---METADATA---
VENDOR: Saloon
PRODUCT: Saloon (PHP Library)
AFFECTED_VERSIONS: Versions prior to 4.0.0
---END_METADATA---

Description Summary:
Saloon versions prior to 4.0.0 are vulnerable to PHP Object Injection via insecure use of unserialize() in the AccessTokenAuthenticator class, potentially leading to remote code execution.

Executive Summary:
The Saloon PHP library is vulnerable to a critical object injection flaw that can be leveraged to achieve remote code execution by providing malicious serialized OAuth token data.

Vulnerability Details

CVE-ID: CVE-2026-33942

Affected Software: Saloon

Affected Versions: Versions prior to 4.0.0

Vulnerability: The library used unserialize() with allowed_classes => true in its AccessTokenAuthenticator class. If an attacker can control the serialized string (e.g., via cache poisoning or file overwrites), they can inject a "gadget" object that triggers malicious code execution through PHP magic methods during instantiation.

Business Impact

This vulnerability can lead to full remote code execution, especially in environments containing common PHP gadget chains like Monolog. The CVSS score of 9.8 reflects the high impact on confidentiality and integrity, as an attacker could gain complete control over the application's execution environment.

Remediation Plan

Immediate Action: Upgrade the Saloon library to version 4.0.0 or higher. This version removes the dangerous use of PHP serialization for token management.

Proactive Monitoring: Monitor for suspicious activity in application cache directories and review logs for PHP serialization errors or unexpected object types.

Compensating Controls: If upgrading is not immediately possible, ensure that the storage mechanism for OAuth tokens (e.g., Redis, file system) is strictly secured and inaccessible to untrusted users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

PHP Object Injection remains a critical threat to modern applications. Users of the Saloon library should migrate to version 4.0.0 immediately to eliminate the use of unserialize() and mitigate the risk of remote code execution.

---METADATA---
VENDOR: Handlebars
PRODUCT: Handlebars.js
AFFECTED_VERSIONS: 4.0.0 through 4.7.8
---END_METADATA---

Description Summary:
Handlebars.js allows Remote Code Execution when Handlebars.compile() processes a crafted AST object containing unsanitized numeric literals.

Executive Summary:
Handlebars.js versions prior to 4.7.9 are vulnerable to unauthenticated Remote Code Execution if an attacker can provide a malicious AST object to the template compiler.

Vulnerability Details

CVE-ID: CVE-2026-33937

Affected Software: Handlebars Handlebars.js

Affected Versions: 4.0.0 through 4.7.8

Vulnerability: The Handlebars.compile() function accepts pre-parsed Abstract Syntax Tree (AST) objects. The value field of a NumberLiteral node is injected directly into generated JavaScript without sanitization. An unauthenticated attacker who can control the input to compile() can execute arbitrary JavaScript on the server.

Business Impact

This is a critical RCE vulnerability in a widely used library. Successful exploitation allows an attacker to execute code with the privileges of the Node.js process, leading to full server takeover and data compromise. The CVSS score of 9.8 reflects the severity and potential for widespread impact across numerous applications.

Remediation Plan

Immediate Action: Update the handlebars package to version 4.7.9 or later in all project dependencies.

Proactive Monitoring: Audit application code to ensure that Handlebars.compile() is only called with trusted string inputs and never with objects derived from user-supplied JSON.

Compensating Controls: Use the Handlebars runtime-only build (handlebars/runtime) in production environments where templates are pre-compiled, as this build does not include the vulnerable compile() function.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. However, because Handlebars is a foundational dependency for many web applications, this vulnerability has a massive attack surface.

Analyst Recommendation

Updating to version 4.7.9 is the most effective mitigation. Developers should also adopt the practice of pre-compiling templates and using the runtime-only version of Handlebars in production to eliminate the risk of dynamic compilation vulnerabilities entirely.

---METADATA---
VENDOR: Incus
PRODUCT: Incus
AFFECTED_VERSIONS: Versions prior to 6.23.0
---END_METADATA---

Description Summary:
Incus versions prior to 6.23.0 contain a critical sandbox escape in the pongo2 template implementation that allows arbitrary file reads and writes as root on the host server.

Executive Summary:
A critical vulnerability in Incus allows for arbitrary file read and write operations with root privileges on the host system by bypassing the template engine's filesystem isolation.

Vulnerability Details

CVE-ID: CVE-2026-33897

Affected Software: Incus

Affected Versions: Versions prior to 6.23.0

Vulnerability: The implementation of pongo2 templates within Incus fails to enforce chroot isolation. An attacker capable of creating or modifying instance templates can bypass the instance's filesystem boundaries to read or write any file on the host operating system with root authority.

Business Impact

This flaw permits an attacker to fully compromise the host server and all hosted instances. By reading sensitive host files (like /etc/shadow) or writing malicious binaries/scripts, an attacker can achieve persistent root access. The CVSS score of 9.9 reflects the critical nature of this host-level compromise.

Remediation Plan

Immediate Action: Upgrade Incus to version 6.23.0 immediately to restore proper template isolation and chroot enforcement.

Proactive Monitoring: Inspect all pongo2 template files for commands that attempt to access paths outside the standard instance directory structure.

Compensating Controls: Disable the use of instance templates if they are not strictly required for operations, or restrict template modification permissions to a minimal set of users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The failure of the chroot mechanism in the template engine is a high-priority security issue. Immediate patching is required to ensure that the isolation between the host and its containers remains intact.

---METADATA---
VENDOR: Gematik
PRODUCT: Authenticator
AFFECTED_VERSIONS: < 4.16.0
---END_METADATA---

Description Summary:
Gematik Authenticator is vulnerable to authentication flow hijacking via malicious deep links, allowing attackers to impersonate victim users.

Executive Summary:
Gematik Authenticator users are at risk of identity theft and session hijacking if they click on malicious deep links, potentially compromising sensitive health data.

Vulnerability Details

CVE-ID: CVE-2026-33875

Affected Software: Gematik Authenticator Gematik Authenticator

Affected Versions: Versions prior to 4.16.0

Vulnerability: The application is vulnerable to authentication flow hijacking. An unauthenticated attacker can craft a malicious deep link that, when clicked by a victim, redirects the authentication process to the attacker, allowing them to log in using the victim's identity.

Business Impact

This vulnerability directly threatens the confidentiality of digital health records. A successful attack allows unauthorized access to sensitive medical information and identity impersonation within the German health infrastructure. The CVSS score of 9.3 reflects the critical impact on user privacy and the high potential for targeted phishing attacks.

Remediation Plan

Immediate Action: Update Gematik Authenticator to version 4.16.0 or greater immediately.

Proactive Monitoring: Organizations should educate users on the risks of clicking unsolicited links, even those that appear to open legitimate local applications.

Compensating Controls: There are no known technical workarounds for this vulnerability; the software update is the only effective mitigation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 27, 2026, there is no public information indicating active exploitation. This type of vulnerability is often used in highly targeted social engineering campaigns.

Analyst Recommendation

The update to version 4.16.0 is mandatory for all users of the Gematik Authenticator. Given the sensitive nature of the data protected by this application, administrators should verify that all managed devices have been updated to the patched version to prevent identity hijacking.

---METADATA---
VENDOR: Apache
PRODUCT: Cassandra
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

Executive Summary:
An input validation vulnerability in Azure Managed Instance for Apache Cassandra allows authorized attackers to achieve remote code execution, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-33844

Affected Software: Apache Cassandra (Azure Managed Instance)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper input validation that allows an authenticated attacker to inject and execute malicious code within the database environment.

Business Impact

A CVSS score of 9.0 confirms the severity of this vulnerability. Successful exploitation could lead to full system compromise, data theft, and the disruption of critical business services dependent on the Cassandra instance.

Remediation Plan

Immediate Action: Update the Azure Managed Instance for Apache Cassandra to the latest version.

Proactive Monitoring: Review database logs for anomalous input patterns and unauthorized command execution.

Compensating Controls: Implement input filtering and validation at the application level to prevent potentially malicious payloads from reaching the database.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation. The potential for RCE makes this a high-priority risk.

Analyst Recommendation

Apply all vendor-provided updates immediately. Ensure that the database environment is isolated and that access is strictly controlled to mitigate the risk of unauthorized input injection.

---METADATA---
VENDOR: Double
PRODUCT: Windows IKE Extension
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A double-free vulnerability in the Windows IKE Extension may allow an unauthorized attacker to execute code over a network.

Executive Summary:
A critical double-free vulnerability within the Windows IKE Extension poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-33824

Affected Software: Windows IKE Extension (Vendor: Double)

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: This is a memory corruption vulnerability involving a double-free error within the IKE Extension. This flaw allows an unauthenticated, remote attacker to trigger memory management errors, potentially leading to arbitrary code execution.

Business Impact

The ability for an unauthenticated attacker to execute code over a network creates a high risk of remote system compromise. With a CVSS score of 9.8, this vulnerability is extremely critical and could be leveraged for widespread network infiltration or system instability. Immediate action is required to prevent unauthorized access to affected infrastructure.

Remediation Plan

Immediate Action: Consult the official vendor security advisory to identify the affected versions and apply the necessary security updates or configuration changes.

Proactive Monitoring: Monitor network traffic for anomalous IKE protocol packets that may indicate exploitation attempts.

Compensating Controls: Implement network-level access controls to restrict access to IKE services to only authorized, trusted IP addresses, effectively isolating the vulnerable component.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical nature of this remote code execution vulnerability, administrators must verify the status of their IKE implementations immediately. Ensure all security patches are applied as soon as they are made available by the vendor to mitigate this significant network-level threat.

---METADATA---
VENDOR: Microsoft
PRODUCT: Teams
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper authorization in Microsoft Teams permits an authorized attacker to perform unauthorized information disclosure over a network.

Executive Summary:
An authorization vulnerability in Microsoft Teams exposes sensitive information to authorized attackers, presenting a critical risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-33823

Affected Software: Microsoft Teams

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves improper authorization checks within Microsoft Teams, which can be leveraged by an already authenticated user to access information they are not permitted to view.

Business Impact

The exploitation of this flaw could lead to significant unauthorized disclosure of sensitive corporate data. With a CVSS score of 9.6, the severity is high, reflecting the potential for widespread data exposure that could compromise intellectual property, internal communications, and lead to regulatory compliance violations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft specifically for the Teams environment.

Proactive Monitoring: Review access logs for unusual patterns of data retrieval or unauthorized attempts to access sensitive channels.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and data loss prevention (DLP) policies to limit the scope of accessible data for standard users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the prevalence of Microsoft Teams in enterprise environments, the potential for exploitation is significant.

Analyst Recommendation

Security teams should prioritize patching this vulnerability across all endpoints using Microsoft Teams. Given the critical nature of the flaw, verify that automated update mechanisms are functioning correctly and audit user permissions to minimize the impact of potential unauthorized access.

---METADATA---
VENDOR: Microsoft
PRODUCT: Bing
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A deserialization vulnerability in Microsoft Bing allows an unauthorized remote attacker to execute arbitrary code via the network.

Executive Summary:
A critical deserialization flaw in Microsoft Bing permits unauthenticated remote attackers to execute arbitrary code, creating a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33819

Affected Software: Microsoft Bing

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from insecure deserialization of untrusted data handled by the application. This allows an unauthorized attacker to inject malicious payloads that execute code within the context of the service.

Business Impact

A CVSS score of 10.0 reflects the maximum severity, indicating that this vulnerability could lead to a total breach of the affected infrastructure. Successful exploitation may result in complete loss of data confidentiality, integrity, and system availability.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft for the Bing service immediately.

Proactive Monitoring: Review network traffic and server logs for unusual deserialization patterns or unexpected process execution following data ingestion.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input and restrict network access to the affected service components.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability and its 10.0 CVSS score, immediate patching is required to prevent remote code execution. Security teams should verify that all instances of the affected software are updated to the vendor-recommended versions without delay.

---METADATA---
VENDOR: Perl (CPAN)
PRODUCT: Compress::Raw::Zlib
AFFECTED_VERSIONS: Versions through 2.219
---END_METADATA---

Description Summary:
Compress::Raw::Zlib for Perl bundles an insecure version of the zlib library (CVE-2026-27171). Updating to version 2.220 resolves these underlying security issues.

Executive Summary:
A critical vulnerability in the bundled zlib library within Compress::Raw::Zlib exposes Perl applications to memory corruption and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3381

Affected Software: Compress::Raw::Zlib (Perl)

Affected Versions: Versions through 2.219

Vulnerability: This module includes a static copy of the zlib library that is susceptible to CVE-2026-27171. An unauthenticated attacker could provide specially crafted compressed data to an application using this module, triggering a vulnerability within the underlying library to achieve code execution or system denial.

Business Impact

Since many Perl applications rely on this module for data compression, the attack surface is broad. Exploitation could lead to arbitrary code execution, allowing attackers to compromise the underlying server hosting the Perl application. The CVSS score of 9.8 reflects the high risk associated with vulnerabilities in fundamental data processing libraries.

Remediation Plan

Immediate Action: Update the Compress::Raw::Zlib Perl module to version 2.220 or later, which includes the patched zlib 1.3.2 library.

Proactive Monitoring: Monitor for application crashes or unexpected memory usage spikes when processing compressed files or network streams.

Compensating Controls: Implement input validation to limit the size and type of compressed data processed by the application, and run applications in sandboxed environments to contain potential exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation of this specific Perl wrapper. However, the underlying zlib vulnerability is well-documented and targeted by researchers.

Analyst Recommendation

Supply chain vulnerabilities in core libraries like zlib are highly dangerous. Organizations must inventory their Perl environments and ensure that all instances of Compress::Raw::Zlib are updated. Failure to patch leaves applications vulnerable to reliable exploitation via malformed data inputs.

---METADATA---
VENDOR: Fastify
PRODUCT: @fastify/express
AFFECTED_VERSIONS: 4.0.4 and earlier
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A path handling error in @fastify/express causes middleware security controls to be bypassed for child plugins, leaving routes exposed to unauthorized requests.

Executive Summary:
A path handling bug in @fastify/express versions 4.0.4 and earlier causes critical middleware, such as authentication and authorization, to be bypassed for affected child plugin routes.

Vulnerability Details

CVE-ID: CVE-2026-33807

Affected Software: @fastify/express

Affected Versions: 4.0.4 and earlier

Vulnerability: A logic error in the onRegister function causes middleware paths to be incorrectly prefixed when inherited by child plugins, resulting in the middleware failing to match and execute for those routes.

Business Impact

This flaw effectively disables security layers such as authentication, authorization, and rate limiting for specific application routes. Given the CVSS score of 9.1, this creates a high risk of unauthorized data access and denial-of-service, as attackers can reach protected endpoints without satisfying security requirements.

Remediation Plan

Immediate Action: Upgrade the @fastify/express package to version 4.0.5 or later.

Proactive Monitoring: Review application routes to identify those that rely on middleware and monitor server logs for unexpected access to protected endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to enforce access control policies at the edge, providing a layer of protection while internal application code is being updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The bypass of core security controls represents a critical failure in the application's defense-in-depth posture. Development and security teams should prioritize the update to version 4.0.5 to restore intended security restrictions across all plugin routes.

---METADATA---
VENDOR: Fastify
PRODUCT: @fastify/reply-from and @fastify/http-proxy
AFFECTED_VERSIONS: @fastify/reply-from v12.6.1 and earlier; @fastify/http-proxy v11.4.3 and earlier
---END_METADATA---

Description Summary:
A vulnerability in Fastify proxy plugins allows attackers to strip proxy-added headers by manipulating the Connection header.

Executive Summary:
A high-severity vulnerability in Fastify proxy plugins enables attackers to bypass security mechanisms via header manipulation.

Vulnerability Details

CVE-ID: CVE-2026-33805

Affected Software: @fastify/reply-from, @fastify/http-proxy

Affected Versions: @fastify/reply-from v12.6.1 and earlier; @fastify/http-proxy v11.4.3 and earlier

Vulnerability: This vulnerability allows attackers to retroactively strip proxy-added headers from upstream requests by manipulating the client's Connection header, potentially bypassing security mechanisms or gaining unauthorized access.

Business Impact

With a CVSS score of 8.6, this flaw poses a significant risk to applications relying on these proxy plugins for security header injection. Bypassing these headers could lead to unauthorized access to downstream services, potentially exposing sensitive data.

Remediation Plan

Immediate Action: Upgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.

Proactive Monitoring: Monitor logs for requests with irregular Connection headers or signs of header stripping in proxy traffic.

Compensating Controls: Use a WAF to validate and sanitize the Connection header of incoming requests before they reach the proxy.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 2, 2026, a public exploit is available for this vulnerability. The risk is elevated, and immediate patching is required to prevent potential exploitation.

Analyst Recommendation

Because a public exploit is available, this vulnerability should be treated with extreme urgency. Developers must update their Fastify dependencies to the latest versions to mitigate the risk of header-based security bypasses.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability found in the Tenda F453 router could allow for unauthorized access or execution of arbitrary actions by an attacker.

Executive Summary:
A high-severity vulnerability in the Tenda F453 router introduces a critical risk of unauthorized device access and potential data exfiltration from the network.

Vulnerability Details

CVE-ID: CVE-2026-3380

Affected Software: Tenda F453

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability has been discovered in the Tenda F453 router software. Based on the high CVSS score, the flaw likely allows for an attacker to interact with the device at a high privilege level, potentially bypassing standard authentication mechanisms.

Business Impact

The CVSS score of 8.8 places this vulnerability in the High severity category. Exploitation could lead to a complete loss of control over the router, enabling an attacker to monitor all unencrypted traffic, gain access to local network resources, and severely impact the confidentiality of organizational data.

Remediation Plan

Immediate Action: Apply the manufacturer's recommended security updates to the Tenda F453 router to address the underlying vulnerability.

Proactive Monitoring: Monitor device logs for signs of brute-force attacks or access from unusual geographic locations that may indicate an attempted compromise.

Compensating Controls: Segment the network to limit the router's exposure and use internal firewalls to protect sensitive assets from a potentially compromised gateway.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity score suggests that the vulnerability is highly reliable if an exploit were developed.

Analyst Recommendation

Given the central role of the Tenda F453 in network connectivity, this vulnerability must be addressed with urgency. Applying the vendor-provided update is the only effective way to mitigate the risk and protect the organizational perimeter.