---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to inject arbitrary PHP code, resulting in full server compromise.

Executive Summary:
A critical pre-authentication remote code execution vulnerability in the ChurchCRM setup wizard allows unauthenticated attackers to achieve full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-39337

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is a pre-authentication remote code execution vulnerability originating from improper sanitization of the "$dbPassword" variable during the installation process. It serves as an incomplete remediation for a previous vulnerability (CVE-2025-62521).

Business Impact

Successful exploitation grants an attacker complete control over the underlying server, enabling data theft, lateral movement, and the installation of persistent backdoors. Given the critical CVSS score of 10, this vulnerability represents an existential threat to the integrity and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Update ChurchCRM to version 7.1.0 immediately; if installation is currently in progress, ensure the environment is isolated until the patch is applied.

Proactive Monitoring: Audit server logs for unexpected execution of PHP files or anomalous processes initiated during or after the installation phase.

Compensating Controls: Ensure the installation directory is protected by strict file system permissions and restrict public access to the setup wizard interface.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents the highest level of risk, allowing for total server takeover. It is imperative that administrators verify their ChurchCRM installations are updated to 7.1.0 to prevent remote command execution and maintain the security of the host environment.

---METADATA---
VENDOR: Trilium
PRODUCT: Trilium Notes
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Trilium Notes application, a cross-platform personal knowledge base tool.

Executive Summary:
Trilium Notes is vulnerable to a security flaw that may allow unauthorized access or data compromise within the application.

Vulnerability Details

CVE-ID: CVE-2026-39310

Affected Software: Trilium Trilium Notes

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects Trilium Notes, which is used for managing large personal knowledge bases. The specific technical details of the vulnerability are currently sparse, preventing a precise determination of the attack surface.

Business Impact

The CVSS score of 8.6 qualifies this as a High severity vulnerability. Successful exploitation could lead to the unauthorized disclosure of sensitive information stored within personal knowledge bases or potential system-level compromise, depending on the application's deployment environment.

Remediation Plan

Immediate Action: Apply all vendor-supplied security updates immediately upon release to ensure the application environment is secured.

Proactive Monitoring: Monitor for unusual modifications to note databases or unauthorized access attempts to the application interface.

Compensating Controls: Restrict network access to the application instance to trusted users and networks to minimize the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Trilium Notes should treat this vulnerability as a significant risk to their personal or organizational data. Maintain vigilance for official vendor announcements and apply updates immediately to maintain the security of stored information.

---METADATA---
VENDOR: PraisonAI
PRODUCT: PraisonAI
AFFECTED_VERSIONS: Prior to 1.5.113
---END_METADATA---

Description Summary:
A Path Traversal vulnerability in the PraisonAI Action Orchestrator allows attackers to read or write arbitrary files on the host system.

Executive Summary:
A critical Path Traversal flaw in PraisonAI enables attackers to overwrite sensitive files or execute payloads via the Action Orchestrator.

Vulnerability Details

CVE-ID: CVE-2026-39305

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.113

Vulnerability: The Action Orchestrator fails to sanitize input paths, permitting the use of directory traversal sequences (../). This allows an attacker to escape the designated workspace directory and perform unauthorized file system operations.

Business Impact

With a CVSS score of 9.0, this vulnerability allows for significant system-level impact. Attackers can gain persistence, modify configuration files, or overwrite binaries, leading to total compromise of the PraisonAI host.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.113 or later to patch the path validation logic.

Proactive Monitoring: Monitor file system activity logs for unauthorized modifications to sensitive directories and binary files.

Compensating Controls: Run the application within a containerized environment with a read-only root file system and strictly limited volume mounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities in orchestration systems are extremely dangerous. Organizations must upgrade to version 1.5.113 immediately to prevent potential remote code execution or system file tampering.

---METADATA---
VENDOR: Pivotal
PRODUCT: CRM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in Pivotal CRM that may allow unauthorized access or impact system integrity.

Executive Summary:
A high-severity vulnerability in Pivotal CRM poses a significant risk to organizational data integrity and system access control.

Vulnerability Details

CVE-ID: CVE-2026-39253

Affected Software: Pivotal CRM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within Pivotal CRM. Based on the CVSS score of 8.1, this flaw likely allows for unauthorized actions that could compromise the confidentiality or integrity of the CRM environment.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive customer data, potentially resulting in regulatory non-compliance and significant reputational harm. With a CVSS score of 8.1, the vulnerability is classified as High, indicating that successful exploitation could lead to a substantial compromise of the CRM's core functionality.

Remediation Plan

Immediate Action: Apply all vendor-supplied security patches for Pivotal CRM immediately upon release.

Proactive Monitoring: Monitor system and application access logs for unusual patterns or unauthorized administrative activity.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to filter malicious traffic targeting the CRM interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, organizations should treat this vulnerability with urgency. Administrators must verify their current version against the vendor's security documentation and prioritize patching to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Agents component of Google Chrome allows unauthenticated remote attackers to potentially execute arbitrary code via a crafted web page.

Executive Summary:
Google Chrome versions prior to 146 are susceptible to a use-after-free vulnerability in the Agents component, which could lead to remote code execution by an unauthenticated attacker.

Vulnerability Details

CVE-ID: CVE-2026-3917

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a use-after-free (UAF) vulnerability in the "Agents" component of Chrome. An unauthenticated remote attacker can exploit this by manipulating memory through a malicious website, causing the browser to reference memory that has already been freed.

Business Impact

A use-after-free condition can be reliably used to achieve remote code execution (RCE). This allows an attacker to bypass security boundaries and potentially gain access to local files or the corporate network. The CVSS score of 8.8 highlights the severe potential for system compromise and data breach.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 146 or later immediately to fix the memory management flaw in the Agents component.

Proactive Monitoring: Use memory-protection features provided by modern operating systems and monitor for unusual activity in the Chrome GPU or renderer processes.

Compensating Controls: Employ a robust web gateway solution to block access to untrusted or high-risk web categories, reducing the likelihood of encountering an exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Use-after-free vulnerabilities are common targets for sophisticated attackers seeking to bypass browser security.

Analyst Recommendation

The severity of a use-after-free vulnerability in a core browser component cannot be overstated. It provides a direct path for remote attackers to compromise end-user devices. Immediate patching to version 146 is the primary and most effective recommendation to mitigate this critical security risk.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
Google Chrome contains a heap buffer overflow in the WebML component, enabling unauthenticated remote attackers to achieve memory corruption or code execution via malicious pages.

Executive Summary:
A heap buffer overflow in the WebML component of Google Chrome prior to version 146 allows remote, unauthenticated attackers to potentially execute code on a victim's system.

Vulnerability Details

CVE-ID: CVE-2026-3915

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a heap buffer overflow within the WebML framework. An unauthenticated attacker can exploit this by hosting a malicious page that, when rendered by Chrome, overflows allocated memory buffers to gain control over program execution.

Business Impact

This vulnerability threatens the integrity of the user's computing environment. If exploited, it could lead to the theft of sensitive session data, credentials, or the installation of malware. The CVSS score of 8.8 reflects the high impact on confidentiality and availability should a remote execution occur.

Remediation Plan

Immediate Action: Force an update of Google Chrome to the latest stable version (146 or higher) to patch the vulnerable WebML code.

Proactive Monitoring: Monitor network traffic for connections to suspicious domains and review endpoint logs for browser-related crashes which may indicate failed exploit attempts.

Compensating Controls: Utilize browser sandboxing and application control policies to limit the potential impact of a successful browser exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Historically, WebML-related flaws are prime candidates for exploitation due to the complexity of media processing.

Analyst Recommendation

To maintain a secure posture, it is critical to address browser vulnerabilities before they are integrated into active exploit kits. We recommend an immediate audit of all installed Chrome versions and the mandatory application of the version 146 update to eliminate the risk of heap-based memory corruption.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 146
---END_METADATA---

Description Summary:
A heap buffer overflow vulnerability in the WebML component of Google Chrome allows unauthenticated remote attackers to potentially execute arbitrary code via crafted web content.

Executive Summary:
Google Chrome is vulnerable to a heap buffer overflow in its WebML component, which could allow a remote attacker to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-3913

Affected Software: Google Chrome

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a heap buffer overflow vulnerability located in the WebML implementation. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a specially crafted, malicious website, leading to memory corruption.

Business Impact

Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser's sandbox or cause the application to crash. Given the ubiquity of Chrome in corporate environments, this poses a risk of workstation compromise and subsequent lateral movement. The CVSS score of 8.8 indicates a high severity due to the ease of remote delivery via the web.

Remediation Plan

Immediate Action: Update Google Chrome to version 146 or later across all workstations to resolve the underlying memory management issue.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual browser child processes or unexpected memory allocation patterns.

Compensating Controls: Implement web filtering to prevent users from visiting known malicious or untrusted websites that could host exploit code.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Browser-based heap overflows are frequently targeted for "drive-by download" attacks, making rapid patching essential.

Analyst Recommendation

The risk of remote code execution through a standard web browser is a high-priority threat. Organizations must ensure that Chrome's auto-update feature is enabled and functional across the enterprise. Immediate deployment of version 146 is the only effective way to mitigate this memory corruption vulnerability and protect end-user systems.

---METADATA---
VENDOR: Iru, Inc
PRODUCT: Kandji Agent
AFFECTED_VERSIONS: Before v.4.7.5(5374)
---END_METADATA---

Description Summary:
A local privilege escalation vulnerability in the Kandji Agent allows attackers to invoke restricted functionality through a client validation gap.

Executive Summary:
A local privilege escalation vulnerability in the Kandji Agent prior to version 4.7.5(5374) could allow an attacker to gain elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2026-39118

Affected Software: Iru, Inc Kandji Agent

Affected Versions: Before v.4.7.5(5374)

Vulnerability: This vulnerability is caused by a client validation gap in the Kandji Agent. A local attacker can exploit this weakness to bypass intended restrictions and invoke privileged agent functionality, leading to privilege escalation.

Business Impact

The 8.4 CVSS score indicates a high risk for local environments. An attacker who has already gained low-level access to a machine can use this vulnerability to escalate their privileges to match the agent's service account, potentially allowing full control over the affected device and bypassing security management policies.

Remediation Plan

Immediate Action: Update the Kandji Agent to version v.4.7.5(5374) or later to close the validation gap.

Proactive Monitoring: Monitor for unexpected execution of agent-related commands or unauthorized attempts to access protected system configurations.

Compensating Controls: Enforce strict access control on local user accounts and apply the principle of least privilege to minimize the risk of a local attacker reaching the vulnerable agent.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical in managed environments. Administrators should deploy the updated version of the Kandji Agent across all endpoints immediately to prevent local attackers from elevating their access and compromising the integrity of the managed fleet.

---METADATA---
VENDOR: Apartment Visitors Management System
PRODUCT: Apartment Visitors Management System
AFFECTED_VERSIONS: V1.1
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
The Apartment Visitors Management System is vulnerable to unauthenticated SQL injection via the login page's username parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Apartment Visitors Management System allows attackers to retrieve sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-39109

Affected Software: Apartment Visitors Management System Apartment Visitors Management System

Affected Versions: V1.1

Vulnerability: A SQL injection vulnerability exists in the index.php login page within the username parameter. This flaw allows an unauthenticated attacker to manipulate backend SQL queries to bypass authentication or extract data from the database.

Business Impact

The CVSS score of 9.4 highlights the severity of this vulnerability, which could lead to the unauthorized exposure of sensitive visitor or system data. Such a breach can result in significant reputational damage and potential regulatory non-compliance regarding data privacy.

Remediation Plan

Immediate Action: Restrict access to the login page via network controls and contact the vendor for a security patch. If no patch exists, consider implementing custom input sanitization for the vulnerable parameter.

Proactive Monitoring: Monitor database query logs for anomalous activity, such as unexpected UNION operations or high volumes of failed authentication attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious payloads directed at the login interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease with which an unauthenticated attacker can access the database, this vulnerability requires immediate mitigation. Administrators should prioritize restricting public access to the vulnerable login page until a formal patch is applied.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to 146
---END_METADATA---

Description Summary:
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.

Executive Summary:
Active exploitation of a V8 engine flaw in Google Chrome allows unauthenticated remote attackers to execute arbitrary code, posing a severe threat to enterprise security.

Vulnerability Details

CVE-ID: CVE-2026-3910

Affected Software: Google Chrome

Affected Versions: Prior to 146

Vulnerability: The vulnerability stems from an "inappropriate implementation" within the V8 JavaScript engine. This type of flaw typically involves logic errors in the JIT (Just-In-Time) compiler, which an unauthenticated remote attacker can exploit to bypass memory safety protections and execute code.

Business Impact

With a CVSS score of 8.8 and confirmed active exploitation, the business impact is significant. A successful attack can result in the full compromise of the browser process, potentially allowing for sandbox escapes and subsequent infection of the underlying host system. This endangers sensitive corporate data and user credentials.

Remediation Plan

Immediate Action: Force an update of Google Chrome to version 146 or higher to close the exploitation window.

Proactive Monitoring: Monitor for crashes in the Chrome renderer process and investigate any associated shellcode-like behavior detected by security software.

Compensating Controls: Implement "Site Isolation" features and use application control software to prevent unauthorized executables from running on workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This vulnerability is listed on the CISA KEV, confirming that it is being used in active attacks. Organizations have a very limited timeframe to apply patches before the risk of widespread compromise increases.

Analyst Recommendation

Immediate patching is the only effective defense against this actively exploited V8 flaw. Administrators should prioritize this update alongside CVE-2026-3909, as both affect the same software version and are being targeted simultaneously by threat actors. Ensure all users restart their browsers to finalize the update.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Prior to 146
---END_METADATA---

Description Summary:
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.

Executive Summary:
A high-severity out-of-bounds write in Google Chrome's Skia engine is under active exploitation, allowing attackers to execute arbitrary code via malicious web content.

Vulnerability Details

CVE-ID: CVE-2026-3909

Affected Software: Google Chrome

Affected Versions: Prior to 146

Vulnerability: This vulnerability is an out-of-bounds write within the Skia component, which handles graphics rendering. An unauthenticated attacker can trigger this flaw by enticing a user to visit a specially crafted website, leading to memory corruption and potential remote code execution (RCE) within the browser's sandbox.

Business Impact

As a CVSS 8.8 vulnerability included in the CISA KEV, the risk is immediate and verified. Successful exploitation can lead to the compromise of user workstations, theft of session cookies, and unauthorized access to corporate web applications. The active exploitation status elevates this from a theoretical risk to a confirmed threat.

Remediation Plan

Immediate Action: Update Google Chrome to version 146 or later immediately across the entire enterprise to mitigate active threats.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to look for suspicious child processes originating from Chrome or unusual memory allocation patterns.

Compensating Controls: Deploy web filtering to block access to known malicious domains and ensure browser sandboxing features are strictly enforced via Group Policy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: This vulnerability is confirmed to be under active exploitation in the wild. While a public exploit payload may not be broadly available, the inclusion in CISA KEV indicates that sophisticated threat actors are currently utilizing this flaw.

Analyst Recommendation

Due to confirmed active exploitation, this vulnerability must be treated with the highest priority. IT teams should automate the deployment of Chrome version 146 and verify that all endpoints have successfully updated. The 13-day window remaining for remediation emphasizes the urgency of this action.

---METADATA---
VENDOR: Ntfy
PRODUCT: ntfy.sh
AFFECTED_VERSIONS: Before v.2.21
---END_METADATA---

Description Summary:
A vulnerability in the parseActions function of ntfy.sh allows remote attackers to execute arbitrary code.

Executive Summary:
A critical code execution vulnerability in ntfy.sh allows unauthenticated remote attackers to compromise the server by exploiting the parseActions function.

Vulnerability Details

CVE-ID: CVE-2026-39087

Affected Software: ntfy.sh

Affected Versions: Before v.2.21

Vulnerability: The parseActions function incorrectly handles user-supplied data, leading to a vulnerability that allows for arbitrary code execution. This can be triggered by a remote attacker without authentication.

Business Impact

With a CVSS score of 9.8, this flaw represents a significant risk to any infrastructure running ntfy.sh. Exploitation allows an attacker to gain control over the server, potentially leading to unauthorized data access and service disruption.

Remediation Plan

Immediate Action: Update ntfy.sh to version 2.21 or later.

Proactive Monitoring: Review server logs for suspicious activity and monitor for unexpected outbound network connections from the ntfy service.

Compensating Controls: Implement network-level access controls to limit exposure of the ntfy service to trusted users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an unauthenticated attacker to execute arbitrary code makes this a top-priority item. Administrators must update the software immediately to protect against potential remote exploitation.

---METADATA---
VENDOR: PrestaShop
PRODUCT: upsshipping
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability affects the PrestaShop upsshipping module, potentially exposing the application to unauthorized actions.

Executive Summary:
The PrestaShop upsshipping module contains an unspecified vulnerability that may pose a significant security risk to the host e-commerce platform.

Vulnerability Details

CVE-ID: CVE-2026-39079

Affected Software: PrestaShop upsshipping

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability details are currently sparse; however, it affects all versions through at least 2. The authentication requirements for this flaw remain undetermined based on available data.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access or potential compromise of the e-commerce environment. With a CVSS score of 7.5, this is categorized as a High severity issue that could result in data leakage or service disruption if left unpatched.

Remediation Plan

Immediate Action: Consult the official PrestaShop security advisories or the module developer's documentation to identify if a patched version is available for deployment.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns or unexpected administrative modifications originating from the upsshipping module path.

Compensating Controls: If a patch is unavailable, restrict public access to the affected module or utilize a Web Application Firewall (WAF) to filter suspicious requests targeting the module's URI.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators should prioritize checking for updates from the module vendor. Until specific technical details are released, exercise caution and implement network-level restrictions to limit the exposure of the affected component.

---METADATA---
VENDOR: Oinone
PRODUCT: Pamirs
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Oinone Pamirs 7. The exact technical nature of the flaw remains unspecified in current disclosures.

Executive Summary:
Oinone Pamirs 7 contains a security vulnerability that poses a high risk to organizational systems due to its potential for unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39054

Affected Software: Oinone Pamirs

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific technical details of this vulnerability are currently limited, but it is classified as a high-severity flaw requiring immediate administrative attention. Authentication requirements are currently unknown.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a significant risk to business continuity and data integrity. Successful exploitation could lead to unauthorized system access, potentially resulting in the compromise of sensitive organizational data or operational disruption.

Remediation Plan

Immediate Action: Consult the official Oinone security portal to identify and apply the latest security patches or configuration updates.

Proactive Monitoring: Audit system access logs for anomalous behavior or unauthorized connection attempts originating from untrusted sources.

Compensating Controls: Implement network-level access controls and ensure that the Pamirs instance is not exposed to the public internet without adequate WAF protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the lack of detailed technical specifications, it is imperative that administrators maintain a posture of heightened vigilance. We recommend prioritizing the identification of the affected software version within your environment and applying vendor-supplied updates as soon as they become available.

---METADATA---
VENDOR: EPSON
PRODUCT: L14150 FL27PB
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the EPSON L14150 FL27PB printer allows remote unauthenticated attackers to execute arbitrary code via the RAW Printing Service (JetDirect) on TCP port 9100.

Executive Summary:
The EPSON L14150 FL27PB printer is vulnerable to remote code execution via the JetDirect printing service, posing a severe risk to network-connected devices.

Vulnerability Details

CVE-ID: CVE-2026-39047

Affected Software: EPSON, L14150 FL27PB

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a buffer overflow in the RAW Printing Service (JetDirect), which listens on TCP port 9100. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution on the printer hardware.

Business Impact

A CVSS score of 7.5 (High) reflects the critical nature of remote code execution on network-attached hardware. Successful exploitation could allow an attacker to gain persistent access to the printer, potentially using it as a pivot point to launch further attacks against the internal network or steal sensitive printed data.

Remediation Plan

Immediate Action: Update the printer firmware to the latest version provided by EPSON to remediate the buffer overflow.

Proactive Monitoring: Monitor network traffic directed at TCP port 9100 for anomalous payloads or high volumes of unexpected traffic.

Compensating Controls: If a firmware update is not immediately possible, restrict access to the printer's TCP port 9100 to known, trusted IP addresses using a hardware firewall or VLAN segmentation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it is remotely exploitable without authentication. Organizations should immediately isolate affected printers from public-facing or untrusted networks and apply firmware patches as the primary mitigation strategy.

---METADATA---
VENDOR: Carlson
PRODUCT: VASCO-B GNSS Receiver
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Carlson VASCO-B GNSS Receiver lacks authentication, allowing unauthenticated attackers to modify configurations and operational functions.

Executive Summary:
A critical authentication bypass vulnerability in the Carlson VASCO-B GNSS Receiver allows unauthenticated attackers to fully control the device.

Vulnerability Details

CVE-ID: CVE-2026-3893

Affected Software: Carlson VASCO-B GNSS Receiver

Affected Versions: See vendor advisory

Vulnerability: This is an authentication bypass vulnerability due to a complete lack of an authentication mechanism. An attacker with network access can directly interface with the device to modify its operational functions and configuration.

Business Impact

The CVSS score of 9.4 highlights the critical risk of this vulnerability. An attacker could tamper with critical GNSS data, leading to operational disruption, safety risks in navigation, or unauthorized control over the receiver's output.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Carlson to enable authentication mechanisms.

Proactive Monitoring: Monitor network access logs for connections to the receiver from unauthorized IP addresses.

Compensating Controls: Isolate the GNSS receiver on a dedicated, non-routable management network to prevent unauthorized access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 28, 2026, there is no evidence of active exploitation. However, the lack of authentication makes this device highly vulnerable to any attacker with network reach.

Analyst Recommendation

Given the critical nature of the vulnerability, it is imperative to secure the device by applying the vendor-provided patch. If patching is delayed, immediate network isolation of the device is required to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Pix for WooCommerce
PRODUCT: Pix for WooCommerce (WordPress Plugin)
AFFECTED_VERSIONS: Up to and including 1.5.0
---END_METADATA---

Description Summary:
The Pix for WooCommerce WordPress plugin (up to 1.5.0) is vulnerable to unauthenticated arbitrary file uploads due to missing capability checks and file type validation.

Executive Summary:
Unauthenticated attackers can upload malicious files, including web shells, to WordPress servers running the Pix for WooCommerce plugin, leading to complete site takeover.

Vulnerability Details

CVE-ID: CVE-2026-3891

Affected Software: Pix for WooCommerce (WordPress Plugin)

Affected Versions: Up to and including 1.5.0

Vulnerability: The lkn_pix_for_woocommerce_c6_save_settings function lacks both a capability check (authorization) and file type validation. This allows any unauthenticated visitor to upload arbitrary files, such as PHP scripts, directly to the server's web directory.

Business Impact

This is a critical vulnerability with a CVSS score of 9.8. Successful exploitation allows for unauthenticated remote code execution (RCE). An attacker can gain full control over the WordPress installation, steal customer data, deface the website, or use the server to launch further attacks, causing severe reputational and financial damage.

Remediation Plan

Immediate Action: Update the Pix for WooCommerce plugin to the latest patched version immediately. If no patch is available, deactivate and remove the plugin.

Proactive Monitoring: Scan the WordPress wp-content/uploads directory for suspicious PHP files and review web server logs for POST requests to the affected function.

Compensating Controls: Use a Web Application Firewall (WAF) with rules to block PHP file uploads and restrict directory execution permissions for the uploads folder.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation. However, arbitrary file upload vulnerabilities in popular WordPress plugins are highly sought after and are typically exploited within days of public disclosure.

Analyst Recommendation

The lack of basic security checks in a file upload function is a critical failure. Administrators must update the plugin immediately to mitigate the risk of a total site compromise. Given the severity, we recommend a full security audit of the WordPress environment to ensure no backdoors were planted if the plugin was already exposed.

---METADATA---
VENDOR: kvf
PRODUCT: kvf-admin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
An insecure permissions vulnerability exists in kvf-admin version 1, potentially allowing unauthorized access or modification.

Executive Summary:
An insecure permissions vulnerability in kvf-admin version 1 could allow unauthorized users to gain elevated access or perform administrative actions.

Vulnerability Details

CVE-ID: CVE-2026-38807

Affected Software: kvf kvf-admin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an insecure permissions vulnerability within the administration interface (kvf-admin). The flaw likely allows users to bypass intended access controls, though the specific level of authentication required depends on the implementation details.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the integrity and confidentiality of the administrative environment. Unauthorized access can lead to privilege escalation, data exfiltration, or complete administrative takeover of the affected system.

Remediation Plan

Immediate Action: Review and restrict access to the kvf-admin interface and apply vendor-provided security updates as soon as they become available.

Proactive Monitoring: Monitor audit logs for unauthorized access attempts or suspicious administrative actions within the kvf-admin dashboard.

Compensating Controls: Place the administrative interface behind a VPN or use IP whitelisting to limit access to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate administrative review. Ensure that access to the kvf-admin interface is strictly controlled and that the system is patched to the latest version as soon as the vendor releases a fix.