implemented across the environment.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 3.0.0 before 4.14.6, 4.15.0 before 4.18.2, 4.19.0 before 4.20.0
---END_METADATA---

Description Summary:
Improper header filtering in Apache Camel allows attackers to inject case-variant headers, leading to remote code execution and arbitrary file writes.

Executive Summary:
A critical vulnerability in Apache Camel allows remote attackers to achieve code execution and file system access by bypassing header filtering mechanisms.

Vulnerability Details

CVE-ID: CVE-2026-40453

Affected Software: Apache Camel

Affected Versions: 3.0.0 before 4.14.6, 4.15.0 before 4.18.2, 4.19.0 before 4.20.0

Vulnerability: This is a header injection vulnerability occurring due to inconsistent case-sensitive filtering in specific Camel components (JMS, CoAP, Google Pubsub). An attacker with producer access to the message broker can inject malicious headers that are processed by downstream components.

Business Impact

Successful exploitation results in full remote code execution and arbitrary file write capabilities, posing a catastrophic risk to data integrity and system availability. With a CVSS score of 9.9, this vulnerability represents an extreme threat level, enabling attackers to take complete control of the affected application server.

Remediation Plan

Immediate Action: Upgrade to the patched versions provided by the vendor (4.20.0, 4.14.6, or 4.18.2) immediately.

Proactive Monitoring: Monitor message broker traffic for anomalous header patterns and review application logs for unauthorized file system operations or execution commands.

Compensating Controls: Implement strict input validation on message brokers and restrict producer access to trusted entities only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of triggering it via message injection, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for full system compromise, organizations must prioritize patching these Apache Camel components. Administrators should treat this as a high-priority update to prevent unauthorized code execution.