---METADATA---
VENDOR: Delta Electronics
PRODUCT: COMMGR2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Delta Electronics COMMGR2 is affected by a stack-based buffer overflow vulnerability that could lead to arbitrary code execution or system crashes.

Executive Summary:
A critical stack-based buffer overflow in Delta Electronics COMMGR2 allows attackers to potentially execute arbitrary code or cause a total system denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-3630

Affected Software: Delta Electronics COMMGR2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack-based buffer overflow within the COMMGR2 software. While the authentication level is not explicitly defined in the brief, such flaws typically allow an attacker to overwrite memory by sending specially crafted data to a vulnerable function.

Business Impact

A successful exploit of this vulnerability could result in complete system compromise or significant operational downtime. With a CVSS score of 9.8, this is classified as Critical, indicating that the flaw is easily exploitable and carries a high risk of unauthorized remote code execution, which could lead to data theft or the introduction of ransomware into the industrial control environment.

Remediation Plan

Immediate Action: Update Delta Electronics COMMGR2 to the latest available version immediately to patch the buffer overflow flaw.

Proactive Monitoring: Implement network traffic analysis to detect unusual communication patterns or malformed packets directed at the COMMGR2 service.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) and restrict network access to the software to authorized administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its critical severity, the potential for exploitation is extremely high once technical details become known.

Analyst Recommendation

The Critical severity of this vulnerability necessitates immediate attention from security teams. Organizations using Delta Electronics COMMGR2 should prioritize the application of the vendor-supplied patch to mitigate the risk of remote code execution and ensure the continued integrity of their control systems.

---METADATA---
VENDOR: Import and export users and customers
PRODUCT: Import and export users and customers
AFFECTED_VERSIONS: Up to and including 1.x
---END_METADATA---

Description Summary:
The Import and export users and customers WordPress plugin is vulnerable to privilege escalation, enabling attackers to gain unauthorized administrative rights.

Executive Summary:
The Import and export users and customers plugin for WordPress contains a high-severity privilege escalation flaw that allows attackers to elevate their access to administrative levels.

Vulnerability Details

CVE-ID: CVE-2026-3629

Affected Software: Import and export users and customers Import and export users and customers

Affected Versions: All versions up to, and including, 1.x

Vulnerability: This plugin is vulnerable to privilege escalation. An authenticated attacker can exploit flaws in the plugin's user management logic to grant themselves administrative privileges, bypassing intended security restrictions.

Business Impact

The impact is a total loss of control over the WordPress site. An attacker gaining administrative access can perform any action, including data exfiltration, site defacement, and the creation of backdoor accounts. The CVSS score of 8.1 indicates a high risk to the organization's digital assets.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately. If an update is not available, uninstall the plugin until a patch is released.

Proactive Monitoring: Check for any newly created administrator accounts and review the site's user list for discrepancies.

Compensating Controls: Restrict access to user import/export functions to only the most trusted administrators and use file integrity monitoring to detect unauthorized changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, plugins that handle user data and permissions are frequently scrutinized by researchers and attackers alike.

Analyst Recommendation

The ability for an attacker to escalate privileges is a critical security failure. Administrators must apply the update immediately or remove the plugin to mitigate the risk of a full site compromise.

---METADATA---
VENDOR: Honeywell
PRODUCT: IQ4x
AFFECTED_VERSIONS: Factory-default configuration
---END_METADATA---

Description Summary:
Honeywell IQ4x controllers allow unauthenticated remote attackers to create administrative accounts and take full control of building management systems.

Executive Summary:
The Honeywell IQ4x building management controller is subject to a critical authentication bypass that allows unauthenticated attackers to gain full administrative control and lock out legitimate users.

Vulnerability Details

CVE-ID: CVE-2026-3611

Affected Software: Honeywell IQ4x building management controller

Affected Versions: Factory-default configuration (prior to user module enablement)

Vulnerability: In its default state, the device's HMI is exposed without authentication. Because the account creation function (U.htm) is accessible to unauthenticated users, an attacker can create an administrative account, which then enables the user module and locks the system under the attacker's credentials.

Business Impact

This vulnerability has a CVSS score of 10.0, the highest possible. An attacker can take complete control of building systems (HVAC, lighting, etc.) and effectively lock out legitimate operators. This poses significant risks to physical safety, operational continuity, and the security of the facility.

Remediation Plan

Immediate Action: Immediately enable the user module by creating a secure administrative account and updating the firmware to the latest version.

Proactive Monitoring: Scan the network for any Honeywell IQ4x devices that are still operating in a factory-default state or showing unauthorized administrative accounts.

Compensating Controls: Ensure that building management controllers are never exposed directly to the public internet and are protected by a VPN or a robust firewall.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation. However, the "insecure by design" nature of the default configuration makes these devices extremely vulnerable to discovery via automated internet scanning tools.

Analyst Recommendation

This is a critical flaw that requires immediate attention to prevent unauthorized physical infrastructure control. Administrators must ensure that all IQ4x controllers have authentication enabled and are updated to the latest firmware to mitigate this risk.

---METADATA---
VENDOR: Pensar
PRODUCT: Apex
AFFECTED_VERSIONS: <= 0
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A critical vulnerability has been identified in the @pensar/apex software package.

Executive Summary:
The @pensar/apex package is affected by a critical vulnerability that requires immediate attention from security administrators.

Vulnerability Details

CVE-ID: CVE-2026-36044

Affected Software: Pensar Apex

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided information is insufficient to determine the specific technical nature, attack vector, or authentication requirements of this vulnerability.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as high-risk. Potential consequences may include unauthorized system access, loss of data integrity, or service disruption, depending on the role the Apex package plays within the organizational infrastructure.

Remediation Plan

Immediate Action: Consult the official vendor security advisories or repository documentation for @pensar/apex to identify and apply the necessary security updates.

Proactive Monitoring: Monitor server-side logs and application performance metrics for any anomalous activity that deviates from established baselines.

Compensating Controls: If a patch is not immediately available, restrict external access to the affected software component and ensure that least-privilege principles are enforced for all service accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the lack of specific details, maintain a heightened security posture regarding this component.

Analyst Recommendation

The severity of the CVSS score necessitates immediate investigation into your software bill of materials (SBOM) to confirm usage of the affected package. Prioritize updating this dependency as soon as the vendor releases security guidance.

---METADATA---
VENDOR: WordPress
PRODUCT: Riaxe Product Customizer
AFFECTED_VERSIONS: 2.1.2 and below
---END_METADATA---

Description Summary:
The Riaxe Product Customizer plugin for WordPress allows unauthenticated attackers to update arbitrary site options via an unprotected AJAX action.

Executive Summary:
A critical privilege escalation vulnerability in the Riaxe Product Customizer plugin enables unauthenticated attackers to modify site settings and gain administrative control.

Vulnerability Details

CVE-ID: CVE-2026-3596

Affected Software: WordPress Riaxe Product Customizer

Affected Versions: 2.1.2 and below

Vulnerability: The plugin provides an unauthenticated AJAX hook ('wp_ajax_nopriv_install-imprint') that lacks any nonce verification or capability checks. This allows attackers to manipulate critical WordPress options, such as enabling user registration and setting the default user role to administrator.

Business Impact

This vulnerability carries a 9.8 CVSS score, enabling complete site compromise. Attackers can gain unauthorized administrative access, leading to full system takeover and potential data theft.

Remediation Plan

Immediate Action: Update to the latest version of the plugin or deactivate the Riaxe Product Customizer immediately if no patch is available.

Proactive Monitoring: Audit the 'wp_options' table for suspicious changes, particularly settings related to user registration and default roles.

Compensating Controls: Utilize a WAF to block unauthorized requests to the 'wp-admin/admin-ajax.php' endpoint that include the 'install-imprint' action.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of basic security checks in this plugin makes it a high-risk vector. Immediate removal or patching is required to prevent unauthorized administrative escalation.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.20.0-9.20.22, 9.21.0-9.21.21, 9.20.9-S1-9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 may allow for memory corruption or unstable behavior.

Executive Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 poses a risk of service disruption and potential memory exploitation.

Vulnerability Details

CVE-ID: CVE-2026-3593

Affected Software: ISC BIND 9

Affected Versions: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This is a use-after-free vulnerability (CWE-416) within the DNS-over-HTTPS component. The vulnerability is triggered when the application improperly handles memory, which can lead to crashes or arbitrary code execution by an unauthenticated attacker.

Business Impact

The vulnerability carries a CVSS score of 7.4, indicating a High severity risk. Successful exploitation could lead to a denial-of-service (DoS) condition, impacting critical DNS infrastructure, or potentially allow an attacker to gain unauthorized control over the affected BIND server, compromising the integrity of network traffic.

Remediation Plan

Immediate Action: Upgrade immediately to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1.

Proactive Monitoring: Monitor BIND 9 process logs for unexpected termination or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, consider disabling DNS-over-HTTPS functionality if it is not business-critical to mitigate the primary attack vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of DNS services, this vulnerability requires urgent attention. Administrators should prioritize patching BIND instances to the specified versions to prevent potential service instability and unauthorized access, ensuring that critical infrastructure remains resilient against exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Linux-based OS
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can escape a restricted CLI interface in certain Linux-based operating systems to gain root access.

Executive Summary:
A critical vulnerability in the CLI prompt of certain Linux-based systems allows unauthenticated remote attackers to bypass restrictions and gain full root privileges.

Vulnerability Details

CVE-ID: CVE-2026-3587

Affected Software: Linux Linux-based OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a hidden function within the CLI prompt that can be triggered by an unauthenticated remote attacker. This allows the attacker to "escape" the restricted shell environment and execute commands with root-level permissions on the underlying operating system.

Business Impact

The impact is a total compromise of the affected device. With root access, an attacker has unrestricted control over the system, including the ability to modify files, steal data, install persistent malware, and use the system to attack other internal assets. The CVSS score of 10.0 represents the maximum possible risk level.

Remediation Plan

Immediate Action: Apply the latest security patches from the OS vendor immediately to remove the hidden CLI function and secure the restricted interface.

Proactive Monitoring: Audit CLI logs for unusual command sequences and monitor for unauthorized privilege escalation or the creation of new root-level accounts.

Compensating Controls: Restrict access to the CLI interface using network-level access control lists (ACLs) and implement multi-factor authentication (MFA) for all remote access points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, a CVSS 10.0 vulnerability that grants root access is a prime target for sophisticated threat actors and state-sponsored groups.

Analyst Recommendation

This is a "patch now" scenario. The ability for an unauthenticated attacker to gain root access remotely is the highest possible security risk. Immediate remediation via vendor updates is mandatory to protect the integrity of the environment.

---METADATA---
VENDOR: Kali Forms
PRODUCT: Kali Forms plugin for WordPress
AFFECTED_VERSIONS: All versions up to, and including, 2.4.9
---END_METADATA---

Description Summary:
The Kali Forms WordPress plugin is vulnerable to Remote Code Execution (RCE) via the form_process function, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
Unauthenticated attackers can achieve full server compromise by exploiting a Remote Code Execution (RCE) vulnerability in the Kali Forms WordPress plugin.

Vulnerability Details

CVE-ID: CVE-2026-3584

Affected Software: Kali Forms plugin for WordPress

Affected Versions: All versions up to, and including, 2.4.9

Vulnerability: This critical RCE vulnerability exists in the form_process function due to the prepare_post_data function mapping user-supplied keys directly into internal storage. When combined with the insecure use of call_user_func on these values, unauthenticated attackers can trigger arbitrary PHP code execution.

Business Impact

An RCE vulnerability is the most severe type of security flaw, as it allows an attacker to take complete control of the web server. This can lead to total data theft, website defacement, and the use of the server as a pivot point for further internal network attacks. The CVSS score of 9.8 underscores the extreme urgency of this issue.

Remediation Plan

Immediate Action: Update the Kali Forms plugin to the latest patched version (2.5.0 or higher) immediately. If a patch is unavailable, deactivate and remove the plugin.

Proactive Monitoring: Scan for suspicious PHP files in the WordPress uploads and plugin directories and review web server access logs for unusual POST requests to the Kali Forms endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) with generic RCE protection rules to block malicious payloads targeting PHP functions like call_user_func.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in popular WordPress plugins are frequently targeted by automated exploit kits shortly after disclosure.

Analyst Recommendation

Due to the critical nature of unauthenticated Remote Code Execution, this vulnerability must be addressed with the highest priority. Administrators should update the Kali Forms plugin immediately and conduct a thorough security audit of the WordPress environment to ensure no backdoors were established.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in phpMyFAQ versions prior to 4, potentially allowing unauthorized access or impact to the application.

Executive Summary:
The phpMyFAQ application contains a security vulnerability in versions prior to 4 that poses a high risk to organizational data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-35676

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application is susceptible to a vulnerability affecting versions before 4. The specific authentication requirements and technical nature of this flaw remain undisclosed in the current documentation.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the knowledge base, potential data exfiltration, or system compromise. With a CVSS score of 8.2, this flaw is categorized as High severity, indicating a significant risk to the confidentiality and integrity of the hosted information.

Remediation Plan

Immediate Action: Upgrade to phpMyFAQ version 4 or the latest available release provided by the vendor.

Proactive Monitoring: Review application access logs for unusual patterns or unauthorized requests directed at the phpMyFAQ installation.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets to detect and block common attack vectors targeting knowledge management software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, immediate action is required to secure the phpMyFAQ instance. Administrators should prioritize verifying their current version and updating to the latest secure release to mitigate the risk of exploitation.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been identified in phpMyFAQ versions prior to 4, which may expose the system to security risks.

Executive Summary:
The phpMyFAQ application is affected by a security vulnerability in versions prior to 4 that requires urgent attention to prevent unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2026-35675

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects phpMyFAQ versions prior to 4. The specific technical mechanism of the flaw and the required attacker authentication level are not currently specified.

Business Impact

A CVSS score of 8.2 classifies this vulnerability as High severity, suggesting that an attacker could potentially compromise the application. Failure to remediate this issue may result in unauthorized data exposure or service disruption, impacting business operations dependent on the knowledge base.

Remediation Plan

Immediate Action: Apply all vendor-supplied security updates and migrate to version 4 or higher.

Proactive Monitoring: Monitor server logs for suspicious activity and unexpected access patterns originating from external sources.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block malformed requests that could be used to exploit this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability as a priority due to its High CVSS rating. It is strongly recommended that administrators perform an inventory of their phpMyFAQ deployments and apply the necessary patches immediately.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
OpenClaw products contain an unspecified security vulnerability affecting versions released prior to 2026.

Executive Summary:
A high-severity vulnerability in OpenClaw products requires immediate attention to prevent potential unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35674

Affected Software: OpenClaw Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vendor has disclosed a security vulnerability affecting various OpenClaw products. Specific technical details regarding the attack vector and authentication requirements remain undisclosed in the current advisory.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a significant risk to organizational infrastructure. Successful exploitation could lead to unauthorized system access, potential data exfiltration, or service disruption, threatening both operational continuity and data integrity.

Remediation Plan

Immediate Action: Consult the official OpenClaw security portal to identify specific affected products and apply available security updates immediately.

Proactive Monitoring: Review system access logs for anomalous behavior or unauthorized connection attempts targeting OpenClaw interfaces.

Compensating Controls: Implement network-level restrictions and utilize a Web Application Firewall (WAF) to filter suspicious traffic until official patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Given the lack of granular technical data, prioritize reviewing the vendor’s security advisory to determine if your specific environment is at risk and deploy all recommended updates without delay.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability exists in phpMyFAQ versions prior to 4, posing a significant risk to the integrity and security of the application.

Executive Summary:
A critical security vulnerability in phpMyFAQ versions prior to 4 threatens the security of the application and requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-35671

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects versions of phpMyFAQ prior to 4. Further technical details regarding the specific function or parameter involved are currently unavailable.

Business Impact

With a CVSS score of 8.8, this vulnerability is categorized as High/Critical, indicating a high potential for severe impact on the affected system. Unauthorized exploitation could lead to full system compromise, data theft, or prolonged service downtime, disrupting business continuity.

Remediation Plan

Immediate Action: Update the phpMyFAQ installation to version 4 or the most recent stable release to ensure the vulnerability is patched.

Proactive Monitoring: Implement enhanced logging and monitoring to detect anomalous administrative actions or unauthorized access attempts.

Compensating Controls: Deploy a WAF and ensure that the application is restricted to trusted network segments to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The elevated CVSS score of 8.8 necessitates an urgent response. Security teams must ensure that all instances of the affected software are updated to the latest version to prevent potential exploitation and maintain the integrity of the application environment.

---METADATA---
VENDOR: ConnectWise
PRODUCT: ScreenConnect
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical flaw in ScreenConnect allows attackers with access to server-level cryptographic material to obtain unauthorized access and elevated privileges.

Executive Summary:
ConnectWise ScreenConnect contains a high-severity vulnerability that could allow an attacker to gain unauthorized administrative access by leveraging server-level cryptographic materials.

Vulnerability Details

CVE-ID: CVE-2026-3564

Affected Software: ConnectWise ScreenConnect

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves a condition where an actor who has obtained server-level cryptographic material used for authentication can bypass security checks. This allows for unauthorized access and the potential for privilege escalation within the ScreenConnect environment.

Business Impact

Unauthorized access to a remote monitoring and management (RMM) tool like ScreenConnect can lead to a total compromise of all managed endpoints. The CVSS score of 9.0 highlights the severe risk of data exfiltration, ransomware deployment, and long-term persistence within an organization's infrastructure.

Remediation Plan

Immediate Action: Update ScreenConnect to the latest version provided by the vendor and rotate all server-level cryptographic keys and authentication tokens.

Proactive Monitoring: Review ScreenConnect audit logs for unusual login activity, especially from unknown IP addresses or at irregular times, and monitor for unauthorized privilege changes.

Compensating Controls: Implement multi-factor authentication (MFA) for all ScreenConnect accounts and restrict access to the management console using IP allowlisting and VPNs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, ScreenConnect is a high-value target for threat actors, making immediate patching essential.

Analyst Recommendation

Administrators must treat this vulnerability with the highest urgency due to the potential for widespread endpoint compromise. Apply the vendor's updates immediately and ensure that cryptographic secrets are rotated to invalidate any potentially compromised material.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiClientEMS
AFFECTED_VERSIONS: 7.4.5 through 7.4.6
---END_METADATA---

Description Summary:
Fortinet FortiClientEMS versions 7.4.5 and 7.4.6 contain an improper access control vulnerability. Unauthenticated attackers can execute unauthorized code or commands via crafted requests.

Executive Summary:
Fortinet FortiClientEMS is vulnerable to unauthenticated remote command execution due to improper access controls, posing a critical risk to endpoint management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35616

Affected Software: Fortinet FortiClientEMS

Affected Versions: 7.4.5 through 7.4.6

Vulnerability: This vulnerability involves improper access control within the FortiClientEMS management server. An unauthenticated attacker can send specially crafted network requests to the server to execute unauthorized code or OS commands.

Business Impact

Compromise of a FortiClientEMS server is a tier-0 security event, as it allows an attacker to potentially control all connected endpoints. The CVSS score of 9.8 reflects the extreme severity of unauthenticated code execution on a central security management platform. This could lead to enterprise-wide ransomware or data exfiltration.

Remediation Plan

Immediate Action: Update Fortinet FortiClientEMS to the latest patched version (refer to the vendor advisory for specific build numbers) immediately.

Proactive Monitoring: Monitor FortiClientEMS logs for anomalous requests and check for unauthorized administrative accounts or changes in endpoint policies.

Compensating Controls: Restrict access to the FortiClientEMS management ports to trusted administrative IP addresses using a hardware firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, Fortinet products are frequent targets for advanced persistent threat (APT) groups, making immediate patching vital.

Analyst Recommendation

Because FortiClientEMS manages the security posture of all corporate endpoints, this vulnerability represents a critical path for attackers to achieve total environment compromise. Apply the vendor-provided updates immediately and perform a retrospective log analysis to ensure the system has not already been compromised.

---METADATA---
VENDOR: Emissary
PRODUCT: Emissary
AFFECTED_VERSIONS: Prior to 8.39.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A shell injection vulnerability in Emissary workflow files allows attackers with repository write access to execute arbitrary commands, leading to supply chain compromise.

Executive Summary:
A critical shell injection vulnerability in the Emissary workflow engine allows attackers with repository write access to execute arbitrary commands and compromise downstream users.

Vulnerability Details

CVE-ID: CVE-2026-35580

Affected Software: Emissary Emissary

Affected Versions: Prior to 8.39.0

Vulnerability: The vulnerability exists due to the insecure interpolation of user-controlled workflow_dispatch inputs directly into shell commands via ${{ }} syntax within workflow files. This allows an authenticated attacker with repository write access to inject malicious shell commands.

Business Impact

This flaw facilitates supply chain attacks, potentially allowing an attacker to poison build artifacts and impact all users downstream of the affected workflow. The CVSS score of 9.1 reflects the high potential for widespread disruption and unauthorized code execution within the software development lifecycle.

Remediation Plan

Immediate Action: Upgrade the Emissary workflow engine to version 8.39.0 or later to ensure proper sanitization of inputs.

Proactive Monitoring: Inspect existing workflow files for suspicious ${{ }} expressions and review audit logs for unexpected shell commands executed by the workflow engine.

Compensating Controls: Restrict repository write access to trusted personnel only and implement strict peer review processes for all changes to workflow configuration files.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Supply chain security is paramount; failure to remediate this vulnerability could result in the compromise of downstream development pipelines. Organizations should prioritize updating to version 8.39.0 and reviewing repository access permissions to mitigate the risk of malicious command injection.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 6.5.3
---END_METADATA---

Description Summary:
ChurchCRM's backup restore functionality is vulnerable to path traversal, allowing authenticated administrators to overwrite configuration files and achieve remote code execution.

Executive Summary:
A path traversal flaw in ChurchCRM allows an authenticated administrator to achieve remote code execution by overwriting sensitive system configuration files.

Vulnerability Details

CVE-ID: CVE-2026-35573

Affected Software: ChurchCRM

Affected Versions: Prior to 6.5.3

Vulnerability: The vulnerability resides in the src/ChurchCRM/Backup/RestoreJob.php file, where improper handling of the $rawUploadedFile['name'] parameter allows for path traversal. An authenticated administrator can upload arbitrary files, such as a malicious .htaccess file, to the server's directory structure to gain code execution.

Business Impact

While this vulnerability requires administrative authentication, the impact is critical (CVSS 9.1). A compromised administrator account can lead to full server takeover, unauthorized access to sensitive donor and member data, and significant operational disruption of the church management system.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary path validation fixes.

Proactive Monitoring: Audit logs for administrative file upload activity and monitor for unexpected changes to .htaccess files or other sensitive configuration files.

Compensating Controls: Ensure that the web server process runs with the least privileges necessary and that the /tmp_attach/ directory is restricted from executing scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ChurchCRM must verify their current version and apply the 6.5.3 update immediately. Additionally, ensure that administrative access is restricted to authorized personnel only to mitigate the risk of account compromise.