---METADATA---
VENDOR: Dgraph
PRODUCT: Dgraph
AFFECTED_VERSIONS: Prior to 25.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dgraph is vulnerable to an unauthenticated DQL injection attack that allows full read access to database data via crafted HTTP POST requests.

Executive Summary:
A critical DQL injection vulnerability in Dgraph allows unauthenticated attackers to gain full read access to sensitive database contents.

Vulnerability Details

CVE-ID: CVE-2026-41327

Affected Software: Dgraph Dgraph

Affected Versions: Prior to 25.3.3

Vulnerability: This vulnerability involves improper input sanitization within the DQL query parser, where an unauthenticated attacker can inject arbitrary query blocks into the cond field of an upsert mutation. The lack of parameterization allows the injected query to execute server-side and return sensitive data in the HTTP response.

Business Impact

The ability for an unauthenticated user to retrieve the entire contents of a database represents a catastrophic security failure. Given the CVSS score of 9.1, this vulnerability poses an extreme risk of mass data exfiltration, regulatory non-compliance, and severe reputational damage to any organization utilizing Dgraph in its default configuration.

Remediation Plan

Immediate Action: Upgrade all Dgraph instances to version 25.3.3 or later immediately to resolve the query injection flaw.

Proactive Monitoring: Review access logs for suspicious HTTP POST requests directed to the /mutate endpoint, specifically looking for anomalous cond field values.

Compensating Controls: Implement strict network access controls to limit access to the Dgraph API and ensure that Access Control Lists (ACLs) are enabled and configured to prevent unauthorized operations.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides an unauthenticated path to total data exposure. Organizations must prioritize upgrading their Dgraph installations to version 25.3.3 immediately and audit their current configuration to ensure ACLs are properly enforced.

---METADATA---
VENDOR: NLnet Labs
PRODUCT: Unbound
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the NLnet Labs Unbound DNS resolver, requiring further investigation into specific affected versions and technical impact.

Executive Summary:
A security vulnerability has been identified in the NLnet Labs Unbound DNS resolver that requires immediate review and update once vendor guidance is finalized.

Vulnerability Details

CVE-ID: CVE-2026-41292

Affected Software: NLnet Labs Unbound

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided information is limited; however, it concerns the Unbound DNS resolver. Further technical details regarding the exact nature of the vulnerability were not provided in the input.

Business Impact

As a core DNS infrastructure component, any vulnerability in Unbound can have widespread consequences, including service disruption or traffic redirection. The CVSS score of 7.5 indicates a High severity risk that could lead to significant operational instability if the resolver is compromised.

Remediation Plan

Immediate Action: Monitor official communication from NLnet Labs and apply all security-related patches for Unbound as soon as they become available.

Proactive Monitoring: Review DNS server logs for unexpected traffic patterns or abnormal request spikes that could indicate exploitation attempts.

Compensating Controls: Ensure that DNS infrastructure is protected by network-level access controls to restrict management interfaces and limit exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of DNS in network operations, administrators should prioritize keeping Unbound updated to the latest stable release. Proactive monitoring of vendor security advisories is essential until specific remediation details are provided.

---METADATA---
VENDOR: OpenStack
PRODUCT: Mistral
AFFECTED_VERSIONS: OpenStack Mistral through 22.0.0.
---END_METADATA---

Description Summary:
OpenStack Mistral allows arbitrary remote code execution via exposed API endpoints, potentially leading to the exfiltration of sensitive service credentials.

Executive Summary:
A critical remote code execution vulnerability in OpenStack Mistral allows unauthenticated attackers to execute arbitrary commands and exfiltrate sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-41283

Affected Software: OpenStack Mistral

Affected Versions: OpenStack Mistral through 22.0.0.

Vulnerability: The vulnerability exists in the API endpoints of OpenStack Mistral, which do not properly sanitize input or restrict execution, allowing an unauthenticated remote attacker to execute arbitrary code. This flaw provides a vector for attackers to compromise service credentials and gain broader control over the OpenStack environment.

Business Impact

With a CVSS score of 9.9, this vulnerability represents an extremely high risk. Successful exploitation can lead to a complete compromise of the OpenStack environment, resulting in data breaches, unauthorized access to cloud resources, and catastrophic loss of service integrity.

Remediation Plan

Immediate Action: Upgrade OpenStack Mistral to version 23.0.0 or later immediately to resolve the vulnerable API endpoints.

Proactive Monitoring: Review API access logs for unusual activity or requests directed at sensitive Mistral endpoints that could indicate exploitation.

Compensating Controls: Restrict access to the Mistral API service to trusted internal networks only, using firewalls or VPNs, until the patch can be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE and its potential impact on cloud infrastructure, immediate patching is required. Organizations running OpenStack Mistral should prioritize this update to prevent unauthorized administrative access to their cloud platforms.

---METADATA---
VENDOR: OpenMRS
PRODUCT: OpenMRS Core
AFFECTED_VERSIONS: 2.7.0 to 2.7.8, and 2.8.0 to 2.8.5
---END_METADATA---

Description Summary:
OpenMRS Core fails to properly sandbox Apache Velocity templates, allowing authenticated users with specific privileges to achieve arbitrary Java reflection and code execution.

Executive Summary:
An authenticated remote code execution vulnerability in OpenMRS Core allows users with Manage Concepts privileges to execute arbitrary Java code via malicious Velocity template expressions.

Vulnerability Details

CVE-ID: CVE-2026-41258

Affected Software: OpenMRS Core

Affected Versions: 2.7.0 to 2.7.8, and 2.8.0 to 2.8.5

Vulnerability: The application evaluates database-stored criteria as Velocity templates without adequate sandboxing; an authenticated user with "Manage Concepts" privileges can inject and execute arbitrary code.

Business Impact

An attacker with modest privileges can escalate to full system access, potentially exposing highly sensitive electronic medical records. A CVSS score of 9.1 underlines the severity of this privilege escalation and execution risk.

Remediation Plan

Immediate Action: Upgrade to OpenMRS Core version 2.7.9 or 2.8.6 to address the template evaluation flaw.

Proactive Monitoring: Audit recent changes to concept reference ranges and monitor for unusual Java object instantiation or unauthorized service layer calls.

Compensating Controls: Restrict administrative privileges to a minimal set of trusted users and implement strict code review processes for any configuration changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the sensitivity of data handled by OpenMRS, this vulnerability must be remediated immediately. Administrators should upgrade to the specified versions to prevent unauthorized code execution.

---METADATA---
VENDOR: Pimcore
PRODUCT: CoreShop
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
CoreShop, a Pimcore enhanced eCommerce solution, contains a vulnerability that requires immediate attention.

Executive Summary:
A high-severity vulnerability in the CoreShop eCommerce solution for Pimcore poses a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-41249

Affected Software: Pimcore CoreShop

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw within the CoreShop framework. While specific authentication requirements are not detailed, such flaws often allow attackers to manipulate core eCommerce functionality.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive eCommerce data, potential order manipulation, or full compromise of the application backend. With a CVSS score of 8.2, this vulnerability is classified as High and requires prioritized remediation to prevent business disruption and financial loss.

Remediation Plan

Immediate Action: Apply all security updates provided by the vendor immediately upon release.

Proactive Monitoring: Monitor application logs for anomalous traffic patterns or unauthorized attempts to access administrative functions.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests targeting the eCommerce platform.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, administrators must prioritize the assessment of their CoreShop environment. Apply vendor-supplied patches immediately to mitigate the risk of unauthorized access or data compromise.

---METADATA---
VENDOR: Clerk
PRODUCT: Clerk JavaScript (Next.js, Nuxt, Astro)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A bypass vulnerability in Clerk's createRouteMatcher allows unauthenticated requests to skip middleware gating and reach downstream handlers.

Executive Summary:
A critical authentication bypass vulnerability in Clerk JavaScript libraries allows attackers to circumvent middleware security controls and access protected routes.

Vulnerability Details

CVE-ID: CVE-2026-41248

Affected Software: Clerk Clerk JavaScript

Affected Versions: @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, 7.2.1; @clerk/nuxt 1.13.28, 2.2.2; @clerk/shared 2.22.1, 3.47.4, 4.8.1

Vulnerability: The createRouteMatcher function in various Clerk integration packages fails to properly validate certain crafted requests. This allows an attacker to bypass authentication middleware, effectively reaching application handlers that were intended to be protected by Clerk authentication.

Business Impact

This vulnerability undermines the fundamental authentication logic of applications using Clerk, potentially exposing private user data and administrative functions. With a CVSS score of 9.1, the risk of unauthorized access is severe, as attackers can bypass security checks designed to guard sensitive business logic and backend services.

Remediation Plan

Immediate Action: Update all affected Clerk packages (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and @clerk/shared) to the versions specified in the vendor security advisory.

Proactive Monitoring: Monitor application logs for unexpected access patterns where users are reaching routes that should be restricted by middleware.

Compensating Controls: While no direct WAF rule can fully replace the middleware logic, ensuring that backend handlers also perform secondary authorization checks provides a vital layer of defense-in-depth.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers must treat this as a high-priority update. Because this vulnerability affects the core security gating mechanism of the application, failure to patch will leave protected routes and downstream handlers completely exposed to unauthenticated access.

---METADATA---
VENDOR: Froxlor
PRODUCT: Server Administration Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Froxlor open source server administration software contains a vulnerability related to improper access control or authorization mechanisms.

Executive Summary:
A critical vulnerability in Froxlor server administration software could allow unauthorized access, jeopardizing the security of managed server environments.

Vulnerability Details

CVE-ID: CVE-2026-41236

Affected Software: Froxlor, Server Administration Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the administrative functions of the platform. Based on the CVSS score, this flaw likely involves a failure to properly enforce security constraints, allowing unauthorized actors to perform actions reserved for administrators.

Business Impact

As an administration tool, Froxlor has privileged access to the server environment. A successful exploit, rated at 8.8, could result in full server compromise, unauthorized modification of configurations, and total loss of administrative control over hosted services.

Remediation Plan

Immediate Action: Update the Froxlor installation to the latest stable release as soon as the vendor provides a security patch.

Proactive Monitoring: Inspect server logs for unusual administrative logins, unexpected configuration changes, or unauthorized access attempts to the management interface.

Compensating Controls: Limit access to the Froxlor management interface to authorized IP addresses only, utilizing VPNs or firewall rules to restrict exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Froxlor manages server configurations, the risk associated with this vulnerability is severe. Administrators must treat this as a top-priority update and ensure that the management interface is not exposed to untrusted networks.

---METADATA---
VENDOR: Froxlor
PRODUCT: Froxlor
AFFECTED_VERSIONS: Prior to 2.3.6
---END_METADATA---

Description Summary:
An injection vulnerability in Froxlor's PhpHelper allows administrators to inject and execute arbitrary PHP code via unescaped string literals.

Executive Summary:
A critical injection vulnerability in Froxlor prior to version 2.3.6 allows an authenticated administrator to execute arbitrary PHP code by injecting malicious strings into configuration files.

Vulnerability Details

CVE-ID: CVE-2026-41229

Affected Software: Froxlor Froxlor

Affected Versions: Prior to 2.3.6

Vulnerability: This is a code injection vulnerability where the PhpHelper::parseArrayToString() function fails to escape single quotes, allowing an administrator to inject malicious PHP code into lib/userdata.inc.php.

Business Impact

By exploiting this flaw, an attacker with change_serversettings permission can gain persistent remote code execution, which executes on every page load. This grants the attacker ongoing control over the server environment, risking total data compromise and system integrity. The CVSS score of 9.1 underlines the severe risk to organizational infrastructure.

Remediation Plan

Immediate Action: Upgrade to Froxlor version 2.3.6 or later to ensure proper escaping of configuration strings.

Proactive Monitoring: Audit the lib/userdata.inc.php file for any unauthorized modifications or embedded PHP code blocks.

Compensating Controls: Limit access to administrative functions and strictly enforce the principle of least privilege for all administrative accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for persistent code execution, making it a high-priority concern for any administrator. Immediate patching to version 2.3.6 is required to neutralize the injection vector and secure the server configuration.

---METADATA---
VENDOR: Froxlor
PRODUCT: Froxlor
AFFECTED_VERSIONS: Prior to 2.3.6
---END_METADATA---

Description Summary:
A path traversal flaw in the Froxlor API allows authenticated customers to execute arbitrary PHP code via the def_language parameter.

Executive Summary:
An authenticated path traversal vulnerability in Froxlor prior to version 2.3.6 allows attackers to execute arbitrary PHP code on the server with web service privileges.

Vulnerability Details

CVE-ID: CVE-2026-41228

Affected Software: Froxlor Froxlor

Affected Versions: Prior to 2.3.6

Vulnerability: This is a path traversal and arbitrary code execution vulnerability where an authenticated customer can inject a malicious path into the def_language parameter, which is then executed via require.

Business Impact

Successful exploitation allows an attacker to achieve remote code execution, granting them the ability to run arbitrary commands as the web server user. This could lead to a total server compromise, unauthorized access to sensitive customer data, and potential lateral movement within the network. The CVSS score of 9.9 highlights the extreme severity of this flaw.

Remediation Plan

Immediate Action: Upgrade all Froxlor instances to version 2.3.6 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious file system access patterns or unauthorized calls to the require function.

Compensating Controls: Restrict API access to trusted IP addresses and utilize a WAF to block requests containing path traversal sequences (e.g., ../).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical risk to the integrity of the server environment. Administrators must verify their current version of Froxlor and apply the 2.3.6 update as a high-priority task to prevent full system compromise.

---METADATA---
VENDOR: Arch
PRODUCT: CI4MS
AFFECTED_VERSIONS: 0.31.4.0
---END_METADATA---

Description Summary:
CI4MS contains a stored DOM-based XSS vulnerability in the backup module that can be leveraged for full account takeover.

Executive Summary:
A stored DOM XSS vulnerability in CI4MS allows attackers to perform full account takeover and privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-41201

Affected Software: Arch CI4MS

Affected Versions: 0.31.4.0

Vulnerability: An attacker can upload a crafted SQL file containing a malicious filename that triggers stored DOM XSS when processed by the backup module. This allows for the execution of arbitrary JavaScript in the context of an administrator's session.

Business Impact

The ability to execute JavaScript in an administrator's browser leads directly to account takeover and full control over the CMS. Given the 9.1 CVSS score, this is a critical threat to the integrity and availability of the managed content and infrastructure.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.5.0 immediately.

Proactive Monitoring: Monitor application logs for suspicious file uploads or unusual backup module activity.

Compensating Controls: Implement strict file type and name validation on the server side and utilize a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must update to the patched version immediately. Additionally, verify that all existing backup files are clean and that no malicious payloads have already been stored.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Prior to 1.8.215
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
FreeScout before 1.8.215 contains an arbitrary file write vulnerability in the module installation feature due to improper validation of ZIP archive file paths.

Executive Summary:
An authenticated administrative vulnerability in FreeScout allows arbitrary file writes on the server, posing a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-41193

Affected Software: FreeScout

Affected Versions: Prior to 1.8.215

Vulnerability: The vulnerability exists in the module installation feature, which fails to validate file paths when extracting ZIP archives. An authenticated administrator can leverage this to write malicious files to arbitrary locations on the server filesystem.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the underlying server infrastructure. An attacker with administrative access could achieve remote code execution, leading to full server compromise, persistent backdoors, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.215 or later to resolve the archive extraction flaw.

Proactive Monitoring: Inspect the server's web directories and sensitive system paths for the presence of unauthorized or unexpected files created during module installation tasks.

Compensating Controls: Restrict administrative access to the module installation interface to trusted personnel only and ensure the web server service account has minimal filesystem write permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for self-hosted FreeScout instances. Administrators must prioritize the update to version 1.8.215 to prevent potential remote code execution via arbitrary file writes.

---METADATA---
VENDOR: Create DB Tables
PRODUCT: Create DB Tables for WordPress
AFFECTED_VERSIONS: Up to and including 1.2.1
---END_METADATA---

Description Summary:
The Create DB Tables plugin for WordPress is vulnerable to authorization bypass, allowing authenticated attackers to drop or create database tables.

Executive Summary:
Authenticated attackers with Subscriber-level access can destroy the entire WordPress database due to missing authorization checks in the Create DB Tables plugin.

Vulnerability Details

CVE-ID: CVE-2026-4119

Affected Software: Create DB Tables

Affected Versions: Up to and including 1.2.1

Vulnerability: The plugin fails to perform capability checks or nonce verification on administrative actions, allowing any authenticated user to execute DROP TABLE or CREATE TABLE commands.

Business Impact

An attacker can delete critical WordPress tables, leading to permanent data loss and total site failure. With a CVSS score of 9.1, this represents a major threat to the availability and integrity of the site's data.

Remediation Plan

Immediate Action: Update the Create DB Tables plugin to the latest version.

Proactive Monitoring: Monitor database logs for unusual DROP or CREATE table queries performed by standard user accounts.

Compensating Controls: Use a WAF to restrict access to administrative admin-post.php actions for non-privileged users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Update the plugin immediately. Furthermore, audit user roles to ensure that only trusted administrators have access to potentially destructive administrative functions.

---METADATA---
VENDOR: Jellystat
PRODUCT: Jellystat
AFFECTED_VERSIONS: Prior to 1.1.10
---END_METADATA---

Description Summary:
Jellystat is vulnerable to SQL injection and subsequent remote code execution due to improper sanitization of user-supplied data in API endpoints.

Executive Summary:
An authenticated attacker can perform SQL injection in Jellystat, enabling full database access and arbitrary command execution on the PostgreSQL server.

Vulnerability Details

CVE-ID: CVE-2026-41167

Affected Software: Jellystat

Affected Versions: Prior to 1.1.10

Vulnerability: The application fails to sanitize inputs in multiple API endpoints, allowing an authenticated user to inject SQL commands. Because the database role often has superuser privileges, this can be escalated to RCE via the COPY ... TO PROGRAM command.

Business Impact

This vulnerability allows for the total compromise of the database and the underlying server. Attackers can steal sensitive configuration data, including API keys and credentials, and gain complete control of the host system. The CVSS score of 9.1 reflects the extreme risk of total system takeover.

Remediation Plan

Immediate Action: Update Jellystat to version 1.1.10 or later immediately.

Proactive Monitoring: Review PostgreSQL logs for suspicious COPY commands or unexpected shell execution attempts originating from the application user.

Compensating Controls: Implement strict database role permissions (Principle of Least Privilege) to ensure the application user cannot execute system commands like COPY ... TO PROGRAM.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of SQL injection and RCE makes this a critical priority. Administrators must update the application immediately and re-evaluate the database permissions used by the service to minimize the impact of potential future vulnerabilities.