---METADATA---
VENDOR: Axios
PRODUCT: Axios
AFFECTED_VERSIONS: Prior to 1.15.0
---END_METADATA---

Description Summary:
Axios is vulnerable to a prototype pollution attack chain that can be escalated to remote code execution or AWS IMDSv2 bypass.

Executive Summary:
A critical vulnerability in the Axios library allows for prototype pollution to be escalated into remote code execution or full cloud environment compromise.

Vulnerability Details

CVE-ID: CVE-2026-40175

Affected Software: Axios

Affected Versions: Prior to 1.15.0

Vulnerability: This vulnerability involves a "Gadget" attack chain where prototype pollution is leveraged to achieve remote code execution or bypass AWS IMDSv2 protections. The vulnerability is accessible to external attackers through the HTTP client's processing of malicious data.

Business Impact

With a CVSS score of 10.0, this is a maximum-severity flaw. The impact ranges from full server takeover to the compromise of cloud infrastructure, potentially allowing attackers to escalate privileges and access sensitive cloud metadata, leading to widespread data breaches.

Remediation Plan

Immediate Action: Update the Axios library to version 1.15.0 or later across all applications and dependencies.

Proactive Monitoring: Utilize Software Composition Analysis (SCA) tools to identify and track the usage of vulnerable Axios versions throughout the development lifecycle.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads associated with prototype pollution techniques.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update. Development teams must ensure that all instances of Axios are patched to the secure version to prevent potential cloud-level compromises.

---METADATA---
VENDOR: Dgraph
PRODUCT: Dgraph
AFFECTED_VERSIONS: 25.3.1 and prior
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
Dgraph versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability via the /debug/pprof/cmdline endpoint, leaking admin tokens.

Executive Summary:
An unauthenticated credential disclosure in Dgraph allows attackers to steal administrative tokens and gain full operational control over the database.

Vulnerability Details

CVE-ID: CVE-2026-40173

Affected Software: Dgraph

Affected Versions: 25.3.1 and prior

Vulnerability: This is an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint exposes sensitive configuration flags, including the admin token, which can then be reused to bypass authentication.

Business Impact

This vulnerability carries a CVSS score of 9.4, indicating critical risk. An attacker can gain full administrative control over the Dgraph database, allowing them to modify configurations, access sensitive data, or disrupt operations, leading to significant potential for data breaches and service outages.

Remediation Plan

Immediate Action: Upgrade Dgraph to version 25.3.2 or later to remediate the endpoint exposure and token handling logic.

Proactive Monitoring: Review access logs for unauthorized requests to /debug/pprof/ endpoints and monitor for unexpected administrative configuration changes.

Compensating Controls: Ensure the Alpha HTTP port is protected by network-level access controls (e.g., firewalls or VPC security groups) to prevent access by untrusted parties.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The exposure of administrative credentials via an unauthenticated endpoint is a severe security oversight. Administrators must upgrade to version 25.3.2 immediately and verify that no unauthorized administrative tokens were generated or utilized during the period the service was exposed.

---METADATA---
VENDOR: authentik
PRODUCT: authentik
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the authentik open-source identity provider which may impact authentication security.

Executive Summary:
The authentik identity provider is affected by a security vulnerability that could threaten the integrity of managed authentication services.

Vulnerability Details

CVE-ID: CVE-2026-40165

Affected Software: authentik authentik

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the authentik open-source identity provider. Specific details regarding the attack vector and required authentication levels are currently insufficient to determine if the flaw is exploitable by an unauthenticated attacker.

Business Impact

With a CVSS score of 8.7, this is a High severity vulnerability that poses a significant risk to identity management infrastructure. Exploitation could allow unauthorized access to sensitive systems integrated with the identity provider, leading to widespread data exposure or privilege escalation.

Remediation Plan

Immediate Action: Upgrade to the latest version of authentik as soon as a security patch is released by the vendor.

Proactive Monitoring: Monitor authentication logs for suspicious login patterns, failed access attempts, or unauthorized configuration changes.

Compensating Controls: Ensure multi-factor authentication (MFA) is enforced wherever possible to provide a secondary layer of defense against credential-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Identity providers are high-value targets for attackers; therefore, this vulnerability must be addressed with high priority. Organizations should track the official authentik security channel for patch releases and prepare for an immediate deployment once the fix is available.

---METADATA---
VENDOR: Saltcorn
PRODUCT: Saltcorn
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability exists in Saltcorn, an extensible, open-source, no-code database application builder.

Executive Summary:
A high-severity vulnerability in the Saltcorn no-code database builder poses a significant risk to application integrity.

Vulnerability Details

CVE-ID: CVE-2026-40163

Affected Software: Saltcorn

Affected Versions: See vendor advisory

Vulnerability: The vulnerability affects the Saltcorn platform, which allows for the creation of database-driven applications. Further technical details regarding the specific flaw are forthcoming from the vendor.

Business Impact

A CVSS score of 8.2 classifies this as a high-risk vulnerability. Exploitation could allow attackers to manipulate database applications or gain unauthorized access to underlying data, risking the compromise of business-critical information stored within the platform.

Remediation Plan

Immediate Action: Check the Saltcorn vendor advisory for the latest security patches and apply them immediately.

Proactive Monitoring: Audit application logs for unusual administrative actions or unauthorized modifications to database schemas.

Compensating Controls: Implement strong access controls and ensure the application is not exposed to the public internet without adequate protection.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 12, 2026, there is no public information indicating active exploitation. However, given the nature of the platform, the risk of exploitation is high.

Analyst Recommendation

Security teams must prioritize updating the Saltcorn platform. Given the high severity, ensure that all instances are patched as soon as the vendor releases the necessary updates.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 4.5.128
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PraisonAI fails to validate the integrity or origin of remotely fetched template files, enabling supply chain attacks by executing malicious code.

Executive Summary:
A critical supply chain vulnerability in PraisonAI allows for arbitrary code execution by treating unverified, remotely fetched templates as trusted executable code.

Vulnerability Details

CVE-ID: CVE-2026-40154

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.128

Vulnerability: The application suffers from a lack of integrity verification and origin validation when processing remotely fetched template files. This allows an attacker to inject malicious templates that the system subsequently executes without user confirmation or validation.

Business Impact

The ability to inject and execute arbitrary code via malicious templates creates a severe supply chain risk, potentially leading to unauthorized data access, service disruption, and total system compromise. With a CVSS score of 9.3, this flaw necessitates immediate remediation to prevent attackers from gaining persistent access to the server or integrated environments.

Remediation Plan

Immediate Action: Upgrade the PraisonAI system to version 4.5.128 or later to incorporate the necessary integrity and validation checks.

Proactive Monitoring: Monitor for unexpected outbound network connections from the PraisonAI application to untrusted endpoints and audit logs for unusual template file processing events.

Compensating Controls: Implement strict egress filtering on the application server to prevent the fetching of templates from unauthorized or unknown external domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant supply chain risk that could be leveraged for widespread system compromise. Security teams should immediately verify their current PraisonAI version and apply the patch to ensure all template processing is subjected to rigorous integrity verification.

---METADATA---
VENDOR: BeyondTrust
PRODUCT: Remote Support and Privileged Remote Access
AFFECTED_VERSIONS: Remote Support: < 26.2.1, < 25.3.3; Privileged Remote Access: < 26.2.1, < 25.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the web application component of BeyondTrust Remote Support and Privileged Remote Access allows authenticated users to exploit improper neutralization of data query logic.

Executive Summary:
An authenticated vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows attackers with low-level access to potentially compromise data and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-40141

Affected Software: BeyondTrust Remote Support and Privileged Remote Access

Affected Versions: Remote Support: < 26.2.1, < 25.3.3; Privileged Remote Access: < 26.2.1, < 25.3.3

Vulnerability: This vulnerability (CWE-943) involves improper neutralization of special elements in data query logic within a web application component. Exploitation requires the attacker to have at least low-level authenticated access to the system.

Business Impact

The CVSS score of 8.5 reflects the potential for unauthorized data access and integrity compromise. By manipulating query logic, an attacker could potentially extract sensitive information or alter system states, undermining the security of the privileged access management environment and posing a significant reputational and operational risk.

Remediation Plan

Immediate Action: Apply vendor security updates to version 26.2.1, 25.3.3, or later as specified in the vendor advisory (BT26-03).

Proactive Monitoring: Review access logs for unusual queries or unexpected database interactions originating from authenticated user accounts.

Compensating Controls: Enforce the principle of least privilege for user accounts to limit the potential impact of an authenticated attacker, and utilize WAF rules to detect SQL-injection-style patterns in web requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires authentication, the impact on a privileged access management system is severe. Administrators must prioritize updating these systems to the latest version to prevent unauthorized data access or manipulation by compromised or malicious user accounts.

---METADATA---
VENDOR: BeyondTrust
PRODUCT: Remote Support and Privileged Remote Access
AFFECTED_VERSIONS: Remote Support: < 26.2.1, < 25.3.3; Privileged Remote Access: < 26.2.1, < 25.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication vulnerability in the network communication subsystem of BeyondTrust Remote Support and Privileged Remote Access allows for uncontrolled resource consumption.

Executive Summary:
A critical pre-authentication vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows unauthenticated attackers to trigger uncontrolled resource consumption, potentially causing a denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-40140

Affected Software: BeyondTrust Remote Support and Privileged Remote Access

Affected Versions: Remote Support: < 26.2.1, < 25.3.3; Privileged Remote Access: < 26.2.1, < 25.3.3

Vulnerability: This is a pre-authentication resource consumption vulnerability (CWE-400) located within the network communication subsystem. An unauthenticated remote attacker can exploit this flaw to exhaust system resources, leading to service disruption.

Business Impact

The vulnerability carries a CVSS score of 8.7, indicating high severity due to the ease of exploitation (no authentication required). Successful exploitation could result in significant system downtime, preventing legitimate users from accessing critical remote support or privileged access management tools, thereby disrupting IT operations and administrative workflows.

Remediation Plan

Immediate Action: Upgrade to version 26.2.1, 25.3.3, or later as specified in the vendor security advisory (BT26-03).

Proactive Monitoring: Monitor system performance metrics for sudden spikes in resource utilization and review network traffic logs for anomalous patterns directed at the communication subsystem.

Compensating Controls: Implement rate limiting or blocking at the network perimeter for unauthorized or suspicious traffic patterns attempting to interact with the appliance's communication ports.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, which allows for unauthenticated remote denial-of-service, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for unauthenticated attackers to impact system availability, organizations should prioritize patching these BeyondTrust appliances immediately. Ensure all instances are updated to the non-vulnerable versions provided by the vendor to prevent potential service disruption.

---METADATA---
VENDOR: BeyondTrust
PRODUCT: Remote Support and Privileged Remote Access
AFFECTED_VERSIONS: 0 up to 26.2.1, 0 up to 25.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows unauthenticated attackers to bypass access controls and gain unauthorized administrative access.

Executive Summary:
A critical vulnerability in BeyondTrust remote access appliances could allow unauthenticated attackers to achieve full system compromise, representing a severe risk to organizational security.

Vulnerability Details

CVE-ID: CVE-2026-40139

Affected Software: BeyondTrust Remote Support and Privileged Remote Access

Affected Versions: 0 up to 26.2.1; 0 up to 25.3.3

Vulnerability: This is an authentication bypass vulnerability (CWE-287) located within the appliance authentication subsystem. An unauthenticated remote attacker can exploit improper request processing to gain elevated privileges, provided a specific authentication configuration is enabled.

Business Impact

Successful exploitation grants an attacker complete unauthorized access to the appliance, effectively neutralizing the security perimeter provided by the remote access solution. Given the CVSS score of 9.2, this vulnerability poses a critical threat to data confidentiality and integrity, potentially allowing attackers to pivot into the internal network or harvest sensitive credentials.

Remediation Plan

Immediate Action: Upgrade BeyondTrust Remote Support and Privileged Remote Access appliances to version 26.2.1, 25.3.3, or the latest available release as specified by the vendor advisory.

Proactive Monitoring: Review appliance access logs for anomalous authentication patterns or unexpected administrative sessions originating from unknown sources.

Compensating Controls: Restrict access to the administrative interface of the appliance to known, trusted IP addresses using network-level access control lists (ACLs) until patching is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of remote access infrastructure. Administrators must prioritize updating these appliances immediately, as the ability for an unauthenticated attacker to gain administrative access constitutes a total system compromise.

---METADATA---
VENDOR: BeyondTrust
PRODUCT: Remote Support
AFFECTED_VERSIONS: BeyondTrust Remote Support: 0 up to (excluding) 26.2.1, 0 up to (excluding) 25.3.3; Privileged Remote Access: 0 up to (excluding) 26.2.1, 0 up to (excluding) 25.3.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication vulnerability in the BeyondTrust Remote Support and Privileged Remote Access authentication subsystem allows attackers to bypass access controls.

Executive Summary:
A critical pre-authentication vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows attackers to bypass security controls and gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-40138

Affected Software: BeyondTrust Remote Support and Privileged Remote Access

Affected Versions: BeyondTrust Remote Support and Privileged Remote Access: 0 up to (excluding) 26.2.1, 0 up to (excluding) 25.3.3

Vulnerability: This is a pre-authentication vulnerability located within the authentication subsystem. Improper validation of authentication data allows a network-positioned attacker to bypass access controls, provided specific authentication configurations are enabled.

Business Impact

Given the central role these products play in privileged access management, the risk of unauthorized access is extreme, reflected by the CVSS score of 9.2. Successful exploitation could allow an attacker to hijack the appliance and gain elevated privileges across the entire managed environment.

Remediation Plan

Immediate Action: Upgrade BeyondTrust Remote Support and Privileged Remote Access to version 26.2.1 or 25.3.3, depending on the current branch, to patch the authentication subsystem.

Proactive Monitoring: Monitor authentication logs for failed and successful logins originating from unusual network paths or during off-hours.

Compensating Controls: Temporarily disable the specific authentication configurations noted in the vendor advisory until the patch can be verified and applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

BeyondTrust appliances are high-value targets for attackers seeking to move laterally within a network. Organizations must apply the vendor-provided patches immediately to secure these critical privileged access points.

---METADATA---
VENDOR: Nimiq
PRODUCT: core-rs-albatross
AFFECTED_VERSIONS: < 1.4.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Nimiq core-rs-albatross blockchain implementation is vulnerable to an unchecked return value in its persistent block storage, which may lead to security inconsistencies.

Executive Summary:
An unchecked return value vulnerability in Nimiq core-rs-albatross block storage could lead to data integrity issues or system instability.

Vulnerability Details

CVE-ID: CVE-2026-40092

Affected Software: Nimiq core-rs-albatross

Affected Versions: < 1.4.0

Vulnerability: This vulnerability is caused by an unchecked return value (CWE-252) within the persistent block storage component of the blockchain implementation. An attacker could potentially exploit this to cause unexpected behavior or state inconsistencies, though the exact authentication requirements depend on the deployment context.

Business Impact

The failure to check return values in critical blockchain storage can result in data corruption, loss of synchronization, or system instability. Given the CVSS score of 7.5, this poses a substantial risk to the reliability of the Nimiq network implementation, potentially leading to financial or data integrity loss.

Remediation Plan

Immediate Action: Upgrade the Nimiq core-rs-albatross implementation to version 1.4.0 or later immediately.

Proactive Monitoring: Monitor blockchain node logs for error signals or unexpected termination events that may indicate failed storage operations.

Compensating Controls: Ensure robust integrity checks and backups of the blockchain state are maintained to facilitate rapid recovery in the event of storage failure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the block storage component, all users of the Nimiq core-rs-albatross software must update to version 1.4.0. Failure to patch may expose the system to data integrity risks that could impact the entire node's operational status.

---METADATA---
VENDOR: Sonicverse
PRODUCT: Sonicverse Radio Audio Streaming Stack
AFFECTED_VERSIONS: Installations created via install.sh
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Sonicverse Radio dashboard allows authenticated operators to perform arbitrary HTTP requests to internal or external systems.

Executive Summary:
An SSRF vulnerability in the Sonicverse Radio streaming dashboard enables authenticated attackers to perform unauthorized requests against internal and external infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-40089

Affected Software: Sonicverse Radio Audio Streaming Stack

Affected Versions: Installations created via the provided install.sh script.

Vulnerability: The dashboard API client lacks sufficient validation when processing user-controlled URLs, leading to a Server-Side Request Forgery (SSRF) vulnerability. An authenticated operator can abuse this flaw to force the backend to make arbitrary HTTP requests to internal network resources or external systems.

Business Impact

SSRF vulnerabilities are frequently used to bypass network perimeters, scan internal infrastructure, or interact with cloud metadata services. With a CVSS score of 9.9, the potential for lateral movement and unauthorized access to sensitive internal services is extreme, posing a significant risk to the integrity and confidentiality of the host network.

Remediation Plan

Immediate Action: Apply the fix provided in commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4 or update to the latest available version provided by the project maintainers.

Proactive Monitoring: Review application logs for anomalous API requests and monitor network traffic for unexpected internal scans originating from the streaming stack dashboard.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block suspicious URL parameters or requests directed at internal IP ranges from the dashboard application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the exceptionally high CVSS score, this vulnerability should be treated as a priority. Administrators must immediately apply the code-level fix and restrict access to the dashboard to trusted users only to mitigate the risk of internal network reconnaissance and exploitation.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 4.5.121
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PraisonAI is vulnerable to command injection via the execute_command function and workflow shell execution, allowing attackers to execute arbitrary commands through crafted YAML or LLM inputs.

Executive Summary:
A critical command injection vulnerability in PraisonAI allows attackers to execute arbitrary shell commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40088

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.121

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command. Attackers can inject arbitrary shell metacharacters through agent workflows, YAML definitions, or LLM-generated tool calls, which the application then executes with system-level privileges.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the underlying host. Given the CVSS score of 9.6, this represents a critical risk that could lead to complete data exfiltration, lateral movement within the network, and full loss of system integrity.

Remediation Plan

Immediate Action: Upgrade the PraisonAI system to version 4.5.121 or later immediately to resolve the command injection flaw.

Proactive Monitoring: Review system logs for unusual shell process spawns or unexpected command execution patterns originating from agent workflows.

Compensating Controls: Implement strict input validation for all YAML definitions and restrict agent workflow permissions to the least privilege necessary to prevent unauthorized shell access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations utilizing PraisonAI must prioritize updating to version 4.5.121 to mitigate the risk of arbitrary code execution and potential total system compromise.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Cacti performance and fault management framework that requires immediate attention from system administrators.

Executive Summary:
A high-severity vulnerability in the Cacti performance management framework poses a significant risk of unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40079

Affected Software: Cacti Cacti

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Cacti performance and fault management framework, potentially allowing for unauthorized operations. The exact authentication requirements remain dependent on the specific exploit vector identified in the vendor's forthcoming technical disclosure.

Business Impact

The vulnerability carries a CVSS score of 8.6, placing it in the High severity category. Successful exploitation could lead to unauthorized system access, potential data exfiltration, or disruption of critical network monitoring infrastructure, which may severely impact operational visibility and business continuity.

Remediation Plan

Immediate Action: Administrators should monitor the official Cacti security advisory page and apply the recommended security patches or configuration changes as soon as they are made available.

Proactive Monitoring: Review web server and application access logs for anomalous request patterns or unauthorized administrative activity originating from untrusted sources.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter malicious traffic targeting the Cacti interface until a permanent patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, immediate vigilance is required. IT teams must prioritize the tracking of the vendor’s security bulletins and ensure that all instances of Cacti are updated to a secure version as soon as the vendor releases a patch to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: CrowdStrike
PRODUCT: LogScale
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical unauthenticated path traversal vulnerability in CrowdStrike LogScale allows remote attackers to read arbitrary files from the server filesystem.

Executive Summary:
A critical unauthenticated path traversal vulnerability in CrowdStrike LogScale allows remote attackers to access arbitrary files, necessitating immediate updates for self-hosted instances.

Vulnerability Details

CVE-ID: CVE-2026-40050

Affected Software: CrowdStrike LogScale

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A specific cluster API endpoint fails to sanitize user input, allowing an unauthenticated remote attacker to perform directory traversal and read sensitive files from the server's filesystem.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Unauthorized access to files could expose system configurations, credentials, or sensitive log data, leading to severe security breaches. Next-Gen SIEM customers are not affected.

Remediation Plan

Immediate Action: Self-hosted customers must upgrade to the latest patched version of LogScale immediately.

Proactive Monitoring: Review server access logs for path traversal patterns (e.g., ../ sequences) directed at cluster API endpoints.

Compensating Controls: Ensure that LogScale cluster API endpoints are not exposed to the public internet and are restricted to internal network access only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CrowdStrike has confirmed this vulnerability and already mitigated it for SaaS customers. Self-hosted customers must prioritize updating their infrastructure to the latest version to ensure protection against unauthorized file access.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.15.0 up to (excluding) 4.18.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An argument injection vulnerability in the Apache Camel Docling component allows attackers to inject malicious CLI flags and perform directory traversal via improperly sanitized exchange headers.

Executive Summary:
An argument injection vulnerability in Apache Camel’s Docling component enables attackers to manipulate system command execution, potentially leading to unauthorized file access.

Vulnerability Details

CVE-ID: CVE-2026-40047

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.15.0 up to (excluding) 4.18.3

Vulnerability: The component uses insufficient validation when constructing command-line arguments for the docling tool. An attacker can supply malicious flags or traversal sequences through the CamelDoclingCustomArguments header, which are then passed to the subprocess.

Business Impact

A successful exploit could allow an attacker to read files outside of the intended directory or influence the behavior of the external docling tool. Given the CVSS score of 9.1, this is a critical issue that could lead to significant data exposure if the application handles untrusted input within these specific headers.

Remediation Plan

Immediate Action: Upgrade to Apache Camel 4.19.0 or 4.18.3 to apply the strict allowlist and path normalization fixes.

Proactive Monitoring: Review Camel routes for any mapping of untrusted message content into the CamelDoclingCustomArguments header.

Compensating Controls: Implement strict input validation at the edge and strip internal Camel headers from messages originating from untrusted sources before they reach the Docling producer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a high risk of argument injection. Organizations should prioritize patching to the recommended versions and ensure that header sanitization is enforced across all Camel routes to prevent untrusted data from reaching the Docling component.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files.

Executive Summary:
An unauthenticated deserialization vulnerability in Pachno 1.0.6 allows attackers to execute arbitrary code by injecting malicious objects into world-writable cache files.

Vulnerability Details

CVE-ID: CVE-2026-40044

Affected Software: Pachno

Affected Versions: 1.0.6

Vulnerability: The application unserializes data from world-writable cache files during the framework bootstrap process before any authentication checks occur. An unauthenticated attacker can exploit this by writing malicious serialized PHP objects to these predictable file paths, leading to remote code execution.

Business Impact

The CVSS score of 9.8 indicates a critical risk, as this vulnerability provides a direct vector for full server compromise. Successful exploitation grants the attacker the ability to execute commands with the privileges of the web server, leading to data exfiltration, system destruction, or further network penetration.

Remediation Plan

Immediate Action: Restrict write permissions on the directory containing the Pachno cache files to prevent unauthorized object injection.

Proactive Monitoring: Monitor the web server’s cache directory for the creation of unexpected files or modifications to existing files that do not correspond to legitimate application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to the ease of exploitation and the level of access granted. Administrators must immediately restrict file system permissions as an interim measure while awaiting an official vendor patch to address the underlying deserialization flaw.

---METADATA---
VENDOR: Pachno
PRODUCT: Pachno
AFFECTED_VERSIONS: 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pachno 1.0.6 is vulnerable to XML external entity (XXE) injection, allowing unauthenticated attackers to read arbitrary files via the TextParser helper.

Executive Summary:
Pachno version 1.0.6 contains a critical XML external entity injection vulnerability that allows unauthenticated remote attackers to read sensitive files from the host system.

Vulnerability Details

CVE-ID: CVE-2026-40042

Affected Software: Pachno

Affected Versions: 1.0.6

Vulnerability: The application utilizes unsafe XML parsing via simplexml_load_string() without proper LIBXML_NONET restrictions. This allows an unauthenticated attacker to inject malicious XML entities into wiki articles or comments, forcing the server to resolve external files.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk of data exfiltration. Attackers can bypass access controls to read configuration files, credentials, or sensitive business data, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Update Pachno to the latest available version provided by the vendor to remediate the unsafe XML parsing implementation.

Proactive Monitoring: Review application logs for unusual XML entity references or repeated failed access attempts to system-level files.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious XML payloads or non-standard external entity resolution requests.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security gap that could lead to complete information disclosure. Administrators should prioritize patching the Pachno instance immediately to prevent unauthenticated access to sensitive system data.