---METADATA---
VENDOR: Kovid Goyal
PRODUCT: Kitty
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the cross-platform GPU-based terminal emulator, Kitty.

Executive Summary:
A high-severity vulnerability in the Kitty terminal emulator requires immediate attention to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33633

Affected Software: Kovid Goyal Kitty

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability details are currently sparse, providing no specific information on the attack vector or the authentication requirements. With a CVSS score of 7.5, the issue is considered high risk and likely involves memory corruption or command execution vectors typical of terminal emulators.

Business Impact

A CVSS score of 7.5 indicates a significant risk to the local environment where the terminal is deployed. Exploitation could allow an attacker to gain unauthorized access to the local machine, potentially leading to privilege escalation or the theft of sensitive local session data.

Remediation Plan

Immediate Action: Update the Kitty terminal software to the latest version provided by the developer as soon as a patch is released.

Proactive Monitoring: Monitor for unexpected terminal behavior or unauthorized processes spawned from the terminal environment.

Compensating Controls: Restrict terminal access to trusted users and ensure that the host operating system is hardened against local privilege escalation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize updating terminal software in environments where high-privilege users interact with untrusted input or remote systems. Proactive monitoring of local system logs is advised until further technical details are disclosed.

---METADATA---
VENDOR: ClearanceKit
PRODUCT: ClearanceKit for macOS
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
ClearanceKit for macOS contains a vulnerability in its file-system access event interception, potentially allowing bypass of per-process access policies.

Executive Summary:
A vulnerability in ClearanceKit on macOS could allow an attacker to bypass file-system access policies, leading to unauthorized data access or privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-33631

Affected Software: ClearanceKit for macOS

Affected Versions: See vendor advisory for affected versions

Vulnerability: ClearanceKit is designed to intercept file-system access events on macOS to enforce security policies. The vulnerability exists in the interception mechanism, which may fail to correctly identify or block unauthorized requests, allowing processes to access files they should be restricted from based on the defined security policy.

Business Impact

This vulnerability is assigned a CVSS score of 8.7, indicating a High-severity risk. If exploited, it undermines the core security function of the software, potentially allowing malicious applications to access sensitive user data, configuration files, or system resources. This could lead to a total compromise of the endpoint's data confidentiality and integrity.

Remediation Plan

Immediate Action: Update ClearanceKit to the latest version provided by the developer to ensure the file-system interception and policy enforcement engine is properly secured.

Proactive Monitoring: Monitor macOS system logs and Endpoint Detection and Response (EDR) alerts for unauthorized file access attempts or modifications to ClearanceKit configuration files.

Compensating Controls: Use macOS native security features, such as Transparency, Consent, and Control (TCC) and Sandbox profiles, to provide redundant layers of file-system protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation. The high severity stems from the fact that this software is used specifically for security enforcement, and a bypass renders the entire policy framework ineffective.

Analyst Recommendation

Security tools that fail to enforce their primary policies create a false sense of security. Organizations should prioritize the update of ClearanceKit across all macOS endpoints to ensure that file-system access remains strictly controlled and monitored.

---METADATA---
VENDOR: Unknown
PRODUCT: Affected Software (setinfo endpoint)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the setinfo endpoint allows attackers to execute malicious SQL UPDATE commands, resulting in total loss of integrity and availability.

Executive Summary:
A critical SQL injection vulnerability in the setinfo endpoint allows unauthenticated remote attackers to manipulate database records, leading to potential data destruction and system failure.

Vulnerability Details

CVE-ID: CVE-2026-33615

Affected Software: Unknown (setinfo endpoint software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability arises from improper neutralization of special elements within a SQL UPDATE command at the "setinfo" endpoint. An unauthenticated remote attacker can submit crafted input to execute arbitrary SQL queries against the backend database.

Business Impact

A successful SQL injection attack can allow for the unauthorized modification or deletion of critical database records, leading to a total loss of data integrity. With a CVSS score of 9.1, this flaw could be used to disable user accounts, alter financial records, or render the entire application unavailable through database corruption.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the software vendor to implement proper input parameterization and sanitization for the setinfo endpoint.

Proactive Monitoring: Enable database activity monitoring to detect anomalous UPDATE patterns or syntax errors that indicate SQL injection attempts.

Compensating Controls: Deploy or update Web Application Firewall (WAF) signatures to detect and block common SQL injection patterns (e.g., ' OR 1=1) targeting the setinfo endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 2, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most reliable vectors for attackers to gain initial access or cause widespread data loss.

Analyst Recommendation

Due to the unauthenticated nature of this flaw and its high severity, it is imperative to apply the vendor's remediation immediately. Organizations should also conduct a broader review of their application code to ensure that all database interactions utilize prepared statements to prevent similar vulnerabilities.

---METADATA---
VENDOR: 10Web
PRODUCT: Form Maker
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Form Maker by 10Web WordPress plugin contains an SQL injection vulnerability in the 'inputs' parameter, enabling potential unauthorized database interaction.

Executive Summary:
An SQL injection flaw in the 10Web Form Maker plugin for WordPress allows attackers to potentially compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-3359

Affected Software: 10Web Form Maker

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability manifests as an SQL injection within the 'inputs' parameter. This allows an attacker to manipulate backend database queries, potentially leading to unauthorized data retrieval or modification.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high-risk entry point for attackers to bypass application logic. Successful exploitation can result in full database exposure, leading to severe reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: Apply the latest security update for the Form Maker plugin provided by 10Web immediately.

Proactive Monitoring: Monitor database query logs for unusual activity or signs of unauthorized data access originating from the Form Maker plugin components.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing suspicious SQL injection patterns directed at the 'inputs' parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Urgent patching is required to secure the environment against this SQL injection vector. Administrators must verify that they are running the most recent version of the plugin and audit site logs for any evidence of prior exploitation attempts.

---METADATA---
VENDOR: Open Notebook
PRODUCT: Open Notebook
AFFECTED_VERSIONS: v1.8.3
---END_METADATA---

Description Summary:
A Server-Side Template Injection (SSTI) vulnerability in Open Notebook v1.8.3 allows authenticated users to execute arbitrary Python code and OS commands within the Docker container.

Executive Summary:
A critical Server-Side Template Injection vulnerability in Open Notebook allows attackers to achieve arbitrary code execution within the container environment.

Vulnerability Details

CVE-ID: CVE-2026-33587

Affected Software: Open Notebook

Affected Versions: v1.8.3

Vulnerability: The application fails to sanitize user-provided input during transformations, resulting in SSTI. An authenticated user can leverage this flaw to execute arbitrary Python code, leading to full OS command execution on the host Docker container.

Business Impact

The ability to execute arbitrary commands at the container level poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 10.0, this vulnerability represents the highest level of risk, potentially allowing an attacker to pivot into the internal network, steal sensitive data, or compromise the integrity of the application environment.

Remediation Plan

Immediate Action: Update Open Notebook to the latest available version provided by the vendor to remediate the input sanitization flaw.

Proactive Monitoring: Review application logs for suspicious transformation requests and monitor for anomalous process spawning within the container.

Compensating Controls: Implement strict network segmentation for the Docker container and utilize security tools to restrict execution permissions for the application user.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS 10.0 severity, this vulnerability must be treated as a top priority. Organizations using Open Notebook v1.8.3 should apply the necessary patches immediately to prevent unauthorized code execution and mitigate the risk of a full container compromise.

---METADATA---
VENDOR: Apache
PRODUCT: Kafka
AFFECTED_VERSIONS: 4.1.0, 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A JWT validation flaw in Apache Kafka's OAuth bearer authentication allows unauthenticated attackers to impersonate any user by providing forged tokens.

Executive Summary:
Apache Kafka versions 4.1.0 and 4.1.1 are vulnerable to an authentication bypass that permits unauthorized users to gain full access to the broker.

Vulnerability Details

CVE-ID: CVE-2026-33557

Affected Software: Apache Kafka

Affected Versions: 4.1.0, 4.1.1

Vulnerability: The default JWT validator fails to perform cryptographic signature, issuer, or audience verification. This allows an unauthenticated attacker to supply a crafted JWT with arbitrary claims to successfully authenticate as any user.

Business Impact

The exploitation of this vulnerability poses a critical risk to data integrity and confidentiality. With a CVSS score of 9.1, this flaw allows an attacker to masquerade as privileged users, potentially leading to unauthorized data exfiltration, service disruption, or administrative control over the Kafka cluster.

Remediation Plan

Immediate Action: Upgrade to Apache Kafka version 4.1.2 or 4.2.0 or later. If an immediate upgrade is not feasible, explicitly set the sasl.oauthbearer.jwt.validator.class configuration to org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.

Proactive Monitoring: Monitor authentication logs for suspicious patterns or unauthorized user sessions that do not align with expected identity provider signatures.

Compensating Controls: Implement strict network-level access controls to limit communication with the Kafka broker to known, trusted IP addresses while the patch is being applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this authentication bypass, organizations must prioritize patching or configuration changes immediately. Failure to address this vulnerability allows trivial impersonation of legitimate users, effectively nullifying the security posture of the Kafka infrastructure.

---METADATA---
VENDOR: Google
PRODUCT: Tinyauth
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Tinyauth, an authentication and authorization server, contains a high-severity vulnerability that may compromise identity management.

Executive Summary:
A high-severity vulnerability in the Google Tinyauth authentication server could allow attackers to compromise authorization protocols and gain unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2026-33544

Affected Software: Google Tinyauth

Affected Versions: See vendor advisory for affected versions

Vulnerability: Tinyauth is an authentication and authorization server; this vulnerability likely involves a failure in how it processes identity tokens or handles authorization logic. While the specific mechanism is not fully detailed, the CVSS score indicates a significant risk of unauthorized access.

Business Impact

As an identity management component, a flaw in Tinyauth impacts the security of every application relying on it for access control. A successful exploit could lead to unauthorized privilege escalation and lateral movement across the network. The CVSS score of 7.7 reflects a high risk to the integrity and confidentiality of the entire authentication ecosystem.

Remediation Plan

Immediate Action: Apply the latest security updates from the vendor immediately to ensure the integrity of the authentication server.

Proactive Monitoring: Monitor authentication logs for anomalous login patterns, credential stuffing attempts, or unauthorized token generation.

Compensating Controls: Ensure that multi-factor authentication (MFA) is strictly enforced for all users to provide a secondary layer of security against compromised credentials.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this affects a core security component, it remains an attractive target for sophisticated actors.

Analyst Recommendation

Securing identity infrastructure is paramount to maintaining a robust security posture. Organizations utilizing Tinyauth should apply vendor updates without delay to mitigate the risk of unauthorized access. Continuous monitoring of authorization events is highly recommended to detect any early signs of attempted exploitation.

---METADATA---
VENDOR: FOSSBilling
PRODUCT: FOSSBilling
AFFECTED_VERSIONS: 0.7.2 and prior
---END_METADATA---

Description Summary:
A flawed administrator existence check in the FOSSBilling guest API allows unauthenticated attackers to create new administrator accounts, leading to full system compromise.

Executive Summary:
An unauthenticated administrative account creation vulnerability in FOSSBilling enables attackers to gain full system control, posing a critical risk to organizational data and operations.

Vulnerability Details

CVE-ID: CVE-2026-33543

Affected Software: FOSSBilling FOSSBilling

Affected Versions: 0.7.2 and prior

Vulnerability: This vulnerability occurs due to an improper type check in the /api/guest/staff/create endpoint, which fails to correctly verify if an administrator account already exists. This allows an unauthenticated attacker to inject a new, fully privileged administrative user into the system.

Business Impact

Successful exploitation results in total compromise of the billing and client management system. Given the CVSS score of 9.3, this flaw presents an unacceptable risk of unauthorized data exfiltration, service manipulation, and complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade FOSSBilling to version 0.8.0 or later immediately to resolve the logic error in the guest API endpoint.

Proactive Monitoring: Review system logs for unauthorized account creation events and monitor the administrative user list for accounts not provisioned by authorized staff.

Compensating Controls: Restrict access to the API directory at the web server or WAF level to prevent public access to the /api/guest/ path until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to full administrative access. Organizations utilizing FOSSBilling must prioritize this update as a critical maintenance task to prevent unauthorized system takeover.

---METADATA---
VENDOR: Zserio
PRODUCT: Zserio
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Zserio, a framework for serializing structured data, is affected by a high-severity vulnerability that could impact system data integrity and security.

Executive Summary:
A high-severity vulnerability in the Zserio serialization framework may allow attackers to compromise the integrity of structured data processing.

Vulnerability Details

CVE-ID: CVE-2026-33524

Affected Software: Zserio

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Zserio framework used for data serialization. With a CVSS score of 7.5, the flaw likely relates to improper handling of serialized data streams, which could be exploited to cause memory corruption, denial of service, or potentially arbitrary code execution when processing malicious data packets.

Business Impact

A CVSS score of 7.5 indicates a high risk to applications that rely on Zserio for efficient data communication. Exploitation could lead to unauthorized data manipulation or service disruption, which is particularly concerning in systems where Zserio is used for high-performance data exchange.

Remediation Plan

Immediate Action: Update the Zserio framework to the latest version provided by the project maintainers.

Proactive Monitoring: Review logs for errors occurring during the serialization or deserialization process, which could indicate malformed data or exploitation attempts.

Compensating Controls: Implement input validation for all structured data before it is passed to the Zserio deserialization layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Applications using Zserio should be updated immediately to mitigate this serialization vulnerability. Ensuring the integrity of data processing pipelines is essential to preventing downstream security impacts.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.4, 11.5, 12.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in Esri Portal for ArcGIS 11.4, 11.5, and 12.0 fails to correctly validate permissions assigned to developer credentials.

Executive Summary:
An authorization flaw in Esri Portal for ArcGIS allows unauthorized access due to improper permission validation for developer credentials, creating a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-33519

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.4, 11.5, 12.0

Vulnerability: The application suffers from incorrect authorization, specifically failing to properly verify the permissions associated with developer-level credentials, which can be leveraged to gain unauthorized access.

Business Impact

With a CVSS score of 9.8, this flaw represents a severe risk to organizational data integrity and confidentiality. Successful exploitation could allow attackers to bypass intended access controls, potentially accessing sensitive geospatial data and administrative functions within the ArcGIS environment.

Remediation Plan

Immediate Action: Update the Esri Portal for ArcGIS installation to the latest available version provided by the vendor.

Proactive Monitoring: Audit existing user and developer accounts for unusual activity and review access logs for attempts to access resources outside of assigned permission scopes.

Compensating Controls: Implement the principle of least privilege by auditing and restricting developer credentials until the patch is successfully applied.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to patching the affected ArcGIS Portal instances. Organizations must verify their current versioning and apply the necessary updates to ensure that developer credential permissions are correctly enforced and to prevent unauthorized access to the platform.

---METADATA---
VENDOR: Esri
PRODUCT: Portal for ArcGIS
AFFECTED_VERSIONS: 11.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Esri Portal for ArcGIS 11.5 contains an incorrect privilege assignment vulnerability allowing highly privileged users to escalate developer credentials beyond intended limits.

Executive Summary:
A critical privilege assignment vulnerability in Esri Portal for ArcGIS 11.5 allows authorized users to escalate their permissions, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-33518

Affected Software: Esri Portal for ArcGIS

Affected Versions: 11.5

Vulnerability: This is an incorrect privilege assignment vulnerability where highly privileged users can create developer credentials that grant excessive access rights, exceeding their authorized scope.

Business Impact

The ability for privileged users to grant themselves unauthorized elevated permissions creates a substantial risk of data compromise and unauthorized administrative control. With a CVSS score of 9.8, this flaw represents a critical threat to the security posture of the organization, potentially leading to unauthorized access to sensitive geospatial data and infrastructure management.

Remediation Plan

Immediate Action: Consult the official Esri security advisory for the latest security patches or configuration hardening steps to restrict developer credential creation.

Proactive Monitoring: Review access logs for the creation of new developer credentials and audit the privilege levels assigned to existing administrative accounts.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and limit the number of users with administrative or developer-level permissions within the Portal.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this privilege assignment issue, administrators should prioritize auditing current portal accounts and applying vendor-supplied updates immediately. Limiting the scope of highly privileged accounts is essential to preventing potential abuse of this vulnerability.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo's Live plugin allows attackers to probe internal networks and cloud metadata endpoints.

Executive Summary:
WWBN AVideo is vulnerable to a critical SSRF flaw that allows unauthenticated attackers to scan internal infrastructure and potentially steal cloud service credentials.

Vulnerability Details

CVE-ID: CVE-2026-33502

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: The vulnerability exists in plugin/Live/test.php. It allows an unauthenticated remote user to force the server to send HTTP requests to arbitrary URLs, including localhost and internal network resources that are not publicly accessible.

Business Impact

Attackers can use this SSRF to bypass firewall restrictions and access internal services, such as databases or configuration management tools. In cloud environments, this can be used to query the Instance Metadata Service (IMDS) to steal temporary security tokens, leading to a full cloud account compromise. The CVSS score of 9.3 reflects this high potential for lateral movement.

Remediation Plan

Immediate Action: Apply the patch in commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 or update to the latest version.

Proactive Monitoring: Monitor outbound network traffic from the AVideo server for requests to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).

Compensating Controls: Implement egress filtering at the network level to prevent the web server from initiating connections to sensitive internal ports or metadata services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, no active exploitation has been reported. SSRF is a common vector for initial access in cloud-native environments and should be addressed with high urgency.

Analyst Recommendation

Applying the vendor patch is the most effective solution. Organizations running AVideo in AWS, Azure, or GCP should be especially vigilant and ensure that IMDSv2 (or equivalent) is enforced to mitigate the impact of SSRF.

---METADATA---
VENDOR: ORY
PRODUCT: Oathkeeper
AFFECTED_VERSIONS: Versions prior to 26.2.0
---END_METADATA---

Description Summary:
ORY Oathkeeper versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal where raw paths are matched against permissive rules before normalization.

Executive Summary:
ORY Oathkeeper is subject to a critical authorization bypass that allows unauthenticated attackers to access protected administrative endpoints by utilizing path traversal sequences in HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-33494

Affected Software: ORY Oathkeeper

Affected Versions: Versions prior to 26.2.0

Vulnerability: The vulnerability exists in the rule evaluation engine, which uses un-normalized HTTP paths to match access rules. An unauthenticated attacker can craft a URL containing traversal sequences (e.g., /public/../admin) that bypasses restrictive rules but resolves to protected paths after server-side normalization.

Business Impact

This flaw effectively nullifies the security posture of the Identity & Access Proxy, allowing unauthorized access to sensitive internal APIs and administrative secrets. Given the CVSS score of 10.0, the risk is maximum, as it enables complete bypass of the primary security gatekeeper for protected infrastructure.

Remediation Plan

Immediate Action: Upgrade ORY Oathkeeper to version 26.2.0 or later immediately to ensure that path normalization occurs prior to access rule evaluation.

Proactive Monitoring: Review access logs for requests containing dot-dot-slash (../) sequences targeted at known public or permissive endpoints.

Compensating Controls: Ensure that downstream services perform their own secondary authorization checks and utilize a WAF to block requests containing URL-encoded path traversal characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

As an Identity and Access Proxy, the failure of Oathkeeper to correctly normalize paths is a fundamental security failure. Organizations must prioritize this update to prevent unauthorized actors from reaching internal resources that rely on the proxy for protection.

---METADATA---
VENDOR: WWBN
PRODUCT: AVideo
AFFECTED_VERSIONS: Up to and including 26.0
---END_METADATA---

Description Summary:
WWBN AVideo contains a vulnerability chain allowing unauthenticated remote code execution via exposed clone secrets, database dumps, and OS command injection.

Executive Summary:
The WWBN AVideo platform is subject to a critical vulnerability chain that allows unauthenticated attackers to achieve full remote code execution and system takeover.

Vulnerability Details

CVE-ID: CVE-2026-33478

Affected Software: WWBN AVideo

Affected Versions: Up to and including 26.0

Vulnerability: This is a multi-step exploit chain. First, clones.json.php leaks secret keys. These keys allow unauthenticated database dumps via cloneServer.json.php. Attackers can then crack MD5 hashes to gain admin access and finally exploit an OS command injection in the rsync command construction.

Business Impact

This vulnerability represents the highest possible risk (CVSS 10.0). An attacker can gain total control over the video platform, access all private content, steal user credentials, and execute arbitrary commands on the underlying host. The ability to dump the entire database unauthenticated makes this an extremely dangerous flaw for data privacy.

Remediation Plan

Immediate Action: Apply the patch provided in commit c85d076375fab095a14170df7ddb27058134d38c or update to the latest version of AVideo.

Proactive Monitoring: Check for unauthorized access to .json.php files in the CloneSite plugin directory and monitor for unusual rsync processes on the server.

Compensating Controls: Disable the CloneSite plugin if it is not strictly required for business operations and restrict access to the administration interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, the complexity of the chain does not lower the risk, as the individual steps are straightforward to automate.

Analyst Recommendation

Given the CVSS 10.0 rating, this is a "patch now" priority. Administrators must update the software immediately and should consider rotating all administrative passwords and secret keys, as they may have been compromised.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

Executive Summary:
A vulnerability in the SiYuan system allows for potential unauthorized access to sensitive knowledge bases, necessitating an immediate security update.

Vulnerability Details

CVE-ID: CVE-2026-33476

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan application, a tool used for private data management. Given the high CVSS severity, the flaw likely permits an attacker to bypass security controls or execute unauthorized commands within the application environment.

Business Impact

A successful exploit could allow an attacker to read, modify, or delete sensitive notes and documents stored within the SiYuan system. For organizations using SiYuan for internal documentation, this could result in the leak of proprietary research or strategic plans. The 7.5 CVSS score indicates that the risk to data confidentiality and availability is substantial.

Remediation Plan

Immediate Action: Immediately update SiYuan to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Monitor system resource usage and file integrity within the SiYuan directory to detect potential unauthorized modifications.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall (WAF) to filter suspicious traffic targeting the knowledge management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of personal knowledge management tools makes them attractive targets for targeted information-gathering attacks.

Analyst Recommendation

Immediate patching is the primary and most effective defense against this vulnerability. Users should not delay in applying updates, as the high severity score suggests that the flaw could be easily leveraged if technical details become public. Ensure that all backups of the knowledge base are encrypted and stored securely during the update process.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: Prior to version 1.9.0
---END_METADATA---

Description Summary:
Unauthenticated remote shell injection in Langflow's GitHub Actions workflows allows attackers to execute arbitrary commands and exfiltrate CI secrets via malicious branch names.

Executive Summary:
Langflow is vulnerable to unauthenticated remote shell injection in its CI/CD pipelines, allowing attackers to steal sensitive secrets and compromise the software supply chain.

Vulnerability Details

CVE-ID: CVE-2026-33475

Affected Software: Langflow

Affected Versions: Prior to version 1.9.0

Vulnerability: This is a shell injection vulnerability in GitHub Actions workflows. It occurs because unsanitized GitHub context variables (like github.head_ref) are directly interpolated into run: shell commands, allowing an unauthenticated attacker to execute commands by submitting a pull request with a malicious branch name.

Business Impact

An attacker can exfiltrate sensitive CI secrets, such as GITHUB_TOKEN, and potentially push malicious code or images to production repositories. This could lead to a massive supply chain compromise affecting all users of the Langflow product. The CVSS score of 9.1 reflects the critical risk to the integrity of the development lifecycle.

Remediation Plan

Immediate Action: Update Langflow to version 1.9.0 or later, which refactors workflows to use environment variables instead of direct interpolation.

Proactive Monitoring: Audit GitHub Actions logs for suspicious activity, such as unusual curl commands or unauthorized access to secrets in workflows triggered by external forks.

Compensating Controls: Restrict GitHub Actions permissions and require manual approval for all workflows triggered by pull requests from external contributors.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Mar 24, 2026, a proof-of-concept (PoC) is publicly available demonstrating how to exfiltrate secrets via a malicious branch name. Active exploitation is highly likely given the public nature of the PoC.

Analyst Recommendation

This is a critical supply chain vulnerability. We strongly recommend that all organizations using Langflow immediately update to version 1.9.0 and rotate any secrets that may have been exposed in their CI/CD environments.