---METADATA---
VENDOR: wenxian
PRODUCT: wenxian
AFFECTED_VERSIONS: Versions 0.3.1 and prior
---END_METADATA---

Description Summary:
The wenxian GitHub Actions workflow is vulnerable to command injection via untrusted user input in issue comments, allowing arbitrary code execution on the GitHub runner.

Executive Summary:
An unauthenticated attacker can execute arbitrary code on a GitHub Actions runner by simply posting a crafted comment on a repository using the wenxian tool.

Vulnerability Details

CVE-ID: CVE-2026-34243

Affected Software: wenxian (GitHub Actions workflow)

Affected Versions: Versions 0.3.1 and prior

Vulnerability: The workflow uses issue_comment.body directly inside a shell command without sanitization. An unauthenticated attacker can post a comment containing shell metacharacters to trigger command injection and execute arbitrary code within the context of the GitHub Actions runner.

Business Impact

A successful exploit allows an attacker to hijack the CI/CD pipeline. This can lead to the theft of GitHub secrets (e.g., API keys, cloud credentials), the injection of malicious code into the software supply chain, or unauthorized access to the repository. The CVSS score of 9.8 highlights the extreme risk of supply chain compromise.

Remediation Plan

Immediate Action: Disable the affected GitHub Actions workflow immediately. Since no patch is currently available, manually sanitize the workflow file to use environment variables for user input instead of direct shell interpolation.

Proactive Monitoring: Review GitHub Actions run history for suspicious activity and audit all secrets used by the affected repository for potential compromise.

Compensating Controls: Use "Restrict repository permissions" in GitHub to ensure that the GITHUB_TOKEN has minimal permissions (read-only) for workflows triggered by external users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there are no publicly available patches. This vulnerability is particularly dangerous as it can be triggered by any GitHub user by simply commenting on an issue.

Analyst Recommendation

The lack of a vendor patch makes this a critical "zero-day" risk for users of wenxian. Immediate manual intervention is required to secure the GitHub Actions workflow. Ensure that all user-supplied data is treated as untrusted and never passed directly to a shell.

---METADATA---
VENDOR: CtrlPanel
PRODUCT: CtrlPanel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the open-source billing software CtrlPanel.

Executive Summary:
A high-severity vulnerability in the CtrlPanel billing software poses a significant risk to the integrity and confidentiality of hosting provider infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34241

Affected Software: CtrlPanel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation lacks specific technical details regarding the vulnerability type or the required authentication level for exploitation. Given the software's role in billing and hosting management, the 8.7 CVSS score suggests a high potential for unauthorized access or administrative compromise.

Business Impact

The vulnerability carries a CVSS score of 8.7, categorizing it as High severity. Successful exploitation could lead to unauthorized access to sensitive billing data, customer information, or control over hosting infrastructure, resulting in severe reputational damage and potential financial loss.

Remediation Plan

Immediate Action: Consult the official CtrlPanel security advisories to identify and apply the latest security patches.

Proactive Monitoring: Review system and application access logs for anomalous behavior or unauthorized administrative requests.

Compensating Controls: Implement strict access control lists (ACLs) and utilize a Web Application Firewall (WAF) to filter malicious traffic directed at the billing portal.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the software's function, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations utilizing CtrlPanel must treat this as a priority. Administrators should monitor official vendor channels for specific patch releases and perform a thorough security audit of their instances immediately.

---METADATA---
VENDOR: CtrlPanel
PRODUCT: CtrlPanel
AFFECTED_VERSIONS: 1.1.1 and prior
---END_METADATA---

Description Summary:
CtrlPanel contains an unauthenticated Remote Code Execution (RCE) vulnerability in its web-based installer, allowing attackers to execute arbitrary commands on the server.

Executive Summary:
An actively exploited, unauthenticated RCE vulnerability in CtrlPanel allows remote attackers to execute arbitrary code with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34234

Affected Software: CtrlPanel

Affected Versions: 1.1.1 and prior

Vulnerability: An unauthenticated attacker can trigger code execution via the web-based installer, which fails to properly validate the installation state and passes user input directly into shell commands.

Business Impact

With a CVSS score of 10.0, this vulnerability is critical and poses an immediate threat to the entire hosting infrastructure. Active exploitation in the wild indicates that attackers are likely using this flaw to establish persistent backdoors, exfiltrate hosting data, or deploy ransomware, leading to total loss of control over the affected servers.

Remediation Plan

Immediate Action: Update CtrlPanel to version 1.2.0 or higher immediately; if an update is not possible, remove or disable the public/installer/index.php file.

Proactive Monitoring: Search for evidence of unauthorized shell processes, unexpected file creations in web directories, and anomalous outbound network traffic.

Compensating Controls: Immediately restrict public access to the installer endpoint via WAF rules or server-level configuration (e.g., .htaccess or Nginx deny directives).

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 19, 2026, there is confirmed active exploitation of this vulnerability in the wild. Immediate patching is mandatory to secure the environment.

Analyst Recommendation

This is an extremely high-risk vulnerability with confirmed active exploitation. Organizations must treat this as a high-priority incident and apply the necessary patches or mitigating controls without delay to prevent unauthorized remote command execution.

---METADATA---
VENDOR: e-Excellence
PRODUCT: U-Office Force
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An insecure deserialization vulnerability in U-Office Force allows unauthenticated remote attackers to execute arbitrary code via crafted serialized content.

Executive Summary:
U-Office Force is vulnerable to a critical insecure deserialization flaw that enables unauthenticated remote attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-3422

Affected Software: e-Excellence U-Office Force

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly validate serialized data, leading to an Insecure Deserialization vulnerability. An unauthenticated remote attacker can exploit this by sending maliciously crafted serialized objects to the server, resulting in arbitrary code execution.

Business Impact

Successful exploitation allows an attacker to gain full control over the U-Office Force server, potentially leading to the exposure of sensitive corporate data and internal communications. With a CVSS score of 9.8, this vulnerability poses a severe threat to the confidentiality and integrity of the organization’s digital workspace.

Remediation Plan

Immediate Action: Update U-Office Force to the latest version immediately to address the insecure deserialization logic.

Proactive Monitoring: Review application logs for unusual error messages related to object deserialization and monitor for unauthorized shell activity on the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block common Java or .NET deserialization gadget chains.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, deserialization flaws are frequently targeted by advanced persistent threats (APTs) due to their reliability in achieving RCE.

Analyst Recommendation

The critical nature of this vulnerability requires an immediate response. Organizations should verify their current version of U-Office Force and apply vendor-supplied patches without delay to prevent unauthorized server access.

---METADATA---
VENDOR: SandboxJS
PRODUCT: SandboxJS
AFFECTED_VERSIONS: Prior to 0.8.36
---END_METADATA---

Description Summary:
A sandbox escape in SandboxJS allows attackers to bypass global object protection by utilizing an exposed constructor path, enabling arbitrary property writes in the host environment.

Executive Summary:
A critical sandbox escape vulnerability in SandboxJS allows attackers to bypass security protections, enabling arbitrary code execution and persistence across sandbox instances.

Vulnerability Details

CVE-ID: CVE-2026-34208

Affected Software: SandboxJS

Affected Versions: Prior to 0.8.36

Vulnerability: The library fails to sufficiently block access to the constructor property within the sandbox. Attackers can leverage this.constructor.call to write arbitrary properties into host global objects, effectively breaking the isolation boundary.

Business Impact

This flaw permits an attacker to escape the intended sandbox isolation, which could lead to unauthorized access to host-level resources and sensitive memory. Given the CVSS score of 10.0, this represents the highest level of risk to applications relying on SandboxJS for secure code execution.

Remediation Plan

Immediate Action: Update the SandboxJS library to version 0.8.36 or later immediately.

Proactive Monitoring: Review application logs for unusual global object modifications or unexpected cross-sandbox interaction patterns.

Compensating Controls: Ensure that applications utilizing sandboxing implement secondary defense-in-depth measures, such as limiting the privileges of the process running the sandbox.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS rating, immediate remediation is required. Organizations using SandboxJS must prioritize upgrading to version 0.8.36 to ensure the integrity of their sandboxed environments and prevent potential host-level compromise.

---METADATA---
VENDOR: Home Assistant
PRODUCT: Home Assistant (Supervisor)
AFFECTED_VERSIONS: < 2026.03.02
---END_METADATA---

Description Summary:
Home Assistant Supervisor fails to restrict access to internal Docker endpoints when using host network mode on Linux, exposing unauthenticated management interfaces to the local network.

Executive Summary:
Home Assistant installations on Linux are vulnerable to unauthenticated access to internal management endpoints, potentially allowing local network attackers to compromise the home automation system.

Vulnerability Details

CVE-ID: CVE-2026-34205

Affected Software: Home Assistant Home Assistant Supervisor

Affected Versions: Versions prior to 2026.03.02

Vulnerability: On Linux, Home Assistant apps configured with "host network mode" fail to isolate unauthenticated endpoints bound to the internal Docker bridge. This allows any device on the same local network to access these administrative interfaces without any authentication.

Business Impact

Unauthorized access to Home Assistant can lead to the control of physical smart home devices, access to private camera feeds, and the theft of sensitive configuration data. The CVSS score of 9.6 reflects the high risk of unauthenticated access and the potential for complete system takeover by an attacker on the local network.

Remediation Plan

Immediate Action: Update Home Assistant Supervisor to version 2026.03.02 or later immediately.

Proactive Monitoring: Inspect local network traffic for unauthorized connections to Home Assistant's internal management ports (typically 8123 or other Docker-assigned ports).

Compensating Controls: Implement network segmentation (VLANs) to isolate the Home Assistant server from untrusted local devices until the update is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. This vulnerability is particularly relevant for users who run Home Assistant on generic Linux distributions rather than the dedicated Home Assistant OS.

Analyst Recommendation

The update to Supervisor 2026.03.02 is critical for maintaining the privacy and security of the Home Assistant environment. Users should prioritize this update and review their network configuration to ensure that management interfaces are not exposed to untrusted segments of their local network.

---METADATA---
VENDOR: Imagination Technologies
PRODUCT: GPU Driver
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Software running as a non-privileged user can trigger an out-of-bounds write in the kernel via intentional GPU sparse memory API calls.

Executive Summary:
A high-severity kernel-level vulnerability exists in the GPU driver, allowing a local non-privileged user to achieve arbitrary code execution with kernel-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34195

Affected Software: Imagination Technologies GPU Driver

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from incorrect indexing of internal state when performing sparse allocation remapping. A local attacker can intentionally trigger these API calls to cause an out-of-bounds write, granting them control over the kernel's execution flow.

Business Impact

The CVSS score of 8.8 reflects the high risk posed by kernel-level exploits. Successful exploitation allows a local user to elevate their privileges to the highest level, potentially resulting in complete system takeover, persistence, and the bypass of all OS-level security controls.

Remediation Plan

Immediate Action: Apply the latest GPU driver updates provided by the hardware vendor or system manufacturer.

Proactive Monitoring: Monitor for unexpected system crashes or unusual kernel-related errors, which may indicate attempted exploitation.

Compensating Controls: Restrict access to GPU-accelerated applications to trusted users only and enforce the principle of least privilege for all local accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no evidence of proof of exploitation at the moment. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Kernel vulnerabilities of this nature are extremely dangerous. Administrators must prioritize updating GPU drivers on all affected systems to prevent local attackers from gaining full administrative control over the underlying host.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: 4.12 through 6.7
---END_METADATA---

Description Summary:
Canonical LXD versions 4.12 through 6.7 contain a privilege escalation vulnerability where restricted TLS certificate users can elevate to cluster admin.

Executive Summary:
A critical privilege escalation vulnerability in Canonical LXD allows authenticated users to gain cluster admin privileges.

Vulnerability Details

CVE-ID: CVE-2026-34179

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The doCertificateUpdate function fails to validate the Type field during PUT/PATCH requests to /1.0/certificates/{fingerprint}. This allows a remote authenticated attacker with restricted TLS access to escalate privileges to cluster admin.

Business Impact

With a CVSS score of 9.1, this vulnerability allows an attacker to gain full control over the LXD cluster. This could lead to unauthorized access to all containers, data theft, and the ability to deploy malicious workloads across the cluster.

Remediation Plan

Immediate Action: Update LXD to a version that contains the fix for this privilege escalation vulnerability.

Proactive Monitoring: Monitor API audit logs for unusual certificate update requests or unauthorized administrative actions.

Compensating Controls: Limit access to the LXD API to only trusted, authorized users and implement strict network-level controls for cluster management traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation within container orchestration platforms is a high-priority risk. Administrators must update their LXD installations immediately to ensure that restricted users cannot elevate their privileges and compromise the entire cluster.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: Before 6.8
---END_METADATA---

Description Summary:
A backup import validation flaw in Canonical LXD allows authenticated remote attackers to bypass project restrictions and achieve full host compromise.

Executive Summary:
An authentication bypass vulnerability in the Canonical LXD backup import process allows an attacker to execute arbitrary configurations, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34178

Affected Software: Canonical LXD

Affected Versions: Before 6.8

Vulnerability: The vulnerability exists because the backup import process validates restrictions against the wrong file. An authenticated remote attacker with instance-creation permissions can craft a malicious archive to force privileged execution, bypassing security constraints.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw. By bypassing project restrictions, an attacker can gain full control over the host system, creating significant risk for data confidentiality, integrity, and availability within the affected LXD environment.

Remediation Plan

Immediate Action: Update all instances of Canonical LXD to version 6.8 or later to ensure backup integrity validation is enforced correctly.

Proactive Monitoring: Review logs for suspicious instance creation events or backup imports originating from untrusted or low-privilege users.

Compensating Controls: Implement strict Access Control Lists (ACLs) for users permitted to perform instance creation or backup restoration tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this as a high-priority update. The ability for a restricted user to gain full host access via a simple backup import makes this a critical path for remediation to prevent catastrophic system failure.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: 4.12 through 6.7
---END_METADATA---

Description Summary:
An incomplete denylist in Canonical LXD allows a restricted project user to inject AppArmor and QEMU configurations, facilitating privilege escalation to host root.

Executive Summary:
A critical vulnerability in Canonical LXD allows an attacker with restricted VM permissions to escape the sandbox and achieve full host root privileges.

Vulnerability Details

CVE-ID: CVE-2026-34177

Affected Software: Canonical LXD

Affected Versions: 4.12 through 6.7

Vulnerability: The vulnerability resides in the isVMLowLevelOptionForbidden function, which fails to correctly block raw.apparmor and raw.qemu.conf keys. An authenticated attacker with can_edit permissions can leverage this to bridge the LXD Unix socket and escalate privileges.

Business Impact

With a CVSS score of 9.1, this flaw represents a major security failure in multi-tenant environments. An attacker gaining host root access effectively compromises the entire hypervisor and all containers or VMs managed by the cluster, leading to total data loss and system-wide compromise.

Remediation Plan

Immediate Action: Upgrade Canonical LXD to the latest version to ensure the restricted project denylist is properly enforced.

Proactive Monitoring: Audit LXD project configurations for unauthorized usage of raw.apparmor or raw.qemu.conf keys.

Compensating Controls: Restrict the can_edit permission to only highly trusted administrators until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a severe risk to containerized and virtualized environments. Administrators must audit their current LXD configurations for signs of tampering and apply the vendor-provided patch immediately to prevent unauthorized host-level access.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow an unauthorized party to perform actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Coolify could enable attackers to perform unauthorized actions, potentially leading to a full compromise of the application environment.

Vulnerability Details

CVE-ID: CVE-2026-34171

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is a CSRF (CWE-352) flaw where an attacker can trick an authenticated user into executing unwanted actions within the Coolify interface. This is typically achieved by enticing a user to click a malicious link while they have an active session.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the confidentiality and integrity of the application. An attacker could force administrative actions, such as changing system settings or creating new user accounts, leading to unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later to implement the required CSRF protection mechanisms.

Proactive Monitoring: Review audit logs for unexpected account modifications or changes to application settings that do not align with known administrative activity.

Compensating Controls: Encourage users to log out of the Coolify dashboard when not in use and implement browser-based security policies to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be highly damaging in management tools like Coolify. It is essential to update to the patched version immediately to ensure that session integrity is maintained and to prevent unauthorized administrative actions.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a severe risk to host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34168

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an authenticated user with low privileges to inject and execute arbitrary OS commands. The vulnerability exists due to improper neutralization of special elements used in system calls.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the server hosting Coolify. Given the high CVSS score of 8.8, this vulnerability could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell commands originating from the Coolify service account.

Compensating Controls: Ensure the Coolify service is running with the least privilege necessary on the host OS to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators should prioritize patching to version 4.0.0-beta.471 immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
FastGPT, an AI Agent building platform, contains a security vulnerability that could lead to unauthorized access or manipulation of AI agent configurations.

Executive Summary:
A security vulnerability in the FastGPT AI platform could allow attackers to compromise AI agent workflows, leading to data leakage or the execution of unauthorized AI tasks.

Vulnerability Details

CVE-ID: CVE-2026-34163

Affected Software: FastGPT

Affected Versions: See vendor advisory for affected versions

Vulnerability: FastGPT is an AI Agent building platform that integrates with databases like MongoDB and Redis. The vulnerability likely involves a failure to properly secure agent configurations or API interactions, potentially allowing an attacker to intercept or modify the logic of deployed AI agents.

Business Impact

As AI agents are increasingly used for automated business logic and data processing, a compromise in FastGPT could result in the leakage of proprietary prompts, API keys, or sensitive training data. The CVSS score of 7.7 reflects a high risk where an attacker could disrupt AI-driven business processes, leading to significant operational inaccuracies and loss of intellectual property.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the FastGPT maintainers and ensure that all associated database connections (MongoDB/Redis) use secure, encrypted channels.

Proactive Monitoring: Review AI agent execution logs for anomalous behavior and audit API access tokens for any signs of unauthorized usage or credential stuffing.

Compensating Controls: Implement strict network segmentation for the FastGPT environment and use robust authentication (such as OAuth2) to protect the agent-building interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, the rising popularity of AI platforms makes them high-value targets for modern threat actors.

Analyst Recommendation

We recommend that organizations utilizing FastGPT for AI automation immediately review their deployment security and apply all available updates. Ensuring the integrity of AI workflows is critical for maintaining business continuity and protecting sensitive data processed by these agents.

---METADATA---
VENDOR: FastGPT
PRODUCT: FastGPT
AFFECTED_VERSIONS: Prior to version 4.14.9.5
---END_METADATA---

Description Summary:
FastGPT exposes an unauthenticated HTTP tools testing endpoint that functions as a full HTTP proxy, enabling Server-Side Request Forgery (SSRF) and internal network scanning.

Executive Summary:
An unauthenticated attacker can use FastGPT as an open HTTP proxy to access internal network resources or mask malicious traffic, leading to significant exposure of private infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34162

Affected Software: FastGPT

Affected Versions: Prior to version 4.14.9.5

Vulnerability: The /api/core/app/httpTools/runTool endpoint lacks authentication and allows arbitrary HTTP requests to be made by the server. This functions as a full-featured HTTP proxy where an unauthenticated attacker can control the method, headers, body, and target URL.

Business Impact

The impact is a critical breach of perimeter security. Attackers can use this flaw to perform Server-Side Request Forgery (SSRF) to scan internal networks, access metadata services in cloud environments, or bypass IP-based access controls. The CVSS score of 10 reflects the total loss of control over the application's network communication capabilities.

Remediation Plan

Immediate Action: Update FastGPT to version 4.14.9.5 or later to enforce authentication on the affected testing endpoints.

Proactive Monitoring: Review application logs for high volumes of requests to the /runTool endpoint and monitor for outbound traffic to internal or unusual IP ranges.

Compensating Controls: Implement egress filtering on the server hosting FastGPT to prevent it from initiating connections to sensitive internal network segments or cloud metadata IPs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. The simplicity of exploiting an unauthenticated proxy makes this a likely candidate for automated scanning and exploitation.

Analyst Recommendation

Given the CVSS 10 rating, this vulnerability should be treated as an emergency. The ability for an unauthenticated outsider to pivot through the server into your internal network is a catastrophic risk. Apply the 4.14.9.5 patch immediately and restrict network access to the FastGPT server until remediated.

---METADATA---
VENDOR: llama.cpp
PRODUCT: llama.cpp
AFFECTED_VERSIONS: Prior to version b8492
---END_METADATA---

Description Summary:
An unauthenticated attacker can achieve remote code execution and ASLR bypass in llama.cpp by exploiting a lack of bounds validation in the RPC backend's tensor deserialization.

Executive Summary:
The llama.cpp LLM inference engine is vulnerable to unauthenticated remote code execution via its RPC backend, allowing attackers to fully compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-34159

Affected Software: llama.cpp

Affected Versions: Versions prior to b8492

Vulnerability: The RPC backend's deserialize_tensor() function fails to perform bounds validation when a tensor's buffer field is zero. This allows an unauthenticated attacker with TCP access to the RPC server to read/write arbitrary memory, bypass ASLR, and execute code.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation allows an attacker to take full control of the AI inference server, potentially stealing proprietary models, sensitive training data, or using the server for malicious purposes.

Remediation Plan

Immediate Action: Update llama.cpp to version b8492 or later immediately to implement the necessary bounds validation in the RPC backend.

Proactive Monitoring: Monitor the RPC server port for anomalous traffic patterns and unexpected memory usage spikes that could signal an exploitation attempt.

Compensating Controls: Do not expose the llama.cpp RPC server port to the public internet; use VPNs or SSH tunnels for remote access and implement strict IP whitelisting.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. However, the combination of ASLR bypass and RCE makes this a highly attractive target for attackers.

Analyst Recommendation

Given the unauthenticated nature of this RCE, immediate patching is mandatory. Organizations should also ensure that LLM infrastructure is isolated from untrusted networks to reduce the attack surface.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.469
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a high risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34158

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that permits an authenticated user with low-level privileges to inject malicious commands into the host operating system. The vulnerability stems from improper neutralization of special elements used in system calls.

Business Impact

The ability to execute arbitrary OS commands provides an attacker with a foothold on the server, potentially leading to full system compromise. With a CVSS score of 8.8, this high-severity vulnerability could result in unauthorized data exfiltration, service disruption, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system and application logs for unexpected shell process executions or irregular administrative activity.

Compensating Controls: Implement strict network segmentation and restrict access to the management interface to trusted IP addresses to limit the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a significant risk to the security of the host environment. Organizations should prioritize updating their Coolify instances to the latest available version immediately to remediate the command injection vector and prevent potential unauthorized remote code execution.

---METADATA---
VENDOR: NocoBase
PRODUCT: NocoBase
AFFECTED_VERSIONS: Prior to version 2.0.28
---END_METADATA---

Description Summary:
NocoBase Workflow Script Node allows authenticated sandbox escape to Remote Code Execution as root via prototype chain traversal of console objects. This flaw is patched in version 2.0.28.

Executive Summary:
An authenticated attacker can escape the Node.js sandbox in NocoBase to achieve full Remote Code Execution with root privileges, compromising the entire host system.

Vulnerability Details

CVE-ID: CVE-2026-34156

Affected Software: NocoBase

Affected Versions: Prior to version 2.0.28

Vulnerability: This is a sandbox escape vulnerability within the Workflow Script Node. An authenticated attacker can leverage exposed WritableWorkerStdio objects on the console object to traverse the prototype chain, bypassing the vm sandbox restrictions to execute arbitrary commands as the root user.

Business Impact

A successful exploit grants an attacker full control over the underlying server infrastructure. Given the root-level access, this results in total loss of data confidentiality, integrity, and availability, potentially leading to massive data breaches and long-term system compromise. The CVSS score of 9.9 reflects the critical nature of achieving unconstrained code execution on a business-critical no-code platform.

Remediation Plan

Immediate Action: Upgrade NocoBase to version 2.0.28 or later immediately to apply the security patch.

Proactive Monitoring: Review system logs for unusual Node.js process activity and monitor the WORKFLOW_SCRIPT_MODULES environment variable for unauthorized changes.

Compensating Controls: Restrict access to the NocoBase administrative interface and the Workflow builder to trusted personnel only using network-level access controls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the technical feasibility of prototype pollution and sandbox escapes, the potential for exploitation is extremely high once the patch is analyzed by threat actors.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows a user with workflow access to escalate to full system administrator. Organizations using NocoBase must prioritize the update to version 2.0.28. Immediate patching is the only effective way to mitigate the risk of a complete host takeover.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, allowing authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host, posing a significant risk to the entire self-hosted environment.

Vulnerability Details

CVE-ID: CVE-2026-34153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: The application fails to properly neutralize special elements used in an OS command, enabling an authenticated user to perform OS command injection. This vulnerability requires a low-privilege authenticated session to initiate the attack.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute commands with the privileges of the Coolify application. Given the CVSS score of 8.8, this poses a high risk of full system compromise, unauthorized data access, and potential lateral movement into other databases or services managed by the platform.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later to implement the necessary input neutralization patches.

Proactive Monitoring: Review system and application access logs for unusual command executions or unexpected process spawning originating from the Coolify service account.

Compensating Controls: Ensure the Coolify instance is running in an isolated container with minimal host-level permissions to limit the impact of a potential container escape or code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk to the integrity of the host server. Administrators are urged to prioritize the update to the latest version immediately to eliminate the command injection vector.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, enabling authenticated attackers to execute arbitrary system commands through insecure input handling.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify allows for remote code execution, threatening the integrity of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-34152

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability (CWE-78) occurs due to the improper neutralization of special characters in input fields, allowing an authenticated attacker to inject and execute OS-level commands. This effectively bypasses the application's intended functional boundaries.

Business Impact

The ability to execute OS commands on the host server provides an attacker with broad capabilities, including data theft, privilege escalation, and persistent backdooring of the environment. The CVSS score of 8.8 highlights the high risk associated with this vulnerability, requiring prompt remediation to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 4.0.0-beta.471 or later to remediate the command injection flaw.

Proactive Monitoring: Regularly audit server access logs and monitor for unexpected command execution or child processes being spawned by the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns in request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for Coolify users. Administrators are strongly advised to perform the update to version 4.0.0-beta.471 across all environments to ensure protection against potential exploitation.

---METADATA---
VENDOR: itsourcecode
PRODUCT: University Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A flaw in itsourcecode University Management System version 1 presents a high-severity security risk to the application's environment.

Executive Summary:
A secondary flaw has been identified in the University Management System, further increasing the risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-3413

Affected Software: itsourcecode University Management System

Affected Versions: Version 1

Vulnerability: A flaw has been found in the University Management System. This vulnerability, distinct from others in the same product, contributes to the overall attack surface of the management platform.

Business Impact

The potential for unauthorized data access or system manipulation remains high. If exploited, this could lead to a loss of data integrity and potential disruption of university services. The CVSS score of 7.3 confirms the High severity of the risk, necessitating prompt remediation to protect institutional assets.

Remediation Plan

Immediate Action: Update the University Management System to the latest available version that includes fixes for this specific flaw.

Proactive Monitoring: Regularly review application and server logs for signs of unauthorized access attempts or unusual system behavior.

Compensating Controls: Implement network segmentation to isolate the management system from other critical assets and enforce strict input validation on all web forms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The presence of multiple flaws in the same version emphasizes the need for a comprehensive update strategy.

Analyst Recommendation

Institutions using the itsourcecode University Management System version 1 must apply all available security patches immediately. Maintaining an up-to-date software environment is the most effective defense against exploitation.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical OS command injection vulnerability exists in the text_to_subtitles.php script of the Guardian language-system, allowing unauthenticated remote code execution.

Executive Summary:
The Guardian language-system is vulnerable to an unauthenticated remote code execution flaw that permits attackers to execute arbitrary commands on the host server.

Vulnerability Details

CVE-ID: CVE-2026-34117

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in text_to_subtitles.php. An unauthenticated remote attacker can inject shell metacharacters to execute unauthorized OS commands.

Business Impact

The CVSS score of 9.8 underscores the severity of this flaw, which allows for full system compromise without requiring authentication. Business impacts include the loss of confidentiality, integrity, and availability of the affected system, as well as the potential for lateral movement into the broader internal network.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the improper input sanitization in text_to_subtitles.php.

Proactive Monitoring: Review server logs for anomalous process execution or unexpected outbound network connections originating from the web server service account.

Compensating Controls: Utilize a WAF to filter and deny requests to text_to_subtitles.php that include malicious shell command sequences in the id parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this command injection vulnerability, immediate patching is required. Security teams should treat this as a high-priority incident until the vendor-supplied update is verified as installed across all affected instances.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical OS command injection vulnerability exists in the transcribe.php script of the Guardian language-system, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Guardian language-system poses a critical risk of total server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34116

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in transcribe.php. An unauthenticated remote attacker can inject arbitrary shell metacharacters to execute OS-level commands.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat. Successful exploitation provides an attacker with full control over the underlying server, potentially leading to unauthorized data exfiltration, service disruption, and the establishment of a persistent backdoor within the corporate network.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest vendor-supplied version immediately to incorporate necessary input sanitization.

Proactive Monitoring: Inspect web server access logs for suspicious strings containing shell metacharacters (e.g., ;, &&, |) within the id parameter of requests to transcribe.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming HTTP requests that contain shell injection patterns in the id query parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for unauthenticated remote code execution, which is one of the most severe security risks. Organizations should prioritize patching this system immediately and audit the server for any signs of unauthorized activity that may have occurred prior to remediation.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the transcribe_amazon.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, resulting in a critical risk to the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-34115

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id parameter before passing it to an exec() call within transcribe_amazon.php. This allows unauthenticated remote attackers to trigger arbitrary OS command execution by injecting shell metacharacters.

Business Impact

The CVSS score of 9.8 underscores the severity of this issue. A successful attack effectively grants the adversary the same level of access as the web service user, which can be leveraged to compromise the entire host, exfiltrate data, or disrupt business operations.

Remediation Plan

Immediate Action: Patch the Guardian language-system to the latest version to neutralize the vulnerability in the transcription component.

Proactive Monitoring: Monitor system and web server logs for irregular process execution patterns or unexpected shell activity linked to the transcribe_amazon.php file.

Compensating Controls: Deploy WAF signatures designed to detect and block shell-injection characters in HTTP GET parameters to provide virtual patching until the update is applied.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous due to the lack of required authentication and the potential for full system compromise. Immediate application of vendor patches is strongly recommended to protect the integrity and security of the affected environment.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the translate_text.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, presenting a critical risk to server security.

Vulnerability Details

CVE-ID: CVE-2026-34114

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper input sanitization in the translate_text.php script, where the id parameter is passed to a system exec() call. The flaw is exploitable by unauthenticated remote attackers who can inject arbitrary shell commands.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Exploitation could lead to complete system takeover, unauthorized access to sensitive translation data, and the potential for lateral movement into other segments of the internal network.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the command injection flaw in the translate_text.php file.

Proactive Monitoring: Monitor server logs for suspicious activity, specifically looking for attempts to pass shell commands through the translate_text.php endpoint.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that contain malicious command injection patterns directed at the translation module.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ease of exploitation for this unauthenticated command injection makes this a top priority for remediation. Security teams must ensure all instances of the affected software are updated to the secure version to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability exists in the speech_text.php file of the Guardian language-system due to improper sanitization of the id parameter.

Executive Summary:
An unauthenticated remote attacker can execute arbitrary OS commands on the Guardian language-system, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34113

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: This is a command injection vulnerability occurring in speech_text.php where the id GET parameter is passed directly to a PHP exec() function. Because no authentication is required, any remote actor can supply malicious shell metacharacters to execute unauthorized OS commands.

Business Impact

The CVSS score of 9.8 reflects the extreme risk posed by this vulnerability. Successful exploitation allows an attacker to gain full control over the underlying server, resulting in potential data theft, service disruption, and the establishment of a persistent backdoor within the corporate network.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest vendor-supplied version immediately to patch the command injection vulnerability.

Proactive Monitoring: Review web server access logs for unusual GET requests containing shell metacharacters (e.g., ;, |, &&) targeting the speech_text.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing shell command syntax in the id parameter.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the lack of authentication requirements, this vulnerability presents an immediate threat to the confidentiality and integrity of your infrastructure. Organizations should prioritize patching the Guardian language-system as a matter of urgency to prevent unauthorized remote code execution.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in speechmac.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34112

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter in speechmac.php before passing it to a PHP exec() function. This vulnerability allows an unauthenticated remote attacker to perform command injection, enabling them to execute arbitrary system-level commands.

Business Impact

The ability for an attacker to execute arbitrary commands without authentication represents a significant danger, potentially allowing them to pivot within the network or exfiltrate sensitive data. With a CVSS score of 9.8, this vulnerability warrants immediate attention to prevent unauthorized access and protect business-critical infrastructure.

Remediation Plan

Immediate Action: Install the latest software update from the vendor to remediate the command injection flaw in speechmac.php.

Proactive Monitoring: Regularly audit server logs for suspicious activity involving the speechmac.php endpoint and associated shell execution attempts.

Compensating Controls: Implement WAF rules specifically designed to detect and block command injection payloads targeting vulnerable GET parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity and the lack of authentication required, this vulnerability represents an urgent threat. It is highly recommended that administrators apply the available security updates immediately to mitigate the risk of remote code execution and unauthorized server access.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in speechmac_text.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34111

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: This vulnerability resides in the speechmac_text.php script, where the id GET parameter is unsafely concatenated into a PHP exec() command. An unauthenticated remote attacker can exploit this lack of sanitization to inject and execute arbitrary OS-level commands.

Business Impact

Successful exploitation allows an attacker to gain unauthorized execution privileges on the host server, which can lead to catastrophic data breaches and complete system compromise. The CVSS score of 9.8 confirms that this represents an extreme risk to the organization's security posture and data confidentiality.

Remediation Plan

Immediate Action: Update the Guardian Language-System to the latest version to address the improper input handling in speechmac_text.php.

Proactive Monitoring: Monitor server-side process logs for unauthorized or unexpected PHP execution patterns related to the jobs/speech_audio_mac_text.php script.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out requests containing malicious shell metacharacters targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation and the level of access granted to an attacker. Security teams must treat this as a high-priority item and ensure the vendor-provided patch is implemented across all production environments immediately.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-System
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated command injection vulnerability in complex_start.php allows remote attackers to execute arbitrary OS commands via the 'id' parameter.

Executive Summary:
A critical command injection vulnerability in the Guardian Language-System allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk of full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-34110

Affected Software: Guardian Language-System

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists due to improper input sanitization in the complex_start.php file, where the id GET parameter is passed directly into a PHP exec() function. An unauthenticated remote attacker can leverage this by appending shell metacharacters to execute unauthorized OS commands.

Business Impact

The exploitation of this flaw grants attackers complete control over the underlying server, leading to potential data exfiltration, system destruction, or lateral movement into the internal network. With a CVSS score of 9.8, this vulnerability is classified as critical, representing an immediate threat to the integrity and availability of business operations.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian immediately to sanitize the input parameters.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing shell metacharacters or unexpected system calls originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing suspicious shell syntax directed at complex_start.php.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this command injection flaw and the lack of authentication required for exploitation, immediate remediation is mandatory. Organizations should prioritize updating the Guardian Language-System to the latest patched version to prevent potential remote code execution and unauthorized system access.

---METADATA---
VENDOR: itsourcecode
PRODUCT: University Management System
AFFECTED_VERSIONS: 1
---END_METADATA---

Description Summary:
A security vulnerability in itsourcecode University Management System version 1 could lead to unauthorized access to academic and administrative records.

Executive Summary:
The University Management System contains a high-severity vulnerability that poses a significant risk to the confidentiality and integrity of university data.

Vulnerability Details

CVE-ID: CVE-2026-3411

Affected Software: itsourcecode University Management System

Affected Versions: Version 1

Vulnerability: A security vulnerability has been detected in the software. While the specific flaw is not detailed, such systems are often prone to authentication bypass or injection-based attacks that compromise the underlying database.

Business Impact

Exploitation of this flaw could allow unauthorized individuals to access or modify student records, financial data, or sensitive institutional information. The CVSS score of 7.3 reflects a High severity, indicating a credible threat to the institution's operational security and compliance status.

Remediation Plan

Immediate Action: Apply the latest security updates from itsourcecode for the University Management System immediately.

Proactive Monitoring: Audit user account activity for anomalies and monitor database logs for signs of SQL injection or unauthorized data extraction.

Compensating Controls: Use a Web Application Firewall (WAF) to block common web-based attacks and ensure that all administrative interfaces are protected by strong authentication.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as educational institutions are frequent targets for cyberattacks.

Analyst Recommendation

Immediate patching is recommended to protect the University Management System. IT departments should ensure that all instances of the software are updated to the most recent secure version to prevent data breaches.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system is vulnerable to unauthenticated remote code execution due to improper sanitization of the 'id' parameter in speech.php.

Executive Summary:
An unauthenticated command injection vulnerability in the Guardian language-system allows remote attackers to execute arbitrary OS commands via the speech.php script.

Vulnerability Details

CVE-ID: CVE-2026-34109

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application insecurely passes the 'id' GET parameter directly into a PHP exec() function within speech.php. This lack of input validation permits an unauthenticated attacker to inject shell commands, leading to unauthorized OS-level execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to business operations. Exploitation allows attackers to gain full control over the underlying server, potentially leading to total data loss, unauthorized access to sensitive language processing assets, and significant system downtime during incident response efforts.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest version, which includes necessary input sanitization for the speech.php script.

Proactive Monitoring: Monitor system logs for anomalous child processes spawned by the web server user, which may indicate command injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious GET requests targeting speech.php that include command-chaining syntax.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of multiple command injection vulnerabilities in the Guardian language-system indicates a systemic issue with input handling. It is recommended to apply the vendor patches immediately and conduct a comprehensive security review of the entire codebase to identify any additional unpatched injection vectors.

---METADATA---
VENDOR: Guardian
PRODUCT: Language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system is vulnerable to unauthenticated remote code execution due to improper sanitization of the 'id' parameter in text.php.

Executive Summary:
An unauthenticated command injection vulnerability in the Guardian language-system allows remote attackers to execute arbitrary OS commands with server-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-34108

Affected Software: Guardian Language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the 'id' GET parameter before passing it to a PHP exec() function in text.php. This allows an unauthenticated attacker to inject shell metacharacters and execute arbitrary operating system commands.

Business Impact

A CVSS score of 9.8 reflects the severe impact of this vulnerability, which facilitates full remote code execution. Successful exploitation results in complete system compromise, enabling attackers to install backdoors, exfiltrate sensitive data, or pivot into the internal network, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the command injection vulnerability in text.php.

Proactive Monitoring: Review web server access logs for requests containing shell metacharacters (e.g., ;, |, &, `) in the 'id' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing common shell injection payloads targeting the text.php file.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is trivial to exploit and carries extreme risk to the host server. Security teams should treat this as a high-priority remediation item and verify that all instances of the Guardian language-system are patched or isolated from public access until a fix is deployed.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote command injection vulnerability exists in the language-system translate.php script, allowing attackers to execute arbitrary OS commands via the id parameter.

Executive Summary:
Guardian language-system is vulnerable to critical unauthenticated remote code execution due to improper input sanitization in the translation module.

Vulnerability Details

CVE-ID: CVE-2026-34107

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: This is a command injection vulnerability occurring in translate.php, where the id GET parameter is passed directly into a PHP exec() function. An unauthenticated attacker can supply shell metacharacters to execute arbitrary system commands with the privileges of the web server.

Business Impact

The potential for unauthenticated remote code execution poses a catastrophic risk to organizational security, as it allows attackers to take full control of the underlying server. With a CVSS score of 9.8, this vulnerability could facilitate data exfiltration, lateral movement, or complete system compromise, leading to severe operational downtime and loss of intellectual property.

Remediation Plan

Immediate Action: Apply the latest security update provided by Guardian to address the command injection flaw in translate.php.

Proactive Monitoring: Inspect web server access logs for suspicious GET requests containing shell metacharacters (e.g., ;, |, &, $) within the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests that contain unexpected shell characters in URL parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this remote code execution vulnerability, immediate patching is mandatory. Organizations should prioritize updating the Guardian language-system to the latest version to eliminate the injection vector and secure the application against unauthenticated adversaries.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical OS command injection vulnerability exists in the subtitles.php script of the Guardian language-system, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Guardian language-system exposes the host server to complete compromise by remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-34106

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in subtitles.php. An unauthenticated remote attacker can append shell metacharacters to the parameter to execute arbitrary OS commands.

Business Impact

With a CVSS score of 9.8, this flaw presents an extreme risk to organizational security. Successful exploitation could allow an attacker to gain elevated privileges, access sensitive data, or disable critical security controls, leading to significant operational and reputational damage.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest version, which includes patches for the command injection vulnerability in subtitles.php.

Proactive Monitoring: Monitor for unusual system command execution logs or unauthorized file modifications on the server hosting the language-system.

Compensating Controls: Configure a WAF to block requests containing common shell injection characters or patterns targeting the subtitles.php script until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides an unauthenticated attacker with the ability to execute arbitrary code, necessitating immediate remediation. Organizations should verify their patch management status and ensure that no exposed instances of the affected software remain unpatched.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system contains an error-based SQL injection vulnerability in translate_text.php, allowing authenticated users to extract database contents via the 'id' GET parameter.

Executive Summary:
An authenticated SQL injection vulnerability in the Guardian language-system allows attackers to perform unauthorized database queries and data extraction.

Vulnerability Details

CVE-ID: CVE-2026-34105

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: This is an error-based SQL injection vulnerability located in the translate_text.php file. An authenticated attacker can exploit this by passing malicious input through the unsanitized 'id' GET parameter.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical threat to the confidentiality of stored data. Successful exploitation could allow an attacker to bypass standard database access controls, leading to unauthorized data exfiltration and potential compromise of the entire backend repository.

Remediation Plan

Immediate Action: Apply the latest security update released by Guardian for the language-system.

Proactive Monitoring: Monitor database query performance and logs for suspicious error patterns or unauthorized access attempts originating from authenticated sessions.

Compensating Controls: Deploy WAF rules designed to inspect and block malformed GET requests that contain SQL syntax, particularly those targeting the translate_text.php script.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitation and the severity of potential data loss, organizations must prioritize this update. Ensure that all authenticated accounts are monitored and that the patch is applied across all instances of the language-system immediately.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Guardian language-system is vulnerable to error-based SQL injection via the 'name' GET parameter in designer.php, allowing authenticated attackers to extract database contents.

Executive Summary:
An authenticated SQL injection vulnerability in the Guardian language-system could allow an attacker to extract sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-34104

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an error-based SQL injection occurring in designer.php. An authenticated attacker can manipulate the unsanitized 'name' GET parameter to execute arbitrary SQL commands.

Business Impact

The ability to perform unauthorized database queries poses a severe risk to data confidentiality and integrity. Given the CVSS score of 9.8, this flaw could lead to the total exposure of sensitive business information stored within the database, potentially resulting in significant regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest patched version provided by the vendor.

Proactive Monitoring: Review application and database logs for unusual SQL syntax or unexpected error messages indicative of injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious GET requests targeting the designer.php endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk that requires immediate remediation. Administrators should prioritize patching the affected software and auditing current database access permissions to minimize the blast radius of any potential compromise.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Guardian language-system is vulnerable to error-based SQL injection in subtitles.php, stemming from the unsanitized 'id' GET parameter.

Executive Summary:
An authenticated SQL injection vulnerability in the Guardian language-system poses a critical threat to the confidentiality of stored file and metadata information.

Vulnerability Details

CVE-ID: CVE-2026-34103

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The application fails to validate the 'id' GET parameter in subtitles.php, allowing an authenticated attacker to inject malicious SQL commands into the backend query. This results in error-based data extraction from the files database.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized retrieval of file metadata and identifiers, potentially facilitating further attacks. The CVSS score of 9.8 highlights the critical urgency of this issue, as it allows for the subversion of database security controls, leading to significant risk of data breach.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch for the Guardian language-system immediately.

Proactive Monitoring: Audit server logs for suspicious activity involving 'subtitles.php' and look for evidence of database errors that may indicate injection attempts.

Compensating Controls: Use a WAF to intercept and block requests containing SQL injection patterns directed at the 'id' parameter.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of multiple SQL injection points in this product confirms a systemic security weakness. It is imperative that administrators apply the provided updates immediately to mitigate this high-severity risk and prevent unauthorized database access.

---METADATA---
VENDOR: Guardian
PRODUCT: language-system
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Guardian language-system contains an error-based SQL injection vulnerability in job_info_get.php, where the 'id' parameter is processed without proper sanitization.

Executive Summary:
An authenticated SQL injection vulnerability in the Guardian language-system enables attackers to compromise sensitive job information stored within the database.

Vulnerability Details

CVE-ID: CVE-2026-34102

Affected Software: Guardian language-system

Affected Versions: See vendor advisory

Vulnerability: The 'id' GET parameter in job_info_get.php is passed directly to an unsanitized SQL query. This allows an authenticated attacker to perform error-based SQL injection to extract data from the 'jobs' table.

Business Impact

The ability to perform SQL injection allows an attacker to query the database, potentially exposing proprietary job data or system-level information. With a CVSS score of 9.8, the severity is extreme, as it provides a direct path for attackers to gain unauthorized access to sensitive information, undermining the security posture of the entire application.

Remediation Plan

Immediate Action: Update the Guardian language-system to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor database query logs for unusual error patterns or unexpected query execution times originating from the 'job_info_get.php' script.

Compensating Controls: Implement input validation at the application level and utilize a WAF to filter malicious SQL injection strings in GET requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of SQL injection vulnerabilities, immediate action is required to patch the affected script. Security teams should ensure that all instances of the Guardian language-system are updated to the most current release to eliminate this attack vector.