---METADATA---
VENDOR: Unfurl
PRODUCT: Unfurl
AFFECTED_VERSIONS: Through 2025.08
---END_METADATA---

Description Summary:
Unfurl contains an improper input validation vulnerability in configuration parsing that enables Flask debug mode by default, potentially leading to remote code execution.

Executive Summary:
An improper input validation vulnerability in Unfurl allows unauthenticated attackers to enable Flask debug mode, leading to potential remote code execution and sensitive information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-40035

Affected Software: Unfurl Unfurl

Affected Versions: Through 2025.08

Vulnerability: This is an improper input validation flaw within the application's configuration parsing logic. Because the debug configuration value is improperly evaluated as a boolean, an unauthenticated attacker can trigger the Werkzeug debugger to execute arbitrary code.

Business Impact

The vulnerability carries a CVSS score of 9.1, indicating a critical risk to organizational security. Successful exploitation allows for complete system compromise, enabling attackers to extract sensitive data or gain persistent unauthorized access, which could lead to significant reputational damage and operational disruption.

Remediation Plan

Immediate Action: Upgrade Unfurl to the latest version immediately to patch the insecure configuration parsing logic.

Proactive Monitoring: Monitor application logs for unauthorized access to the Werkzeug debugger interface or unusual Flask initialization patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests attempting to reach the Werkzeug debug endpoint or suspicious debug-related headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, organizations should prioritize patching as the primary mitigation strategy. Failure to address this could result in full remote control of the affected infrastructure, necessitating immediate attention from IT security teams.

---METADATA---
VENDOR: FreeRDP
PRODUCT: FreeRDP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in FreeRDP versions prior to 3.0, potentially exposing systems to unauthorized exploitation.

Executive Summary:
Legacy versions of FreeRDP (prior to 3.0) contain a critical security vulnerability that requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-40033

Affected Software: FreeRDP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a high-severity vulnerability affecting versions prior to the 3.0 release. While specific technical details are limited, it involves core protocol handling that could lead to unauthorized system access.

Business Impact

As FreeRDP is a critical component for remote desktop connectivity, this vulnerability could allow an attacker to intercept sessions or compromise the underlying host system. The CVSS score of 8.8 justifies immediate action to prevent unauthorized access or remote code execution.

Remediation Plan

Immediate Action: Upgrade all instances of FreeRDP to version 3.0 or the latest available stable release.

Proactive Monitoring: Monitor network traffic for anomalous RDP-related connections or unexpected session behavior.

Compensating Controls: Restrict RDP access to VPN-only tunnels and implement Multi-Factor Authentication (MFA) for all remote access points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on FreeRDP for remote infrastructure management must prioritize the upgrade path to version 3.0. Failure to update leaves remote access infrastructure highly susceptible to exploitation.

---METADATA---
VENDOR: Users manager – PN
PRODUCT: Users manager – PN
AFFECTED_VERSIONS: Up to and including 1.1.15
---END_METADATA---

Description Summary:
The Users manager – PN WordPress plugin contains a privilege escalation flaw allowing unauthenticated attackers to modify arbitrary user metadata.

Executive Summary:
An unauthenticated privilege escalation vulnerability in Users manager – PN allows attackers to modify arbitrary user account metadata.

Vulnerability Details

CVE-ID: CVE-2026-4003

Affected Software: Users manager – PN (WordPress Plugin)

Affected Versions: Up to and including 1.1.15

Vulnerability: The plugin fails to perform proper authorization checks on an AJAX endpoint, and the required nonce is publicly exposed. This allows unauthenticated attackers to update arbitrary user metadata, including security tokens used for authentication.

Business Impact

This vulnerability is rated at 9.8 CVSS, as it allows an unauthenticated attacker to manipulate user accounts, potentially escalating their own privileges to administrative status. This leads to total site compromise and unauthorized access to administrative functions.

Remediation Plan

Immediate Action: Update the Users manager – PN plugin to the latest available version provided by the vendor.

Proactive Monitoring: Audit user account metadata for unauthorized changes, specifically looking for modifications to security-related fields.

Compensating Controls: Temporarily disable the plugin until a secure update is applied, or use a WAF to block access to the affected AJAX endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of an ineffective nonce and missing authorization checks makes this a critical risk. Administrators must update the plugin immediately and inspect user account records for any signs of tampering.

---METADATA---
VENDOR: Apache
PRODUCT: Wicket
AFFECTED_VERSIONS: 8.0.0 through 8.17.0, 9.0.0, 10.0.0 through 10.8.0
---END_METADATA---

Description Summary:
Apache Wicket fails to invoke the changeSessionId method after session binding, exposing the application to session fixation attacks.

Executive Summary:
A session fixation vulnerability in Apache Wicket allows unauthorized attackers to hijack user sessions due to improper session management.

Vulnerability Details

CVE-ID: CVE-2026-40010

Affected Software: Apache Wicket

Affected Versions: 8.0.0–8.17.0, 9.0.0, 10.0.0–10.8.0

Vulnerability: The application does not properly update the session identifier upon authentication or session binding. This allows an attacker to potentially fix a session ID and hijack a victim's authenticated session.

Business Impact

Session fixation can lead to total unauthorized access to user accounts, including administrative accounts, resulting in data theft and unauthorized transactions. The 9.1 CVSS score reflects the high risk of account takeover and the potential for broad impact on user security.

Remediation Plan

Immediate Action: Upgrade to Apache Wicket version 10.9.0 or the latest recommended release for your specific branch.

Proactive Monitoring: Audit application logs for suspicious session activity or frequent session ID reuse patterns.

Compensating Controls: Implement strict session timeout policies and ensure that all sensitive traffic is protected by HTTPS with the Secure cookie flag enabled.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Addressing this vulnerability is essential for maintaining user trust and security. Administrators should update their dependencies as soon as possible to ensure that session identifiers are correctly rotated upon authentication.

---METADATA---
VENDOR: Woocommerce Custom Product Addons Pro
PRODUCT: Woocommerce Custom Product Addons Pro (WordPress Plugin)
AFFECTED_VERSIONS: Up to and including 5.4.1
---END_METADATA---

Description Summary:
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to unauthenticated Remote Code Execution (RCE) via the PHP eval() function in custom pricing formulas.

Executive Summary:
Unauthenticated attackers can execute arbitrary PHP code on WordPress sites using the Woocommerce Custom Product Addons Pro plugin, resulting in total server takeover.

Vulnerability Details

CVE-ID: CVE-2026-4001

Affected Software: Woocommerce Custom Product Addons Pro

Affected Versions: Up to and including 5.4.1

Vulnerability: The plugin uses the eval() function within process_custom_formula() to handle pricing. Because it fails to properly sanitize user-submitted field values (specifically failing to escape single quotes), an unauthenticated attacker can inject and execute arbitrary PHP code.

Business Impact

A successful exploit grants the attacker full control over the WordPress environment and the underlying web server. This can lead to the theft of customer data, injection of credit card skimmers (Magecart-style), and complete site defacement. The CVSS score of 9.8 indicates a critical risk to the confidentiality and integrity of the e-commerce platform.

Remediation Plan

Immediate Action: Update the Woocommerce Custom Product Addons Pro plugin to the latest patched version immediately.

Proactive Monitoring: Scan the WordPress filesystem for unauthorized PHP files or modifications to core files. Monitor for unusual outbound network connections from the web server.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing PHP execution patterns or suspicious characters in product addon fields.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public evidence of active exploitation. However, RCE vulnerabilities in popular WordPress plugins are frequently targeted by automated botnets shortly after disclosure.

Analyst Recommendation

Due to the critical nature of unauthenticated RCE, administrators must update this plugin immediately. If an update is not available, the plugin should be deactivated until a patch is applied to prevent site compromise.

---METADATA---
VENDOR: Unknown
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A broken access control vulnerability in an unspecified product allows authenticated users to perform horizontal privilege escalation.

Executive Summary:
A critical broken access control vulnerability enables authenticated users to escalate privileges horizontally, potentially leading to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3999

Affected Software: Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is defined as a broken access control flaw that allows an authenticated user to access or manipulate data belonging to other users. This is a horizontal privilege escalation issue, meaning a user can access resources at the same privilege level but belonging to a different account.

Business Impact

This vulnerability poses a significant threat to data privacy and multi-tenant environment security. With a CVSS score of 8.8, it represents a high risk of unauthorized data exposure, which could lead to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Apply the vendor-provided security patch immediately upon availability for all affected software instances.

Proactive Monitoring: Review access logs and audit trails to identify any suspicious user activity that suggests horizontal movement or unauthorized data access.

Compensating Controls: Implement strict role-based access control (RBAC) and, where possible, enforce additional authentication layers for sensitive data access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights the importance of robust access control mechanisms. Administrators should audit user permissions and ensure that security patches are applied as soon as they are released by the respective vendors to prevent privilege escalation.

---METADATA---
VENDOR: OpenCTI
PRODUCT: OpenCTI
AFFECTED_VERSIONS: Prior to 6.9.5
---END_METADATA---

Description Summary:
OpenCTI prior to 6.9.5 contains an EJS template injection vulnerability allowing authenticated users with Manage customization capabilities to execute arbitrary JavaScript on the platform.

Executive Summary:
An authenticated remote code execution vulnerability in OpenCTI allows users with specific administrative privileges to execute arbitrary JavaScript, potentially compromising the platform.

Vulnerability Details

CVE-ID: CVE-2026-39980

Affected Software: OpenCTI

Affected Versions: Prior to 6.9.5

Vulnerability: The vulnerability exists in the safeEjs.ts file, which fails to properly sanitize EJS templates. An attacker with the "Manage customization" capability can exploit this flaw during notifier template execution to run arbitrary JavaScript within the context of the OpenCTI process.

Business Impact

Successful exploitation allows an attacker to gain code execution within the OpenCTI environment. Given the CVSS score of 9.1, this represents a critical risk, as it could lead to the theft of sensitive threat intelligence data, platform takeover, or lateral movement into connected security infrastructure.

Remediation Plan

Immediate Action: Upgrade all OpenCTI instances to version 6.9.5 or later immediately.

Proactive Monitoring: Review audit logs for unusual notifier template modifications or unauthorized access to the customization management interface.

Compensating Controls: Restrict "Manage customization" capabilities to the absolute minimum number of trusted administrators until patching is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of threat intelligence operations. Organizations should prioritize patching to version 6.9.5 to eliminate the risk of arbitrary code execution by malicious or compromised internal accounts.

---METADATA---
VENDOR: n8n
PRODUCT: n8n-MCP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The n8n-MCP server contains an unspecified vulnerability that may expose sensitive documentation, properties, and operations to unauthorized AI assistants.

Executive Summary:
A high-severity vulnerability in the n8n-MCP server poses a significant risk of unauthorized information disclosure regarding sensitive node documentation and operations.

Vulnerability Details

CVE-ID: CVE-2026-39974

Affected Software: n8n n8n-MCP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the Model Context Protocol (MCP) server implementation within n8n. It involves improper handling of access controls or data exposure, potentially allowing unauthorized AI entities to interact with or extract sensitive operational configuration data.

Business Impact

Successful exploitation could lead to the exposure of internal workflow documentation and operational properties, facilitating reconnaissance for further attacks against the n8n environment. Given the CVSS score of 8.5, the risk to intellectual property and internal configuration security is substantial.

Remediation Plan

Immediate Action: Review the official n8n security advisory and apply the latest security patches for the n8n-MCP component immediately.

Proactive Monitoring: Audit logs for unusual access requests to the MCP interface and monitor for unexpected AI-driven queries against sensitive endpoints.

Compensating Controls: Restrict network access to the MCP server endpoint to trusted IP ranges and implement robust authentication mechanisms for all AI-assistant integrations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Organizations utilizing n8n-MCP must treat this issue with high urgency. Ensure all components are updated to the latest supported versions and audit existing integrations to ensure that AI access is limited to the minimum required functionality.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
The Cacti performance management framework is vulnerable to a pre-authentication SQL injection via an improperly validated input parameter in graph_view.php.

Executive Summary:
A critical unauthenticated SQL injection vulnerability in Cacti allows remote attackers to execute arbitrary database queries, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39955

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The application fails to properly sanitize input via the FILTER_VALIDATE_REGEXP in graph_view.php. This allows an unauthenticated attacker to inject malicious SQL commands directly into the database query structure.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the high potential for data exfiltration, database modification, or complete administrative takeover of the Cacti framework. The impact includes significant risk to organizational data integrity and potential unauthorized access to sensitive performance monitoring metrics.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to implement the necessary input validation fixes.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that may indicate SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the graph_view.php endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability is unauthenticated and allows for full database control, immediate patching is required. Organizations should treat this as a high-priority remediation task to protect their monitoring infrastructure from unauthorized access.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
An SQL injection vulnerability in Cacti allows unauthenticated attackers to execute arbitrary database commands via the rfilter parameter in graph_view.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in Cacti 1.2.30 and prior permits remote attackers to compromise the confidentiality, integrity, and availability of the database.

Vulnerability Details

CVE-ID: CVE-2026-39948

Affected Software: Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability stems from improper validation of the 'rfilter' request parameter, which is directly concatenated into SQL queries. An unauthenticated attacker can supply a malicious payload to bypass regex validation, enabling arbitrary SQL injection on installations where guest graph viewing is enabled.

Business Impact

With a CVSS score of 9.3, this flaw is highly critical. A successful exploit grants an attacker the ability to dump sensitive database contents, modify records, or potentially disrupt service, leading to significant data loss or unauthorized access to internal management frameworks.

Remediation Plan

Immediate Action: Upgrade the Cacti installation to version 1.2.31 or later immediately.

Proactive Monitoring: Review database and web server access logs for anomalous SQL queries, particularly those involving 'RLIKE' syntax or unexpected character patterns.

Compensating Controls: Disable guest graph viewing functionality and deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the 'rfilter' parameter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the severity of impact, the potential for exploitation is high.

Analyst Recommendation

The severity of this SQL injection vulnerability necessitates an immediate upgrade to version 1.2.31. Organizations must treat this as a high-priority remediation to prevent unauthorized database access and ensure the continued integrity of the Cacti management framework.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
Cacti versions 1.2.30 and prior contain an unauthenticated Local File Inclusion (LFI) vulnerability via the graph_theme parameter, potentially allowing unauthorized file access.

Executive Summary:
An unauthenticated Local File Inclusion vulnerability in Cacti enables remote attackers to read arbitrary files from the host system, creating a critical risk of sensitive data exposure.

Vulnerability Details

CVE-ID: CVE-2026-39938

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability stems from improper input validation within the graph_theme parameter and rrdtool IPC serialization. This allows an unauthenticated attacker to traverse the file system and include arbitrary local files.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical as it allows for the disclosure of sensitive configuration files, credentials, or system data. Such access facilitates further exploitation and compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to implement the necessary hardening and input sanitization.

Proactive Monitoring: Inspect web server logs for suspicious requests containing directory traversal sequences (e.g., ../) targeting the graph_theme parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block directory traversal patterns and unauthorized file access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of LFI vulnerabilities, immediate patching is required to protect the host environment. Administrators should verify the integrity of the system after applying the update to ensure no unauthorized access occurred previously.

---METADATA---
VENDOR: BridgeHead
PRODUCT: FileStore
AFFECTED_VERSIONS: Prior to 24A
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
BridgeHead FileStore exposes the Apache Axis2 admin module with default credentials, allowing unauthenticated remote code execution.

Executive Summary:
A critical vulnerability in BridgeHead FileStore allows unauthenticated attackers to execute arbitrary OS commands via the exposed Apache Axis2 administration interface.

Vulnerability Details

CVE-ID: CVE-2026-39920

Affected Software: BridgeHead FileStore

Affected Versions: Prior to 24A

Vulnerability: The application incorrectly exposes the Apache Axis2 administration module on network-accessible ports with default credentials. An unauthenticated remote attacker can leverage these credentials to deploy a malicious Java archive and execute arbitrary OS commands on the underlying host.

Business Impact

This vulnerability provides an attacker with full control over the host system, leading to complete system compromise and potential lateral movement within the network. The CVSS score of 9.8 reflects the extreme severity, as the ease of exploitation through default credentials makes this an attractive target for automated threats.

Remediation Plan

Immediate Action: Upgrade to BridgeHead FileStore version 24A or later, which addresses the exposure of the administration module.

Proactive Monitoring: Monitor for unauthorized access to the Apache Axis2 administration portal and inspect the server for any unusual Java archive deployments or unexpected process executions.

Compensating Controls: Immediately restrict network access to the administration module using firewall rules and ensure that all default credentials have been changed across the entire infrastructure.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is an extremely critical vulnerability that facilitates full system compromise. Organizations running BridgeHead FileStore must prioritize patching to version 24A and verify that no management interfaces are exposed to untrusted networks.

---METADATA---
VENDOR: Vvveb
PRODUCT: Vvveb
AFFECTED_VERSIONS: Prior to 1.0.8.1
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
Vvveb is vulnerable to unauthenticated remote code execution via code injection in the installation endpoint's subdir parameter.

Executive Summary:
An unauthenticated code injection vulnerability in Vvveb allows attackers to achieve remote code execution by manipulating configuration files.

Vulnerability Details

CVE-ID: CVE-2026-3918

Affected Software: Vvveb Vvveb

Affected Versions: Prior to 1.0.8.1

Vulnerability: The installation endpoint fails to sanitize the subdir POST parameter before writing it to the env.php configuration file. An unauthenticated attacker can break out of the string context to inject arbitrary PHP code.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to the integrity and availability of the web application. Successful exploitation allows an attacker to execute code as the web server user, leading to full system compromise and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade Vvveb installations to version 1.0.8.1 or later immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests to installation endpoints and verify the integrity of the env.php configuration file for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious injection patterns targeting the installation directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute arbitrary code makes this an urgent security priority. Organizations using Vvveb must verify their versioning and apply the necessary updates without delay.

---METADATA---
VENDOR: V2Board
PRODUCT: V2Board and Xboard
AFFECTED_VERSIONS: V2Board 1.6.1 through 1.7.4; Xboard 0 through 0.1.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
V2Board and Xboard expose authentication tokens in HTTP response bodies during the loginWithMailLink process, allowing unauthenticated attackers to hijack accounts, including those with admin privileges.

Executive Summary:
An authentication token exposure vulnerability in V2Board and Xboard enables unauthenticated attackers to perform full account takeovers by intercepting sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-39912

Affected Software: V2Board and Xboard

Affected Versions: V2Board 1.6.1-1.7.4; Xboard 0-0.1.9

Vulnerability: The application improperly leaks authentication tokens in HTTP response bodies via the loginWithMailLink endpoint. An unauthenticated attacker can supply a known email address to trigger the workflow and obtain a valid bearer token, granting them full access to the target account.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to user and administrative accounts. Exploitation leads to unauthorized access to sensitive user data, configuration changes, and potential full administrative control over the board instance, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update V2Board and Xboard to the latest patched versions provided by the respective maintainers.

Proactive Monitoring: Inspect application logs for anomalous POST requests to the loginWithMailLink endpoint and monitor for unexpected administrative account activity.

Compensating Controls: Disable the login_with_mail_link_enable feature immediately if patching cannot be performed, and implement WAF rules to block suspicious traffic patterns targeting authentication endpoints.

Exploitation Status

Public Exploit Available: Yes (PoC)

Analyst Notes: As of Apr 9, 2026, there is evidence of a Proof-of-Concept (PoC) exploit. Immediate remediation is required to prevent unauthorized account access.

Analyst Recommendation

This vulnerability is highly critical due to the ease of exploitation and the potential for full account takeover. Administrators should apply the vendor-provided patches immediately and review recent access logs for signs of unauthorized token exchange.

---METADATA---
VENDOR: STACKIT
PRODUCT: IaaS API
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A missing authorization check in the STACKIT IaaS API allows low-privileged users to escalate privileges to full organization compromise.

Executive Summary:
A critical authorization bypass in the STACKIT IaaS API allows low-privileged attackers to escalate privileges and gain full control over the organization’s cloud environment.

Vulnerability Details

CVE-ID: CVE-2026-39910

Affected Software: STACKIT IaaS API

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves a missing authorization check on the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach high-privileged service accounts to virtual machines and retrieve OAuth2 tokens from the metadata service.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an existential risk to the organization's cloud infrastructure. An attacker exploiting this can move laterally, access high-privilege credentials, and effectively gain full administrative control over the entire organization's cloud environment, leading to massive data theft and infrastructure destruction.

Remediation Plan

Immediate Action: Update the STACKIT IaaS API to the latest version that enforces proper authorization checks on service account management.

Proactive Monitoring: Audit API logs for unauthorized modifications to virtual machine service accounts and suspicious metadata service queries.

Compensating Controls: Apply the principle of least privilege by restricting user ability to manage service accounts and monitoring for unusual OAuth2 token requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it enables complete cloud environment takeover. Immediate patching of the IaaS API is required, alongside an audit of current service account configurations to identify any prior unauthorized escalations.

---METADATA---
VENDOR: Cacti
PRODUCT: Cacti
AFFECTED_VERSIONS: 1.2.30 and prior
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in Cacti versions 1.2.30 and prior, where the rfilter parameter is unsafely concatenated into an RLIKE clause, reachable by unauthenticated users.

Executive Summary:
An unauthenticated SQL injection vulnerability in Cacti allows remote attackers to execute arbitrary database commands, posing a critical risk of complete database compromise.

Vulnerability Details

CVE-ID: CVE-2026-39893

Affected Software: Cacti Cacti

Affected Versions: 1.2.30 and prior

Vulnerability: The vulnerability occurs because the rfilter request variable is passed directly into a SQL RLIKE clause without proper sanitization. In environments where guest viewing is enabled, an unauthenticated attacker can manipulate database queries to extract or modify data.

Business Impact

The CVSS score of 9.8 reflects the high potential for total database compromise, including the theft of user credentials, system configuration, or monitoring data. This represents a significant risk to the confidentiality and integrity of the entire management framework.

Remediation Plan

Immediate Action: Upgrade Cacti to version 1.2.31 or later to ensure all SQL inputs are properly sanitized and parameterized.

Proactive Monitoring: Review database query logs for unusual patterns or SQL syntax errors that may indicate automated injection attempts.

Compensating Controls: Disable guest access to the Cacti interface if it is not strictly required for business operations to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a critical vulnerability that must be addressed immediately to prevent data exfiltration. Organizations should apply the vendor-provided patch and audit database activity for any signs of post-compromise manipulation.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 4.5.115
---END_METADATA---

Description Summary:
PraisonAI versions prior to 4.5.115 are vulnerable to RCE via insecure YAML parsing, allowing execution of arbitrary JavaScript.

Executive Summary:
A critical Remote Code Execution vulnerability in PraisonAI allows attackers to execute arbitrary JavaScript by uploading malicious YAML files.

Vulnerability Details

CVE-ID: CVE-2026-39890

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.115

Vulnerability: The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML without disabling dangerous tags. This allows an attacker to inject and execute arbitrary JavaScript during the parsing process.

Business Impact

Successful exploitation leads to Remote Code Execution on the server. This allows an attacker to compromise the entire system, access sensitive internal data, and potentially pivot into other parts of the infrastructure, as reflected by the 9.8 CVSS score.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 4.5.115 or later immediately to patch the insecure YAML parsing.

Proactive Monitoring: Review API logs for uploads of suspicious YAML files and monitor for anomalous JavaScript execution.

Compensating Controls: Implement input validation to ensure that uploaded agent definition files strictly adhere to expected schemas and do not contain dangerous YAML tags.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Insecure deserialization is a severe vulnerability. Administrators must prioritize the upgrade to the patched version of PraisonAI to prevent potential remote code execution attacks against their infrastructure.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 1.5.115
---END_METADATA---

Description Summary:
PraisonAI versions prior to 1.5.115 contain a sandbox escape vulnerability in its Python code execution tool, allowing arbitrary code execution.

Executive Summary:
A critical sandbox escape vulnerability in PraisonAI allows attackers to bypass security layers and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-39888

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.115

Vulnerability: The execute_code() function uses an insufficient AST-based blocklist for sandbox mode. Attackers can chain specific attributes to escape the sandbox, access internal Python built-ins, and achieve Remote Code Execution.

Business Impact

The ability to escape the sandbox environment allows an attacker to execute arbitrary commands with the privileges of the application. With a CVSS score of 9.9, this vulnerability presents an extreme risk to server integrity and data security.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.115 or later immediately.

Proactive Monitoring: Monitor for abnormal subprocess activity or attempts to access restricted Python built-ins within the application logs.

Compensating Controls: Run the application within a containerized environment with strict resource limits and read-only filesystems to minimize the impact of a potential escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a high-severity sandbox escape that fundamentally undermines the security of the PraisonAI system. Immediate upgrade to the patched version is mandatory to ensure the integrity of the execution environment.

---METADATA---
VENDOR: NixOS
PRODUCT: Nix
AFFECTED_VERSIONS: All versions prior to 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6
---END_METADATA---

Description Summary:
A symlink following vulnerability in the Nix package manager allows users to overwrite files and escalate privileges to root in multi-user installations.

Executive Summary:
A critical privilege escalation vulnerability in the Nix package manager allows local users to overwrite sensitive files and gain root privileges.

Vulnerability Details

CVE-ID: CVE-2026-39860

Affected Software: NixOS Nix

Affected Versions: Prior to 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6

Vulnerability: This is a flaw in the handling of symlinks during fixed-output derivation registration. A local, authenticated attacker can craft a build that follows a symlink to overwrite arbitrary files, including those owned by the root-privileged Nix daemon.

Business Impact

With a CVSS score of 9.0, this vulnerability poses a severe threat to any multi-user Linux environment using Nix. An attacker can achieve complete system compromise by overwriting system binaries or configuration files, leading to unauthorized root-level access and total control over the host.

Remediation Plan

Immediate Action: Upgrade the Nix package manager to the specified patched versions (e.g., 2.34.5 or the relevant maintenance release) immediately.

Proactive Monitoring: Review system logs for unauthorized modifications to critical system files or unusual build processes initiated by non-privileged users.

Compensating Controls: Restrict access to the Nix daemon to only trusted users if an immediate upgrade is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical for multi-user Linux systems. Administrators must prioritize updating the Nix daemon to prevent local privilege escalation, as the current flaw provides a direct path for any user with build access to gain full administrative control.

---METADATA---
VENDOR: Yii Software
PRODUCT: Yii 2 PHP Framework
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the Yii 2 PHP application framework that may expose the system to security risks.

Executive Summary:
The Yii 2 PHP application framework is affected by a security vulnerability that requires immediate attention from system administrators to prevent potential compromise.

Vulnerability Details

CVE-ID: CVE-2026-39850

Affected Software: Yii Software, Yii 2 PHP Framework

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided data identifies the Yii 2 framework as the affected component but does not specify the exact vulnerability type or the authentication requirements necessary to trigger the flaw.

Business Impact

The lack of specific technical details regarding this vulnerability necessitates a conservative security posture. Given the CVSS score of 7.4 (High), unauthorized access or arbitrary code execution could lead to significant data exfiltration, service disruption, or full server compromise, impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Monitor the official Yii Software security advisory page for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for unusual patterns or unexpected payloads directed at framework-specific endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter malicious traffic and potentially block exploitation attempts targeting common PHP framework vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high severity score, administrators should treat this as a priority. Ensure all framework dependencies are audited and stay updated to the latest secure version once released by the vendor.

---METADATA---
VENDOR: Creative Mail
PRODUCT: Creative Mail – Easier WordPress & WooCommerce Email Marketing
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
The Creative Mail plugin for WordPress is vulnerable to SQL injection via the 'checkout_uuid' parameter, allowing unauthorized database interactions.

Executive Summary:
The Creative Mail plugin for WordPress contains a high-severity SQL injection vulnerability that could allow attackers to manipulate database queries and compromise site data.

Vulnerability Details

CVE-ID: CVE-2026-3985

Affected Software: Creative Mail – Easier WordPress & WooCommerce Email Marketing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is an SQL injection flaw triggered via the 'checkout_uuid' parameter. Based on the plugin architecture, this flaw can likely be exploited by an unauthenticated attacker to execute arbitrary SQL commands against the WordPress database.

Business Impact

Successful exploitation of this SQL injection vulnerability could result in unauthorized access to sensitive customer data, including email marketing lists and WooCommerce transaction details. Given the CVSS score of 7.5, this represents a significant risk to data integrity and confidentiality, potentially leading to regulatory compliance failures and reputational damage.

Remediation Plan

Immediate Action: Update the Creative Mail plugin to the latest available version provided by the vendor. If an update is not currently available, consider disabling or uninstalling the plugin until a secure version is released.

Proactive Monitoring: Review database error logs for suspicious query patterns or unexpected SQL syntax errors. Monitor web traffic for malicious payloads targeting the 'checkout_uuid' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting WordPress plugin parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the Creative Mail plugin must prioritize this update to prevent potential data breaches. Given the critical nature of SQL injection vulnerabilities, immediate mitigation is required to protect the integrity of the WordPress environment.

---METADATA---
VENDOR: Emmett
PRODUCT: Emmett
AFFECTED_VERSIONS: 2.5.0 to before 2.8.1
---END_METADATA---

Description Summary:
The Emmett web framework is vulnerable to path traversal attacks via the RSGI static handler, allowing unauthorized access to arbitrary files.

Executive Summary:
A path traversal vulnerability in Emmett allows an unauthenticated attacker to read arbitrary files on the server by manipulating static file paths.

Vulnerability Details

CVE-ID: CVE-2026-39847

Affected Software: Emmett

Affected Versions: 2.5.0 to before 2.8.1

Vulnerability: The RSGI static handler for internal assets (paths starting with /__emmett__) fails to properly sanitize input. An attacker can use ../ sequences in the URL to escape the assets directory and access sensitive files elsewhere on the filesystem.

Business Impact

This vulnerability (CVSS 9.1) allows for unauthorized disclosure of sensitive system files, configuration files, or source code. The severity is high as it facilitates reconnaissance or direct theft of credentials/secrets, which can be used to further compromise the server environment.

Remediation Plan

Immediate Action: Upgrade the Emmett web framework to version 2.8.1 or later.

Proactive Monitoring: Review web server logs for requests containing ../ sequences directed at the /__emmett__ endpoint.

Compensating Controls: Configure the web server to restrict directory traversal and ensure the web application user has the minimum possible filesystem permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers should prioritize upgrading to version 2.8.1. Given the ease of exploitation for information disclosure, verifying that no sensitive files have been accessed via this method should be a priority during post-patching audits.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Desktop Client
AFFECTED_VERSIONS: Prior to 3.6.4
---END_METADATA---

Description Summary:
SiYuan personal knowledge management system is vulnerable to stored XSS, which can lead to remote code execution in the Electron desktop client.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows an attacker to achieve remote code execution on a victim's machine by syncing a malicious note.

Vulnerability Details

CVE-ID: CVE-2026-39846

Affected Software: SiYuan Desktop Client

Affected Versions: Prior to 3.6.4

Vulnerability: The vulnerability is caused by improper escaping of table caption content, which creates a stored XSS sink. Because the desktop client (based on Electron) operates with nodeIntegration enabled and contextIsolation disabled, the injected JavaScript gains full access to Node.js APIs, enabling remote code execution.

Business Impact

With a CVSS score of 9.0, this flaw poses a severe risk to users. Exploitation allows an attacker to execute arbitrary commands on the user's local workstation, potentially leading to the theft of local credentials, private notes, and complete compromise of the local environment.

Remediation Plan

Immediate Action: Update the SiYuan desktop client to version 3.6.4 or later immediately.

Proactive Monitoring: Users should monitor for suspicious note activity or unexpected synchronization behavior if they suspect their account has been compromised.

Compensating Controls: While difficult to mitigate via network controls, users should avoid syncing or opening notes from untrusted or unknown sources within the SiYuan platform.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.6.4 or later. Given the ability to achieve code execution through simple note synchronization, this update should be treated as a high-priority security maintenance task.

---METADATA---
VENDOR: OpenRemote
PRODUCT: IoT platform
AFFECTED_VERSIONS: 1.21.0 and below
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
OpenRemote contains expression injection vulnerabilities in its rules engine, enabling unauthenticated remote code execution with root-level privileges.

Executive Summary:
A critical expression injection vulnerability in the OpenRemote IoT platform allows attackers to execute arbitrary code with root privileges, leading to full system and multi-tenant compromise.

Vulnerability Details

CVE-ID: CVE-2026-39842

Affected Software: OpenRemote IoT platform

Affected Versions: 1.21.0 and below

Vulnerability: This vulnerability involves an expression injection flaw in the JavaScript and Groovy rules engines. An attacker with the "write:rules" role can bypass authorization and sandbox restrictions to execute arbitrary code with full JVM and root access.

Business Impact

The exploitation of this vulnerability results in complete system compromise, including unauthorized access to sensitive database credentials, arbitrary file reading, and the bypass of multi-tenant security boundaries. Given the CVSS score of 9.9, this represents a severe risk of data exfiltration and total loss of platform integrity, which could lead to significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Upgrade the OpenRemote IoT platform to version 1.22.0 or later immediately to patch the rules engine vulnerabilities.

Proactive Monitoring: Review server logs for suspicious rule creation activity and monitor for unauthorized access attempts to sensitive configuration files or environment variables.

Compensating Controls: Restrict access to the "write:rules" functionality to only the most trusted administrative accounts and utilize network segmentation to isolate the IoT platform from critical infrastructure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for complete root-level compromise of the IoT environment, necessitates an immediate update to version 1.22.0. Organizations should prioritize this deployment to prevent unauthorized access and protect sensitive multi-tenant data.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8
---END_METADATA---

Description Summary:
A path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to achieve privilege escalation via crafted file paths.

Executive Summary:
A critical path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to escalate privileges and compromise the system.

Vulnerability Details

CVE-ID: CVE-2026-39813

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8

Vulnerability: This is a path traversal flaw residing in the file directory handling logic, which can be triggered by an unauthenticated attacker to manipulate system files and escalate privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to organizational security. Successful exploitation allows an attacker to bypass security boundaries, potentially leading to full system compromise, unauthorized access to sensitive sandbox data, and the ability to execute arbitrary code with elevated privileges.

Remediation Plan

Immediate Action: Update FortiSandbox to the latest vendor-supplied version immediately to patch the directory traversal flaw.

Proactive Monitoring: Review system access logs for anomalous directory traversal patterns or unexpected file modification attempts targeting internal system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) with rulesets configured to detect and block directory traversal sequences (e.g., ../) in incoming traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators must prioritize patching affected FortiSandbox appliances. The ability for an unauthenticated attacker to achieve privilege escalation represents a severe threat to the integrity and confidentiality of the entire network segment where the sandbox resides.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: 4.4.0 through 4.4.8
CONFIDENCE: medium
MISSING: exploit_status, technical_details
---END_METADATA---

Description Summary:
Fortinet FortiSandbox versions 4.4.0 through 4.4.8 are susceptible to OS command injection, potentially allowing unauthorized code execution.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to execute unauthorized commands, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39808

Affected Software: Fortinet FortiSandbox

Affected Versions: 4.4.0 through 4.4.8

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command, enabling command injection. The flaw allows an attacker to execute arbitrary code or commands on the underlying system.

Business Impact

A successful exploit of this critical vulnerability (CVSS 9.8) grants an attacker full control over the FortiSandbox appliance. This could lead to complete data exfiltration, lateral movement within the corporate network, and significant operational downtime.

Remediation Plan

Immediate Action: Upgrade Fortinet FortiSandbox to the latest version as specified by the vendor security advisory.

Proactive Monitoring: Review system access logs for anomalous entries or unexpected command execution patterns originating from untrusted sources.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter and block suspicious command injection patterns targeting the appliance management interface.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.8, this vulnerability represents an immediate threat to the environment. Security teams must prioritize patching affected FortiSandbox instances to the latest secure version to prevent unauthorized system access and potential exploitation.