---METADATA---
VENDOR: OpenSIPS
PRODUCT: Control Panel (opensips-cp)
AFFECTED_VERSIONS: prior to version 9.3.3
---END_METADATA---

Description Summary:
A Time-Based Blind SQL Injection vulnerability exists in the alias_management module of the OpenSIPS Control Panel.

Executive Summary:
An authenticated SQL injection vulnerability in OpenSIPS Control Panel allows attackers to extract sensitive database information via the alias_management module.

Vulnerability Details

CVE-ID: CVE-2026-36670

Affected Software: OpenSIPS Control Panel

Affected Versions: prior to version 9.3.3

Vulnerability: The alias_management module fails to properly sanitize user inputs, enabling a Time-Based Blind SQL Injection. An authenticated attacker can execute arbitrary SQL commands by manipulating parameters within this module.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk of data breach and unauthorized database modification. Successful exploitation could lead to full database compromise, where sensitive configuration or user data is exfiltrated or manipulated, undermining the security of the entire telephony infrastructure.

Remediation Plan

Immediate Action: Update OpenSIPS Control Panel to version 9.3.3 or later immediately.

Proactive Monitoring: Enable database query logging and monitor for unusual query execution times, which are indicative of time-based injection attacks.

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection detection rules to inspect and block malicious input directed at the alias_management module.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 17, 2026, a public exploit is available for this vulnerability. Given the ease of exploitation, the risk to unpatched systems is critical.

Analyst Recommendation

The availability of a public exploit significantly elevates the risk associated with this vulnerability. Organizations using OpenSIPS Control Panel must upgrade to version 9.3.3 immediately. Security teams should perform a forensic review of database logs to determine if unauthorized access has already occurred.

---METADATA---
VENDOR: WordPress
PRODUCT: wpForo Forum Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 2.

Executive Summary:
An arbitrary file deletion vulnerability in the wpForo Forum WordPress plugin could allow unauthorized removal of critical system files.

Vulnerability Details

CVE-ID: CVE-2026-3666

Affected Software: WordPress wpForo Forum Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains a vulnerability that allows for arbitrary file deletion. This can lead to service instability or the deletion of critical configuration files, depending on the attacker's ability to interact with the plugin's functionality.

Business Impact

With a CVSS score of 8.8, this is a high-risk vulnerability. An attacker could potentially disrupt business operations by deleting essential files, leading to site downtime or the removal of security-critical configuration files that could facilitate further system compromise.

Remediation Plan

Immediate Action: Update the wpForo Forum plugin to the latest version immediately to resolve the file deletion flaw.

Proactive Monitoring: Monitor file system integrity and review WordPress logs for unusual activity related to the plugin.

Compensating Controls: Remove the plugin if it is not strictly necessary for business operations, and ensure that the WordPress installation is running with restricted file system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe and requires immediate remediation. Organizations should update the plugin as soon as a patch is confirmed available by the developer or remove the plugin to eliminate the risk entirely.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router allows UPnP AddPortMapping to forward external traffic to the router's own administrative interface, exposing it to unauthorized access.

Executive Summary:
A critical vulnerability in the Mercusys AC12G router’s UPnP implementation allows attackers to expose the device's internal administrative interface to the internet, creating a significant risk of unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-36608

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: The router's UPnP service improperly validates AddPortMapping requests, allowing an attacker to map external ports to the router's internal administrative interface. This effectively bypasses network segmentation by making the admin panel accessible from outside the local network.

Business Impact

With a CVSS score of 8.8, this flaw is highly critical as it directly exposes administrative controls to external actors. Successful exploitation allows for unauthorized management of the router, potentially resulting in full device control, credential theft, or the interception of sensitive network traffic.

Remediation Plan

Immediate Action: Disable the UPnP feature on the router immediately if it is not strictly required for network operations.

Proactive Monitoring: Audit current port forwarding rules and UPnP mappings to ensure no unintended services or administrative interfaces are exposed to the WAN.

Compensating Controls: Implement a firewall rule to block all inbound traffic to the router's administrative port from external sources, regardless of UPnP settings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Exposing administrative interfaces to the internet is a severe security failure. Organizations should disable UPnP functionality immediately and verify that no management interfaces are accessible from external networks to mitigate the risk of unauthorized exploitation.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router contains an unauthenticated brute-force vulnerability in the TDDP password change endpoint due to a lack of rate limiting.

Executive Summary:
An unauthenticated brute-force vulnerability in the Mercusys AC12G router firmware allows attackers to bypass password change protections, posing a significant risk of unauthorized device takeover.

Vulnerability Details

CVE-ID: CVE-2026-36607

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: This vulnerability resides in the TDDP password change endpoint (code=10), which fails to implement the rate limiting found on the standard login endpoint. An attacker on the adjacent network can perform unlimited password guessing attempts without triggering account lockout mechanisms.

Business Impact

With a CVSS score of 8.8, this high-severity vulnerability could lead to a complete compromise of the router. Successful exploitation grants an attacker full control over the network traffic, potentially leading to unauthorized data interception, device reconfiguration, and lateral movement into the local network.

Remediation Plan

Immediate Action: Consult the vendor security advisory at https://www.mercusys.com/en/support/security-advisory to identify and apply the latest firmware updates.

Proactive Monitoring: Review router access logs for high-frequency requests to the TDDP endpoint originating from internal or adjacent network IP addresses.

Compensating Controls: Restrict management access to the router to trusted administrative IP addresses only, and isolate the management interface from the public-facing or guest network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of rate limiting on critical administrative endpoints represents a significant security oversight. Administrators should prioritize updating the firmware immediately to eliminate the brute-force vector and secure the device against unauthorized access.

---METADATA---
VENDOR: IBM
PRODUCT: Engineering Lifecycle Management
AFFECTED_VERSIONS: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0
---END_METADATA---

Description Summary:
IBM Engineering Lifecycle Management allows unauthenticated remote attackers to update server property files, potentially resulting in unauthorized access.

Executive Summary:
A critical vulnerability in IBM Engineering Lifecycle Management permits unauthenticated attackers to modify server configurations, leading to unauthorized application access.

Vulnerability Details

CVE-ID: CVE-2026-3660

Affected Software: IBM Engineering Lifecycle Management

Affected Versions: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0

Vulnerability: An unauthenticated remote attacker can exploit this vulnerability to update server property files, which facilitates unauthorized access to the application.

Business Impact

By enabling unauthorized access, this vulnerability compromises the integrity and confidentiality of the Engineering Lifecycle Management platform. With a CVSS score of 9.8, the risk of data exposure or administrative takeover of the platform is severe, potentially disrupting critical engineering workflows.

Remediation Plan

Immediate Action: Update IBM Engineering Lifecycle Management to the latest version as provided by the vendor.

Proactive Monitoring: Review file integrity logs for unauthorized modifications to server property files and monitor application access logs for suspicious administrative activity.

Compensating Controls: Ensure the application is not directly exposed to the public internet and restrict management access to authorized internal networks.

Exploitation Status

Public Exploit Available: Null

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should check for vendor security bulletins and apply the necessary patches immediately to prevent unauthorized access. Securing the configuration files and limiting network exposure are vital steps in mitigating this critical risk.

---METADATA---
VENDOR: Openlabs
PRODUCT: docker-wkhtmltopdf-aas
AFFECTED_VERSIONS: All versions up to and including commit 9f50579.
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the app.py component allows unauthenticated attackers to execute arbitrary commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas exposes systems to full remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-36576

Affected Software: Openlabs docker-wkhtmltopdf-aas

Affected Versions: All versions up to and including commit 9f50579.

Vulnerability: This is a command injection flaw (CWE-78) located in the app.py component. An unauthenticated attacker can exploit this by submitting a specially crafted POST request, which fails to properly neutralize special elements used in OS commands, resulting in arbitrary code execution.

Business Impact

The CVSS score of 9.8 confirms the extreme severity of this vulnerability. Successful exploitation permits an attacker to gain full control over the underlying host system, leading to total data compromise, lateral movement within the network, and potential disruption of critical business services.

Remediation Plan

Immediate Action: Upgrade to the latest version of docker-wkhtmltopdf-aas to ensure the vulnerable app.py component is patched.

Proactive Monitoring: Inspect application and system logs for suspicious POST requests containing shell metacharacters or unexpected system commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common command injection patterns in HTTP request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection vulnerabilities, organizations must prioritize patching this component. Ensure that any instance of docker-wkhtmltopdf-aas is updated immediately to prevent potential remote compromise of the server infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: OTP Login With Phone Number, OTP Verification Plugin
AFFECTED_VERSIONS: versions 1.8.50 through 1.8.60
---END_METADATA---

Description Summary:
The OTP Login With Phone Number plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to hijack user accounts by exploiting a flawed Firebase verification flow.

Executive Summary:
A critical authentication bypass flaw in the WordPress OTP Login plugin allows unauthenticated attackers to gain administrative access to sites by hijacking legitimate Firebase sessions.

Vulnerability Details

CVE-ID: CVE-2026-3655

Affected Software: WordPress OTP Login With Phone Number, OTP Verification Plugin

Affected Versions: versions 1.8.50 through 1.8.60

Vulnerability: The vulnerability exists in the lwp_ajax_register AJAX handler, where the Firebase session is not correctly bound to the user's phone number. An unauthenticated attacker can verify their own Firebase session but supply a victim's phone number in the request, causing the application to incorrectly authenticate the attacker as that user.

Business Impact

The CVSS score of 9.8 reflects the high risk of account takeover. If an attacker targets an administrator's account, they can gain full control over the WordPress site, leading to complete data loss, site defacement, or the injection of malicious code into the site's front end.

Remediation Plan

Immediate Action: Immediately update the "OTP Login With Phone Number, OTP Verification" plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user account logs for suspicious logins, particularly those involving administrative accounts, and monitor for unauthorized changes to user metadata.

Compensating Controls: Temporarily disable the plugin if an update is not immediately available, or implement a secondary authentication factor (MFA) that is not tied to the vulnerable OTP verification flow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to bypass authentication for administrative accounts makes this a high-priority risk.

Analyst Recommendation

Given that this vulnerability allows for trivial account takeover including administrative accounts, organizations should treat this update as a high priority. Ensure all WordPress sites utilizing this plugin are updated immediately to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: MeiG Smart
PRODUCT: FORGE_SLT711
AFFECTED_VERSIONS: MDM9607.LE.1.0-00110-STD.PROD-1
---END_METADATA---

Description Summary:
The GoAhead web server on MeiG Smart FORGE_SLT711 devices allows unauthenticated remote attackers to perform OS command injection via the /action/SetRemoteAccessCfg endpoint.

Executive Summary:
A critical OS command injection vulnerability in the MeiG Smart FORGE_SLT711 device allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-36356

Affected Software: MeiG Smart FORGE_SLT711 (GoAhead web server)

Affected Versions: MDM9607.LE.1.0-00110-STD.PROD-1

Vulnerability: This is an OS command injection vulnerability residing in the /action/SetRemoteAccessCfg endpoint of the GoAhead web server, which fails to properly sanitize user input before passing it to the underlying system shell.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat, enabling attackers to gain full control over the device at the operating system level. This compromise can lead to data exfiltration, denial of service, or the use of the device as a botnet node within the local network.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Monitor the device for unexpected outbound traffic or anomalous processes running on the system.

Compensating Controls: Restrict access to the device's web management interface via firewall rules to ensure it is not reachable from untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the MeiG Smart FORGE_SLT711 should treat this as a high-priority update. Ensure that all devices are patched and that network-level controls are in place to prevent unauthenticated access to the management interfaces.

---METADATA---
VENDOR: Realtek
PRODUCT: rtl819x Jungle SDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Realtek rtl819x Jungle SDK affecting the rtl8192cd Wi-Fi kernel driver, which may allow for unauthorized system impact.

Executive Summary:
The Realtek rtl819x Jungle SDK contains a high-severity flaw in the Wi-Fi kernel driver that could lead to unauthorized system-level access.

Vulnerability Details

CVE-ID: CVE-2026-36355

Affected Software: Realtek rtl819x Jungle SDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the rtl8192cd Wi-Fi kernel driver. It involves an improper handling of data within the driver, which may be exploited to compromise the stability or security of the host system.

Business Impact

The CVSS score of 7.7 reflects a high risk to organizations relying on hardware integrated with the Realtek SDK. Successful exploitation could result in the compromise of wireless communications or the host operating system, potentially leading to data exfiltration or denial of service.

Remediation Plan

Immediate Action: Update to the latest firmware or SDK version provided by the hardware manufacturer.

Proactive Monitoring: Monitor network infrastructure logs for abnormal Wi-Fi driver behavior or unexpected system reboots.

Compensating Controls: Restrict access to wireless management interfaces to trusted administrative subnets to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Hardware administrators must verify the SDK versions used in their wireless equipment and apply vendor-supplied patches promptly. Given the role of the kernel driver in system security, deferring this update is not recommended.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: COMMGR2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Delta Electronics COMMGR2 is affected by a stack-based buffer overflow vulnerability that could lead to arbitrary code execution or system crashes.

Executive Summary:
A critical stack-based buffer overflow in Delta Electronics COMMGR2 allows attackers to potentially execute arbitrary code or cause a total system denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-3630

Affected Software: Delta Electronics COMMGR2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack-based buffer overflow within the COMMGR2 software. While the authentication level is not explicitly defined in the brief, such flaws typically allow an attacker to overwrite memory by sending specially crafted data to a vulnerable function.

Business Impact

A successful exploit of this vulnerability could result in complete system compromise or significant operational downtime. With a CVSS score of 9.8, this is classified as Critical, indicating that the flaw is easily exploitable and carries a high risk of unauthorized remote code execution, which could lead to data theft or the introduction of ransomware into the industrial control environment.

Remediation Plan

Immediate Action: Update Delta Electronics COMMGR2 to the latest available version immediately to patch the buffer overflow flaw.

Proactive Monitoring: Implement network traffic analysis to detect unusual communication patterns or malformed packets directed at the COMMGR2 service.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) and restrict network access to the software to authorized administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its critical severity, the potential for exploitation is extremely high once technical details become known.

Analyst Recommendation

The Critical severity of this vulnerability necessitates immediate attention from security teams. Organizations using Delta Electronics COMMGR2 should prioritize the application of the vendor-supplied patch to mitigate the risk of remote code execution and ensure the continued integrity of their control systems.

---METADATA---
VENDOR: Import and export users and customers
PRODUCT: Import and export users and customers
AFFECTED_VERSIONS: Up to and including 1.x
---END_METADATA---

Description Summary:
The Import and export users and customers WordPress plugin is vulnerable to privilege escalation, enabling attackers to gain unauthorized administrative rights.

Executive Summary:
The Import and export users and customers plugin for WordPress contains a high-severity privilege escalation flaw that allows attackers to elevate their access to administrative levels.

Vulnerability Details

CVE-ID: CVE-2026-3629

Affected Software: Import and export users and customers Import and export users and customers

Affected Versions: All versions up to, and including, 1.x

Vulnerability: This plugin is vulnerable to privilege escalation. An authenticated attacker can exploit flaws in the plugin's user management logic to grant themselves administrative privileges, bypassing intended security restrictions.

Business Impact

The impact is a total loss of control over the WordPress site. An attacker gaining administrative access can perform any action, including data exfiltration, site defacement, and the creation of backdoor accounts. The CVSS score of 8.1 indicates a high risk to the organization's digital assets.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately. If an update is not available, uninstall the plugin until a patch is released.

Proactive Monitoring: Check for any newly created administrator accounts and review the site's user list for discrepancies.

Compensating Controls: Restrict access to user import/export functions to only the most trusted administrators and use file integrity monitoring to detect unauthorized changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, plugins that handle user data and permissions are frequently scrutinized by researchers and attackers alike.

Analyst Recommendation

The ability for an attacker to escalate privileges is a critical security failure. Administrators must apply the update immediately or remove the plugin to mitigate the risk of a full site compromise.

---METADATA---
VENDOR: Honeywell
PRODUCT: IQ4x
AFFECTED_VERSIONS: Factory-default configuration
---END_METADATA---

Description Summary:
Honeywell IQ4x controllers allow unauthenticated remote attackers to create administrative accounts and take full control of building management systems.

Executive Summary:
The Honeywell IQ4x building management controller is subject to a critical authentication bypass that allows unauthenticated attackers to gain full administrative control and lock out legitimate users.

Vulnerability Details

CVE-ID: CVE-2026-3611

Affected Software: Honeywell IQ4x building management controller

Affected Versions: Factory-default configuration (prior to user module enablement)

Vulnerability: In its default state, the device's HMI is exposed without authentication. Because the account creation function (U.htm) is accessible to unauthenticated users, an attacker can create an administrative account, which then enables the user module and locks the system under the attacker's credentials.

Business Impact

This vulnerability has a CVSS score of 10.0, the highest possible. An attacker can take complete control of building systems (HVAC, lighting, etc.) and effectively lock out legitimate operators. This poses significant risks to physical safety, operational continuity, and the security of the facility.

Remediation Plan

Immediate Action: Immediately enable the user module by creating a secure administrative account and updating the firmware to the latest version.

Proactive Monitoring: Scan the network for any Honeywell IQ4x devices that are still operating in a factory-default state or showing unauthorized administrative accounts.

Compensating Controls: Ensure that building management controllers are never exposed directly to the public internet and are protected by a VPN or a robust firewall.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation. However, the "insecure by design" nature of the default configuration makes these devices extremely vulnerable to discovery via automated internet scanning tools.

Analyst Recommendation

This is a critical flaw that requires immediate attention to prevent unauthorized physical infrastructure control. Administrators must ensure that all IQ4x controllers have authentication enabled and are updated to the latest firmware to mitigate this risk.

---METADATA---
VENDOR: Pensar
PRODUCT: Apex
AFFECTED_VERSIONS: <= 0
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A critical vulnerability has been identified in the @pensar/apex software package.

Executive Summary:
The @pensar/apex package is affected by a critical vulnerability that requires immediate attention from security administrators.

Vulnerability Details

CVE-ID: CVE-2026-36044

Affected Software: Pensar Apex

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided information is insufficient to determine the specific technical nature, attack vector, or authentication requirements of this vulnerability.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as high-risk. Potential consequences may include unauthorized system access, loss of data integrity, or service disruption, depending on the role the Apex package plays within the organizational infrastructure.

Remediation Plan

Immediate Action: Consult the official vendor security advisories or repository documentation for @pensar/apex to identify and apply the necessary security updates.

Proactive Monitoring: Monitor server-side logs and application performance metrics for any anomalous activity that deviates from established baselines.

Compensating Controls: If a patch is not immediately available, restrict external access to the affected software component and ensure that least-privilege principles are enforced for all service accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the lack of specific details, maintain a heightened security posture regarding this component.

Analyst Recommendation

The severity of the CVSS score necessitates immediate investigation into your software bill of materials (SBOM) to confirm usage of the affected package. Prioritize updating this dependency as soon as the vendor releases security guidance.

---METADATA---
VENDOR: WordPress
PRODUCT: Riaxe Product Customizer
AFFECTED_VERSIONS: 2.1.2 and below
---END_METADATA---

Description Summary:
The Riaxe Product Customizer plugin for WordPress allows unauthenticated attackers to update arbitrary site options via an unprotected AJAX action.

Executive Summary:
A critical privilege escalation vulnerability in the Riaxe Product Customizer plugin enables unauthenticated attackers to modify site settings and gain administrative control.

Vulnerability Details

CVE-ID: CVE-2026-3596

Affected Software: WordPress Riaxe Product Customizer

Affected Versions: 2.1.2 and below

Vulnerability: The plugin provides an unauthenticated AJAX hook ('wp_ajax_nopriv_install-imprint') that lacks any nonce verification or capability checks. This allows attackers to manipulate critical WordPress options, such as enabling user registration and setting the default user role to administrator.

Business Impact

This vulnerability carries a 9.8 CVSS score, enabling complete site compromise. Attackers can gain unauthorized administrative access, leading to full system takeover and potential data theft.

Remediation Plan

Immediate Action: Update to the latest version of the plugin or deactivate the Riaxe Product Customizer immediately if no patch is available.

Proactive Monitoring: Audit the 'wp_options' table for suspicious changes, particularly settings related to user registration and default roles.

Compensating Controls: Utilize a WAF to block unauthorized requests to the 'wp-admin/admin-ajax.php' endpoint that include the 'install-imprint' action.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of basic security checks in this plugin makes it a high-risk vector. Immediate removal or patching is required to prevent unauthorized administrative escalation.

---METADATA---
VENDOR: ISC
PRODUCT: BIND 9
AFFECTED_VERSIONS: 9.20.0-9.20.22, 9.21.0-9.21.21, 9.20.9-S1-9.20.22-S1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 may allow for memory corruption or unstable behavior.

Executive Summary:
A use-after-free vulnerability in the DNS-over-HTTPS implementation of ISC BIND 9 poses a risk of service disruption and potential memory exploitation.

Vulnerability Details

CVE-ID: CVE-2026-3593

Affected Software: ISC BIND 9

Affected Versions: 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Vulnerability: This is a use-after-free vulnerability (CWE-416) within the DNS-over-HTTPS component. The vulnerability is triggered when the application improperly handles memory, which can lead to crashes or arbitrary code execution by an unauthenticated attacker.

Business Impact

The vulnerability carries a CVSS score of 7.4, indicating a High severity risk. Successful exploitation could lead to a denial-of-service (DoS) condition, impacting critical DNS infrastructure, or potentially allow an attacker to gain unauthorized control over the affected BIND server, compromising the integrity of network traffic.

Remediation Plan

Immediate Action: Upgrade immediately to the patched releases: 9.20.23, 9.21.22, or 9.20.23-S1.

Proactive Monitoring: Monitor BIND 9 process logs for unexpected termination or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: If immediate patching is not feasible, consider disabling DNS-over-HTTPS functionality if it is not business-critical to mitigate the primary attack vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of DNS services, this vulnerability requires urgent attention. Administrators should prioritize patching BIND instances to the specified versions to prevent potential service instability and unauthorized access, ensuring that critical infrastructure remains resilient against exploitation.

---METADATA---
VENDOR: Linux
PRODUCT: Linux-based OS
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can escape a restricted CLI interface in certain Linux-based operating systems to gain root access.

Executive Summary:
A critical vulnerability in the CLI prompt of certain Linux-based systems allows unauthenticated remote attackers to bypass restrictions and gain full root privileges.

Vulnerability Details

CVE-ID: CVE-2026-3587

Affected Software: Linux Linux-based OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a hidden function within the CLI prompt that can be triggered by an unauthenticated remote attacker. This allows the attacker to "escape" the restricted shell environment and execute commands with root-level permissions on the underlying operating system.

Business Impact

The impact is a total compromise of the affected device. With root access, an attacker has unrestricted control over the system, including the ability to modify files, steal data, install persistent malware, and use the system to attack other internal assets. The CVSS score of 10.0 represents the maximum possible risk level.

Remediation Plan

Immediate Action: Apply the latest security patches from the OS vendor immediately to remove the hidden CLI function and secure the restricted interface.

Proactive Monitoring: Audit CLI logs for unusual command sequences and monitor for unauthorized privilege escalation or the creation of new root-level accounts.

Compensating Controls: Restrict access to the CLI interface using network-level access control lists (ACLs) and implement multi-factor authentication (MFA) for all remote access points.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, a CVSS 10.0 vulnerability that grants root access is a prime target for sophisticated threat actors and state-sponsored groups.

Analyst Recommendation

This is a "patch now" scenario. The ability for an unauthenticated attacker to gain root access remotely is the highest possible security risk. Immediate remediation via vendor updates is mandatory to protect the integrity of the environment.

---METADATA---
VENDOR: Kali Forms
PRODUCT: Kali Forms plugin for WordPress
AFFECTED_VERSIONS: All versions up to, and including, 2.4.9
---END_METADATA---

Description Summary:
The Kali Forms WordPress plugin is vulnerable to Remote Code Execution (RCE) via the form_process function, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
Unauthenticated attackers can achieve full server compromise by exploiting a Remote Code Execution (RCE) vulnerability in the Kali Forms WordPress plugin.

Vulnerability Details

CVE-ID: CVE-2026-3584

Affected Software: Kali Forms plugin for WordPress

Affected Versions: All versions up to, and including, 2.4.9

Vulnerability: This critical RCE vulnerability exists in the form_process function due to the prepare_post_data function mapping user-supplied keys directly into internal storage. When combined with the insecure use of call_user_func on these values, unauthenticated attackers can trigger arbitrary PHP code execution.

Business Impact

An RCE vulnerability is the most severe type of security flaw, as it allows an attacker to take complete control of the web server. This can lead to total data theft, website defacement, and the use of the server as a pivot point for further internal network attacks. The CVSS score of 9.8 underscores the extreme urgency of this issue.

Remediation Plan

Immediate Action: Update the Kali Forms plugin to the latest patched version (2.5.0 or higher) immediately. If a patch is unavailable, deactivate and remove the plugin.

Proactive Monitoring: Scan for suspicious PHP files in the WordPress uploads and plugin directories and review web server access logs for unusual POST requests to the Kali Forms endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) with generic RCE protection rules to block malicious payloads targeting PHP functions like call_user_func.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in popular WordPress plugins are frequently targeted by automated exploit kits shortly after disclosure.

Analyst Recommendation

Due to the critical nature of unauthenticated Remote Code Execution, this vulnerability must be addressed with the highest priority. Administrators should update the Kali Forms plugin immediately and conduct a thorough security audit of the WordPress environment to ensure no backdoors were established.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in phpMyFAQ versions prior to 4, potentially allowing unauthorized access or impact to the application.

Executive Summary:
The phpMyFAQ application contains a security vulnerability in versions prior to 4 that poses a high risk to organizational data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-35676

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application is susceptible to a vulnerability affecting versions before 4. The specific authentication requirements and technical nature of this flaw remain undisclosed in the current documentation.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the knowledge base, potential data exfiltration, or system compromise. With a CVSS score of 8.2, this flaw is categorized as High severity, indicating a significant risk to the confidentiality and integrity of the hosted information.

Remediation Plan

Immediate Action: Upgrade to phpMyFAQ version 4 or the latest available release provided by the vendor.

Proactive Monitoring: Review application access logs for unusual patterns or unauthorized requests directed at the phpMyFAQ installation.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets to detect and block common attack vectors targeting knowledge management software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, immediate action is required to secure the phpMyFAQ instance. Administrators should prioritize verifying their current version and updating to the latest secure release to mitigate the risk of exploitation.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been identified in phpMyFAQ versions prior to 4, which may expose the system to security risks.

Executive Summary:
The phpMyFAQ application is affected by a security vulnerability in versions prior to 4 that requires urgent attention to prevent unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2026-35675

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects phpMyFAQ versions prior to 4. The specific technical mechanism of the flaw and the required attacker authentication level are not currently specified.

Business Impact

A CVSS score of 8.2 classifies this vulnerability as High severity, suggesting that an attacker could potentially compromise the application. Failure to remediate this issue may result in unauthorized data exposure or service disruption, impacting business operations dependent on the knowledge base.

Remediation Plan

Immediate Action: Apply all vendor-supplied security updates and migrate to version 4 or higher.

Proactive Monitoring: Monitor server logs for suspicious activity and unexpected access patterns originating from external sources.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block malformed requests that could be used to exploit this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability as a priority due to its High CVSS rating. It is strongly recommended that administrators perform an inventory of their phpMyFAQ deployments and apply the necessary patches immediately.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
OpenClaw products contain an unspecified security vulnerability affecting versions released prior to 2026.

Executive Summary:
A high-severity vulnerability in OpenClaw products requires immediate attention to prevent potential unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35674

Affected Software: OpenClaw Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vendor has disclosed a security vulnerability affecting various OpenClaw products. Specific technical details regarding the attack vector and authentication requirements remain undisclosed in the current advisory.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a significant risk to organizational infrastructure. Successful exploitation could lead to unauthorized system access, potential data exfiltration, or service disruption, threatening both operational continuity and data integrity.

Remediation Plan

Immediate Action: Consult the official OpenClaw security portal to identify specific affected products and apply available security updates immediately.

Proactive Monitoring: Review system access logs for anomalous behavior or unauthorized connection attempts targeting OpenClaw interfaces.

Compensating Controls: Implement network-level restrictions and utilize a Web Application Firewall (WAF) to filter suspicious traffic until official patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is significant.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency. Given the lack of granular technical data, prioritize reviewing the vendor’s security advisory to determine if your specific environment is at risk and deploy all recommended updates without delay.

---METADATA---
VENDOR: phpMyFAQ
PRODUCT: phpMyFAQ
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability exists in phpMyFAQ versions prior to 4, posing a significant risk to the integrity and security of the application.

Executive Summary:
A critical security vulnerability in phpMyFAQ versions prior to 4 threatens the security of the application and requires immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-35671

Affected Software: phpMyFAQ

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects versions of phpMyFAQ prior to 4. Further technical details regarding the specific function or parameter involved are currently unavailable.

Business Impact

With a CVSS score of 8.8, this vulnerability is categorized as High/Critical, indicating a high potential for severe impact on the affected system. Unauthorized exploitation could lead to full system compromise, data theft, or prolonged service downtime, disrupting business continuity.

Remediation Plan

Immediate Action: Update the phpMyFAQ installation to version 4 or the most recent stable release to ensure the vulnerability is patched.

Proactive Monitoring: Implement enhanced logging and monitoring to detect anomalous administrative actions or unauthorized access attempts.

Compensating Controls: Deploy a WAF and ensure that the application is restricted to trusted network segments to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The elevated CVSS score of 8.8 necessitates an urgent response. Security teams must ensure that all instances of the affected software are updated to the latest version to prevent potential exploitation and maintain the integrity of the application environment.

---METADATA---
VENDOR: ConnectWise
PRODUCT: ScreenConnect
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical flaw in ScreenConnect allows attackers with access to server-level cryptographic material to obtain unauthorized access and elevated privileges.

Executive Summary:
ConnectWise ScreenConnect contains a high-severity vulnerability that could allow an attacker to gain unauthorized administrative access by leveraging server-level cryptographic materials.

Vulnerability Details

CVE-ID: CVE-2026-3564

Affected Software: ConnectWise ScreenConnect

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves a condition where an actor who has obtained server-level cryptographic material used for authentication can bypass security checks. This allows for unauthorized access and the potential for privilege escalation within the ScreenConnect environment.

Business Impact

Unauthorized access to a remote monitoring and management (RMM) tool like ScreenConnect can lead to a total compromise of all managed endpoints. The CVSS score of 9.0 highlights the severe risk of data exfiltration, ransomware deployment, and long-term persistence within an organization's infrastructure.

Remediation Plan

Immediate Action: Update ScreenConnect to the latest version provided by the vendor and rotate all server-level cryptographic keys and authentication tokens.

Proactive Monitoring: Review ScreenConnect audit logs for unusual login activity, especially from unknown IP addresses or at irregular times, and monitor for unauthorized privilege changes.

Compensating Controls: Implement multi-factor authentication (MFA) for all ScreenConnect accounts and restrict access to the management console using IP allowlisting and VPNs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, ScreenConnect is a high-value target for threat actors, making immediate patching essential.

Analyst Recommendation

Administrators must treat this vulnerability with the highest urgency due to the potential for widespread endpoint compromise. Apply the vendor's updates immediately and ensure that cryptographic secrets are rotated to invalidate any potentially compromised material.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiClientEMS
AFFECTED_VERSIONS: 7.4.5 through 7.4.6
---END_METADATA---

Description Summary:
Fortinet FortiClientEMS versions 7.4.5 and 7.4.6 contain an improper access control vulnerability. Unauthenticated attackers can execute unauthorized code or commands via crafted requests.

Executive Summary:
Fortinet FortiClientEMS is vulnerable to unauthenticated remote command execution due to improper access controls, posing a critical risk to endpoint management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35616

Affected Software: Fortinet FortiClientEMS

Affected Versions: 7.4.5 through 7.4.6

Vulnerability: This vulnerability involves improper access control within the FortiClientEMS management server. An unauthenticated attacker can send specially crafted network requests to the server to execute unauthorized code or OS commands.

Business Impact

Compromise of a FortiClientEMS server is a tier-0 security event, as it allows an attacker to potentially control all connected endpoints. The CVSS score of 9.8 reflects the extreme severity of unauthenticated code execution on a central security management platform. This could lead to enterprise-wide ransomware or data exfiltration.

Remediation Plan

Immediate Action: Update Fortinet FortiClientEMS to the latest patched version (refer to the vendor advisory for specific build numbers) immediately.

Proactive Monitoring: Monitor FortiClientEMS logs for anomalous requests and check for unauthorized administrative accounts or changes in endpoint policies.

Compensating Controls: Restrict access to the FortiClientEMS management ports to trusted administrative IP addresses using a hardware firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, Fortinet products are frequent targets for advanced persistent threat (APT) groups, making immediate patching vital.

Analyst Recommendation

Because FortiClientEMS manages the security posture of all corporate endpoints, this vulnerability represents a critical path for attackers to achieve total environment compromise. Apply the vendor-provided updates immediately and perform a retrospective log analysis to ensure the system has not already been compromised.