---METADATA---
VENDOR: oras-project
PRODUCT: oras-go
AFFECTED_VERSIONS: < 2.6.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The oras-go Go library for managing OCI artifacts is vulnerable to server-side request forgery (SSRF) due to improper input validation.

Executive Summary:
A server-side request forgery vulnerability in the oras-go library allows unauthenticated attackers to perform unauthorized requests to internal resources.

Vulnerability Details

CVE-ID: CVE-2026-50151

Affected Software: oras-project oras-go

Affected Versions: < 2.6.1

Vulnerability: The library is susceptible to server-side request forgery (CWE-918), where an unauthenticated attacker can manipulate the library to send requests to unintended internal destinations.

Business Impact

This vulnerability could allow an attacker to bypass network boundaries, potentially accessing internal services or sensitive configuration endpoints that are not exposed to the public internet. With a CVSS score of 7.5, this high severity flaw represents a significant risk to internal network security and data confidentiality.

Remediation Plan

Immediate Action: Update the oras-go library to version 2.6.1 or later to implement proper input validation and prevent unauthorized request redirection.

Proactive Monitoring: Review egress traffic logs from services utilizing oras-go for unexpected connections to internal IP addresses or sensitive local resources.

Compensating Controls: Implement strict network segmentation and egress filtering to ensure that services running this library cannot communicate with internal infrastructure that is not necessary for their operation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of SSRF makes this an attractive target for attackers looking to map internal network topology.

Analyst Recommendation

Updating to version 2.6.1 is essential to eliminate the SSRF risk and protect internal network assets. Security teams should audit applications that incorporate the oras-go library to ensure they are updated promptly and operate within a restricted network environment.

---METADATA---
VENDOR: metabase
PRODUCT: metabase
AFFECTED_VERSIONS: >= 1.54.0, < 1.54.24, >= 1.55.0, < 1.55.24, >= 1.56.0, < 1.56.25, >= 1.57.0, < 1.57.19, >= 1.58.0, < 1.58.14, >= 1.59.0, < 1.59.10, >= 1.60.0, < 1.60.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in Metabase allows users with database connection permissions to achieve remote code execution via a flaw in the Snowflake JDBC driver.

Executive Summary:
An attacker with existing database configuration permissions can achieve remote code execution on the host server by exploiting a file path manipulation flaw in the Metabase Snowflake integration.

Vulnerability Details

CVE-ID: CVE-2026-50148

Affected Software: metabase metabase

Affected Versions: See metadata for specific range

Vulnerability: This vulnerability (CWE-73) allows an authenticated user to perform external control of file paths through the Snowflake JDBC driver. By configuring a connection to an attacker-controlled server, the attacker can write arbitrary files to the host, leading to full remote code execution.

Business Impact

With a CVSS score of 10.0, this is a maximum-severity vulnerability. It allows an attacker to gain full control over the Metabase server, which often contains sensitive business intelligence data and credentials for connected databases. The impact includes total system compromise, data theft, and the potential for the server to be used as a pivot point in the internal network.

Remediation Plan

Immediate Action: Upgrade to the specific patched versions listed for each release branch (e.g., 1.54.24, 1.55.24, etc.) immediately.

Proactive Monitoring: Review database connection configurations for any recent, unauthorized changes, particularly those pointing to external or unrecognized Snowflake instances.

Compensating Controls: Restrict the ability to add or edit database connections to a strictly controlled set of administrative users to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its potential for unrestricted code execution on the underlying host.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should identify all active Metabase deployments and ensure they are updated to the corresponding fixed version to prevent unauthorized remote code execution and potential data breaches.

---METADATA---
VENDOR: WithAstro
PRODUCT: Astro
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified within the Astro web framework. Users are advised to review the vendor's security disclosures for specific version impacts.

Executive Summary:
A vulnerability discovered in the Astro web framework presents a high-severity risk to applications utilizing the platform, requiring prompt attention from development teams.

Vulnerability Details

CVE-ID: CVE-2026-50146

Affected Software: WithAstro Astro

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Astro web framework, potentially impacting how the framework handles requests or processes content. Given the lack of specific technical details, developers must assume that critical security boundaries could be bypassed.

Business Impact

The CVSS score of 7.1 underscores the High impact of this flaw, which could lead to unauthorized data exposure or malicious code execution within the context of applications built on the Astro framework. Such compromises can result in significant reputational damage and the loss of sensitive user data.

Remediation Plan

Immediate Action: Identify all applications utilizing the Astro framework and update them to the latest secure version recommended by the maintainers.

Proactive Monitoring: Monitor application error logs and request patterns for suspicious payloads or unexpected behavior indicative of exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common web framework vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency by coordinating with development staff to verify current Astro versions. Applying the recommended patches is the only effective way to neutralize this risk and ensure the continued security of your web infrastructure.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Budibase low-code platform may allow for unauthorized access or execution of administrative functions.

Executive Summary:
Budibase contains a high-severity vulnerability that could permit unauthorized access to the platform's core low-code development environment.

Vulnerability Details

CVE-ID: CVE-2026-50137

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Budibase low-code platform. It potentially allows an attacker to bypass security checks, which could lead to unauthorized access to applications or the underlying data connections managed by the platform.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a severe threat to organizations relying on Budibase for internal tooling. A successful exploit could result in the unauthorized viewing or modification of business data, or the total compromise of applications developed on the platform, leading to potential data breaches and operational disruption.

Remediation Plan

Immediate Action: Apply all security patches released by Budibase immediately and ensure the software is updated to the most current version.

Proactive Monitoring: Review system logs for unauthorized access attempts or unusual patterns in application data requests.

Compensating Controls: Ensure that the Budibase instance is not exposed to the public internet; utilize VPNs or IP whitelisting to restrict access to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a low-code platform, the potential for exploitation is high.

Analyst Recommendation

Given the potential for broad impact within low-code environments, immediate patching is required. Security teams should verify that their Budibase instances are updated and confirm that appropriate network-level access controls are in place to minimize the attack surface.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform architecture that requires immediate administrative review and patching.

Executive Summary:
A high-severity vulnerability in the Budibase low-code platform poses a significant risk of unauthorized system compromise and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2026-50136

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase platform that may allow for unauthorized access or execution within the application environment. Given the nature of low-code platforms, this likely impacts the integrity of business logic and underlying data structures, though specific authentication requirements depend on the vendor's forthcoming technical disclosure.

Business Impact

The vulnerability carries a CVSS score of 7.4, classifying it as a High-severity risk. Successful exploitation could lead to unauthorized access to sensitive business applications, potential data exfiltration, or the manipulation of critical automated workflows, resulting in significant operational disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: Review the official Budibase security advisory and apply the latest security patches or version updates immediately upon release.

Proactive Monitoring: Monitor application access logs for unusual patterns, unauthorized administrative attempts, or unexpected API calls originating from internal or external sources.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or robust Web Application Firewall (WAF) rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Budibase must prioritize this update as part of their standard patch management cycle. Given the platform's role in centralizing business logic, failing to address this vulnerability could grant attackers persistent access to internal business processes.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform that requires urgent review to prevent unauthorized system interaction.

Executive Summary:
A high-severity security vulnerability in the Budibase platform presents a significant risk of unauthorized access and potential compromise of integrated business applications.

Vulnerability Details

CVE-ID: CVE-2026-50132

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase framework that may facilitate unauthorized access or bypasses of standard platform security controls. Attackers could potentially leverage this to gain higher privileges or access data they are not authorized to view, depending on the specific configuration of the platform.

Business Impact

The CVSS score of 7.3 underscores the high severity of this vulnerability. Successful exploitation could result in the compromise of sensitive organizational data, unauthorized manipulation of low-code business processes, and significant reputational damage, necessitating immediate remediation to maintain system security posture.

Remediation Plan

Immediate Action: Review the official vendor documentation for Budibase and apply the latest security updates or patches as soon as they are made available.

Proactive Monitoring: Monitor application logs for anomalies, specifically focusing on unauthorized login attempts or irregular data access patterns within the Budibase environment.

Compensating Controls: Ensure that the Budibase instance is protected by robust identity and access management (IAM) policies and utilize a WAF to inspect incoming traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of low-code platforms in modern infrastructure, it is imperative to address this vulnerability immediately. Administrators should follow the vendor's guidance to patch the system and perform a routine audit of user permissions to ensure that the principle of least privilege is strictly enforced.

---METADATA---
VENDOR: Fedify
PRODUCT: Fedify (TypeScript library)
AFFECTED_VERSIONS: versions >=0.11.2 and <1.9.12, <1.10.11, <2.0.19, <2.1.15, and <2.2.4
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Fedify TypeScript library allows attackers to bypass IP validation and interact with internal or restricted network resources.

Executive Summary:
Incomplete IPv4 validation in the Fedify library enables Server-Side Request Forgery, allowing attackers to target internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-50131

Affected Software: Fedify

Affected Versions: versions >=0.11.2 and <1.9.12, <1.10.11, <2.0.19, <2.1.15, and <2.2.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability caused by flawed logic in the isValidPublicIPv4Address() function. The function fails to properly filter special-use, reserved, and internal IP ranges, allowing attackers to force the server to initiate requests to unauthorized internal destinations.

Business Impact

The CVSS score of 8.6 highlights the critical nature of this SSRF flaw. An attacker can use this vulnerability to probe internal network infrastructure, access sensitive internal metadata services, or interact with services not intended for public access, potentially leading to unauthorized data exposure.

Remediation Plan

Immediate Action: Update Fedify to the patched versions: 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4.

Proactive Monitoring: Monitor outgoing server traffic for requests directed toward internal or restricted IP ranges originating from the Fedify application.

Compensating Controls: Implement strict egress filtering at the network level to prevent the server from initiating connections to sensitive internal segments.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and administrators utilizing the Fedify library must apply the necessary updates to their project dependencies immediately. The ability to bypass SSRF protections poses a significant threat to internal network security and should be addressed without delay.

---METADATA---
VENDOR: Pi-hole
PRODUCT: Pi-hole
AFFECTED_VERSIONS: >= 6.0.0, < 6.4.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Pi-hole allows for improper ownership management, which may lead to unauthorized system-level actions when exploited by a local user.

Executive Summary:
A vulnerability in Pi-hole versions 6.0.0 through 6.4.2 permits unauthorized ownership management, creating a high risk of privilege escalation and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50130

Affected Software: Pi-hole Pi-hole

Affected Versions: >= 6.0.0, < 6.4.3

Vulnerability: This vulnerability, identified as CWE-282, involves improper ownership management. It requires the attacker to have low-level local privileges to exploit the flaw, potentially resulting in full system impact.

Business Impact

The CVSS score of 8.8 reflects the significant potential for a local attacker to escalate privileges and achieve complete control over the Pi-hole instance. This could lead to unauthorized network monitoring, data exfiltration, or the disabling of security-critical DNS filtering services, resulting in broader operational downtime and loss of network integrity.

Remediation Plan

Immediate Action: Update Pi-hole to version 6.4.3 or later to apply the necessary security fixes.

Proactive Monitoring: Review system logs for unauthorized configuration changes or attempts to modify sensitive files within the Pi-hole installation directory.

Compensating Controls: Restrict local shell access to the Pi-hole server to authorized administrative personnel only to minimize the risk of a local attacker exploiting this vulnerability.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high severity stems from the potential for complete system compromise if an attacker with local access leverages this ownership flaw.

Analyst Recommendation

The risk posed by this vulnerability is substantial due to the potential for full system control. Administrators must prioritize updating to version 6.4.3 immediately to remediate the underlying ownership management issue and prevent unauthorized escalation.

---METADATA---
VENDOR: StoneFly
PRODUCT: Storage Concentrator
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
StoneFly Storage Concentrator stores hardcoded, reversible credentials for internal services within a configuration file, enabling potential unauthorized access to interconnected systems.

Executive Summary:
The StoneFly Storage Concentrator contains hardcoded, reversible credentials that could grant an attacker full access to critical internal database and replication services.

Vulnerability Details

CVE-ID: CVE-2026-50110

Affected Software: StoneFly Storage Concentrator

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves the presence of hardcoded credentials stored in an encoded format within configuration files. An attacker can reverse the encoding to obtain plaintext credentials for database, licensing, and replication services, requiring no prior authentication to the underlying OS if the configuration file is accessible.

Business Impact

The exposure of administrative and service-level credentials presents a severe risk to data integrity and system availability. With a CVSS score of 9.2, this vulnerability allows for lateral movement and complete compromise of the storage infrastructure, potentially leading to unauthorized data exfiltration or total system shutdown.

Remediation Plan

Immediate Action: Apply the latest firmware or software update provided by StoneFly immediately to remove the hardcoded credentials.

Proactive Monitoring: Audit system access logs for any unauthorized attempts to access internal service ports or unusual configuration file read operations.

Compensating Controls: Restrict network access to the storage management interface to only authorized administrative subnets and implement strict file system permissions on configuration directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of hardcoded credentials, organizations must prioritize patching this vulnerability as soon as the vendor release becomes available. Administrators should also perform a credential rotation for all services managed by the Storage Concentrator immediately following the update to ensure any potentially leaked credentials are invalidated.

---METADATA---
VENDOR: Naxclow
PRODUCT: Smart Home Devices
AFFECTED_VERSIONS: Naxclow Smart Doorbell X3, Naxclow X Smart Home, Naxclow V720, Naxclow ix cam (all versions)
---END_METADATA---

Description Summary:
Naxclow smart devices utilize static, non-rotating relay credentials, allowing persistent unauthorized access to device relay channels.

Executive Summary:
Naxclow smart home devices are vulnerable to persistent unauthorized access due to the use of static, non-rotating relay credentials.

Vulnerability Details

CVE-ID: CVE-2026-50101

Affected Software: Naxclow Smart Home Devices

Affected Versions: Naxclow Smart Doorbell X3, Naxclow X Smart Home, Naxclow V720, Naxclow ix cam (all versions)

Vulnerability: The devices use a server-side, per-device relay credential that is never rotated and is re-issued upon boot. If these static credentials are obtained, an attacker can maintain persistent access to the device's relay channel, surviving even factory resets.

Business Impact

With a CVSS score of 8.1 (High), this represents a severe privacy and security risk for smart home environments. Unauthorized access to these devices allows an attacker to monitor live video/audio feeds and bypass typical security boundaries, leading to potential surveillance or further network infiltration.

Remediation Plan

Immediate Action: Check the vendor support page for available firmware updates and contact Naxclow support for guidance on mitigating persistent credential risk.

Proactive Monitoring: Monitor network traffic for unusual connections to the Naxclow relay servers and check for unexpected device behavior.

Compensating Controls: Isolate smart home devices on a dedicated VLAN with no access to the primary corporate or home network to contain potential compromises.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that the vulnerability survives factory resets, the risk remains persistent until a firmware-level fix is applied. Users should exercise extreme caution, isolate these devices from critical networks, and check frequently for manufacturer-provided security patches.

---METADATA---
VENDOR: Aqara
PRODUCT: Cloud OAuth
AFFECTED_VERSIONS: Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize)
---END_METADATA---

Description Summary:
A redirect bypass vulnerability in the Aqara Cloud OAuth endpoint allows attackers to perform credential theft and phishing by exploiting weak domain validation.

Executive Summary:
A critical OAuth redirect bypass in the Aqara Cloud Authorization Endpoint (CVSS 9.3) allows unauthenticated attackers to perform phishing and credential theft via improper domain validation.

Vulnerability Details

CVE-ID: CVE-2026-50090

Affected Software: Aqara Cloud OAuth

Affected Versions: Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize)

Vulnerability: The endpoint is vulnerable to a redirect bypass due to lax controls on domain matching (CWE-1289). This flaw allows unauthenticated attackers to manipulate the redirect destination, effectively bypassing intended security controls during the OAuth authorization flow.

Business Impact

With a CVSS score of 9.3, this vulnerability poses a severe risk to user accounts. By redirecting users to attacker-controlled domains, adversaries can conduct effective phishing campaigns and steal sensitive authentication tokens, leading to unauthorized account access and potential data exfiltration from connected devices.

Remediation Plan

Immediate Action: Users should remain vigilant against suspicious login prompts and ensure they are only authenticating on verified domains. Contact the vendor for information on platform updates.

Proactive Monitoring: Review OAuth access logs for anomalous redirect patterns or attempts to redirect users to unauthorized external domains.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and monitor for any abnormal traffic patterns directed away from authorized Aqara domains during the login process.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a significant threat to user trust and account security. Organizations and users interacting with the Aqara Cloud OAuth service should exercise extreme caution and work with the vendor to confirm when a patch or configuration change is implemented to enforce strict domain validation.

---METADATA---
VENDOR: Aqara
PRODUCT: Aqara Developer Portal
AFFECTED_VERSIONS: Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) 2026-04-20 release
---END_METADATA---

Description Summary:
The Aqara Developer Portal exhibits a permissive cross-origin resource sharing (CORS) policy, allowing unauthorized cross-domain access.

Executive Summary:
A permissive CORS policy in the Aqara Developer Portal exposes developers and users to potential cross-site attacks and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-50088

Affected Software: Aqara Developer Portal

Affected Versions: Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) 2026-04-20 release

Vulnerability: The portal implements a permissive CORS policy (CWE-942), which fails to properly restrict cross-domain requests. This allows untrusted domains to interact with the portal, potentially leading to the leakage of sensitive information or unauthorized actions performed on behalf of an authenticated user.

Business Impact

This flaw carries a CVSS score of 8.2, posing a risk of unauthorized access to developer data and associated IoT infrastructure. The vulnerability could be leveraged to perform cross-site scripting or data exfiltration attacks, undermining the trust and security of the developer ecosystem.

Remediation Plan

Immediate Action: Update to the latest version of the portal software and ensure that CORS policies are strictly configured to whitelist only trusted domains.

Proactive Monitoring: Review web application traffic logs for suspicious cross-origin requests or attempts to access API endpoints from unauthorized domains.

Compensating Controls: Implement strict Content Security Policies (CSP) to restrict the origins from which scripts and resources can be loaded or executed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using the Aqara Developer Portal must ensure they are not running the vulnerable 2026-04-20 release. Security teams should verify that CORS configurations are correctly restricted to prevent unauthorized cross-domain interactions.

---METADATA---
VENDOR: Aqara
PRODUCT: IAM/SSO Gateway
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Aqara IAM/SSO gateway contains an overly permissive Cross-Origin Resource Sharing (CORS) policy, allowing unauthorized cross-origin requests.

Executive Summary:
An overly permissive CORS policy in the Aqara IAM/SSO gateway exposes user sessions and credentials to unauthorized cross-origin access.

Vulnerability Details

CVE-ID: CVE-2026-50087

Affected Software: Aqara IAM/SSO Gateway

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The gateway exhibits a cross-origin request sharing vulnerability (CWE-942) due to an overly permissive CORS configuration. This allows malicious actors to craft cross-origin requests that bypass standard security boundaries, potentially leading to the theft of user credentials and session information.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant risk to identity management and single sign-on security. If exploited, an attacker could hijack user sessions or gain unauthorized access to protected resources, leading to potential data breaches and widespread compromise of user accounts.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available to correct the CORS policy configuration.

Proactive Monitoring: Monitor gateway logs for suspicious cross-origin requests originating from unknown or unauthorized domains.

Compensating Controls: Configure Web Application Firewalls (WAF) or server-level policies to enforce strict CORS headers and block requests that do not originate from trusted, authorized origins.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw makes it an attractive target for session hijacking, necessitating proactive security measures.

Analyst Recommendation

Access control vulnerabilities in identity gateways are critical points of failure. Organizations should immediately review their CORS configurations and apply vendor-provided patches or mitigations to ensure that cross-origin access is restricted to legitimate, trusted domains only.

---METADATA---
VENDOR: Aqara
PRODUCT: IAM/SSO gateway
AFFECTED_VERSIONS: Aqara IAM/SSO gateway (gw-builder.aqara.com)
---END_METADATA---

Description Summary:
The Aqara IAM/SSO gateway contains a critical flaw that exposes cryptographic signing keys, allowing unauthenticated attackers to perform unauthorized operations.

Executive Summary:
The Aqara IAM/SSO gateway is vulnerable to an unauthenticated cryptographic bypass that could allow attackers to forge authentication tokens and gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-50086

Affected Software: Aqara IAM/SSO gateway

Affected Versions: Aqara IAM/SSO gateway (gw-builder.aqara.com)

Vulnerability: The gateway performs bidirectional AES round-trips against the platform’s signing key without requiring authentication. This allows an unauthenticated network attacker to leverage the signing key to forge authentication tokens.

Business Impact

The ability to forge authentication tokens effectively renders the Identity and Access Management system useless, allowing an attacker to masquerade as any user or administrator. This leads to a total compromise of the authentication boundary, potentially resulting in unauthorized access to sensitive user data and backend systems. While the base description suggests a lower severity, the ability to bypass core authentication warrants a critical response.

Remediation Plan

Immediate Action: Apply the patch provided in the official GitHub advisory (GHSA-3897-2crh-vgmr) immediately.

Proactive Monitoring: Monitor IAM/SSO logs for anomalous authentication requests or tokens that do not align with known user behavior patterns.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the gateway to authorized internal infrastructure only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypasses involving cryptographic signing keys are high-risk events. Security teams should treat this as a priority update to ensure the integrity of the platform’s identity services and prevent potential unauthorized access.

---METADATA---
VENDOR: Aqara
PRODUCT: Board service (op-test)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The Aqara Board service (op-test) allows unauthenticated remote attackers to send arbitrary MQTT command payloads to the HiveMQ broker.

Executive Summary:
An unauthenticated remote code execution vulnerability in the Aqara Board service allows attackers to hijack devices by sending arbitrary MQTT commands.

Vulnerability Details

CVE-ID: CVE-2026-50085

Affected Software: Aqara Board service (op-test)

Affected Versions: See vendor advisory

Vulnerability: The service lacks proper authentication for MQTT command payloads. It forwards these arbitrary commands directly to the platform's HiveMQ broker, enabling an unauthenticated attacker to take full control of affected devices.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a critical risk to IoT infrastructure. An attacker could remotely take over devices, potentially leading to unauthorized physical access or the creation of a massive botnet. The lack of authentication makes this an exceptionally dangerous flaw for any organization managing these devices at scale.

Remediation Plan

Immediate Action: Apply security updates provided by Aqara immediately, or disable the affected service if it is not business-critical.

Proactive Monitoring: Monitor MQTT broker traffic for unauthorized or anomalous command payloads that do not originate from authenticated sources.

Compensating Controls: Place the device management network behind a robust firewall or VPN to restrict access to the MQTT broker to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the lack of authentication required for device control. Organizations must immediately secure their Aqara deployments and ensure all firmware is patched to the latest version to prevent unauthorized remote access.

---METADATA---
VENDOR: Aqara
PRODUCT: Cloud Production API
AFFECTED_VERSIONS: Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api)
---END_METADATA---

Description Summary:
The Aqara Cloud Production API suffers from a missing authorization vulnerability, allowing any valid developer token to access any user account.

Executive Summary:
A missing authorization vulnerability in the Aqara Cloud Production API allows any valid developer token to access arbitrary user accounts, potentially enabling full remote device takeover.

Vulnerability Details

CVE-ID: CVE-2026-50084

Affected Software: Aqara Cloud Production API

Affected Versions: Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api)

Vulnerability: This is a missing authorization flaw (CWE-862) where the API fails to validate if the developer token used in a request is authorized to access the requested account. This allows unauthorized access to data and, when chained with other vulnerabilities, leads to complete account and device takeover.

Business Impact

The CVSS score of 9.6 highlights the critical impact of this vulnerability. Because it allows unauthorized access to user accounts, it poses a direct risk of data exposure and, in combination with related vulnerabilities, the total compromise of smart home devices, leading to significant privacy violations.

Remediation Plan

Immediate Action: Review the vendor advisory for specific API configuration changes and ensure all developer tokens are audited and restricted.

Proactive Monitoring: Monitor API usage logs for unauthorized access patterns where a single token is attempting to access multiple disparate user accounts.

Compensating Controls: Implement strict API gateway-level authorization checks to validate the ownership of the account being accessed by any given developer token.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 12, 2026, there is public information confirming the vulnerability. The potential for large-scale account takeover is high due to the ease of chaining this with other identified flaws.

Analyst Recommendation

This missing authorization flaw is a critical security oversight. Developers and administrators must immediately implement stricter access controls and follow the vendor's guidance to prevent unauthorized access to user data and device control mechanisms.

---METADATA---
VENDOR: Seiko
PRODUCT: SkyBridge MB-A100/MB-A110
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Seiko SkyBridge MB-A100 and MB-A110 devices are vulnerable to OS command injection due to improper neutralization of special elements in input.

Executive Summary:
A critical OS command injection vulnerability in Seiko SkyBridge devices allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50043

Affected Software: Seiko SkyBridge MB-A100/MB-A110

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device fails to properly sanitize user-supplied input before passing it to a system shell, enabling OS command injection. While the specific authentication requirement is not explicitly defined in the advisory, command injection flaws in such network devices are typically reachable by unauthenticated remote attackers.

Business Impact

The ability to execute arbitrary OS commands grants an attacker full control over the affected hardware, potentially leading to unauthorized data access, network lateral movement, or complete denial of service. With a CVSS score of 8.6, this high-severity vulnerability represents a significant threat to operational continuity and the integrity of the local network environment.

Remediation Plan

Immediate Action: Identify all deployed SkyBridge units and apply vendor-supplied security patches as soon as they become available.

Proactive Monitoring: Monitor device access logs and system process activity for signs of unusual shell command execution or unexpected outbound network connections.

Compensating Controls: Place affected devices behind a robust firewall, restricting management interfaces to authorized IP addresses only until a patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for full system compromise, organizations should prioritize the identification of these devices within their infrastructure. Apply all vendor updates immediately upon release and enforce strict network segmentation for these components until remediation is verified.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-WN579X3-C
AFFECTED_VERSIONS: 231124
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Wavlink WL-WN579X3-C router, version 231124, which could allow for remote exploitation.

Executive Summary:
The Wavlink WL-WN579X3-C router contains a high-severity vulnerability that could compromise the security and integrity of the network device.

Vulnerability Details

CVE-ID: CVE-2026-5004

Affected Software: Wavlink WL-WN579X3-C

Affected Versions: 231124

Vulnerability: While specific technical details are limited in the initial disclosure, the vulnerability affects the Wavlink WL-WN579X3-C router. Based on the CVSS score of 8.8, it likely involves a remote, unauthenticated flaw such as command injection or an authentication bypass.

Business Impact

A compromise of a perimeter networking device like a router allows attackers to intercept traffic, launch man-in-the-middle (MitM) attacks, or gain a foothold in the internal network. The CVSS score of 8.8 indicates a significant risk to the organization's network perimeter.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Wavlink for the WL-WN579X3-C model immediately.

Proactive Monitoring: Monitor the router for unauthorized configuration changes, unusual outbound traffic, or unauthorized administrative logins.

Compensating Controls: Disable remote management interfaces on the WAN side of the router and ensure that strong, unique administrative credentials are in use.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation. Users of this hardware should remain vigilant as routers are frequent targets for botnets and advanced persistent threats.

Analyst Recommendation

Network hardware vulnerabilities must be treated with the highest urgency. Organizations should immediately verify the firmware version of any Wavlink WL-WN579X3-C devices in their inventory and apply all relevant security patches to prevent external exploitation.

---METADATA---
VENDOR: doobidoo
PRODUCT: mcp-memory-service
AFFECTED_VERSIONS: < 10.67.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The mcp-memory-service package contains a critical authentication bypass vulnerability in the /api/documents/* routes, allowing unauthenticated remote access to document stores.

Executive Summary:
An unauthenticated remote attacker can read, write, or delete sensitive document data due to a critical authentication bypass in the mcp-memory-service package.

Vulnerability Details

CVE-ID: CVE-2026-50027

Affected Software: doobidoo mcp-memory-service

Affected Versions: < 10.67.1

Vulnerability: All HTTP routes under /api/documents/* lack necessary authentication checks, despite server-side configurations for API keys or OAuth. This permits unauthenticated remote users to perform arbitrary operations, including content modification and deletion, on the memory store.

Business Impact

The lack of authentication on critical document routes poses a severe risk to data integrity and confidentiality. With a CVSS score of 9.8, this vulnerability allows unauthorized actors to manipulate or destroy AI memory stores, potentially leading to data loss or the injection of malicious information into AI workflows. The inconsistency in the authentication boundary significantly lowers the barrier for exploitation.

Remediation Plan

Immediate Action: Update the mcp-memory-service package to version 10.67.1 or later to enforce mandatory authentication across all API routes.

Proactive Monitoring: Monitor API access logs for anomalous requests to the /api/documents/ endpoint, particularly from unexpected IP addresses. Audit existing memory stores for signs of unauthorized modifications or deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/documents/ path until the patch can be applied. Ensure the service is not exposed to the public internet without additional authentication layers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable given the complete absence of authentication requirements for the affected API routes.

Analyst Recommendation

This vulnerability represents a significant security failure in the software's access control design. Administrators must prioritize the update to version 10.67.1 to restore secure access controls and protect the integrity of the stored data.

---METADATA---
VENDOR: yt-dlp
PRODUCT: yt-dlp
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the yt-dlp command-line utility may allow for arbitrary code execution or unauthorized system access during media processing.

Executive Summary:
The yt-dlp command-line utility is impacted by a high-severity vulnerability that could allow attackers to compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-50023

Affected Software: yt-dlp yt-dlp

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an issue in the command-line interface or processing logic of yt-dlp, which could be leveraged to achieve remote code execution if a user is tricked into processing a malicious video or audio source.

Business Impact

An attacker successfully exploiting this flaw could gain control over the underlying system where yt-dlp is executed, potentially leading to full system compromise. The CVSS score of 8.3 reflects the high risk of malicious code execution, which could result in data theft or lateral movement within the network.

Remediation Plan

Immediate Action: Update the yt-dlp binary to the latest available version through the official distribution channels.

Proactive Monitoring: Monitor system processes for unexpected child processes spawned by the yt-dlp utility during media download tasks.

Compensating Controls: Run the utility within a sandboxed environment or restricted container to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because yt-dlp is frequently used in automated pipelines, a compromise could have cascading effects on organizational security. Users are urged to update their installations immediately to mitigate the risk of code execution.

---METADATA---
VENDOR: pnpm
PRODUCT: pnpm
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the pnpm package manager.

Executive Summary:
The pnpm package manager is affected by a critical vulnerability that could allow for unauthorized system interaction, necessitating immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-50016

Affected Software: pnpm

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the pnpm package manager, potentially allowing attackers to manipulate package installation processes or execute arbitrary code. The authentication requirements remain dependent on the specific implementation of the package management workflow.

Business Impact

With a CVSS score of 8.8, this issue presents a high risk to software supply chain integrity. Successful exploitation could allow an attacker to inject malicious code into build pipelines or compromise developer environments, leading to widespread downstream impacts on application security and organizational intellectual property.

Remediation Plan

Immediate Action: Update the pnpm package manager to the most recent version provided by the vendor to ensure all security patches are applied.

Proactive Monitoring: Regularly audit dependency trees and monitor build logs for unauthorized modifications or unexpected network activity during package installation.

Compensating Controls: Utilize integrity checks for all downloaded packages and restrict package manager access to authorized, hardened build environments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of package managers in software development, this vulnerability poses a significant risk to the software supply chain. Security teams must verify the version of pnpm in use across all development and CI/CD environments and apply the vendor-recommended updates as a matter of urgency.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: Prior to versions 4.1.135.Final and 4.2.15.Final
---END_METADATA---

Description Summary:
A resource exhaustion vulnerability in the Netty RedisArrayAggregator allows unauthenticated attackers to cause a denial of service by triggering excessive memory pre-allocation.

Executive Summary:
An unauthenticated remote attacker can trigger a denial-of-service condition in Netty by exploiting improper memory pre-allocation in the RedisArrayAggregator.

Vulnerability Details

CVE-ID: CVE-2026-50011

Affected Software: Netty

Affected Versions: Prior to versions 4.1.135.Final and 4.2.15.Final

Vulnerability: The RedisArrayAggregator pre-allocates an ArrayList based on a value declared in a RESP array header. An unauthenticated attacker can provide a malicious header with a high capacity value, forcing the system to consume excessive memory.

Business Impact

The CVSS score of 7.5 (High) reflects the ease with which this vulnerability can be used to cause an application crash. For businesses relying on Redis integration via Netty, this represents a significant risk of service interruption and potential data availability loss.

Remediation Plan

Immediate Action: Update to Netty versions 4.1.135.Final or 4.2.15.Final to implement proper validation of array header values.

Proactive Monitoring: Monitor for anomalous memory usage in applications handling Redis protocols, specifically looking for spikes during the initial stages of connection handshakes.

Compensating Controls: Implement strict input validation at the application level to reject RESP headers that specify unrealistic array sizes before they reach the Netty aggregator.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is recommended to prevent resource exhaustion attacks. Organizations should verify their current version of Netty and perform the necessary upgrades to ensure the integrity of their Redis-connected services.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A security vulnerability in the Netty network application framework may allow for unauthorized system impact, requiring immediate attention from security administrators.

Executive Summary:
A high-severity vulnerability in the Netty framework requires prompt remediation to ensure the continued security and availability of affected applications.

Vulnerability Details

CVE-ID: CVE-2026-50010

Affected Software: Netty

Affected Versions: See vendor advisory

Vulnerability: This vulnerability affects the Netty framework, which provides protocol-specific network communication. Further technical details regarding the specific attack vector are currently limited, necessitating a conservative approach to patching.

Business Impact

With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to the integrity and availability of services utilizing the Netty framework. Failure to remediate could allow attackers to disrupt business operations or gain unauthorized control over affected network services.

Remediation Plan

Immediate Action: Monitor official Netty security channels and apply the latest security updates provided by the vendor as soon as they become available.

Proactive Monitoring: Conduct a thorough audit of all applications using the Netty framework to ensure all dependencies are updated to the most recent secure versions.

Compensating Controls: Deploy robust network segmentation and WAF rules to minimize the attack surface of any services powered by the Netty framework.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability as high priority. Given the widespread use of Netty in Java-based infrastructure, identifying and updating all instances of the library is essential for maintaining a secure security posture.

---METADATA---
VENDOR: OFFIS
PRODUCT: DCMTK Toolkit
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A path traversal vulnerability in the DCMTK Toolkit allows a malicious server to force a client to write files to arbitrary locations on the host system.

Executive Summary:
A critical path traversal vulnerability in the OFFIS DCMTK Toolkit enables remote attackers to perform arbitrary file writes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-50003

Affected Software: OFFIS DCMTK Toolkit

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the bit-preserving C-GET storage mode, where the client fails to properly sanitize file paths received from a server. An unauthenticated remote attacker acting as a malicious server can exploit this to write files outside of the intended directory using relative or absolute paths.

Business Impact

With a CVSS score of 9.8, this vulnerability carries a high risk of remote code execution or system file corruption. An attacker could overwrite critical system binaries or configuration files, leading to unauthorized access, system instability, and complete loss of confidentiality and integrity of the affected host.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the DCMTK vendor immediately to remediate the path sanitization flaw.

Proactive Monitoring: Monitor file system activity for unexpected file creation or modification events in sensitive directories while using the DCMTK client.

Compensating Controls: Ensure that the DCMTK client is executed with the least privilege necessary, ideally within a containerized environment to restrict file system access.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the severity and nature of arbitrary file write flaws make this a prime target for weaponization.

Analyst Recommendation

Given the extreme severity of this vulnerability, organizations relying on DCMTK for medical imaging or related data transfers must prioritize patching. Failure to update may allow attackers to gain persistent access to the host system by manipulating local files.

---METADATA---
VENDOR: Centrifugal
PRODUCT: Centrifugo
AFFECTED_VERSIONS: < 6.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Centrifugo contains a vulnerability involving the improper verification of cryptographic signatures in its real-time messaging server.

Executive Summary:
An improper cryptographic signature verification flaw in Centrifugo allows authenticated users to bypass security restrictions and potentially intercept or manipulate real-time communications.

Vulnerability Details

CVE-ID: CVE-2026-49998

Affected Software: Centrifugal Centrifugo

Affected Versions: Versions prior to 6.8.1

Vulnerability: The vulnerability stems from the improper verification of cryptographic signatures (CWE-347), which can be exploited by an authenticated user to perform unauthorized actions within the messaging server.

Business Impact

Exploitation of this flaw allows for the compromise of communication integrity and confidentiality, which is critical for real-time messaging platforms. With a CVSS score of 8.2, this vulnerability poses a high risk of unauthorized data access and potential command injection within the messaging stream.

Remediation Plan

Immediate Action: Upgrade the Centrifugo server to version 6.8.1 or newer immediately.

Proactive Monitoring: Review application logs for anomalies in authentication tokens or signature verification failures that might suggest an attempt to bypass security checks.

Compensating Controls: Ensure that all communication channels utilize secondary validation mechanisms and enforce strict role-based access control (RBAC) to limit the impact of a potential signature bypass.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the available data.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to maintain the integrity of real-time messaging services. Administrators must ensure that the patch is applied across all instances to prevent authenticated users from escalating privileges or manipulating data packets.

---METADATA---
VENDOR: RustFS
PRODUCT: RustFS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
RustFS, a distributed object storage system, contains a vulnerability that may lead to significant security compromise.

Executive Summary:
The RustFS distributed object storage system is affected by a critical vulnerability that poses a significant risk to data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-49991

Affected Software: RustFS RustFS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the RustFS distributed object storage architecture. While specific technical details are pending, the flaw could allow for unauthorized data access or disruption of storage services by an attacker.

Business Impact

The identified vulnerability carries a CVSS score of 8.6, reflecting a high risk of unauthorized access to stored data. A successful exploit could lead to the exposure of sensitive corporate information, loss of data integrity, or prolonged downtime for critical business storage operations.

Remediation Plan

Immediate Action: Review the official RustFS security advisory and apply the latest patches or configuration updates as soon as they are released.

Proactive Monitoring: Monitor storage infrastructure access logs for anomalous patterns or unauthorized connection attempts to the storage cluster.

Compensating Controls: Implement strict network segmentation and ensure that access to the RustFS management interface is restricted to authorized administrative segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity rating of this vulnerability, administrators should prioritize the assessment of their storage environments. Immediate steps must be taken to restrict access to the affected software while awaiting official vendor patches to mitigate the risk of unauthorized data exposure.

---METADATA---
VENDOR: Crate
PRODUCT: CrateDB
AFFECTED_VERSIONS: < 6.2.8, >= 6.3.0, < 6.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in CrateDB allows an authenticated user to perform unauthorized actions within the distributed database.

Executive Summary:
An incorrect authorization flaw in CrateDB could allow an authenticated attacker to bypass security controls and perform unauthorized operations within the database.

Vulnerability Details

CVE-ID: CVE-2026-49989

Affected Software: Crate CrateDB

Affected Versions: < 6.2.8, >= 6.3.0, < 6.3.2

Vulnerability: This vulnerability (CWE-863) involves incorrect authorization logic, which allows an authenticated attacker (PR:L) to gain elevated privileges or perform functions they are not authorized to access. The vulnerability is triggered via network-based requests.

Business Impact

Exploitation of this flaw could result in unauthorized modification or destruction of database records, leading to severe operational disruption or loss of data integrity. With a CVSS score of 7.1, this represents a significant security risk for organizations relying on CrateDB for critical data storage and management.

Remediation Plan

Immediate Action: Upgrade to CrateDB version 6.2.8 or 6.3.2, depending on the current branch, to resolve the authorization logic flaw.

Proactive Monitoring: Monitor database audit logs for unauthorized access attempts or unusual administrative commands executed by non-privileged accounts.

Compensating Controls: Enforce strict network segmentation and ensure that database access is limited to trusted application service accounts only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from a failure to properly validate user permissions during database interactions.

Analyst Recommendation

Organizations using CrateDB must update to the specified fixed versions immediately to mitigate the risk of unauthorized access. The existence of a proof-of-concept increases the urgency for rapid deployment of these security updates.

---METADATA---
VENDOR: cdeust
PRODUCT: Cortex
AFFECTED_VERSIONS: < 3.17.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Cortex MCP server (neuro-cortex-memory) prior to version 3.17.1 is vulnerable to the inclusion of functionality from an untrusted control sphere.

Executive Summary:
A security vulnerability in the Cortex MCP server allows local authenticated users to trigger unauthorized functionality, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-49986

Affected Software: cdeust Cortex

Affected Versions: Prior to 3.17.1

Vulnerability: The software suffers from an inclusion of functionality from an untrusted control sphere (CWE-829). An authenticated local attacker can leverage this flaw to execute arbitrary code or manipulate memory, as the application fails to properly validate the source of included functions.

Business Impact

With a CVSS score of 7.1, this vulnerability presents a high risk to environments where the Cortex MCP server is deployed. Successful exploitation by a local attacker could lead to complete system compromise, including the unauthorized modification or exfiltration of sensitive persistent memory data.

Remediation Plan

Immediate Action: Update the neuro-cortex-memory package to version 3.18.0 or later as specified by the vendor's security advisory.

Proactive Monitoring: Review system and application logs for suspicious local process execution patterns or unexpected calls to memory management functions.

Compensating Controls: Apply strict local access controls and ensure that the principle of least privilege is enforced for all users who have access to the host operating system.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for local access necessitates that attackers already have a foothold on the system.

Analyst Recommendation

The vulnerability is severe due to the potential for full system compromise. Administrators should immediately update the affected library to the fixed version to neutralize the risk of unauthorized functionality execution.

---METADATA---
VENDOR: Kestra
PRODUCT: Kestra
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists within the Kestra event-driven orchestration platform that may allow for unauthorized system interaction.

Executive Summary:
The Kestra orchestration platform is affected by a high-severity vulnerability that poses a significant risk to the integrity and availability of automated workflows.

Vulnerability Details

CVE-ID: CVE-2026-49984

Affected Software: Kestra Kestra

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core orchestration logic of the Kestra platform. While specific authentication requirements are pending further vendor disclosure, orchestrators of this type are frequent targets for privilege escalation and unauthorized command execution.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over automated business processes, potentially resulting in data exfiltration or the sabotage of critical infrastructure. With a CVSS score of 7.7, this flaw represents a high risk to operational continuity and should be addressed as a priority to prevent service disruption.

Remediation Plan

Immediate Action: Review the official Kestra security advisory and apply the recommended software updates or patches as soon as they are released.

Proactive Monitoring: Monitor Kestra orchestration logs for anomalous execution patterns, unauthorized workflow triggers, or unexpected access attempts by service accounts.

Compensating Controls: Implement network segmentation and strict access control lists (ACLs) to limit the exposure of the orchestration interface to trusted internal segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of orchestration platforms in modern IT environments, the potential impact of a compromise is severe. Administrators are urged to track vendor announcements closely and prepare for an immediate deployment of security patches to mitigate potential unauthorized access.

---METADATA---
VENDOR: Raszi
PRODUCT: node-tmp
AFFECTED_VERSIONS: 0.2.6
---END_METADATA---

Description Summary:
A type-confusion vulnerability in node-tmp allows attackers to perform path traversal by supplying non-string values to file path parameters.

Executive Summary:
A type-confusion flaw in the node-tmp library enables attackers to bypass path guards and create files or directories in arbitrary locations on the filesystem.

Vulnerability Details

CVE-ID: CVE-2026-49982

Affected Software: Raszi node-tmp

Affected Versions: 0.2.6

Vulnerability: The _assertPath guard in node-tmp version 0.2.6 can be bypassed using type confusion. When an attacker provides non-string values for the prefix, postfix, or template parameters, the validation logic fails, permitting the creation of temporary files or directories outside of intended safe directories.

Business Impact

With a CVSS score of 8.2, this vulnerability allows for unauthorized filesystem manipulation. An attacker could potentially overwrite critical configuration files, plant malicious scripts, or disrupt system operations, leading to a full compromise of the host environment where the Node.js application resides.

Remediation Plan

Immediate Action: Update the node-tmp dependency in your package.json to version 0.2.7 or later to implement the corrected path validation logic.

Proactive Monitoring: Review filesystem activity logs for the creation of unexpected files or directories in sensitive system paths, particularly those initiated by the user account running the application.

Compensating Controls: Run the application within a containerized environment with a read-only filesystem or restricted permissions to limit the scope of potential arbitrary file creation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Dependency-related vulnerabilities are often overlooked in the software supply chain. Developers must immediately update node-tmp to version 0.2.7 to close this path traversal vector and prevent potential arbitrary file system access.

---METADATA---
VENDOR: Rclone
PRODUCT: Rclone
AFFECTED_VERSIONS: 1.46.0 through 1.74.2
---END_METADATA---

Description Summary:
Rclone’s remote control daemon (rcd) allows unauthenticated Remote Code Execution by processing malicious GET/HEAD requests that trigger local command execution during backend initialization.

Executive Summary:
Rclone versions 1.46.0 through 1.74.2 are susceptible to an unauthenticated Remote Code Execution vulnerability that permits full system compromise via a single network request.

Vulnerability Details

CVE-ID: CVE-2026-49980

Affected Software: Rclone Rclone

Affected Versions: 1.46.0 through 1.74.2

Vulnerability: The vulnerability stems from improper handling of the rcd remote control interface, which accepts unauthenticated requests that can be crafted to include inline remote configuration options. These options are parsed during backend initialization and can be leveraged to execute arbitrary local commands as the rclone process user.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its ability to be exploited remotely without authentication. Successful exploitation grants an attacker the ability to execute commands with the privileges of the Rclone process, leading to potential data exfiltration from connected cloud storage or complete host system takeover.

Remediation Plan

Immediate Action: Upgrade to Rclone version 1.74.3 or later to apply the necessary security fixes to the remote control interface.

Proactive Monitoring: Inspect network traffic for unauthorized GET or HEAD requests targeting the Rclone rcd endpoint, particularly those containing suspicious path parameters.

Compensating Controls: Disable the rcd feature if not required for operations, or restrict access to the remote control interface using IP whitelisting and network-level access controls.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitation and the critical nature of the impact, immediate remediation is required. Organizations running Rclone with the remote control daemon enabled must update to version 1.74.3 or ensure the service is not exposed to untrusted networks.

---METADATA---
VENDOR: Sinaptik AI
PRODUCT: PandasAI
AFFECTED_VERSIONS: Up to and including version 3.x
---END_METADATA---

Description Summary:
A security weakness has been identified in Sinaptik AI PandasAI versions up to 3.x. This flaw may allow attackers to compromise the security of the data analysis environment.

Executive Summary:
Sinaptik AI PandasAI is affected by a security weakness through version 3.x that could facilitate unauthorized access to sensitive data processing functions.

Vulnerability Details

CVE-ID: CVE-2026-4998

Affected Software: Sinaptik AI PandasAI

Affected Versions: Up to and including version 3.x

Vulnerability: This weakness involves a failure in the security controls of the PandasAI library. An attacker could potentially leverage this flaw to manipulate the output of the AI model or gain unauthorized insights into the underlying data structures.

Business Impact

A successful exploit could lead to the corruption of data-driven decision-making processes and the potential leakage of proprietary information. The CVSS score of 7.3 indicates a high level of risk, particularly for enterprises that integrate PandasAI into their production business intelligence stacks. This could result in financial loss or a breach of customer trust if sensitive data is affected.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates for PandasAI immediately to move past the vulnerable 3.x version range.

Proactive Monitoring: Review application logs for unusual data access requests and monitor the performance of AI models for unexpected or suspicious outputs.

Compensating Controls: Utilize containerization or sandboxing to isolate the environment where PandasAI operates, limiting the potential "blast radius" of a successful exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. Users should remain vigilant as AI-related vulnerabilities are increasingly targeted by sophisticated actors.

Analyst Recommendation

The severity of this weakness, reflected in the 7.3 CVSS score, demands immediate remediation. Organizations should prioritize updating their PandasAI dependencies to ensure the continued integrity of their automated analysis platforms.

---METADATA---
VENDOR: Plank
PRODUCT: laravel-mediable
AFFECTED_VERSIONS: 0 up to (excluding) 7.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Laravel-Mediable before 7.0.0 is susceptible to unrestricted file uploads, which can be leveraged by an attacker to achieve remote code execution via file extension bypass.

Executive Summary:
A critical file upload vulnerability in the Laravel-Mediable library allows authenticated attackers to upload malicious files, leading to potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-49972

Affected Software: Plank laravel-mediable

Affected Versions: 0 up to (excluding) 7.0.0

Vulnerability: The vulnerability is an Unrestricted Upload of File with Dangerous Type (CWE-434). Attackers with low-level privileges can bypass extension checks to upload executable scripts, resulting in remote code execution (RCE).

Business Impact

A successful exploit allows an attacker to execute arbitrary code on the server, resulting in total system compromise. With a CVSS score of 8.8, this vulnerability represents a severe threat to business operations, as it can be used to install persistent backdoors, steal sensitive data, or disrupt service availability.

Remediation Plan

Immediate Action: Update laravel-mediable to version 7.0.0 or higher to implement mandatory file type validation.

Proactive Monitoring: Review web server access logs for requests to non-media file extensions within upload directories and monitor for unexpected process execution originating from those paths.

Compensating Controls: Configure the web server to disable script execution in upload directories and implement a strict allow-list for file types at the application gateway or WAF.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it allows for the upload of malicious payloads by authenticated users.

Analyst Recommendation

The risk of remote code execution makes this vulnerability a top priority for remediation. Administrators should ensure that all instances of laravel-mediable are updated to version 7.0.0 immediately to prevent potential system-wide compromise.

---METADATA---
VENDOR: Plank
PRODUCT: laravel-mediable
AFFECTED_VERSIONS: 0 up to (excluding) 7.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Laravel-Mediable before 7.0.0 is vulnerable to path traversal due to improper sanitization of file paths, potentially allowing unauthorized file access.

Executive Summary:
A path traversal vulnerability in the Laravel-Mediable library allows authenticated attackers to access files outside of the intended directory, posing a high risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-49970

Affected Software: Plank laravel-mediable

Affected Versions: 0 up to (excluding) 7.0.0

Vulnerability: This vulnerability is a Path Traversal flaw (CWE-22) triggered during file path sanitization. An attacker with low-level privileges can manipulate input to traverse the filesystem and access restricted directories.

Business Impact

Successful exploitation allows an attacker to read or potentially manipulate sensitive files on the host server. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and integrity of the application environment, potentially leading to full system compromise if sensitive configuration files are exposed.

Remediation Plan

Immediate Action: Update the laravel-mediable dependency to version 7.0.0 or later immediately.

Proactive Monitoring: Monitor application logs for suspicious path traversal patterns, such as sequences like ../ within file upload or management requests.

Compensating Controls: Implement strict input validation and ensure the application runs with the least privilege necessary to limit the impact of filesystem access.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by authenticated users who have access to file management functions within the application.

Analyst Recommendation

This vulnerability is critical due to the potential for unauthorized filesystem access. Organizations using the laravel-mediable package must prioritize updating to version 7.0.0 to remediate the flaw. Failure to patch may expose the host environment to significant data breach risks.

---METADATA---
VENDOR: Sinaptik AI
PRODUCT: PandasAI
AFFECTED_VERSIONS: Up to and including version 0.x
---END_METADATA---

Description Summary:
Sinaptik AI PandasAI is vulnerable to a security flaw in versions up to 0.x. This vulnerability could allow for unauthorized data manipulation or information disclosure.

Executive Summary:
The PandasAI library by Sinaptik AI contains a high-severity vulnerability that poses a significant risk to data integrity and confidential information processing.

Vulnerability Details

CVE-ID: CVE-2026-4996

Affected Software: Sinaptik AI PandasAI

Affected Versions: Up to and including version 0.x

Vulnerability: A vulnerability was identified in the PandasAI data processing logic. This flaw could potentially be exploited by an attacker to bypass security boundaries when the library processes untrusted input or data frames.

Business Impact

The exploitation of this vulnerability could lead to the exposure of sensitive datasets or the execution of unauthorized data queries within the AI environment. With a CVSS score of 7.3, the impact is classified as High, as it directly threatens the confidentiality and integrity of automated data analysis workflows. Organizations using PandasAI for financial or personal data processing are at particular risk of regulatory non-compliance.

Remediation Plan

Immediate Action: Update the PandasAI library to the latest available version (beyond 0.x) immediately to address the underlying code flaw.

Proactive Monitoring: Audit all AI-generated queries and logs for anomalous patterns that suggest prompt injection or unauthorized data access attempts.

Compensating Controls: Implement strict input validation and sanitization for any data passed to the PandasAI interface to prevent the processing of malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the complexity of AI-driven data tools often masks exploitation attempts, making rapid patching essential.

Analyst Recommendation

Given the CVSS score of 7.3, this vulnerability represents a significant threat to secure AI operations. It is strongly recommended that developers update the PandasAI package immediately and review their data ingestion pipelines for security gaps.

---METADATA---
VENDOR: Hermes
PRODUCT: WebUI
AFFECTED_VERSIONS: Hermes WebUI before version 0.51.311
---END_METADATA---

Description Summary:
Hermes WebUI contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands via malicious Git configuration files.

Executive Summary:
An authenticated remote code execution vulnerability in Hermes WebUI allows attackers to execute arbitrary commands by manipulating Git configuration files in workspace repositories.

Vulnerability Details

CVE-ID: CVE-2026-49959

Affected Software: Hermes WebUI

Affected Versions: Versions before 0.51.311

Vulnerability: The vulnerability exists in api/workspace_git.py, where Git subprocess invocations fail to properly sanitize input. An authenticated attacker can exploit this by placing a malicious executable Git configuration (e.g., core.fsmonitor or credential.helper) within a workspace repository's .git/config file.

Business Impact

With a CVSS score of 8.8, this vulnerability allows an attacker with valid user credentials to gain full control over the underlying server hosting the WebUI. This could lead to unauthorized data access, lateral movement within the network, and complete compromise of the application environment.

Remediation Plan

Immediate Action: Update Hermes WebUI to version 0.51.311 or higher immediately.

Proactive Monitoring: Review access logs for unusual Git command executions or unauthorized modifications to repository configuration files.

Compensating Controls: Implement strict file permission controls on repository directories and restrict access to the WebUI to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All organizations running Hermes WebUI must upgrade to the latest version immediately. Because this vulnerability allows for code execution, it is imperative to ensure that only trusted users have access to the platform until the patch is applied.

---METADATA---
VENDOR: Apache
PRODUCT: Apache ActiveMQ
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Apache ActiveMQ is affected by an improper authorization vulnerability that could allow unauthorized access to system resources.

Executive Summary:
An improper authorization vulnerability in Apache ActiveMQ poses a high-risk threat to messaging infrastructure, requiring immediate remediation.

Vulnerability Details

CVE-ID: CVE-2026-49877

Affected Software: Apache ActiveMQ

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is classified as an Improper Authorization issue within the ActiveMQ messaging framework. This flaw may allow an attacker to bypass intended access controls, potentially performing unauthorized actions depending on the specific configuration and authentication state of the broker.

Business Impact

The CVSS score of 8.1 indicates that this is a high-severity issue with the potential to disrupt core messaging services or facilitate unauthorized data access. If exploited, an attacker could compromise the integrity of the message queue, leading to service downtime or unauthorized command execution within the application environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of Apache ActiveMQ as specified in the official vendor security advisory.

Proactive Monitoring: Review access logs for ActiveMQ and monitor for suspicious administrative activity or unauthorized attempts to access restricted message queues.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the ActiveMQ management interface to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical role of messaging services in enterprise architecture, this vulnerability must be treated with high urgency. Administrators are strongly advised to apply the necessary security patches immediately and review current authorization configurations to ensure that the least privilege principle is strictly enforced within the ActiveMQ environment.

---METADATA---
VENDOR: Kestra
PRODUCT: Kestra
AFFECTED_VERSIONS: Prior to 1.0.45 and 1.3.21
---END_METADATA---

Description Summary:
Kestra contains an authentication bypass vulnerability due to an improper path validation, allowing unauthenticated attackers to execute arbitrary workflows and achieve Remote Code Execution.

Executive Summary:
A critical authentication bypass in Kestra allows unauthenticated remote attackers to execute arbitrary code as root within the worker container.

Vulnerability Details

CVE-ID: CVE-2026-49869

Affected Software: Kestra Kestra

Affected Versions: Prior to 1.0.45 and 1.3.21

Vulnerability: The AuthenticationFilter incorrectly uses a suffix match for path whitelisting. This allows any API path ending in /configs to bypass security controls, enabling unauthenticated attackers to trigger script execution plugins and execute commands as root.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation grants an attacker full control over the Kestra orchestration platform and the underlying worker infrastructure. This can lead to complete server compromise, lateral movement within the network, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade Kestra instances to version 1.0.45, 1.3.21, or later immediately to resolve the path validation flaw.

Proactive Monitoring: Inspect Kestra execution logs for unauthorized workflow triggers or unexpected script executions, particularly those originating from unknown or unauthorized sources.

Compensating Controls: Restrict network access to the Kestra API and management interface using IP whitelisting or VPN-only access to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability allows for unauthenticated Remote Code Execution, which is the most dangerous class of security flaws. Organizations utilizing Kestra must treat this as an emergency patching event. Ensure that instances are not exposed to the public internet and apply the vendor-provided patches as soon as possible.

---METADATA---
VENDOR: butlerx
PRODUCT: wetty
AFFECTED_VERSIONS: < 3.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-site Scripting (XSS) vulnerability in the wetty terminal application allows remote attackers to execute arbitrary scripts via improper input neutralization.

Executive Summary:
The wetty terminal application is affected by a high-severity Cross-site Scripting vulnerability that could lead to unauthorized script execution in a user's browser.

Vulnerability Details

CVE-ID: CVE-2026-49864

Affected Software: butlerx wetty

Affected Versions: < 3.0.4

Vulnerability: This vulnerability is a Cross-site Scripting (CWE-79) flaw where the application fails to properly neutralize user-supplied input. It is an unauthenticated vulnerability, meaning no user interaction is required beyond a victim accessing the malicious link or page.

Business Impact

Successful exploitation allows an attacker to execute malicious scripts within the context of a user session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information displayed in the terminal interface. With a CVSS score of 8.6, this represents a significant risk to the integrity and confidentiality of browser-based administrative sessions.

Remediation Plan

Immediate Action: Update the wetty package to version 3.0.4 or later immediately.

Proactive Monitoring: Monitor web server logs for suspicious URL patterns or unexpected script injections targeting the terminal interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect incoming traffic and block malformed requests before they reach the application.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability stems from standard input handling flaws in web-based terminal emulators, which are common targets for session-based attacks.

Analyst Recommendation

Given the high CVSS score and the nature of the application, which provides terminal access, the risk of session compromise is significant. Organizations using wetty must prioritize the update to version 3.0.4 to ensure the security of their remote management sessions.

---METADATA---
VENDOR: authlib
PRODUCT: joserfc
AFFECTED_VERSIONS: < 1.6.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The joserfc library is vulnerable to authentication bypass and weak credential handling due to flaws in its implementation of JSON Object Signing and Encryption standards.

Executive Summary:
A high-severity authentication and encryption flaw in the joserfc library could permit unauthenticated attackers to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-49852

Affected Software: authlib joserfc

Affected Versions: < 1.6.8

Vulnerability: This vulnerability involves Improper Authentication (CWE-287), Inadequate Encryption Strength (CWE-326), and Use of Weak Credentials (CWE-1391). An unauthenticated attacker can leverage these implementation errors to subvert JOSE security mechanisms.

Business Impact

The ability to bypass authentication or manipulate encrypted tokens poses a critical risk to systems relying on joserfc for secure communication or identity management. With a CVSS score of 8.7, this vulnerability could allow unauthorized access to protected resources or the impersonation of users. This represents a fundamental threat to the confidentiality and integrity of the affected infrastructure.

Remediation Plan

Immediate Action: Update the joserfc Python library to version 1.6.8 or later immediately.

Proactive Monitoring: Audit authentication logs and token validation processes for any signs of anomalous activity or failed cryptographic signatures.

Compensating Controls: Ensure that all JOSE implementations are wrapped in secondary validation logic or network-level access controls to limit the exposure of the vulnerable library.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The severity of the underlying weaknesses necessitates prompt action to ensure the robustness of authentication flows.

Analyst Recommendation

The reliance on insecure authentication or weak cryptographic primitives in joserfc presents a severe security risk. Developers should prioritize the update to version 1.6.8 to rectify these flaws and prevent potential unauthorized access to their systems.

---METADATA---
VENDOR: Lepture
PRODUCT: Mistune
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Mistune Python Markdown parser is susceptible to a vulnerability that may allow for remote code execution or cross-site scripting depending on the implementation.

Executive Summary:
A high-severity vulnerability within the Mistune Markdown parser library poses a risk of arbitrary code execution or injection when processing untrusted input.

Vulnerability Details

CVE-ID: CVE-2026-49851

Affected Software: Lepture Mistune

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Mistune is a widely used Python Markdown parser; vulnerabilities in this library often relate to improper handling of complex syntax or plugin interactions. Depending on how the library is integrated into an application, this flaw may allow an attacker to inject malicious scripts or execute code if the parser processes untrusted Markdown input.

Business Impact

Because Mistune is frequently used in web applications to render user-generated content, this vulnerability could be exploited to perform cross-site scripting (XSS) or server-side attacks. Given the CVSS score of 8.7, the impact on applications relying on this library is substantial, potentially leading to unauthorized data access, session hijacking, or full application compromise.

Remediation Plan

Immediate Action: Upgrade to the latest version of Mistune immediately to incorporate the necessary security fixes.

Proactive Monitoring: Audit applications using Mistune to identify where user-supplied Markdown is rendered and monitor for suspicious input patterns.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to mitigate potential XSS impacts and ensure all user input is sanitized before it reaches the parser.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Applications utilizing the Mistune library must be updated immediately to mitigate the risk of arbitrary code or script execution. Developers should verify their dependency trees to ensure the patched version is being utilized across all environments. If an immediate update is not possible, ensure that input rendered by Mistune is strictly validated and sandboxed.

---METADATA---
VENDOR: FreeSWITCH
PRODUCT: FreeSWITCH
AFFECTED_VERSIONS: Prior to version 1.11.1
---END_METADATA---

Description Summary:
A heap overflow vulnerability in the FreeSWITCH mod_verto module allows unauthenticated attackers to trigger memory corruption via crafted HTTP requests.

Executive Summary:
A heap overflow vulnerability in FreeSWITCH prior to version 1.11.1 enables unauthenticated attackers to cause memory corruption and potential code execution.

Vulnerability Details

CVE-ID: CVE-2026-49841

Affected Software: FreeSWITCH

Affected Versions: Prior to version 1.11.1

Vulnerability: The mod_verto HTTP request handler improperly validates the Content-Length header against a fixed 2 MiB buffer, allowing an attacker to trigger a heap overflow of up to 8 MiB. Crucially, this overflow occurs before the application performs an HTTP basic-authentication check.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability, which allows an attacker to bypass authentication mechanisms to compromise the telecom stack. Successful exploitation could result in full system compromise, leading to unauthorized interception of communications or complete service disruption.

Remediation Plan

Immediate Action: Upgrade all FreeSWITCH instances to version 1.11.1 or later to resolve the buffer handling logic.

Proactive Monitoring: Review web server and application logs for malformed HTTP requests or unexpected application crashes associated with the mod_verto module.

Compensating Controls: Implement strict ingress filtering at the network perimeter to limit access to the FreeSWITCH management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability can be triggered prior to any authentication, it is highly attractive to threat actors. Organizations utilizing FreeSWITCH must treat this as a high-priority update and deploy the 1.11.1 patch across all production environments immediately.

---METADATA---
VENDOR: SMEWebify
PRODUCT: WebErpMesv2
AFFECTED_VERSIONS: <= 1.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WebErpMesv2 versions 1.19 and prior are vulnerable to unauthenticated remote code execution via arbitrary PHP file uploads in the HR Expense scan_file parameter.

Executive Summary:
A critical remote code execution vulnerability in SMEWebify WebErpMesv2 allows unauthenticated attackers to execute arbitrary PHP code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-49827

Affected Software: SMEWebify WebErpMesv2

Affected Versions: <= 1.19

Vulnerability: The application fails to perform adequate input validation and authentication checks on the HR Expense scan_file parameter, allowing unauthenticated users to upload malicious PHP files. This is exacerbated by broken role middleware and open registration, enabling full system compromise.

Business Impact

Successful exploitation allows an unauthenticated attacker to gain full control over the application server. This leads to complete data compromise, unauthorized access to sensitive manufacturing data, and potential lateral movement into the internal network. Given the CVSS score of 9.8, this vulnerability represents an immediate and extreme risk to organizational security.

Remediation Plan

Immediate Action: Upgrade to the latest version of SMEWebify WebErpMesv2 immediately, ensuring the fix provided in commit 5c54862fa044b363fd2be03d586750e81afd6818 is applied.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the HR Expense module and monitor for unexpected file creation in the upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload requests containing suspicious extensions, such as .php, to mitigate the risk until the software can be patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication requirements and the ability to upload executable code.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation and the level of access granted to an attacker. Administrators must prioritize the application of the provided security patch immediately. If an immediate upgrade is not possible, the affected HR Expense functionality should be disabled or restricted at the network level until remediation is complete.