---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 Version 24H2, 25H2 (see enrichment for precise build numbers)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in Windows Message Queuing allows an unauthenticated, remote attacker to execute arbitrary code.

Executive Summary:
A critical heap-based buffer overflow in the Windows Message Queuing service allows unauthenticated, remote attackers to execute arbitrary code, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50447

Affected Software: Microsoft Windows

Affected Versions: Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (24H2, 25H2) builds preceding the July 2026 security updates.

Vulnerability: This is a heap-based buffer overflow (CWE-122) within the Windows Message Queuing component. Because the service does not require authentication, it is highly automatable and permits remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk. Successful exploitation allows for unauthenticated remote code execution, which can lead to complete system takeover, data theft, and the deployment of ransomware. The ability to exploit this over the network without user interaction makes it an ideal target for widespread automated attacks.

Remediation Plan

Immediate Action: Deploy the July 2026 security updates for all affected Windows endpoints and servers immediately.

Proactive Monitoring: Monitor for anomalous spikes in traffic to Message Queuing ports and check system logs for process crashes or unexpected service restarts.

Compensating Controls: If patching is delayed, disable the Message Queuing service if it is not business-critical and utilize a network firewall to restrict access to the service from untrusted segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The absence of authentication requirements makes this a highly attractive vulnerability for malicious actors, necessitating rapid remediation.

Analyst Recommendation

This vulnerability is highly dangerous due to its remote, unauthenticated nature. Organizations should treat this as a top priority for patching to prevent potential remote code execution events.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Server Update Service
AFFECTED_VERSIONS: Windows 10 Version 1607 (10.0.14393.0 to <10.0.14393.9339), Windows 10 Version 1809 (10.0.17763.0 to <10.0.17763.9020), Windows Server 2012 (6.2.9200.0 to <6.2.9200.26226), Windows Server 2012 R2 (6.3.9600.0 to <6.3.9600.23291)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the Windows Server Update Service allows an authenticated attacker to elevate privileges over a network.

Executive Summary:
A vulnerability in the Windows Server Update Service allows an authenticated attacker to achieve unauthorized privilege escalation, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-50444

Affected Software: Microsoft Windows Server Update Service (WSUS)

Affected Versions: See the metadata block for specific Windows 10 and Windows Server build ranges.

Vulnerability: This flaw stems from a missing authentication check for a critical function within the Windows Server Update Service. An attacker who has already obtained low-level user privileges can exploit this to perform unauthorized actions and escalate their access level over the network.

Business Impact

Successful exploitation allows an attacker to gain elevated privileges, which could lead to full system compromise, unauthorized data access, or the deployment of malicious software across the enterprise environment. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security, necessitating prioritized remediation to prevent lateral movement and deeper network infiltration.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft in the July 2026 update cycle to all affected Windows 10 and Windows Server instances.

Proactive Monitoring: Monitor network and server logs for unusual administrative activity or unexpected service requests originating from standard user accounts.

Compensating Controls: Ensure that network segmentation is in place to limit the ability of low-privileged users to interact with sensitive update services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation within the core update infrastructure.

Analyst Recommendation

Given the high severity of this privilege escalation vulnerability, organizations should prioritize patching all systems identified in the affected versions list. Promptly applying the vendor provided updates is the most effective way to secure the Windows Server Update Service environment against potential exploitation.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the Belkin F9K1122 router, potentially enabling attackers to gain unauthorized access or disrupt services.

Executive Summary:
A high-severity security vulnerability has been detected in the Belkin F9K1122 router, presenting a critical risk of unauthorized access and network disruption.

Vulnerability Details

CVE-ID: CVE-2026-5044

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Belkin F9K1122 router and is rated with a CVSS score of 8.8. While the specific vulnerability type (e.g., buffer overflow, logic error) is not detailed in the summary, the high score indicates that it could allow an attacker to bypass security measures or gain administrative rights on the device.

Business Impact

A successful exploit could lead to the total compromise of the router, allowing an attacker to monitor all unencrypted traffic passing through the device. This poses a significant threat to organizational data privacy and could lead to secondary attacks on connected devices within the network.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Belkin for the F9K1122 router without delay.

Proactive Monitoring: Enable and monitor logging for administrative access and changes to the device's core configuration.

Compensating Controls: Ensure the router is placed behind an additional layer of security, such as a dedicated hardware firewall, and disable all unnecessary services (e.g., UPnP, WPS).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation. However, router vulnerabilities are frequently discovered and exploited by sophisticated threat actors to establish persistent network access.

Analyst Recommendation

The detection of a high-severity vulnerability in a core network component like the Belkin F9K1122 requires immediate attention. It is strongly recommended to apply the vendor's firmware updates immediately to mitigate the risk of unauthorized access and ensure the security of the broader network.

---METADATA---
VENDOR: Microsoft
PRODUCT: PC Manager
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 3.22.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper link resolution vulnerability in Microsoft PC Manager allows an authenticated local attacker to perform file access operations that lead to privilege escalation.

Executive Summary:
A high-severity file access vulnerability in Microsoft PC Manager allows authenticated local users to escalate privileges, necessitating immediate software updates.

Vulnerability Details

CVE-ID: CVE-2026-50438

Affected Software: Microsoft PC Manager

Affected Versions: Versions prior to 3.22.1.0.

Vulnerability: This vulnerability involves improper link resolution (CWE-59), commonly known as link following. An authenticated attacker can exploit this to perform unauthorized file operations, facilitating local privilege escalation.

Business Impact

Exploitation of this vulnerability allows a local user to bypass security restrictions, potentially gaining control over the system. This could lead to sensitive data exposure or complete system takeover. With a CVSS score of 8.8, the threat to local system security is substantial.

Remediation Plan

Immediate Action: Update Microsoft PC Manager to version 3.22.1.0 or later as soon as possible.

Proactive Monitoring: Monitor for unexpected file system activity or attempts to manipulate symbolic links by non-privileged user accounts.

Compensating Controls: Apply the principle of least privilege by restricting user access to sensitive directories and limiting the ability to create symbolic links.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires local authentication, which serves as a primary barrier to entry.

Analyst Recommendation

Users and administrators should ensure that Microsoft PC Manager is updated to the latest version to address this privilege escalation risk. Failure to update leaves the system exposed to local attackers capable of exploiting file system link resolution flaws.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security weakness has been identified in the Belkin F9K1122 router that could be exploited to compromise the device's security posture.

Executive Summary:
The Belkin F9K1122 router contains a high-severity security weakness that poses a significant risk to network integrity and unauthorized device control.

Vulnerability Details

CVE-ID: CVE-2026-5043

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This identified weakness in the Belkin F9K1122 router is currently categorized as a high-severity issue. With a CVSS score of 8.8, the vulnerability likely permits an attacker to bypass authentication or execute unauthorized actions, though specific function-level details are currently restricted to vendor advisories.

Business Impact

The exploitation of this weakness could allow an attacker to intercept network traffic, redirect users to malicious sites, or use the router as a jumping-off point for further internal attacks. The risk to business continuity and data confidentiality is high, necessitating immediate remediation.

Remediation Plan

Immediate Action: Consult the Belkin support site and apply the recommended firmware patch for the F9K1122 router immediately.

Proactive Monitoring: Regularly review the router's security logs for failed login attempts and check for any unauthorized modifications to DNS settings or firewall rules.

Compensating Controls: Implement strong, unique passwords for all router accounts and ensure that WPA3 or the strongest available encryption is used for wireless communications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of public details should not be mistaken for low risk, given the high severity rating.

Analyst Recommendation

Maintaining updated firmware on networking hardware is a critical security requirement. Administrators should treat this high-severity weakness with urgency and apply the necessary updates to the Belkin F9K1122 to protect the network environment from potential exploitation.

---METADATA---
VENDOR: Belkin
PRODUCT: F9K1122
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in the Belkin F9K1122 router, potentially allowing for unauthorized access or system interference.

Executive Summary:
The Belkin F9K1122 router is affected by a high-severity security flaw that could lead to unauthorized access and compromise of the network device.

Vulnerability Details

CVE-ID: CVE-2026-5042

Affected Software: Belkin F9K1122

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are limited in the initial report, this flaw in the Belkin F9K1122 router indicates a significant security weakness. Given the CVSS score of 8.8, it likely involves a high-impact issue such as unauthorized access or a bypass of security controls on the device.

Business Impact

A compromise of a perimeter router like the Belkin F9K1122 can result in network-wide eavesdropping, unauthorized access to internal resources, and total loss of internet connectivity. The CVSS score of 8.8 justifies an urgent response to prevent attackers from gaining a foothold in the local network infrastructure.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Belkin immediately to address this security flaw.

Proactive Monitoring: Monitor the router for unauthorized configuration changes, unusual outbound traffic patterns, or unrecognized administrative logins.

Compensating Controls: Restrict access to the router's web management interface to trusted internal IP addresses only and disable remote management features.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, router vulnerabilities are frequently targeted by botnets and automated exploit kits.

Analyst Recommendation

Due to the high CVSS score and the critical role of the F9K1122 in network security, it is essential to apply vendor-provided patches immediately. Ensuring the router firmware is up to date is the primary defense against unauthorized access and network compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Runtime
AFFECTED_VERSIONS: Windows 11 Version 24H2 (10.0.26100.0 up to 10.0.26100.8875), Windows 11 Version 25H2 (10.0.26200.0 up to 10.0.26200.8875), Windows 11 version 26H1 (10.0.28000.0 up to 10.0.28000.2269), Windows Server 2025 (10.0.26100.0 up to 10.0.26100.33158)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the Windows Runtime allows an authenticated local attacker to escalate their privileges.

Executive Summary:
An authenticated local privilege escalation vulnerability in the Windows Runtime allows attackers to gain elevated permissions on the system.

Vulnerability Details

CVE-ID: CVE-2026-50413

Affected Software: Microsoft Windows Runtime

Affected Versions: See metadata for specific version ranges across Windows 11 and Windows Server 2025.

Vulnerability: This is a use-after-free vulnerability within the Windows Runtime environment. It requires the attacker to have local access and low-level privileges to trigger the flaw and elevate their access rights.

Business Impact

By enabling privilege escalation, this vulnerability allows a standard user to gain administrative or system-level control over a machine. With a CVSS score of 8.8, this poses a significant risk to the confidentiality and integrity of local data, as well as the overall security posture of the endpoint.

Remediation Plan

Immediate Action: Deploy the latest cumulative security updates from Microsoft to all affected Windows 11 and Windows Server 2025 endpoints.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized attempts to perform administrative tasks by standard user accounts.

Compensating Controls: Implement strict application control policies and limit user permissions to the minimum necessary for daily tasks, which helps contain the impact of local exploits.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily a concern for environments where untrusted local users may have interactive access to systems.

Analyst Recommendation

Organizations should prioritize the rollout of these security updates to all Windows endpoints and servers. Addressing local privilege escalation is essential to preventing lateral movement and securing the enterprise against sophisticated local threats.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows 11 / Windows Server 2025
AFFECTED_VERSIONS: Microsoft Windows 11 Version 24H2 (10.0.26100.0-10.0.26100.8874), 25H2 (10.0.26200.0-10.0.26200.8874), 26H1 (10.0.28000.0-10.0.28000.2268), Microsoft Windows Server 2025 (10.0.26100.0-10.0.26100.33157)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition in Windows Media allows an authenticated attacker to escalate privileges over a network, potentially leading to unauthorized system control.

Executive Summary:
A high-severity race condition in Windows Media enables authenticated network-based privilege escalation, creating a critical risk for enterprise environments.

Vulnerability Details

CVE-ID: CVE-2026-50398

Affected Software: Microsoft Windows 11 and Windows Server 2025

Affected Versions: See the metadata section for specific build ranges.

Vulnerability: The vulnerability stems from improper synchronization of shared resources (CWE-362) within Windows Media. An attacker requires authenticated network access to exploit this flaw, which may also involve use after free conditions (CWE-416).

Business Impact

Because this vulnerability is exploitable over the network, it poses a greater risk than local-only flaws. Successful exploitation could allow an attacker to move laterally or elevate their privileges on a network-connected host, resulting in full system compromise. The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest security updates from Microsoft across all enterprise network environments immediately.

Proactive Monitoring: Review network traffic logs for anomalous behavior associated with Windows Media services and monitor for unauthorized privilege changes.

Compensating Controls: Utilize network segmentation and host-based firewalls to restrict access to sensitive internal services, reducing the potential for remote exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Its network-accessible nature makes it a high priority for patching.

Analyst Recommendation

Given the ability to trigger this vulnerability over the network, organizations should treat this as a high-priority update. Immediate deployment of vendor patches is the most effective way to secure the environment against potential exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows 11 / Windows Server 2025
AFFECTED_VERSIONS: Microsoft Windows 11 Version 24H2 (10.0.26100.0-10.0.26100.8874), 25H2 (10.0.26200.0-10.0.26200.8874), 26H1 (10.0.28000.0-10.0.28000.2268), Microsoft Windows Server 2025 (10.0.26100.0-10.0.26100.33157)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A race condition vulnerability in the Windows Runtime allows an authenticated local attacker to achieve privilege escalation by exploiting improper synchronization of shared resources.

Executive Summary:
A high-severity race condition in Windows Runtime allows authenticated local users to escalate privileges, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-50385

Affected Software: Microsoft Windows 11 and Windows Server 2025

Affected Versions: See the metadata section for specific build ranges.

Vulnerability: This vulnerability involves a race condition (CWE-362) and a potential use after free (CWE-416) within the Windows Runtime. An attacker must possess local access and authenticated user privileges to trigger the flaw.

Business Impact

Successful exploitation allows an attacker to gain elevated privileges on the target system. This could lead to full system compromise, unauthorized access to sensitive data, and the ability to execute arbitrary code with higher permissions. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security and operational continuity.

Remediation Plan

Immediate Action: Update all affected Windows 11 and Windows Server 2025 instances to the latest security patch versions provided by Microsoft.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns or unexpected system crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that only authorized users have local login access to sensitive servers to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which significantly limits the initial attack vector.

Analyst Recommendation

The severity of this privilege escalation flaw necessitates prompt remediation. IT administrators should prioritize patching all systems running the affected Windows versions to prevent unauthorized administrative access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows DirectX
AFFECTED_VERSIONS: Windows 10 Version 1809 (10.0.17763.0 to 10.0.17763.9019), Windows 10 Version 21H2 (10.0.19044.0 to 10.0.19044.7547), Windows 10 Version 22H2 (10.0.19045.0 to 10.0.19045.7547), Windows 11 Version 24H2 (10.0.26100.0 to 10.0.26100.8874), Windows 11 Version 25H2 (10.0.26200.0 to 10.0.26200.8874), Windows 11 version 26H1 (10.0.28000.0 to 10.0.28000.2268)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally on the target system.

Executive Summary:
A vulnerability in Windows DirectX allows an authenticated attacker to perform local code execution, presenting a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50382

Affected Software: Microsoft Windows DirectX

Affected Versions: See metadata for specific version ranges.

Vulnerability: This flaw is classified as an untrusted pointer dereference (CWE-822). It requires the attacker to be locally authenticated to the target system to trigger the vulnerability, which then facilitates arbitrary code execution.

Business Impact

While the attack requires local authentication, the resulting impact is severe, allowing for full code execution on the host machine. A CVSS score of 8.8 reflects the high danger posed to the confidentiality, integrity, and availability of the affected systems. In a corporate environment, this could allow a malicious actor to escalate their control over a workstation or server.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to all affected versions of Windows.

Proactive Monitoring: Monitor for unexpected process creation or unusual activity involving DirectX-related components or graphics driver processes.

Compensating Controls: Restrict interactive login access to sensitive systems to prevent unauthorized users from reaching the state required to trigger this vulnerability.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Pointer dereference vulnerabilities in complex drivers like DirectX are often targets for memory corruption research.

Analyst Recommendation

Although this vulnerability requires local authentication, the potential for code execution makes it a high priority for remediation. Security teams should ensure that all Windows systems are updated to the latest security baseline to mitigate the risk of local exploitation.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows
AFFECTED_VERSIONS: Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 Version 24H2, 25H2 (see enrichment for full build ranges)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Windows GDI+ component allows a remote attacker to execute code on affected Windows systems.

Executive Summary:
A critical heap-based buffer overflow in the Windows GDI+ component poses a high risk of remote code execution on multiple versions of Windows 10 and 11.

Vulnerability Details

CVE-ID: CVE-2026-50380

Affected Software: Microsoft Windows

Affected Versions: Windows 10 Version 1607 (10.0.14393.0 to 10.0.14393.9339), 1809 (10.0.17763.0 to 10.0.17763.9020), 21H2/22H2 (10.0.19044/5.0 to 10.0.19045.7548), Windows 11 Version 24H2/25H2 (10.0.26100/200.0 to 10.0.26200.8875).

Vulnerability: The Windows GDI+ component contains a heap-based buffer overflow that can be triggered by an unauthenticated attacker, though it requires user interaction to facilitate the attack.

Business Impact

With a CVSS score of 9.6, this vulnerability represents a severe threat to endpoint security. Successful exploitation could allow an attacker to gain full control over the user workstation, potentially leading to unauthorized data access and persistence on the corporate network.

Remediation Plan

Immediate Action: Deploy the latest cumulative security updates from Microsoft to all affected Windows 10 and 11 endpoints.

Proactive Monitoring: Review endpoint security logs for process crashes or unusual behavior within the GDI+ library or related graphics rendering processes.

Compensating Controls: Ensure robust email and web filtering is in place to prevent users from interacting with malicious files that could trigger the overflow.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Jul 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The need for user interaction slightly reduces the attack surface compared to purely wormable flaws.

Analyst Recommendation

Security teams should push these updates via standard patch management channels immediately. Because this vulnerability affects a core graphics component, all systems should be considered at risk until the patch is applied.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows DHCP Server
AFFECTED_VERSIONS: Windows 10 Version 1607 (10.0.14393.0 up to 10.0.14393.9339), Windows 10 Version 1809 (10.0.17763.0 up to 10.0.17763.9020), Windows Server 2012 (6.2.9200.0 up to 6.2.9200.26226), Windows Server 2012 R2 (6.3.9600.0 up to 6.3.9600.23291)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the Windows DHCP Server allows an unauthenticated, adjacent attacker to achieve remote code execution.

Executive Summary:
A heap-based buffer overflow in Windows DHCP Server allows unauthenticated, adjacent attackers to execute arbitrary code, creating a critical risk of system takeover.

Vulnerability Details

CVE-ID: CVE-2026-50370

Affected Software: Microsoft Windows DHCP Server

Affected Versions: See metadata for specific version ranges across Windows 10, Server 2012, and Server 2012 R2.

Vulnerability: The vulnerability is a heap-based buffer overflow caused by improper input validation. It is exploitable by an unauthenticated attacker located on an adjacent network, such as the same local network segment.

Business Impact

The ability for an unauthenticated attacker to execute code on a network server represents a critical threat to infrastructure security. With a CVSS score of 8.8, this vulnerability could lead to a complete compromise of the DHCP service, potentially facilitating man-in-the-middle attacks or further lateral movement within the network.

Remediation Plan

Immediate Action: Update all affected Windows Server instances immediately using the security patches referenced in the Microsoft MSRC update guide.

Proactive Monitoring: Monitor network traffic for unusual DHCP handshake activity or unexpected crash reports associated with the DHCP service process.

Compensating Controls: Restrict network access to DHCP servers to trusted segments only and utilize host-based firewalls to minimize the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is highly dangerous, it is currently limited by the requirement for proximity to the target network.

Analyst Recommendation

Immediate patching is required for all Windows Server environments running the DHCP role. Administrators should treat this as a high-priority update to prevent potential remote code execution by unauthorized actors within the local network perimeter.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows Remote Desktop Services
AFFECTED_VERSIONS: See enrichment data for specific Windows 10 and 11 versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use-after-free vulnerability in Windows Remote Desktop Services allows an authenticated attacker to elevate privileges over a network.

Executive Summary:
A high-severity use-after-free vulnerability in Windows Remote Desktop Services allows an authenticated attacker to perform privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-50369

Affected Software: Microsoft Windows 10 and 11 (multiple versions)

Affected Versions: 10.0.14393.0 through 10.0.26200.8875 (see vendor advisory for full list)

Vulnerability: This is a use-after-free vulnerability occurring within Windows Remote Desktop Services. It requires an authenticated user to trigger the flaw, which can then be leveraged to achieve privilege escalation.

Business Impact

The CVSS score of 8.8 reflects the high risk of this vulnerability. While it requires the attacker to be authenticated, the ability to elevate privileges can lead to a complete compromise of the affected host, potentially allowing lateral movement throughout the corporate network and unauthorized access to sensitive data.

Remediation Plan

Immediate Action: Apply the relevant security updates provided by Microsoft in the July 2026 update cycle.

Proactive Monitoring: Audit Remote Desktop logs for unusual session activity or repeated authentication attempts followed by administrative task execution.

Compensating Controls: Limit access to Remote Desktop Services to only necessary administrative accounts and ensure that systems are segmented to prevent unauthorized lateral movement.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no evidence of active exploitation, though the vulnerability is inherently complex due to the use-after-free nature.

Analyst Recommendation

Given the potential for privilege escalation, organizations should prioritize the deployment of the latest security patches from Microsoft across all affected Windows 10 and 11 environments. Ensure that all systems are updated according to the vendor security advisory.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows SMB Server
AFFECTED_VERSIONS: Windows 10 Version 21H2 (10.0.19044.0 to 10.0.19044.7547), Windows 10 Version 22H2 (10.0.19045.0 to 10.0.19045.7547), Windows 11 Version 24H2 (10.0.26100.0 to 10.0.26100.8874), Windows 11 Version 25H2 (10.0.26200.0 to 10.0.26200.8874), Windows 11 version 26H1 (10.0.28000.0 to 10.0.28000.2268), Windows Server 2022 (10.0.20348.0 to 10.0.20348.5385)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect implementation of the authentication algorithm in the Windows SMB Server allows authorized attackers to elevate privileges over a network.

Executive Summary:
A high-severity vulnerability in the Windows SMB Server allows authenticated attackers to perform privilege escalation, posing a significant risk to domain and network security.

Vulnerability Details

CVE-ID: CVE-2026-50360

Affected Software: Microsoft Windows SMB Server

Affected Versions: See metadata for specific version ranges.

Vulnerability: The Windows SMB Server contains an incorrect implementation of an authentication algorithm (CWE-303). The attack vector is network-based and requires the attacker to possess low-level authenticated privileges to successfully elevate their access level.

Business Impact

The ability for an authenticated attacker to elevate privileges over the network poses a critical threat to organizational security. With a CVSS score of 8.8, a successful exploit could allow an attacker to gain unauthorized administrative control over compromised systems, potentially leading to widespread data theft or further network compromise.

Remediation Plan

Immediate Action: Deploy the latest security updates provided by Microsoft to the affected Windows operating systems and server versions.

Proactive Monitoring: Monitor SMB traffic and Windows Event Logs for suspicious privilege escalation attempts or unusual authentication activity originating from known user accounts.

Compensating Controls: Strictly enforce the principle of least privilege for network users and limit access to SMB shares to only those accounts that require them to perform their job functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to the nature of SMB as a core protocol for network communication.

Analyst Recommendation

Privilege escalation vulnerabilities in core protocols like SMB are high-priority items. Security teams must verify that all affected Windows systems are patched immediately to prevent attackers from leveraging low-level access for full system compromise.

---METADATA---
VENDOR: Microsoft
PRODUCT: Windows 11
AFFECTED_VERSIONS: 10.0.26100.0 up to 10.0.26100.8875, 10.0.26200.0 up to 10.0.26100.8875, 10.0.28000.0 up to 10.0.28000.2269
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper access control in the Windows MIDI Service Module allows an authenticated attacker to perform local privilege escalation.

Executive Summary:
An authenticated local privilege escalation vulnerability in the Windows MIDI Service Module exposes Windows 11 systems to potential security compromise.

Vulnerability Details

CVE-ID: CVE-2026-50342

Affected Software: Microsoft Windows 11

Affected Versions: 10.0.26100.0 up to 10.0.26100.8875, 10.0.26200.0 up to 10.0.26100.8875, 10.0.28000.0 up to 10.0.28000.2269

Vulnerability: This vulnerability is caused by improper access control (CWE-284) within the Windows MIDI Service Module, which permits a locally authenticated user to escalate their privileges.

Business Impact

An attacker who has already obtained low-level access to a Windows system can exploit this vulnerability to achieve higher-level privileges, potentially compromising sensitive data or gaining full system control. With a CVSS score of 8.8, this flaw represents a significant risk to host security, particularly in multi-user environments where local access is provided to standard users.

Remediation Plan

Immediate Action: Apply the latest Windows security patches provided by Microsoft to address the improper access control in the MIDI Service Module.

Proactive Monitoring: Audit user activity logs and monitor for unusual execution patterns or system calls originating from the MIDI Service that might indicate an attempt to exploit this flaw.

Compensating Controls: Enforce the principle of least privilege for local users and monitor the execution of MIDI-related services to identify and block unauthorized access attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation requires an attacker to already have valid local access, which serves as a prerequisite for this privilege escalation.

Analyst Recommendation

Given the potential for local privilege escalation, this patch should be prioritized as part of standard monthly maintenance cycles. Ensuring all Windows 11 workstations and servers are updated will effectively remediate the risk associated with this service module.

---METADATA---
VENDOR: sebhildebrandt
PRODUCT: systeminformation
AFFECTED_VERSIONS: < 5.31.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The systeminformation library for Node.js is vulnerable to OS command injection due to improper neutralization of input elements.

Executive Summary:
An OS command injection vulnerability in the sebhildebrandt systeminformation library allows authenticated users to execute arbitrary commands on the host operating system.

Vulnerability Details

CVE-ID: CVE-2026-50289

Affected Software: sebhildebrandt systeminformation

Affected Versions: < 5.31.7

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered by improper handling of input during system information queries. Exploitation requires the attacker to be authenticated with low privileges, yet the impact on confidentiality, integrity, and availability is high.

Business Impact

Successful exploitation allows an authenticated user to escalate privileges or execute unauthorized code within the context of the application. Given the CVSS score of 8.7, this flaw could be leveraged to gain lateral movement within the server environment, leading to significant security breaches and potential unauthorized access to system-level data.

Remediation Plan

Immediate Action: Update the systeminformation package to version 5.31.7 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious command execution patterns or unauthorized access attempts by low-privileged user accounts.

Compensating Controls: Implement strict input validation at the application layer to ensure that only expected parameters are passed to system-level calls.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, the potential impact remains severe.

Analyst Recommendation

Organizations using the systeminformation library must update to the latest patched version to remove this injection vector. As this library is often a dependency, developers should perform a dependency audit to ensure all sub-components are updated to the secure version.

---METADATA---
VENDOR: DataDog
PRODUCT: dd-trace-go
AFFECTED_VERSIONS: < 2.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Datadog dd-trace-go versions prior to 2.8.1 are vulnerable to resource exhaustion due to a lack of limits on allocated resources.

Executive Summary:
A resource exhaustion vulnerability in Datadog dd-trace-go prior to version 2.8.1 could allow an unauthenticated attacker to cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-50274

Affected Software: DataDog dd-trace-go

Affected Versions: < 2.8.1

Vulnerability: The library suffers from an allocation of resources without proper limits or throttling, classified as CWE-770. An unauthenticated attacker can trigger this flaw over the network to exhaust system resources, leading to a denial of service.

Business Impact

Exploitation of this vulnerability can lead to service outages and system instability, impacting the availability of applications utilizing the affected library. With a CVSS score of 7.5, this high-severity issue could disrupt critical monitoring and performance tracking capabilities.

Remediation Plan

Immediate Action: Update the dd-trace-go library to version 2.8.1 or later to implement necessary resource throttling.

Proactive Monitoring: Monitor application resource utilization, specifically memory and CPU usage, for spikes that may indicate an ongoing denial of service attempt.

Compensating Controls: Utilize rate limiting at the network edge or application gateway to prevent excessive requests from reaching the vulnerable library functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability stems from a lack of resource throttling, which is a common vector for denial of service attacks.

Analyst Recommendation

Organizations using the dd-trace-go library should immediately update to version 2.8.1 to eliminate the resource exhaustion vulnerability. Given the ease of triggering such flaws, timely patching is essential to maintain service availability.

---METADATA---
VENDOR: DataDog
PRODUCT: dd-trace-dotnet
AFFECTED_VERSIONS: < 3.43.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A resource allocation vulnerability in DataDog dd-trace-dotnet allows for uncontrolled resource consumption due to the lack of proper limits or throttling.

Executive Summary:
The DataDog dd-trace-dotnet library contains a high-severity vulnerability that permits unauthenticated remote attackers to trigger denial of service conditions.

Vulnerability Details

CVE-ID: CVE-2026-50273

Affected Software: DataDog dd-trace-dotnet

Affected Versions: All versions prior to 3.43.0

Vulnerability: This flaw is an uncontrolled resource consumption vulnerability (CWE-770) where the application fails to adequately throttle or limit incoming resource requests. The vulnerability is exploitable over the network without requiring authentication.

Business Impact

Exploitation of this vulnerability can cause the application hosting the tracer to become unstable or crash, resulting in downtime for the monitored services. Given the CVSS score of 7.5, the impact is significant for environments relying on DataDog for performance monitoring, as the monitoring infrastructure itself becomes a vector for service disruption.

Remediation Plan

Immediate Action: Update the Datadog.Trace and Datadog.Trace.OpenTracing NuGet packages to version 3.43.0 or later.

Proactive Monitoring: Monitor application logs for unexpected spikes in memory or CPU usage that correlate with incoming network requests to the tracing endpoints.

Compensating Controls: Utilize a Web Application Firewall to inspect and filter traffic directed at application endpoints that utilize the dd-trace-dotnet library.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While CISA's SSVC assessment indicates the vulnerability is automatable, there is no evidence of widespread exploitation in the wild.

Analyst Recommendation

Security teams should update the affected NuGet packages immediately to version 3.43.0. Ensuring that monitoring libraries are kept up to date is essential to maintaining the stability of the observability pipeline.

---METADATA---
VENDOR: DataDog
PRODUCT: dd-trace-js
AFFECTED_VERSIONS: < 5.100.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The DataDog dd-trace-js library is vulnerable to resource exhaustion due to improper allocation of resources without limits, enabling remote denial of service.

Executive Summary:
The DataDog dd-trace-js library contains a high severity vulnerability that permits unauthenticated remote attackers to exhaust system resources and cause service disruption.

Vulnerability Details

CVE-ID: CVE-2026-50272

Affected Software: DataDog dd-trace-js

Affected Versions: < 5.100.0

Vulnerability: This vulnerability is classified as CWE-770, which involves the allocation of resources without appropriate limits or throttling. The flaw is remotely exploitable without authentication or user interaction.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a substantial risk to the availability of Node based applications utilizing the Datadog APM client. Exploitation can lead to application crashes or severe performance degradation, which negatively impacts service reliability and operational continuity.

Remediation Plan

Immediate Action: Update the dd-trace-js package to version 5.100.0 or higher to apply the necessary resource handling fixes.

Proactive Monitoring: Review application logs for abnormal error rates or process termination events that may indicate resource exhaustion attempts.

Compensating Controls: Ensure that the underlying Node environment has configured resource limits, such as memory heap constraints, to mitigate the impact of potential exhaustion attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible, as it does not require authentication to exploit.

Analyst Recommendation

Maintaining service uptime is critical for monitoring infrastructure. Security teams should ensure that all instances of the dd-trace-js library are updated to version 5.100.0 immediately to prevent potential denial of service attacks that could compromise application monitoring and stability.

---METADATA---
VENDOR: Datadog
PRODUCT: dd-trace-py
AFFECTED_VERSIONS: < 4.8.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Datadog dd-trace-py is susceptible to a resource exhaustion vulnerability due to a lack of limits on resource allocation.

Executive Summary:
A resource exhaustion vulnerability in the Datadog dd-trace-py Python APM client allows unauthenticated attackers to cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-50271

Affected Software: Datadog dd-trace-py

Affected Versions: < 4.8.2

Vulnerability: This vulnerability is caused by an improper implementation of resource allocation without limits or throttling (CWE-770). Unauthenticated attackers can leverage this flaw to trigger excessive resource consumption, leading to service instability or failure.

Business Impact

Successful exploitation results in a denial of service, which can cause significant operational disruption by rendering the APM client unavailable. With a CVSS score of 7.5, this high-severity vulnerability poses a substantial risk to application monitoring capabilities and overall infrastructure stability.

Remediation Plan

Immediate Action: Update the dd-trace-py library to version 4.8.2 or later to apply the necessary resource throttling protections.

Proactive Monitoring: Monitor application logs for abnormal resource usage spikes or recurring service crashes that may indicate exploitation attempts.

Compensating Controls: Implement infrastructure-level rate limiting or resource quotas on services utilizing the APM client to mitigate the impact of potential exhaustion attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any network-adjacent user capable of interacting with the client process.

Analyst Recommendation

Given the potential for denial of service, administrators must prioritize updating the dd-trace-py client to version 4.8.2 immediately. Ensuring the library is patched is the only effective way to prevent resource exhaustion attacks against your monitoring infrastructure.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: All versions before 1.9.0 (fixed in 1.9.0)
---END_METADATA---

Description Summary:
The 'POST /api/v2/files' endpoint fails to sanitize the 'filename' parameter, allowing unauthenticated path traversal and arbitrary file writes.

Executive Summary:
An unauthenticated path traversal vulnerability in the /api/v2/files endpoint allows attackers to write files to arbitrary locations on the filesystem, potentially leading to system takeover.

Vulnerability Details

CVE-ID: CVE-2026-5027

Affected Software: The affected software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application's file upload API does not sanitize the filename parameter within multipart form data. An unauthenticated attacker can use path traversal sequences (e.g., ../) to bypass the intended upload directory and write files anywhere the application has permissions.

Business Impact

This vulnerability is high-severity (CVSS 8.8) because it can be used to overwrite critical system files or upload a web shell into a web-accessible directory. This leads directly to remote code execution and full system compromise.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately. If no update is available, implement strict input validation on the filename parameter to strip path traversal sequences.

Proactive Monitoring: Monitor the filesystem for the creation of unexpected files, especially in system or web-root directories, and audit logs for POST requests to /api/v2/files containing ../ sequences.

Compensating Controls: Ensure the application process runs with the least privilege necessary, preventing it from writing to sensitive system directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, no public exploitation has been reported. Path traversal in upload endpoints is a common and highly reliable attack vector for gaining initial access.

Analyst Recommendation

The ability to write arbitrary files to a server is a critical security failure. Administrators must prioritize the application of patches for this API service and verify that the fix correctly handles all variants of path traversal characters.

---METADATA---
VENDOR: JetBrains
PRODUCT: Hub
AFFECTED_VERSIONS: Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
---END_METADATA---

Description Summary:
JetBrains Hub contains an authentication bypass vulnerability via direct database access that allows unauthorized administrative control.

Executive Summary:
A critical authentication bypass vulnerability in JetBrains Hub allows unauthenticated attackers to gain full administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-50242

Affected Software: JetBrains Hub

Affected Versions: Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429

Vulnerability: This vulnerability involves an authentication bypass flaw triggered by direct database access. It permits an unauthenticated attacker to assume administrative privileges within the application.

Business Impact

The potential for unauthorized administrative access poses a catastrophic risk to organizational data integrity and confidentiality. Given the CVSS score of 10.0, this vulnerability could lead to complete system compromise, allowing attackers to modify configurations, extract sensitive user data, or deploy malicious payloads across the enterprise environment.

Remediation Plan

Immediate Action: Upgrade all instances of JetBrains Hub to the specified patched versions or higher immediately.

Proactive Monitoring: Review database access logs for unusual queries or unauthorized connection attempts originating from non-standard internal assets.

Compensating Controls: Restrict network-level access to the underlying database port to authorized management hosts only as a temporary mitigation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents the highest level of risk to JetBrains Hub deployments. Administrators must prioritize patching this flaw immediately to prevent total administrative takeover. Failure to remediate will leave the identity and access management infrastructure exposed to full compromise.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: before 24.09.07
---END_METADATA---

Description Summary:
Apache OFBiz contains a template injection vulnerability that allows authenticated users with specific privileges to execute arbitrary code.

Executive Summary:
A high-severity template injection vulnerability in Apache OFBiz allows low-privileged users to achieve Remote Code Execution.

Vulnerability Details

CVE-ID: CVE-2026-50223

Affected Software: Apache OFBiz

Affected Versions: before 24.09.07

Vulnerability: This is an improper control of code generation vulnerability that enables a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks. This can be weaponized to achieve Remote Code Execution (RCE) on the server.

Business Impact

With a CVSS score of 8.8, this vulnerability is extremely dangerous. Successful exploitation grants an attacker the ability to execute arbitrary commands on the server, leading to total system compromise, exfiltration of sensitive data, and potential lateral movement within the corporate network.

Remediation Plan

Immediate Action: Upgrade Apache OFBiz to version 24.09.07 or later immediately to patch the template injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual template rendering requests or suspicious shell command executions originating from the OFBiz application process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious template injection payloads targeting Apache OFBiz.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve full code execution makes this a critical priority. Organizations running Apache OFBiz should verify their version and apply the 24.09.07 update without delay to prevent unauthorized system takeover.

---METADATA---
VENDOR: Acer
PRODUCT: Connect M6E 5G
AFFECTED_VERSIONS: Acer Connect M6E 5G firmware
---END_METADATA---

Description Summary:
Exposed diagnostic software on retail builds of Acer Connect M6E 5G allows malicious applications to write to internal NVRAM registers.

Executive Summary:
A critical security flaw in Acer Connect M6E 5G firmware leaves factory diagnostic interfaces exposed, enabling unauthorized write access to sensitive internal hardware registers.

Vulnerability Details

CVE-ID: CVE-2026-50211

Affected Software: Acer Connect M6E 5G

Affected Versions: Unknown; affects retail firmware builds.

Vulnerability: This vulnerability involves the improper exposure of engineering and factory-level diagnostic software in production environments. An attacker can leverage this exposure to perform out-of-bounds writes to internal NVRAM registers, potentially leading to persistent device compromise.

Business Impact

Rated at a CVSS score of 9.8, this vulnerability poses a severe threat to device integrity. An attacker could potentially bypass security controls, modify device configuration, or achieve persistent control over the hardware, leading to complete loss of device trust and potential network-wide lateral movement.

Remediation Plan

Immediate Action: Remove any remaining diagnostic software and apply firmware updates from the vendor to secure internal NVRAM registers.

Proactive Monitoring: Monitor device logs for anomalous configuration changes or unauthorized attempts to access diagnostic or management interfaces.

Compensating Controls: Isolate affected devices from public-facing networks and restrict administrative access to management interfaces to trusted internal segments only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant hardware-level security risk. Administrators must prioritize the removal of diagnostic tools and ensure that all firmware is patched to the latest version provided by Acer. Verify that no unauthorized diagnostic services are reachable from the network.

---METADATA---
VENDOR: Zalando
PRODUCT: Skipper
AFFECTED_VERSIONS: < 0.26.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Zalando Skipper is vulnerable to HTTP request smuggling due to inconsistent interpretation of HTTP requests between the proxy and backend services.

Executive Summary:
A high-severity HTTP request smuggling vulnerability in Zalando Skipper could allow attackers to bypass security controls and compromise downstream services.

Vulnerability Details

CVE-ID: CVE-2026-50197

Affected Software: Zalando Skipper

Affected Versions: < 0.26.10

Vulnerability: The application suffers from inconsistent interpretation of HTTP requests (CWE-444), commonly referred to as HTTP Request Smuggling. This allows an unauthenticated remote attacker to potentially poison caches or hijack connections between the proxy and backend services.

Business Impact

This vulnerability carries a CVSS score of 7.8, indicating a significant risk to data integrity and system security. If exploited, an attacker could bypass authentication, access sensitive data, or perform actions on behalf of other users, leading to a loss of confidentiality and control over service composition.

Remediation Plan

Immediate Action: Update Zalando Skipper to version 0.26.10 or later immediately.

Proactive Monitoring: Monitor traffic logs for suspicious HTTP header patterns or requests that deviate from standard protocol compliance.

Compensating Controls: Utilize a robust WAF to inspect and normalize incoming HTTP traffic, which can help detect and block smuggling attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of request smuggling often requires deep knowledge of the specific proxy configuration.

Analyst Recommendation

Organizations utilizing Skipper as their reverse proxy must deploy the latest update to ensure consistent HTTP request handling. Failure to patch may expose the entire service mesh to unauthorized request manipulation.

---METADATA---
VENDOR: RARgames
PRODUCT: 4gaBoards
AFFECTED_VERSIONS: < 3.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in 4gaBoards allows unauthenticated attackers to gain unauthorized access to the system through improper authentication mechanisms.

Executive Summary:
CVE-2026-50191 is a critical authentication bypass vulnerability in 4gaBoards that allows unauthenticated attackers to gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2026-50191

Affected Software: RARgames 4gaBoards

Affected Versions: < 3.3.8

Vulnerability: This vulnerability involves improper authentication and an authentication bypass using an alternate path or channel (CWE-287, CWE-288). The vulnerability does not require prior authentication from an attacker.

Business Impact

Authentication bypass is a critical security failure, as it allows attackers to assume the identity of legitimate users or administrators. Given the CVSS score of 8.8, this vulnerability could lead to total data exposure, loss of administrative control over project management boards, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update 4gaBoards to version 3.3.8 or later to patch the authentication bypass mechanism.

Proactive Monitoring: Audit user login logs for suspicious account activity, particularly logins occurring from unrecognized IP addresses or at unusual times.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic for signs of authentication manipulation or bypass attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Because this vulnerability allows for unauthenticated access, it represents a significant risk to the organization. Immediate patching is required to prevent unauthorized access to the 4gaBoards system and the sensitive project data it contains.

---METADATA---
VENDOR: Shaarli
PRODUCT: Shaarli
AFFECTED_VERSIONS: < 0.16.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Shaarli is vulnerable to a stored cross-site scripting (XSS) vulnerability, allowing an unauthenticated attacker to execute arbitrary scripts in the context of a user session.

Executive Summary:
A high-severity cross-site scripting vulnerability in Shaarli could allow an unauthenticated attacker to execute malicious scripts within a user session.

Vulnerability Details

CVE-ID: CVE-2026-50190

Affected Software: Shaarli Shaarli

Affected Versions: < 0.16.3

Vulnerability: This vulnerability is a cross-site scripting (XSS) flaw occurring due to improper neutralization of input during web page generation. An unauthenticated attacker can exploit this by injecting malicious scripts that execute in the browser of a victim.

Business Impact

The successful exploitation of this vulnerability allows attackers to hijack user sessions, steal sensitive session cookies, or perform unauthorized actions on behalf of the user. With a CVSS score of 8.6, this flaw poses a significant risk to the integrity and confidentiality of user accounts, potentially leading to unauthorized data access or account takeover.

Remediation Plan

Immediate Action: Update Shaarli to version 0.16.3 or later to apply the necessary security patches.

Proactive Monitoring: Review application access logs for suspicious input patterns and monitor for unusual activity originating from authenticated sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured XSS protection rules to help filter and block malicious input strings.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability resides in the application's input handling mechanism, making it inherently susceptible to injection attacks if not properly sanitized.

Analyst Recommendation

Given the high CVSS score and the presence of a known proof-of-concept, organizations using Shaarli must prioritize updating to version 0.16.3 immediately. Failure to patch leaves users vulnerable to session hijacking and potential compromise of their personal bookmarking data.

---METADATA---
VENDOR: Appsmith
PRODUCT: Appsmith
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Appsmith platform, used for building internal tools and admin panels, contains a critical security vulnerability requiring immediate attention.

Executive Summary:
A high-severity security vulnerability in the Appsmith platform risks the compromise of sensitive internal tools and administrative dashboards.

Vulnerability Details

CVE-ID: CVE-2026-50189

Affected Software: Appsmith

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core Appsmith platform architecture, which is frequently used to manage sensitive internal business logic. The nature of the flaw allows for potential unauthorized access to the administrative panels and connected data sources.

Business Impact

The CVSS score of 8.9 highlights the severe business risk, as Appsmith is often integrated with sensitive databases and internal APIs. A successful exploit could lead to full unauthorized access to corporate data, credential theft, or the manipulation of critical internal business processes, resulting in significant operational disruption.

Remediation Plan

Immediate Action: Upgrade all instances of the Appsmith platform to the latest stable release provided by the vendor.

Proactive Monitoring: Audit access logs and monitor for anomalous data requests or unauthorized administrative actions within the Appsmith dashboard.

Compensating Controls: Restrict network access to the Appsmith management interface to authorized internal networks or VPNs to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the role of Appsmith as a central hub for internal tool management, this vulnerability is critical. Organizations must prioritize patching and perform a thorough security review of all applications deployed via the platform to ensure no unauthorized persistence mechanisms have been established.

---METADATA---
VENDOR: Oh My Zsh
PRODUCT: Oh My Zsh
AFFECTED_VERSIONS: < 2026-05-28
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Oh My Zsh is susceptible to code injection, allowing an unauthenticated attacker to execute arbitrary commands if a user is coerced into interacting with a malicious environment.

Executive Summary:
A critical code injection vulnerability in Oh My Zsh allows for arbitrary command execution, posing a significant risk to user systems and local environment integrity.

Vulnerability Details

CVE-ID: CVE-2026-50187

Affected Software: Oh My Zsh

Affected Versions: < 2026-05-28

Vulnerability: This vulnerability is classified as CWE-94: Improper Control of Generation of Code (Code Injection). An unauthenticated attacker can leverage this flaw to execute arbitrary code within the context of the user session, requiring user interaction to facilitate the attack.

Business Impact

The potential for arbitrary command execution creates a high risk of unauthorized system access, data exfiltration, and lateral movement within a network. With a CVSS score of 8.8, this high-severity vulnerability necessitates immediate attention to prevent full compromise of the affected developer workstations or server environments.

Remediation Plan

Immediate Action: Update the Oh My Zsh framework to a version released on or after May 28, 2026, to incorporate the necessary security patches.

Proactive Monitoring: Review shell configuration files and history logs for suspicious command execution patterns or unexpected modifications to environment variables.

Compensating Controls: Implement strict environment controls and restrict the use of untrusted shell configurations or plugins that may originate from unverified sources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires user interaction, the potential impact of code injection in shell configuration frameworks remains severe.

Analyst Recommendation

Given the high CVSS score and the nature of shell-based code injection, users should treat this vulnerability with high urgency. Organizations are strongly advised to verify that all instances of Oh My Zsh are updated to the current patched version to mitigate the risk of remote code execution and unauthorized system access.

---METADATA---
VENDOR: RARgames
PRODUCT: 4gaBoards
AFFECTED_VERSIONS: < 3.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the 4gaBoards real-time project management system allows authenticated users to access or modify restricted files on the host system.

Executive Summary:
A path traversal flaw in the 4gaBoards project management system, CVE-2026-50186, allows authenticated attackers to bypass directory restrictions and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-50186

Affected Software: RARgames 4gaBoards

Affected Versions: < 3.3.8

Vulnerability: This is a path traversal vulnerability (CWE-22) resulting from improper limitation of a pathname to a restricted directory. The attack requires the user to be authenticated to the system.

Business Impact

The ability to perform path traversal poses a severe threat to the confidentiality and integrity of the server, as an attacker may read or overwrite sensitive configuration or system files. With a CVSS score of 8.8, this vulnerability represents a high risk that could lead to full system compromise if administrative files or credentials are accessed.

Remediation Plan

Immediate Action: Upgrade 4gaBoards to version 3.3.8 or later to resolve the directory traversal flaw.

Proactive Monitoring: Review file access logs for suspicious path patterns, such as sequences involving double dots, which are indicative of traversal attempts.

Compensating Controls: Implement file system permissions that restrict the service account running 4gaBoards to only the necessary directories, thereby limiting the impact of a potential traversal.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Path traversal vulnerabilities are frequently targeted for initial access and escalation. Organizations utilizing 4gaBoards should treat this as a high-priority update to prevent unauthorized file access and potential system takeover.

---METADATA---
VENDOR: langroid
PRODUCT: langroid
AFFECTED_VERSIONS: < 0.64.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Langroid framework is vulnerable to path traversal and SQL injection attacks, allowing unauthenticated remote attackers to compromise data integrity and confidentiality.

Executive Summary:
The Langroid framework is susceptible to multiple high-severity vulnerabilities, including path traversal and SQL injection, which could lead to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-50180

Affected Software: langroid

Affected Versions: < 0.64.0

Vulnerability: This vulnerability encompasses improper limitation of pathnames to restricted directories (CWE-22) and improper neutralization of SQL command elements (CWE-89). Unauthenticated attackers can leverage these flaws to manipulate file system access or execute arbitrary database queries.

Business Impact

The combination of path traversal and SQL injection poses a severe threat to the confidentiality and integrity of applications built on the Langroid framework. With a CVSS score of 8.7, this flaw could allow attackers to exfiltrate sensitive data or manipulate backend application logic, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Langroid framework to version 0.64.0 or later immediately to resolve these injection vectors.

Proactive Monitoring: Review application logs for patterns indicative of path traversal (e.g., ../ sequences) or suspicious SQL syntax injected into input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection and directory traversal payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of critical injection flaws in a framework necessitates rapid patching.

Analyst Recommendation

Given the severity of these injection vulnerabilities, users of the Langroid framework must prioritize the upgrade to version 0.64.0. Failure to patch these flaws leaves applications exposed to trivial data exfiltration and potential system-level compromise.

---METADATA---
VENDOR: Google
PRODUCT: Angular Language Service VS Code Extension
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Angular Language Service VS Code extension is susceptible to a high-severity flaw that could enable unauthorized access or execution within the development environment.

Executive Summary:
A critical security flaw identified in the Angular Language Service extension could lead to unauthorized system access, requiring immediate attention from security teams.

Vulnerability Details

CVE-ID: CVE-2026-50178

Affected Software: Google Angular Language Service

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the template parsing functionality of the extension. It potentially allows an attacker to manipulate the extension's behavior, leading to unauthorized actions within the context of the user's IDE.

Business Impact

The CVSS score of 8.7 highlights the severity of this issue, as it directly impacts the security of developer workstations. Compromise of these systems can result in the theft of proprietary intellectual property and serve as a beachhead for further attacks against the enterprise infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch for the Angular Language Service extension immediately.

Proactive Monitoring: Monitor developer workstations for anomalous network connections or unauthorized file system modifications occurring within the context of the VS Code process.

Compensating Controls: Implement strict endpoint detection and response (EDR) policies on developer machines to detect and block malicious child processes spawned by IDE extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must coordinate with development departments to ensure that all instances of the Angular Language Service extension are updated to the latest secure version. Prioritize this update to maintain the integrity of the software development lifecycle.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Angular development platform that may allow for unauthorized system interaction or data exposure.

Executive Summary:
The Angular development platform is affected by a high-severity vulnerability that poses a significant risk to the integrity and security of applications built upon this framework.

Vulnerability Details

CVE-ID: CVE-2026-50171

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in the Angular framework's processing logic, which could potentially be leveraged by an attacker to execute unauthorized operations. Based on the current disclosure, authentication requirements remain dependent on the specific implementation of the host application.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to application data or the compromise of client-side logic. Given the CVSS score of 8.2, this represents a high-risk scenario where attackers could manipulate application state, potentially leading to reputational damage and the loss of user trust.

Remediation Plan

Immediate Action: Audit your project dependencies and apply the latest security updates provided by the Angular team as soon as they become available.

Proactive Monitoring: Review application access logs and monitor for unusual traffic patterns or unexpected API calls originating from the client-side.

Compensating Controls: Implement strict Content Security Policies (CSP) to mitigate potential cross-site scripting or unauthorized code execution vectors while awaiting a formal patch.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the framework's widespread use, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize identifying all instances of Angular within their environment. Given the high-severity rating, it is imperative to monitor vendor communication channels for patch releases and apply updates immediately upon availability to minimize the window of exposure.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Angular development platform could potentially allow for unauthorized access or execution within the application environment.

Executive Summary:
A high-severity security vulnerability in Google’s Angular framework necessitates immediate attention to ensure the continued security and integrity of enterprise web applications.

Vulnerability Details

CVE-ID: CVE-2026-50170

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Angular development platform, presenting a risk to applications that utilize vulnerable components for data handling or user interaction. The flaw may allow an attacker to disrupt application functionality or gain unauthorized access to sensitive client-side data.

Business Impact

The potential for exploitation poses a significant risk to business operations, including the compromise of sensitive user information or the integrity of the web application. With a CVSS score of 8.2, this vulnerability is categorized as High, reflecting the need for prompt remediation to prevent potential data breaches and maintain organizational compliance.

Remediation Plan

Immediate Action: Upgrade to the latest version of Angular as identified in the official vendor advisory to resolve the underlying security weakness.

Proactive Monitoring: Conduct regular vulnerability scanning and review application logs for signs of unauthorized access attempts or suspicious activity related to client-side code execution.

Compensating Controls: Utilize a modern Web Application Firewall (WAF) to monitor and block traffic patterns that match the signature of known framework vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploit evidence, the vulnerability's high severity warrants immediate administrative action.

Analyst Recommendation

The high CVSS score underscores the urgency of addressing this vulnerability within the software development lifecycle. Organizations should immediately coordinate with their development teams to apply the necessary patches, ensuring that all applications are updated to a secure version to mitigate the risk of exploitation.

---METADATA---
VENDOR: Google
PRODUCT: Angular
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Angular contains a security vulnerability that may affect the integrity or security of mobile and desktop web applications built using the framework.

Executive Summary:
A High-severity security vulnerability in the Angular framework creates a significant risk of exploitation for applications developed on the platform.

Vulnerability Details

CVE-ID: CVE-2026-50168

Affected Software: Google Angular

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the core Angular framework, potentially allowing attackers to bypass security protections within the application's execution environment. Further analysis is required to determine if the vulnerability is exploitable by unauthenticated remote users.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of systemic compromise for applications relying on the Angular platform. Successful exploitation could lead to unauthorized access, data compromise, and the degradation of trust in applications utilized by both internal users and external customers.

Remediation Plan

Immediate Action: Update the Angular framework to the latest patched version to ensure that all known security vulnerabilities are mitigated.

Proactive Monitoring: Monitor application performance and security logs for signs of anomalous behavior, such as unauthorized script execution or suspicious input patterns.

Compensating Controls: Utilize input validation and sanitization libraries as a defense-in-depth measure to reduce the risk of exploitation until official patches are deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority due to the ubiquity of the Angular framework. Applying the vendor-provided security updates is the most effective way to eliminate the risk; ensure that all production and development environments are updated concurrently.

---METADATA---
VENDOR: oras-project
PRODUCT: oras-go
AFFECTED_VERSIONS: < 2.6.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The oras-go library is affected by path traversal and improper link resolution vulnerabilities, potentially allowing unauthorized file access.

Executive Summary:
The oras-go library is vulnerable to path traversal and improper link resolution, which could allow an attacker to access files outside the intended directory.

Vulnerability Details

CVE-ID: CVE-2026-50163

Affected Software: oras-project oras-go

Affected Versions: < 2.6.2

Vulnerability: This vulnerability involves path traversal (CWE-22) and improper link resolution (CWE-59) within the OCI artifact management library. The vulnerability is exploitable by an unauthenticated attacker via a maliciously crafted artifact.

Business Impact

Successful exploitation allows an attacker to read sensitive files from the host system where the library is being utilized. Given the CVSS score of 7.1, this represents a significant risk to data confidentiality, potentially leading to the exposure of configuration files, credentials, or other sensitive system data.

Remediation Plan

Immediate Action: Update the oras-go library to version 2.6.2 or later to incorporate the necessary security patches.

Proactive Monitoring: Review application logs for unusual file access patterns or attempts to navigate outside of defined storage directories for OCI artifacts.

Compensating Controls: Ensure that the application utilizing this library runs with the minimum necessary filesystem permissions to restrict the impact of potential directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is rooted in how the library handles filesystem paths during artifact extraction.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention for all users of the oras-go library. Organizations should prioritize updating to version 2.6.2 to remediate the path traversal and link resolution risks, effectively closing the window for potential unauthorized file access.

---METADATA---
VENDOR: Hoppscotch
PRODUCT: Hoppscotch
AFFECTED_VERSIONS: 2026.4.1 and earlier
---END_METADATA---

Description Summary:
An unauthenticated mass assignment vulnerability in the Hoppscotch backend allows attackers to overwrite critical configuration secrets and forge administrative JWT tokens.

Executive Summary:
A critical mass assignment vulnerability in Hoppscotch allows unauthenticated attackers to compromise the entire server by overwriting sensitive configuration secrets.

Vulnerability Details

CVE-ID: CVE-2026-50160

Affected Software: Hoppscotch Hoppscotch

Affected Versions: 2026.4.1 and earlier

Vulnerability: This vulnerability stems from an insecurely configured NestJS ValidationPipe that fails to whitelist request body properties. An unauthenticated attacker can manipulate the onboarding endpoint to inject and overwrite critical database entries, including JWT and SESSION secrets.

Business Impact

The exploitation of this flaw leads to a complete compromise of the Hoppscotch instance, granting the attacker the ability to forge tokens for any user, including administrative accounts. With a CVSS score of 10.0, this represents the highest level of risk, leading to total unauthorized control over the API development ecosystem, potential exfiltration of sensitive API keys, and full loss of system integrity.

Remediation Plan

Immediate Action: Upgrade the Hoppscotch backend to version 2026.5.0 or later immediately to apply the necessary validation whitelisting.

Proactive Monitoring: Monitor database audit logs for unauthorized changes to infrastructure configuration settings and review access logs for suspicious activity on the /v1/onboarding/config endpoint.

Compensating Controls: Implement strict network-level access controls to ensure the onboarding endpoint is not exposed to the public internet until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full server takeover, immediate patching is mandatory. Organizations must prioritize updating their Hoppscotch deployments to version 2026.5.0 and perform a security audit of current environment variables to ensure no secrets have already been tampered with.