---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1 (also affects SEC-3100, SEC-3050, SEC-3000)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The CHARX OCPP Agent service on Phoenix Contact devices lacks authentication, allowing remote attackers to reconfigure backend connections and cause denial of service.

Executive Summary:
A critical missing authentication vulnerability in the CHARX OCPP Agent allows unauthenticated attackers to reconfigure backend connections, leading to denial of service and potential data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-44101

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The OCPP Agent service fails to verify the identity of remote entities, granting an unauthenticated attacker the ability to alter backend connection settings.

Business Impact

Exploitation of this vulnerability enables attackers to disrupt charging station operations through denial of service or divert sensitive data by reconfiguring backend connections. Given the CVSS score of 9.8, the potential for service outages and information leakage is substantial. This risk is particularly high for operators of charging infrastructure who rely on secure connectivity to the backend management platform.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to enforce authentication for the OCPP Agent service.

Proactive Monitoring: Monitor the status of backend connections and review logs for unauthorized reconfiguration attempts or unexpected connection drops in the charging management system.

Compensating Controls: Restrict network access to the OCPP Agent service by implementing strict firewall rules and network segmentation, ensuring only verified management servers can communicate with the device.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ability to remotely reconfigure backend connections is a critical flaw that could facilitate large-scale service disruption.

Analyst Recommendation

Operators must treat this vulnerability with high urgency to prevent potential operational downtime and data exposure. It is essential to apply the manufacturer-provided firmware updates and verify network security controls to protect the integrity of the backend management communications.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to 1.9.1 (excluding 1.9.1)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The CHARX JupiCore service in various Phoenix Contact CHARX SEC controllers contains a missing authentication vulnerability, allowing unauthenticated remote attackers to reconfigure charging points.

Executive Summary:
A critical authentication bypass in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to manipulate charging point configurations, potentially causing service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44100

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 through 1.9.0

Vulnerability: The CHARX JupiCore service fails to enforce proper authentication for critical functions. This allows an unauthenticated remote attacker to perform unauthorized reconfigurations, leading to the disclosure of sensitive UIDs, denial-of-service conditions, and file tampering.

Business Impact

The ability to manipulate industrial charging infrastructure remotely carries significant operational risk. With a CVSS score of 9.4, the vulnerability enables attackers to disrupt service availability or potentially cause physical damage to connected assets through unauthorized configuration changes, leading to severe reputational and financial impacts.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or later as specified by the vendor advisory.

Proactive Monitoring: Review system logs for unauthorized configuration change events and monitor for abnormal communication patterns targeting the JupiCore service.

Compensating Controls: Deploy network segmentation to isolate industrial control systems from public-facing networks and utilize industrial firewalls to restrict access to the affected service.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving critical function access, suggests high exploitability if the interface is reachable via the network.

Analyst Recommendation

Organizations utilizing affected Phoenix Contact hardware must prioritize the firmware update to version 1.9.1. Given the potential for operational disruption and unauthorized access, ensuring all controllers are updated is essential to maintaining the integrity of the charging infrastructure.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3000, 3050, 3100, 3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend.

Executive Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44098

Affected Software: Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an OS command injection flaw (CWE-78) triggered when an unauthenticated remote attacker bypasses firewall restrictions to interact with the OCPP backend. Successful exploitation allows the execution of arbitrary commands with the privileges of the charx-oa user.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over charging infrastructure, potentially causing operational disruption or unauthorized access to the underlying network. Given the CVSS score of 8.6, the risk is high: it enables attackers to manipulate controller functions without requiring valid user credentials.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or higher immediately.

Proactive Monitoring: Monitor network traffic for anomalous OCPP communication patterns and audit system logs for unexpected command execution attempts.

Compensating Controls: Ensure that the OCPP backend is strictly isolated from public networks and implement firewall rules to prevent unauthorized access to the management interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on a firewall bypass suggests that robust network perimeter security is a critical factor in preventing exploitation.

Analyst Recommendation

The severity of this remote, unauthenticated vulnerability necessitates immediate patching. Organizations should prioritize updating their Phoenix Contact CHARX controllers to the latest firmware to eliminate the command injection vector and secure their industrial control environment.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Phoenix Contact CHARX series is vulnerable to a fail-open condition, allowing attackers to force a fallback to a firmware partition containing default credentials.

Executive Summary:
A failure to secure the firmware partition fallback process in Phoenix Contact CHARX devices allows unauthenticated attackers to gain unauthorized access via default credentials.

Vulnerability Details

CVE-ID: CVE-2026-44094

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: The devices exhibit a fail-open behavior (CWE-636) where an unauthenticated remote attacker can force a transition to a legacy or secondary firmware partition. This partition contains insecure configurations, specifically the use of default credentials, which can be exploited for unauthorized access.

Business Impact

The CVSS score of 8.6 indicates a high risk of unauthorized access and potential loss of availability. By forcing the system to a less secure state, attackers can bypass current authentication mechanisms, leading to complete device control, data exfiltration, or the disabling of charging operations.

Remediation Plan

Immediate Action: Update the affected CHARX devices to firmware version 1.9.1 or later.

Proactive Monitoring: Monitor device logs for unexpected partition changes or attempts to authenticate with default credentials.

Compensating Controls: Ensure that management interfaces are isolated from public networks and that all default passwords are changed on all accessible partitions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent design weakness in how the system handles partition fallback, making it a target for attackers seeking to bypass modern security hardening.

Analyst Recommendation

The reliance on default credentials in legacy firmware partitions presents a significant security gap. Administrators must prioritize the upgrade to version 1.9.1 to ensure that the device does not fall back to an insecure state, thereby mitigating the risk of unauthorized administrative access.

---METADATA---
VENDOR: Phoenix Contact
PRODUCT: CHARX SEC-3150
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.9.1 (also affects SEC-3100, SEC-3050, SEC-3000)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the Phoenix Contact CHARX SEC series allows unauthenticated remote attackers to access and potentially compromise the MQTT broker.

Executive Summary:
A critical missing authentication flaw in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by accessing the MQTT broker.

Vulnerability Details

CVE-ID: CVE-2026-44090

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The MQTT broker on the affected hardware lacks proper authentication, allowing an unauthenticated remote attacker to interact with the service if network access is permitted.

Business Impact

The ability to access the MQTT broker allows an attacker to manipulate industrial control communications, leading to potential operational disruption or full device compromise. With a CVSS score of 9.8, this vulnerability poses a severe threat to operational technology environments. Unauthorized access may result in unauthorized control of physical processes, leading to safety risks and significant financial impact.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to implement mandatory authentication for the MQTT broker.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the MQTT port and review device logs for suspicious configuration changes or unexpected message publishing.

Compensating Controls: Ensure that all industrial control devices are isolated from the public internet via robust firewall rules and VPNs to restrict access to the MQTT broker to authorized internal sources only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication on critical industrial protocols is a high-risk configuration that should be remediated immediately.

Analyst Recommendation

This vulnerability represents a significant risk to industrial systems and must be addressed as a high priority. Administrators should ensure that firmware updates are applied to all impacted hardware and verify that network-level controls are in place to prevent unauthorized exposure of the MQTT broker.

---METADATA---
VENDOR: Totolink
PRODUCT: EX1200L
AFFECTED_VERSIONS: 9.3.5u.6146_B20201023 (likely others)
---END_METADATA---

Description Summary:
The Totolink EX1200L router contains a buffer overflow in the login functionality, allowing unauthenticated remote attackers to execute arbitrary code as root.

Executive Summary:
A critical buffer overflow in the Totolink EX1200L login interface allows unauthenticated attackers to execute code as root and gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-44089

Affected Software: Totolink EX1200L

Affected Versions: 9.3.5u.6146_B20201023 (and potentially others)

Vulnerability: A buffer overflow exists in the cgi-bin/cstecgi.cgi endpoint, which handles login requests. An unauthenticated attacker can send a crafted request to trigger this overflow and execute arbitrary commands with root-level privileges.

Business Impact

With a CVSS score of 9.4, this vulnerability allows for total compromise of the router. An attacker gaining root access can intercept network traffic, modify DNS settings, or use the device as an entry point to attack other internal systems, posing a significant risk to the entire network environment.

Remediation Plan

Immediate Action: Update the EX1200L firmware to the latest available version provided by Totolink.

Proactive Monitoring: Monitor network traffic for unusual activity originating from the router, such as unexpected outbound connections or system configuration changes.

Compensating Controls: Disable remote management of the router and restrict access to the web interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for root-level remote code execution, this vulnerability poses a severe threat to network integrity. Organizations should immediately apply firmware updates and restrict management access to the device to mitigate the risk of unauthorized remote exploitation.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 2 is susceptible to a path traversal vulnerability that allows authenticated attackers to access restricted directories via improper pathname validation.

Executive Summary:
A path traversal vulnerability in Netatalk 2 allows authenticated attackers to access unauthorized files, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44068

Affected Software: Netatalk Netatalk

Affected Versions: 2.1.0 through 4.4.2

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) residing in the file handling mechanisms of Netatalk 2. It requires an attacker to have authenticated access to the system to successfully traverse outside of restricted directories.

Business Impact

Successful exploitation allows an attacker to bypass file system restrictions, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.6, this represents a high severity risk that could lead to full system compromise if sensitive configuration or data files are accessed.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to apply the necessary security patches.

Proactive Monitoring: Monitor system access logs for unusual path patterns or attempts to access directories outside of expected user shares.

Compensating Controls: Ensure strict file system permissions are enforced for the service account running Netatalk to limit the impact of potential traversals.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is limited to authenticated users, which necessitates robust identity and access management as a baseline defense.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized file access, organizations running Netatalk 2 should prioritize updating to version 4.4.3. Patching is the only definitive way to resolve this path traversal flaw and protect sensitive file system resources.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple heap out-of-bounds reads exist in the Spotlight RPC unmarshalling code in Netatalk 3, potentially allowing information disclosure.

Executive Summary:
A heap out-of-bounds read vulnerability in Netatalk 3 allows authenticated attackers to potentially access sensitive memory.

Vulnerability Details

CVE-ID: CVE-2026-44066

Affected Software: Netatalk Netatalk

Affected Versions: 3.1.0 through 4.4.2

Vulnerability: The vulnerability is an out-of-bounds read (CWE-125) within the Spotlight RPC unmarshalling code. Based on the CVSS vector (PR:L), this requires a low-privilege authenticated user to successfully trigger the flaw.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive information residing in memory. While the CVSS score of 7.1 (High) reflects the potential for information disclosure and service impact, the requirement for authenticated access reduces the immediate risk to external-facing environments.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later, where this vulnerability has been addressed.

Proactive Monitoring: Review system and application logs for unusual RPC traffic or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to Netatalk services to trusted users only and ensure network segmentation is in place to limit the reach of potential attackers.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires specific interaction with the Spotlight RPC interface.

Analyst Recommendation

Given the severity of this memory-handling flaw, administrators should prioritize updating to the patched version, 4.4.3. Ensuring that all Netatalk instances are running the latest software version is the most effective way to mitigate this risk.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.3 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability exists in the ASP session ID handling logic of Netatalk 1, potentially leading to service disruption or information disclosure.

Executive Summary:
An out-of-bounds read vulnerability in Netatalk 1 session handling poses a risk of service interruption and information disclosure to adjacent network attackers.

Vulnerability Details

CVE-ID: CVE-2026-44064

Affected Software: Netatalk Netatalk

Affected Versions: 1.3 through 4.4.2

Vulnerability: This is an out-of-bounds read (CWE-125) triggered during the handling of ASP session IDs. The CVSS vector (AV:A) indicates that the attacker must be positioned on the adjacent network to exploit this flaw.

Business Impact

The vulnerability carries a CVSS score of 7.1 (High), primarily due to its potential to cause a denial-of-service condition (impacting availability) or unauthorized information exposure. Organizations relying on Netatalk for file sharing services may face operational downtime if the service is crashed via this vector.

Remediation Plan

Immediate Action: Update the Netatalk installation to version 4.4.3 or later to resolve the session handling flaw.

Proactive Monitoring: Monitor network-level traffic for anomalous packets directed at the Netatalk service, specifically targeting session ID parameters.

Compensating Controls: Implement network access controls to ensure only authorized devices can communicate with the Netatalk service, mitigating the adjacent network attack vector.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access limits the attack surface significantly.

Analyst Recommendation

The vulnerability necessitates a patch to the latest version (4.4.3) to ensure service stability and security. Administrators should schedule these updates during the next maintenance window to minimize potential exposure.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing output length bounds check in the pull_charset_flags() function of Netatalk 2 allows for a potential out-of-bounds write.

Executive Summary:
A critical out-of-bounds write vulnerability in Netatalk 2 could allow remote, authenticated attackers to achieve arbitrary code execution or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44062

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This is an out-of-bounds write (CWE-787) caused by a missing length check in the pull_charset_flags() function. The CVSS vector indicates that while it requires authenticated access (PR:L), it carries a high impact on Confidentiality, Integrity, and Availability.

Business Impact

With a CVSS score of 7.5 (High), this vulnerability is highly dangerous as it can lead to full system compromise. Successful exploitation could allow an attacker to gain elevated control, potentially leading to unauthorized data modification, theft, or complete service takeover.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or higher immediately to apply the necessary bounds checking logic.

Proactive Monitoring: Audit access logs for unusual user activity and monitor system integrity for unauthorized changes or unexpected process behavior.

Compensating Controls: Employ a Web Application Firewall or intrusion detection system configured to inspect traffic for malformed character set flag parameters.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory corruption flaws of this nature are often highly sought after by threat actors for weaponization.

Analyst Recommendation

Given the potential for total system compromise, this CVE should be treated with high urgency. Organizations must prioritize the update to version 4.4.3 to ensure that the memory-safety defect in character set flag processing is remediated.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.5.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer underflow vulnerability in the dsi_writeinit() function of Netatalk allows for potential service disruption.

Executive Summary:
A critical integer underflow vulnerability in Netatalk versions 1.5.0 through 4.4.2 poses a significant risk of denial-of-service to affected network file systems.

Vulnerability Details

CVE-ID: CVE-2026-44060

Affected Software: Netatalk

Affected Versions: 1.5.0 through 4.4.2

Vulnerability: This vulnerability is an integer underflow (CWE-191) occurring within the dsi_writeinit() function. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/PR:N.

Business Impact

The primary impact of this vulnerability is a high risk of system availability loss. Because the flaw allows for an integer underflow, an attacker can trigger a crash, leading to service downtime for file-sharing infrastructure. While the CVSS score is 7.5 (High), the ability for unauthenticated remote attackers to disrupt business-critical file services necessitates prompt remediation to maintain operational continuity.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to apply the necessary fix for the dsi_writeinit() integer underflow.

Proactive Monitoring: Monitor system logs for abnormal service crashes or repeated connection attempts targeting the DSI (Data Stream Interface) protocol.

Compensating Controls: Implement network segmentation to restrict access to Netatalk services to only trusted internal IP ranges, reducing the exposure to external attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of required authentication, but currently, no known weaponized exploit exists.

Analyst Recommendation

Given the ease of exploitation (low complexity, no authentication), organizations should prioritize patching their Netatalk instances. Upgrading to version 4.4.3 is the only definitive way to eliminate the risk of service disruption associated with this vulnerability.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.2.2 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Netatalk versions 2.2.2 through 4.4.2 allows attackers with high privileges to compromise system integrity and availability.

Executive Summary:
An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 could allow an attacker with high privileges to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44058

Affected Software: Netatalk

Affected Versions: 2.2.2 through 4.4.2

Vulnerability: This is an improper authentication vulnerability (CWE-287) that requires high privileges (PR:H) to exploit. An attacker who has already gained high-level access may leverage this flaw to bypass further authentication controls, leading to total impact on confidentiality, integrity, and availability.

Business Impact

Successful exploitation of this flaw could result in complete administrative control over the affected Netatalk server. Given the CVSS score of 7.2, the risk of unauthorized data access and system manipulation is severe. Organizations relying on Netatalk for sensitive file storage face significant reputational and operational risks if this vulnerability is leveraged by an existing malicious actor within the environment.

Remediation Plan

Immediate Action: Update Netatalk to version 4.5.0 or later to resolve the authentication bypass mechanism.

Proactive Monitoring: Review audit logs for unauthorized configuration changes or anomalous access patterns from existing high-privilege service accounts.

Compensating Controls: Apply the principle of least privilege to administrative accounts and ensure that management interfaces for Netatalk are not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the impact is high, the requirement for high privileges mitigates the immediate risk from external, unauthenticated threats.

Analyst Recommendation

While the requirement for high privileges reduces the attack surface compared to unauthenticated flaws, the potential for total system compromise makes this a high-priority item for maintenance cycles. Administrators should move to version 4.5.0 as soon as possible.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 can lead to OS command injection if successfully exploited.

Executive Summary:
A logic error in Netatalk 3.1.4 through 4.4.2 enables potential OS command injection, posing a severe threat to server security.

Vulnerability Details

CVE-ID: CVE-2026-44055

Affected Software: Netatalk

Affected Versions: 3.1.4 through 4.4.2

Vulnerability: This is an OS command injection vulnerability (CWE-78) triggered by a logic error involving bitwise OR operations. The attack vector requires low privileges (PR:L) and high attack complexity (AC:H), but successful execution allows for full system compromise.

Business Impact

Command injection vulnerabilities are among the most dangerous, as they allow an attacker to execute arbitrary code on the underlying host operating system. With a CVSS score of 7.5, the potential for total system takeover is high. If exploited, an attacker could exfiltrate sensitive files, install persistent backdoors, or pivot to other systems within the internal network.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to patch the logic error that enables command injection.

Proactive Monitoring: Monitor for suspicious child processes being spawned by the Netatalk daemon and inspect system logs for unusual command-line arguments.

Compensating Controls: Use a Web Application Firewall (WAF) or host-based Intrusion Detection System (IDS) to detect and block common command injection signatures in network traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high attack complexity required for successful execution serves as a temporary barrier, but it should not be relied upon as a primary defense.

Analyst Recommendation

Due to the critical nature of OS command injection, this vulnerability should be remediated with high urgency. Administrators must update to version 4.4.3 to ensure that the logic error is neutralized and the command injection vector is closed.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.5.0 through 4.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is vulnerable to an improper cryptographic algorithm usage, potentially allowing unauthorized access to sensitive communications.

Executive Summary:
A vulnerability in Netatalk versions 1.5.0 through 4.2.2 involving the use of broken or risky cryptographic algorithms poses a significant risk of unauthorized data interception.

Vulnerability Details

CVE-ID: CVE-2026-44053

Affected Software: Netatalk Netatalk

Affected Versions: 1.5.0 through 4.2.2

Vulnerability: This vulnerability (CWE-327) involves the use of weak or broken cryptographic algorithms, which can be exploited by an unauthenticated remote attacker to compromise data confidentiality and integrity.

Business Impact

The reliance on insecure cryptography can lead to the exposure of sensitive data transmitted over the network, potentially resulting in unauthorized access or data breaches. With a CVSS score of 7.4, this vulnerability represents a high risk to business operations, particularly in environments where network traffic contains confidential information.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.5.0 or later to ensure the implementation of secure cryptographic standards.

Proactive Monitoring: Review network traffic logs for anomalous patterns and monitor authentication logs for signs of unauthorized access attempts.

Compensating Controls: Implement robust network-level encryption (e.g., VPNs or TLS-based tunneling) to encapsulate traffic if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the cryptographic implementation, making it susceptible to passive interception attacks.

Analyst Recommendation

Given the potential for complete compromise of data confidentiality and integrity, organizations should prioritize upgrading to the patched version of Netatalk. Immediate remediation is necessary to eliminate the risk of cryptographic exploitation.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is susceptible to sensitive information exposure due to the improper insertion of restricted data into application log files.

Executive Summary:
An information disclosure vulnerability in Netatalk versions 2.1.0 through 4.4.2 allows unauthorized access to sensitive data via insecure logging practices.

Vulnerability Details

CVE-ID: CVE-2026-44052

Affected Software: Netatalk Netatalk

Affected Versions: 2.1.0 through 4.4.2

Vulnerability: This vulnerability (CWE-532) occurs when an application inadvertently writes sensitive information, such as credentials or session tokens, into log files that may be accessible to unauthorized users.

Business Impact

The leakage of sensitive information into logs can lead to unauthorized access to systems or accounts, resulting in broader security compromises. With a CVSS score of 7.5, this issue presents a high risk, as it allows unauthenticated attackers to potentially gather intelligence required for further exploitation.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later to remediate the insecure logging behavior.

Proactive Monitoring: Audit existing application logs for the presence of sensitive data and restrict access to log directories to authorized personnel only.

Compensating Controls: Use a Web Application Firewall (WAF) or system-level monitoring to detect and block access attempts targeting sensitive files or log storage paths.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, increasing the risk of discovery by automated scanning tools.

Analyst Recommendation

Organizations should ensure that logging configurations are audited and that the software is updated to the latest version immediately. Securing log files is a critical step in preventing secondary attacks and maintaining overall system integrity.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.0.2 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 3 contains an improper link resolution vulnerability that allows authenticated attackers to perform unauthorized file access via symbolic link following.

Executive Summary:
An improper link resolution vulnerability in Netatalk 3 allows authenticated attackers to manipulate file access, resulting in a high risk of sensitive data exposure.

Vulnerability Details

CVE-ID: CVE-2026-44051

Affected Software: Netatalk Netatalk

Affected Versions: 3.0.2 through 4.4.2

Vulnerability: This vulnerability (CWE-59) occurs when the application fails to properly resolve links before performing file operations. It allows an authenticated attacker to bypass intended file access restrictions.

Business Impact

The ability to exploit link resolution can lead to unauthorized access to sensitive files on the server, resulting in potential data breaches. With a CVSS score of 8.1, the vulnerability is classified as high, reflecting the potential for significant impact on data confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to remediate the vulnerability.

Proactive Monitoring: Audit file system activity logs for suspicious access patterns involving symbolic or hard links.

Compensating Controls: Configure the environment to prevent the creation of symbolic links in directories accessible to the Netatalk service where possible.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, emphasizing the importance of securing user credentials and access levels.

Analyst Recommendation

Organizations should treat this high-severity vulnerability with urgency. Immediate application of the 4.4.3 update is required to close the link resolution flaw and maintain the security posture of the affected Netatalk environments.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.0 through 4.4.2
---END_METADATA---

Description Summary:
Netatalk contains a heap-based buffer overflow vulnerability within the cnid daemon's comm_rcv() function.

Executive Summary:
A heap buffer overflow in the Netatalk cnid daemon could allow a remote attacker to execute arbitrary code or crash the service.

Vulnerability Details

CVE-ID: CVE-2026-44050

Affected Software: Netatalk

Affected Versions: 2.0.0 through 4.4.2

Vulnerability: This is a heap buffer overflow in the cnid daemon. It occurs during the comm_rcv() process, which can be triggered by an attacker sending malformed data to the service.

Business Impact

A successful exploit may result in arbitrary code execution with the privileges of the Netatalk service, leading to full system compromise or a persistent denial-of-service condition. The 9.9 CVSS score highlights the extreme urgency of this vulnerability for any environment utilizing Netatalk for file sharing.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later immediately.

Proactive Monitoring: Monitor system logs for service crashes or unusual memory usage associated with the cnid daemon.

Compensating Controls: Restrict access to the Netatalk service to authorized client IP addresses via firewall rules to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, organizations should prioritize updating all Netatalk instances to version 4.4.3. This will eliminate the buffer overflow condition and secure the communication interface.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical out-of-bounds write vulnerability exists in the Netatalk convert_charset() function due to improper null termination, leading to potential system compromise.

Executive Summary:
An out-of-bounds write vulnerability in the Netatalk convert_charset() function allows authenticated attackers to potentially execute arbitrary code or cause system crashes.

Vulnerability Details

CVE-ID: CVE-2026-44049

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This memory corruption vulnerability (CWE-787) is triggered by improper null termination in the convert_charset() function, allowing an authenticated attacker to manipulate memory.

Business Impact

Successful exploitation can lead to arbitrary code execution, resulting in full system compromise, data loss, or significant service disruption. With a CVSS score of 7.5, this vulnerability poses a severe threat to the availability and integrity of the affected systems.

Remediation Plan

Immediate Action: Apply the vendor-provided security update by upgrading to Netatalk version 4.4.3 or later.

Proactive Monitoring: Monitor system logs for crashes or unusual memory usage patterns that may indicate attempts to trigger a buffer overflow.

Compensating Controls: Ensure the application is running with the principle of least privilege to minimize the potential impact should an attacker successfully execute code.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector (requiring authentication) provides a partial barrier to immediate exploitation.

Analyst Recommendation

Given the potential for remote code execution, patching this vulnerability is of high urgency. System administrators should prioritize the update to version 4.4.3 to prevent memory-related exploitation and maintain system security.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 2.0.4 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk 2 is vulnerable to a stack-based buffer overflow that could allow an authenticated attacker to execute arbitrary code or cause a denial of service.

Executive Summary:
A stack-based buffer overflow in Netatalk 2 allows authenticated attackers to potentially execute arbitrary code, representing a critical security risk.

Vulnerability Details

CVE-ID: CVE-2026-44048

Affected Software: Netatalk Netatalk

Affected Versions: 2.0.4 through 4.4.2

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in Netatalk 2. An authenticated attacker can trigger this condition through specially crafted network requests, leading to memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of remote code execution. Successful exploitation could lead to full system compromise, data theft, or complete service disruption, severely impacting business operations.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to resolve the buffer overflow vulnerability.

Proactive Monitoring: Monitor for service crashes or unusual CPU spikes that may indicate attempts to exploit the memory corruption vulnerability.

Compensating Controls: Use network segmentation and intrusion detection systems (IDS) to identify and block malformed packets directed toward the Netatalk service.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the nature of buffer overflows, this vulnerability is inherently dangerous and represents a high risk for code execution if discovered by malicious actors.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability demands immediate attention. All systems running Netatalk 2 should be updated to version 4.4.3 or later as soon as possible to mitigate the risk of compromise.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netatalk is vulnerable to SQL injection via the cnid backend, allowing authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A SQL injection vulnerability in Netatalk versions 3.1.0 through 4.4.2 allows authenticated attackers to compromise the underlying database, posing a high risk to data integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-44047

Affected Software: Netatalk

Affected Versions: 3.1.0 through 4.4.2

Vulnerability: This is a SQL injection vulnerability (CWE-89) within the cnid backend. The vulnerability requires the attacker to have low-level authenticated access to the system to successfully inject malicious SQL commands.

Business Impact

Successful exploitation of this flaw could allow an attacker to bypass security controls, leading to unauthorized data access, modification, or total system compromise. With a CVSS score of 8.8, this represents a significant threat to business continuity and data confidentiality, as the backend database often contains sensitive configuration or user information.

Remediation Plan

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to remediate the vulnerability.

Proactive Monitoring: Review database access logs for unusual queries or patterns indicative of SQL injection attempts, particularly those originating from authenticated user sessions.

Compensating Controls: Ensure that the database user account utilized by the Netatalk cnid backend operates under the principle of least privilege to limit the scope of a potential injection attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is high, the requirement for authenticated access slightly lowers the immediate threat compared to unauthenticated remote code execution.

Analyst Recommendation

Given the severity of potential SQL injection, administrators should prioritize updating to the latest version of Netatalk. Apply the patch as part of the next scheduled maintenance cycle or sooner if the environment is exposed to untrusted users.

---METADATA---
VENDOR: Harbor
PRODUCT: Harbor (GoHarbor)
AFFECTED_VERSIONS: 2.15.0 and below
---END_METADATA---

Description Summary:
GoHarbor Harbor version 2.15.0 and below uses hard-coded credentials, allowing unauthenticated attackers to gain administrative access to the web user interface.

Executive Summary:
Harbor container registries are at critical risk of unauthorized access due to the use of hard-coded default credentials, potentially leading to the compromise of private container images.

Vulnerability Details

CVE-ID: CVE-2026-4404

Affected Software: Harbor (GoHarbor)

Affected Versions: 2.15.0 and below

Vulnerability: This vulnerability involves the use of hard-coded credentials in the Harbor software. This allows an attacker who knows the default password to log into the web UI with administrative privileges without needing to bypass any other security layers.

Business Impact

The impact is severe, as an attacker with administrative access to a container registry can steal proprietary source code, inject malicious code into container images (supply chain attack), or delete critical infrastructure components. The CVSS score of 9.4 reflects the high impact on confidentiality and integrity resulting from this authentication failure.

Remediation Plan

Immediate Action: Update Harbor to the latest version and immediately change all default administrative passwords.

Proactive Monitoring: Review Harbor access logs for logins using the default "admin" account, especially from unknown or external IP addresses.

Compensating Controls: Ensure the Harbor UI is not exposed to the public internet and implement Multi-Factor Authentication (MFA) if supported by your identity provider integration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. However, hard-coded credentials are among the easiest vulnerabilities for attackers to exploit once the default values are identified.

Analyst Recommendation

Immediate password rotation is the most critical step. Following that, upgrading to a version that enforces password changes or removes hard-coded defaults is essential to maintain a secure container supply chain.

---METADATA---
VENDOR: Fluent
PRODUCT: Fluentd
AFFECTED_VERSIONS: < 1.19.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fluentd allows path traversal via the ${tag} placeholder in file configurations, enabling attackers to write or overwrite arbitrary files and potentially achieve remote code execution.

Executive Summary:
A critical path traversal vulnerability in Fluentd versions prior to 1.19.3 allows attackers to perform arbitrary file writes, creating a significant risk for remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-44024

Affected Software: Fluent Fluentd

Affected Versions: < 1.19.3

Vulnerability: This is a path traversal vulnerability caused by insufficient validation of the ${tag} placeholder in the out_file plugin. By sending crafted tags containing traversal characters, an unauthenticated attacker can manipulate file paths to write to unintended locations on the host filesystem.

Business Impact

Successful exploitation of this vulnerability allows attackers to overwrite critical system configuration files or binary files, which can lead to full system compromise via remote code execution. Given the CVSS score of 9.8, this vulnerability is critical. It poses a severe threat to the integrity and confidentiality of the entire host system running the Fluentd service.

Remediation Plan

Immediate Action: Update the Fluentd installation to version 1.19.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review Fluentd configuration files to identify if they utilize the ${tag} placeholder in path definitions and monitor filesystem activity for unauthorized file write attempts.

Compensating Controls: Run the Fluentd process with the minimum necessary filesystem permissions (least privilege) to limit the impact of a potential path traversal exploit.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical and presents a direct path to system compromise. All users of Fluentd must prioritize upgrading to version 1.19.3 immediately. Organizations should also audit their logging configurations to ensure that input tags are not being used in a way that could facilitate path traversal.

---METADATA---
VENDOR: docling-project
PRODUCT: docling-core
AFFECTED_VERSIONS: >= 1.5.0, < 2.74.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Docling Core is vulnerable to path traversal and server-side request forgery, potentially allowing unauthenticated attackers to access restricted files or perform unauthorized network requests.

Executive Summary:
Docling Core versions 1.5.0 through 2.74.0 contain path traversal and server-side request forgery vulnerabilities that permit unauthorized file access and network interaction.

Vulnerability Details

CVE-ID: CVE-2026-44023

Affected Software: docling-core

Affected Versions: >= 1.5.0, < 2.74.1

Vulnerability: This vulnerability involves improper limitation of pathnames to restricted directories and server-side request forgery. These flaws allow unauthenticated remote attackers to interact with local files or perform requests to internal resources.

Business Impact

The combination of path traversal and SSRF allows an attacker to read sensitive files from the server or probe internal network services that are otherwise protected from the public internet. This can lead to the exposure of configuration files, credentials, or internal data, resulting in a significant security breach. The CVSS score of 8.6 confirms the high severity of these combined issues.

Remediation Plan

Immediate Action: Upgrade to docling-core version 2.74.1 or later to resolve the path traversal and SSRF flaws.

Proactive Monitoring: Audit network logs for unusual outbound connections from the server, which may indicate attempted SSRF exploitation.

Compensating Controls: Ensure the application runs with the minimum necessary filesystem permissions to limit the impact of potential path traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the underlying server environment.

Analyst Recommendation

Given the potential for both information disclosure and internal network reconnaissance, users of docling-core must upgrade to version 2.74.1 immediately. Failure to patch leaves the application exposed to unauthorized file access and potential lateral movement within the network.

---METADATA---
VENDOR: docling-project
PRODUCT: docling-core
AFFECTED_VERSIONS: >= 2.5.0, < 2.74.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Docling Core is vulnerable to path traversal and resource exhaustion due to improper handling of external file names and uncontrolled resource consumption.

Executive Summary:
A high-severity vulnerability in docling-core allows unauthenticated attackers to trigger unauthorized file access and resource exhaustion, posing a significant risk to system stability and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-44019

Affected Software: docling-project docling-core

Affected Versions: >= 2.5.0, < 2.74.1

Vulnerability: This vulnerability involves improper input validation leading to external control of file paths (CWE-73) and uncontrolled resource consumption (CWE-400). The attack vector is network-based and does not require authentication, though it does require user interaction.

Business Impact

The exploitation of these flaws could lead to unauthorized information disclosure or a denial of service condition. Given the CVSS score of 8.1, the risk is classified as high, as an attacker could potentially crash the document processing service or read sensitive files from the underlying server.

Remediation Plan

Immediate Action: Update docling-core to version 2.74.1 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory spikes, and review application access logs for unusual file path patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests that attempt to traverse directories or flood the application with excessive processing tasks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of sufficient input sanitization in file handling routines.

Analyst Recommendation

The severity of this issue necessitates an immediate upgrade to the patched version. Organizations should prioritize patching to prevent potential service degradation and unauthorized data access.

---METADATA---
VENDOR: Docling-project
PRODUCT: Docling
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Docling, a tool for document processing and AI integration, contains a high-severity vulnerability that could be leveraged to compromise document parsing workflows.

Executive Summary:
A high-severity vulnerability in the Docling document processing library threatens the integrity of AI-integrated data pipelines and document parsing workflows.

Vulnerability Details

CVE-ID: CVE-2026-44016

Affected Software: Docling-project Docling

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the document parsing functionality of Docling. Attackers could potentially trigger this flaw by submitting malicious documents, leading to unauthorized code execution or system instability within the processing environment.

Business Impact

A successful exploit could result in the compromise of data processed by AI pipelines, potentially leading to data leakage or the corruption of training datasets. Given the CVSS score of 8.2, this vulnerability represents a critical risk to organizations relying on Docling for automated document ingestion and generative AI integrations.

Remediation Plan

Immediate Action: Update the Docling library to the latest secure version once released by the vendor.

Proactive Monitoring: Monitor document processing logs for errors, crashes, or unexpected execution patterns that may indicate a malformed input attack.

Compensating Controls: Implement strict file validation and sandboxing for all documents processed by Docling to prevent unauthorized payloads from interacting with the host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Docling in production workflows should prioritize identifying all instances where this library is implemented. Apply the vendor-provided patches as soon as they become available to mitigate the risk of document-based attacks against your AI ecosystem.

---METADATA---
VENDOR: 0xJacky
PRODUCT: Nginx-UI
AFFECTED_VERSIONS: <= 2.3.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Nginx-UI is susceptible to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied requests, potentially allowing unauthorized access to internal resources.

Executive Summary:
A Server-Side Request Forgery vulnerability in Nginx-UI allows authenticated attackers to perform unauthorized requests, compromising internal network security.

Vulnerability Details

CVE-ID: CVE-2026-44015

Affected Software: 0xJacky Nginx-UI

Affected Versions: <= 2.3.4

Vulnerability: The vulnerability (CWE-918) allows an authenticated attacker to perform SSRF attacks by manipulating requests handled by the user interface. This enables the attacker to interact with internal services that are not typically exposed to the public network.

Business Impact

Exploitation of this SSRF vulnerability could allow an attacker to bypass firewalls and access internal infrastructure, leading to unauthorized data access or reconnaissance. With a CVSS score of 8.5, the risk is high, particularly in environments where Nginx-UI is deployed with elevated privileges or access to internal network segments.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a patched version; currently, no direct patch is available for version 2.3.4.

Proactive Monitoring: Review web server and application logs for unusual outbound requests originating from the Nginx-UI server to internal IP addresses or restricted ports.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious outbound requests and restrict access to the Nginx-UI management interface to trusted IP ranges only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of a confirmed patch necessitates strict network-level access controls.

Analyst Recommendation

Because no official patch is available, administrators must implement compensating network controls and limit access to the Nginx-UI interface immediately. Monitor for vendor updates daily and apply the fix as soon as it becomes available.

---METADATA---
VENDOR: Node.js (OpenJS Foundation)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox library for Node.js is vulnerable to sandbox escape, potentially allowing arbitrary command execution on the host system.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library for Node.js poses a significant risk of arbitrary code execution on host systems.

Vulnerability Details

CVE-ID: CVE-2026-44009

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: This is a sandbox breakout vulnerability that allows an attacker to bypass the isolation mechanisms of the vm2 environment, leading to full system compromise. The vulnerability can be triggered by an unauthenticated attacker providing malicious input to the sandbox.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and data integrity. Successful exploitation allows an attacker to break out of the intended sandbox environment and execute arbitrary commands on the underlying host, potentially leading to unauthorized access to sensitive data, system takeover, or the deployment of ransomware.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for unusual process execution or attempts to access restricted file paths originating from Node.js applications.

Compensating Controls: Implement strict containerization and principle-of-least-privilege policies for all Node.js environments to limit the blast radius if the sandbox is compromised.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of sandbox escapes, organizations utilizing vm2 must prioritize this update. Ensure that all dependencies are audited and that the patching process is completed across all production and development environments to prevent potential host-level exploitation.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.2
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to an array species batch neutralization flaw, allowing attackers to escape the sandbox and execute arbitrary commands.

Executive Summary:
A critical sandbox escape in the vm2 library allows attackers to access host functions and execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-44008

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.2

Vulnerability: The neutralizeArraySpeciesBatch method improperly handles objects across the sandbox boundary. Attackers can leverage this to retrieve host objects, including the host Function object, and escape the sandbox.

Business Impact

The CVSS score of 9.8 underscores the severe risk of host system compromise. Successful exploitation grants the attacker the ability to escape the sandbox and execute arbitrary commands on the underlying host, leading to full system takeover.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.2 or later immediately.

Proactive Monitoring: Monitor for unexpected system-level processes or unusual file system activity originating from the Node.js application.

Compensating Controls: Enforce strict process-level security, such as using seccomp profiles to block unauthorized system calls if a sandbox escape occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the persistent issues with vm2 sandbox escapes, users should ensure they are on the latest version (3.11.2+) and consider if the use of a sandbox is sufficient for their security requirements or if additional defense-in-depth measures are needed.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype access, allowing attackers to reach arbitrary prototypes and escape the sandbox.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access arbitrary prototypes and gain control over the host environment.

Vulnerability Details

CVE-ID: CVE-2026-44006

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to restrict access to BaseHandler.getPrototypeOf. By reaching this handler, an attacker can retrieve arbitrary prototypes, enabling a sandbox escape and subsequent host-level execution.

Business Impact

The CVSS score of 10.0 confirms this as a critical risk. Successful exploitation grants the attacker full control over the host system, potentially leading to unauthorized data access, service disruption, and compromise of the entire Node.js application environment.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to patch the prototype access handler.

Proactive Monitoring: Monitor for unusual JavaScript execution patterns or attempts to reflect on object prototypes within the application.

Compensating Controls: Implement strict resource limits and process isolation for any Node.js application that processes untrusted code.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is a severe threat to any system relying on vm2 for isolation. Upgrading to the latest version is the only effective mitigation and must be performed immediately.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: 3.9.6 to 3.10.5
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to prototype pollution, allowing sandboxed code to mutate host-realm objects and escape the environment.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to mutate host-realm objects and execute code outside the intended environment.

Vulnerability Details

CVE-ID: CVE-2026-44005

Affected Software: Node.js vm2

Affected Versions: 3.9.6 to 3.10.5

Vulnerability: The library incorrectly exposes mutable proxies for host-realm intrinsic prototypes. This allows sandboxed JavaScript to modify critical objects such as Object.prototype, facilitating a sandbox escape.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Exploitation allows an attacker to break out of the Node.js sandbox, leading to arbitrary code execution on the underlying host system, full server compromise, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately to address the proxy exposure issue.

Proactive Monitoring: Monitor for anomalous process behavior or unexpected file system modifications originating from Node.js applications utilizing the vm2 library.

Compensating Controls: Ensure that Node.js applications are running with the principle of least privilege, utilizing containerization or restricted service accounts to limit the blast radius of a potential escape.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this sandbox escape, users must upgrade to version 3.11.0 immediately. Organizations should conduct a thorough audit of all Node.js applications relying on vm2 for isolation to ensure they are updated and secure.

---METADATA---
VENDOR: patriksimek
PRODUCT: vm2
AFFECTED_VERSIONS: < 3.11.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The vm2 sandbox environment is vulnerable to an uncaught exception flaw, which can be leveraged to cause a denial-of-service or potentially escape the sandbox.

Executive Summary:
An uncaught exception vulnerability in the vm2 sandbox environment allows unauthenticated attackers to cause service instability and potential security bypasses.

Vulnerability Details

CVE-ID: CVE-2026-44001

Affected Software: patriksimek vm2

Affected Versions: < 3.11.0

Vulnerability: The vulnerability (CWE-248) involves an uncaught exception that can be triggered by an attacker. This flaw allows for escape from the sandbox environment or can lead to a denial-of-service condition affecting the Node.js runtime.

Business Impact

A successful exploit could crash the application or allow an attacker to execute code outside of the restricted sandbox, leading to a complete compromise of the host environment. Given the CVSS score of 8.6, this vulnerability poses a severe risk to any application relying on vm2 for secure code execution.

Remediation Plan

Immediate Action: Upgrade the vm2 package to version 3.11.0 or higher.

Proactive Monitoring: Monitor application stability and error logs for recurring uncaught exceptions or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: If upgrading is not immediately possible, consider moving away from vm2 to more modern, actively maintained isolation alternatives, as the sandbox model itself may be fragile.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of sandbox escapes.

Analyst Recommendation

Upgrade to version 3.11.0 immediately to resolve the sandbox escape risk. Given the potential for complete host compromise, this update should be treated with the highest urgency in your security maintenance schedule.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js contains a bypass in its builtin allowlist, enabling unauthorized access to restricted modules and arbitrary code execution.

Executive Summary:
A critical sandbox bypass in the vm2 library allows attackers to load forbidden modules and execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-43999

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox's builtin allowlist can be bypassed by abusing the module builtin. This allows sandboxed code to access Node.js Module._load() to load restricted modules like child_process, resulting in host-level code execution.

Business Impact

The CVSS score of 9.9 highlights the extreme severity of this flaw. By achieving remote code execution outside the sandbox, an attacker can gain full control over the host, leading to data loss, system destruction, or persistent unauthorized access.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later to ensure the builtin allowlist is properly enforced.

Proactive Monitoring: Audit Node.js application logs for attempts to load sensitive modules such as child_process, fs, or net from within sandboxed environments.

Compensating Controls: Use strict environment variable configurations to restrict the capabilities of the Node.js process and prevent the spawning of child processes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that effectively nullifies the isolation provided by vm2. It is imperative to update the library immediately and review all code that relies on this sandbox for security purposes.

---METADATA---
VENDOR: Patriksimek
PRODUCT: vm2
AFFECTED_VERSIONS: 3.10.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The vm2 Node.js sandbox environment is vulnerable to improper link resolution, allowing attackers to bypass sandbox restrictions via link following.

Executive Summary:
A high-severity sandbox escape vulnerability in the vm2 library allows authenticated attackers to execute arbitrary code with host-level permissions.

Vulnerability Details

CVE-ID: CVE-2026-43998

Affected Software: Patriksimek vm2

Affected Versions: 3.10.5

Vulnerability: This vulnerability is caused by improper link resolution before file access (CWE-59), which permits an attacker with low-level privileges to bypass the sandbox environment and interact with the host filesystem.

Business Impact

The ability to escape a sandboxed environment represents a critical security failure, as it allows unauthorized access to the underlying host system. Given the CVSS score of 8.5, this flaw poses a significant risk of full system compromise, data exfiltration, or lateral movement within the network.

Remediation Plan

Immediate Action: Update the vm2 package to version 3.11.0 or later as specified by the OSV advisory.

Proactive Monitoring: Monitor application logs for unusual file system access patterns or attempts to traverse directories outside of the designated sandbox.

Compensating Controls: If immediate patching is not possible, implement strict filesystem permissions for the Node.js process to limit the impact of a potential escape.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of the sandbox escape makes it a targeted vector for sophisticated actors.

Analyst Recommendation

Organizations utilizing the vm2 library must prioritize updating to version 3.11.0 immediately. The presence of a proof-of-concept combined with the potential for total system impact necessitates rapid remediation to prevent host-level exploitation.

---METADATA---
VENDOR: Node.js (vm2)
PRODUCT: vm2
AFFECTED_VERSIONS: Prior to 3.11.0
---END_METADATA---

Description Summary:
The vm2 sandbox for Node.js is vulnerable to a host object escape, allowing attackers to access the host environment by leveraging native symbols.

Executive Summary:
A critical sandbox escape vulnerability in the vm2 library allows attackers to access host objects and bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2026-43997

Affected Software: Node.js vm2

Affected Versions: Prior to 3.11.0

Vulnerability: The sandbox fails to properly restrict access to the host Object. Attackers can use HostObject.getOwnPropertySymbols to obtain sensitive references, enabling a full escape from the sandbox.

Business Impact

A CVSS score of 10.0 signifies an extremely high risk of compromise. Successful exploitation grants the attacker the ability to interact with the host environment, leading to full system control, sensitive data exposure, and potential compromise of the underlying infrastructure.

Remediation Plan

Immediate Action: Update the vm2 library to version 3.11.0 or later immediately.

Proactive Monitoring: Monitor system logs for unusual Node.js activity that deviates from standard application behavior, specifically looking for attempts to access non-sandboxed modules or system functions.

Compensating Controls: Employ robust system-level isolation, such as running Node.js processes within hardened containers or gVisor, to minimize the impact if the sandbox is breached.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe security failure in the isolation mechanism. All systems utilizing versions of vm2 prior to 3.11.0 must be patched immediately to prevent complete host system compromise.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is susceptible to Server-Side Request Forgery (SSRF), allowing unauthenticated attackers to force the server to make unintended requests to internal or external resources.

Executive Summary:
An unauthenticated SSRF vulnerability in the JunoClaw AI platform enables unauthorized interactions with internal network resources, posing a significant risk to infrastructure security.

Vulnerability Details

CVE-ID: CVE-2026-43993

Affected Software: Dragonmonk111 JunoClaw

Affected Versions: < v0.x.y-security-1

Vulnerability: The platform fails to properly validate inputs, leading to a Server-Side Request Forgery (CWE-918) vulnerability. This can be exploited by an unauthenticated attacker to probe internal services or perform requests on behalf of the server.

Business Impact

With a CVSS score of 8.2, this vulnerability allows attackers to bypass network perimeters, potentially accessing sensitive internal APIs or cloud metadata services. Such access can lead to unauthorized information disclosure and serve as a pivot point for deeper network intrusion.

Remediation Plan

Immediate Action: Update to version v0.x.y-security-1 or apply the fix provided in the referenced commit (a168608).

Proactive Monitoring: Review web application firewall (WAF) logs for suspicious outbound requests originating from the JunoClaw server.

Compensating Controls: Configure the server's network egress rules to block traffic to internal-only IP ranges and metadata services (e.g., 169.254.169.254).

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to expose internal network topology.

Analyst Recommendation

The JunoClaw platform should be updated immediately to the secured version. Until updates are applied, network-level egress filtering is strongly recommended to mitigate the impact of potential SSRF exploitation.

---METADATA---
VENDOR: Juno Network
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < 0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw exposes sensitive BIP-39 mnemonic seeds in LLM tool-call JSON data, risking credential theft via telemetry or logging surfaces.

Executive Summary:
JunoClaw versions prior to 0.x.y-security-1 are vulnerable to credential exposure, allowing unauthorized access to BIP-39 seed phrases through system logs and telemetry.

Vulnerability Details

CVE-ID: CVE-2026-43992

Affected Software: Juno Network JunoClaw

Affected Versions: < 0.x.y-security-1

Vulnerability: The platform included the BIP-39 mnemonic seed as an explicit parameter in MCP tool-call JSON strings. This practice exposes the recovery seed to any intermediate system, including logging, telemetry, and external LLM providers.

Business Impact

The exposure of BIP-39 seed phrases essentially grants an attacker full control over the associated wallets or contract assets. With a CVSS score of 9.8, the potential for total financial loss and unauthorized contract manipulation is extreme, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the JunoClaw platform to version 0.x.y-security-1 or higher to remove the inclusion of sensitive mnemonic data in tool calls.

Proactive Monitoring: Review logs, telemetry data, and LLM interaction history for any instances where mnemonic seeds may have been inadvertently recorded or stored.

Compensating Controls: If immediate patching is not possible, rotate all keys or wallets that may have been handled by the platform and isolate the platform from logging systems that store sensitive JSON payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the exposure of cryptographic keys is a high-severity incident that requires immediate attention.

Analyst Recommendation

The exposure of root-level credentials like BIP-39 seeds is a catastrophic failure. Organizations must treat this as a high-priority incident, update the software immediately, and assume that any credentials processed by previous versions are compromised.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: JunoClaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is vulnerable to OS Command Injection, allowing attackers to execute arbitrary commands on the underlying host system.

Executive Summary:
A critical OS command injection vulnerability in JunoClaw allows unauthenticated attackers to achieve full system compromise via malicious input injection.

Vulnerability Details

CVE-ID: CVE-2026-43991

Affected Software: Dragonmonk111 JunoClaw

Affected Versions: < v0.x.y-security-1

Vulnerability: The application improperly neutralizes special elements used in OS commands (CWE-78), allowing an attacker to inject and execute arbitrary system commands. This is a high-impact flaw that does not require user interaction.

Business Impact

The CVSS score of 8.4 reflects the severity of this issue, as it grants an attacker complete control over the application environment. Successful exploitation can lead to total system takeover, data destruction, and the installation of persistent backdoors within the corporate infrastructure.

Remediation Plan

Immediate Action: Update JunoClaw to version v0.x.y-security-1 or apply the patch found in commit 2bc54f6.

Proactive Monitoring: Monitor system process logs for anomalous command execution or unexpected shell activity spawned by the application service user.

Compensating Controls: Run the application with the least privilege necessary and use a WAF to filter input containing shell metacharacters (e.g., ;, &, |).

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection remains one of the most critical classes of vulnerabilities due to the ease of achieving remote code execution.

Analyst Recommendation

This vulnerability represents an immediate and critical threat to the integrity of the JunoClaw platform. Administrators must prioritize the application of the vendor-supplied security update to prevent unauthorized code execution and host compromise.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: junoclaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw is vulnerable to OS Command Injection, allowing an unauthenticated attacker to execute arbitrary commands on the underlying host system.

Executive Summary:
A critical OS command injection vulnerability in the Dragonmonk111 junoclaw platform poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-43990

Affected Software: Dragonmonk111 junoclaw

Affected Versions: < v0.x.y-security-1

Vulnerability: This vulnerability is an OS Command Injection (CWE-77/CWE-78) flaw. It allows an unauthenticated attacker to inject and execute arbitrary OS commands, as indicated by the CVSS vector AV:L (Local) but PR:N (No privilege required).

Business Impact

Successful exploitation results in full system compromise, as the attacker can execute commands with the privileges of the application process. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk that could lead to data exfiltration, service disruption, or the establishment of persistent backdoors within the infrastructure.

Remediation Plan

Immediate Action: Update the junoclaw platform to version v0.x.y-security-1 or later immediately.

Proactive Monitoring: Monitor system logs for unauthorized process execution, unusual child processes spawned by the application, or suspicious command-line activity.

Compensating Controls: Implement strict input validation at the network edge and ensure the application runs with the least privilege necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to bypass input sanitization and execute shell commands directly.

Analyst Recommendation

Due to the critical nature of command injection vulnerabilities, organizations running junoclaw must prioritize patching. Failure to update to v0.x.y-security-1 leaves the host system exposed to complete takeover; immediate deployment of the vendor-provided patch is required to mitigate this risk.

---METADATA---
VENDOR: Dragonmonk111
PRODUCT: junoclaw
AFFECTED_VERSIONS: < v0.x.y-security-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
JunoClaw suffers from path traversal and link following vulnerabilities, allowing attackers to manipulate file access and potentially access sensitive files outside the intended directory.

Executive Summary:
An improper input validation flaw in the Dragonmonk111 junoclaw platform allows for path traversal and unauthorized file access, threatening data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-43989

Affected Software: Dragonmonk111 junoclaw

Affected Versions: < v0.x.y-security-1

Vulnerability: This vulnerability involves Improper Input Validation (CWE-20), Path Traversal (CWE-22), and Link Following (CWE-59). An unauthenticated attacker can leverage these flaws to access arbitrary files on the system or manipulate file resolution, despite the CVSS UI:R (User Interaction Required) requirement.

Business Impact

The ability to traverse directories and follow symbolic links allows an attacker to read sensitive configuration files, system data, or application secrets. With a CVSS score of 8.5, this vulnerability presents a significant risk to the confidentiality and integrity of the application, potentially leading to unauthorized data disclosure or escalation of privilege.

Remediation Plan

Immediate Action: Update the junoclaw platform to version v0.x.y-security-1 or later to resolve the input validation and path resolution flaws.

Proactive Monitoring: Review file access logs for attempts to access directories outside of the designated application paths or suspicious file system operations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns (e.g., ../) in incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for user interaction slightly reduces the immediate exploitability compared to fully automated vectors.

Analyst Recommendation

The combination of path traversal and link resolution vulnerabilities is a serious security oversight that must be addressed. Administrators should apply the patch to v0.x.y-security-1 without delay to prevent unauthorized file system access and potential data leakage.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: Prior to 2.17.1
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Tautulli allows unauthenticated attackers to force the server to fetch arbitrary URLs.

Executive Summary:
Tautulli is affected by a critical SSRF vulnerability that allows unauthenticated attackers to perform arbitrary server-side requests.

Vulnerability Details

CVE-ID: CVE-2026-43986

Affected Software: Tautulli

Affected Versions: Prior to 2.17.1

Vulnerability: The application exposes a public endpoint that resolves attacker-controlled image hashes, transforming an authenticated SSRF primitive into an unauthenticated SSRF gadget.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe risk. Attackers can leverage the server's internal network access to interact with internal services that are otherwise unreachable from the public internet, potentially leading to sensitive information disclosure or internal service exploitation.

Remediation Plan

Immediate Action: Upgrade Tautulli to version 2.17.1 or later immediately.

Proactive Monitoring: Inspect server logs for outbound requests to suspicious external URLs or internal network segments originating from the Tautulli host.

Compensating Controls: Ensure the Tautulli host is isolated from sensitive internal network zones and implement egress filtering to restrict unauthorized outbound connections.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly critical due to the ease of unauthenticated exploitation. Organizations running Tautulli must upgrade to version 2.17.1 immediately to close the SSRF vector and prevent potential internal network probing.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability that could be exploited by an attacker.

Executive Summary:
An additional high-severity security vulnerability in Tautulli requires immediate remediation to maintain the security of the monitoring environment.

Vulnerability Details

CVE-ID: CVE-2026-43985

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Tautulli, a Python-based monitoring tool. It represents a significant security weakness that could be used by an attacker to facilitate unauthorized actions within the scope of the application.

Business Impact

The CVSS score of 8.8 justifies a high-severity rating, indicating that the vulnerability is easily exploitable or carries significant impact. Successful exploitation could lead to unauthorized system access or information leakage regarding the Plex media environment.

Remediation Plan

Immediate Action: Apply the latest security update released by the Tautulli project.

Proactive Monitoring: Check application access logs for unusual patterns and ensure that monitoring accounts have the minimum necessary privileges.

Compensating Controls: Place the Tautulli dashboard behind a secure VPN or an authenticated reverse proxy to reduce the risk of direct exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Tautulli must maintain a proactive patching schedule, especially given the high-severity nature of this entry. Immediate updates, combined with network-level access restrictions, are essential for mitigating the risk posed by this vulnerability.

---METADATA---
VENDOR: Tautulli
PRODUCT: Tautulli
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Tautulli, a monitoring tool for Plex Media Server, contains a high-severity vulnerability requiring immediate attention to prevent unauthorized access.

Executive Summary:
A high-severity vulnerability in Tautulli, a Plex monitoring tool, exposes the underlying system to significant risk of unauthorized access or exploitation.

Vulnerability Details

CVE-ID: CVE-2026-43984

Affected Software: Tautulli

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a security flaw within the Tautulli monitoring and tracking tool for Plex Media Server. While specific technical details are pending, the severity indicates a critical weakness in the application's security posture.

Business Impact

With a CVSS score of 8.9, this vulnerability presents a substantial risk to any organization or home user relying on Tautulli. Exploitation could allow an attacker to compromise the host system, potentially leading to unauthorized access to the Plex Media Server environment.

Remediation Plan

Immediate Action: Update Tautulli to the latest version immediately.

Proactive Monitoring: Review application logs for suspicious activity and monitor the system for unauthorized configuration changes.

Compensating Controls: Ensure the Tautulli interface is not exposed to the public internet and use a reverse proxy with authentication to provide an additional layer of security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Tautulli users should prioritize updating their software to the latest release to address this high-severity flaw. Limiting exposure by restricting network access to the application is highly recommended as a baseline defense.

---METADATA---
VENDOR: Pocket
PRODUCT: pocket-id
AFFECTED_VERSIONS: < 2.6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Pocket ID contains authorization and session management flaws, permitting authenticated users to bypass security controls or maintain invalid sessions.

Executive Summary:
A critical authorization and session management vulnerability in Pocket ID could allow attackers to bypass security controls and maintain unauthorized access to services.

Vulnerability Details

CVE-ID: CVE-2026-43983

Affected Software: Pocket pocket-id

Affected Versions: < 2.6.0

Vulnerability: This vulnerability involves Improper Authorization (CWE-285) and Insufficient Session Expiration (CWE-613). It allows an authenticated user to perform actions they are not authorized to access or maintain sessions longer than intended.

Business Impact

These flaws undermine the OIDC provider's security model, potentially allowing attackers to maintain persistence or perform actions on behalf of other users. Given the CVSS score of 8.1, the impact on identity management systems is severe, as it threatens the trust and authentication integrity of all services relying on Pocket ID.

Remediation Plan

Immediate Action: Update Pocket ID to version 2.6.0 or later to ensure proper authorization checks and session expiration logic are enforced.

Proactive Monitoring: Monitor authentication and session logs for anomalous login durations or users attempting to access restricted administrative functions.

Compensating Controls: Implement additional session validation at the service provider level and enforce short-lived session tokens as a temporary defense-in-depth measure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable in environments that rely solely on default OIDC session configurations.

Analyst Recommendation

The security of an OIDC provider is paramount to the entire ecosystem it protects. Given the existence of a proof-of-concept and the nature of the authorization bypass, immediate migration to version 2.6.0 is essential to protect user sessions and prevent unauthorized access to integrated services.

---METADATA---
VENDOR: wger
PRODUCT: wger
AFFECTED_VERSIONS: < 2.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The wger fitness manager application suffers from an improper privilege management vulnerability that allows low-privileged users to perform unauthorized administrative actions.

Executive Summary:
An improper privilege management vulnerability in wger allows authenticated users to escalate privileges, potentially leading to a total compromise of the application.

Vulnerability Details

CVE-ID: CVE-2026-43978

Affected Software: wger wger

Affected Versions: < 2.6

Vulnerability: This is an improper privilege management vulnerability (CWE-269) where the application fails to correctly validate the roles or permissions of an authenticated user. This allows a standard, authenticated user to perform actions reserved for higher-privileged accounts.

Business Impact

Successful exploitation results in unauthorized access to administrative functions, which could allow an attacker to modify user data, delete records, or alter application configuration. Given the CVSS score of 8.1, this represents a high risk to the confidentiality and integrity of the fitness data managed within the application.

Remediation Plan

Immediate Action: Update to the latest version of wger (version 2.6 or later) as soon as it becomes available to remediate the privilege management flaw.

Proactive Monitoring: Review administrative audit logs for any actions performed by standard user accounts that would typically require elevated privileges.

Compensating Controls: Restrict access to the wger instance via VPN or IP whitelisting until the patch is applied, and verify that all user accounts are limited to the minimum necessary permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Privilege management flaws are highly attractive to attackers as they provide a direct path to administrative control.

Analyst Recommendation

This vulnerability highlights a critical failure in the application access control model. Administrators must monitor the vendor repository for the release of version 2.6 and apply the update immediately to prevent unauthorized privilege escalation and protect sensitive user information.

---METADATA---
VENDOR: wger-project
PRODUCT: wger
AFFECTED_VERSIONS: < 2.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A logic error in wger's gym-scope authorization check allows unprivileged users to perform full account takeovers of other users via password resets.

Executive Summary:
wger versions prior to 2.6 contain an authorization bypass vulnerability that allows an attacker to perform a full account takeover of other users.

Vulnerability Details

CVE-ID: CVE-2026-43948

Affected Software: wger-project wger

Affected Versions: < 2.6

Vulnerability: The application incorrectly performs a Python object comparison that evaluates None != None as False. This allows an attacker with gym.manage_gym permissions and no gym assignment to bypass authorization checks and reset the passwords of other users without a gym assignment.

Business Impact

This flaw permits one-shot full account takeover, granting attackers unauthorized access to sensitive user data and effectively locking out legitimate users. Given the near-perfect CVSS score of 9.9, the risk of data compromise and loss of system integrity is critical.

Remediation Plan

Immediate Action: Update the wger application to version 2.6 or later to correct the faulty authorization logic.

Proactive Monitoring: Monitor application logs for unusual password reset activity or unauthorized access attempts to user accounts.

Compensating Controls: Deploy a WAF to monitor for suspicious POST requests targeting password reset or user management endpoints.

Exploitation Status

Public Exploit Available: Not explicitly stated (PoC exists per SSVC)

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the existence of a PoC and the simplicity of the logic error make this a high-risk target for automated attacks.

Analyst Recommendation

This vulnerability is highly critical due to the ease of account takeover. Organizations must update wger to version 2.6 immediately. Failure to patch will leave user accounts exposed to complete compromise by any user meeting the minor prerequisite conditions.

---METADATA---
VENDOR: frangoteam
PRODUCT: FUXA
AFFECTED_VERSIONS: 1.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FUXA contains an incorrect authorization vulnerability that allows unauthenticated attackers to bypass security restrictions.

Executive Summary:
An incorrect authorization flaw in FUXA allows unauthenticated attackers to bypass security controls and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-43947

Affected Software: frangoteam FUXA

Affected Versions: 1.3.0

Vulnerability: The software fails to properly enforce authorization checks, permitting unauthenticated attackers to perform actions that should be restricted to authorized users.

Business Impact

Unauthorized access to a SCADA or HMI dashboard can result in the loss of confidentiality and integrity regarding industrial processes. With a CVSS score of 8.9, this vulnerability presents a critical risk to the security posture of any environment utilizing the affected software.

Remediation Plan

Immediate Action: Update the fuxa-server component to version 1.3.1 or later.

Proactive Monitoring: Review application-level access logs for unexpected administrative actions performed by unauthenticated or low-privilege sessions.

Compensating Controls: Implement strict network segmentation to restrict access to the FUXA interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability stems from improper authorization logic, which is inherently dangerous in an industrial control context.

Analyst Recommendation

Given the potential for unauthorized access to sensitive control systems, administrators should treat this update as urgent. Applying the patch to version 1.3.1 is the only reliable method to remediate the authorization deficiency.

---METADATA---
VENDOR: frangoteam
PRODUCT: FUXA
AFFECTED_VERSIONS: >= 1.2.11, < 1.3.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FUXA contains multiple vulnerabilities including code injection and authentication bypass, allowing unauthenticated attackers to compromise the system.

Executive Summary:
Unauthenticated attackers can achieve full system compromise in FUXA via code injection and authentication bypass vulnerabilities.

Vulnerability Details

CVE-ID: CVE-2026-43945

Affected Software: frangoteam FUXA

Affected Versions: >= 1.2.11, < 1.3.1

Vulnerability: This issue encompasses improper control of code generation and authentication bypass mechanisms, which allow unauthenticated remote attackers to execute arbitrary code or bypass security controls.

Business Impact

Successful exploitation allows an attacker to gain full control over the FUXA process visualization environment, potentially leading to unauthorized manipulation of industrial controls or data exfiltration. Given the high CVSS score of 8.9, this vulnerability poses a severe risk to operational integrity and system availability.

Remediation Plan

Immediate Action: Update the FUXA software to version 1.3.1 or later.

Proactive Monitoring: Monitor network traffic and server access logs for unusual patterns, specifically looking for attempts to interact with administrative endpoints or unauthorized code execution signatures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads associated with code injection attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of code injection and authentication bypass flaws makes this a high priority for patching.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent potential remote code execution. System administrators must prioritize upgrading to version 1.3.1 to eliminate the underlying flaws.

---METADATA---
VENDOR: electerm
PRODUCT: electerm
AFFECTED_VERSIONS: 3.0.6 to 3.8.14
---END_METADATA---

Description Summary:
The electerm client is vulnerable to local code execution via maliciously crafted deep links or command-line options.

Executive Summary:
A critical local code execution vulnerability in electerm allows attackers to execute arbitrary commands by tricking users into opening malicious links.

Vulnerability Details

CVE-ID: CVE-2026-43944

Affected Software: electerm

Affected Versions: 3.0.6 to 3.8.14

Vulnerability: The application fails to sanitize inputs provided via deep links or CLI arguments, allowing an attacker to inject and execute arbitrary OS commands when the application is launched.

Business Impact

With a CVSS score of 9.6, this vulnerability allows for local system compromise. An attacker gaining code execution on a user's machine can steal local credentials, access SSH keys, or pivot into internal network segments, causing significant security breaches.

Remediation Plan

Immediate Action: Update electerm to version 3.8.15 or later immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious process execution spawned by the electerm application.

Compensating Controls: Implement endpoint protection (EDR) to detect and block abnormal command-line execution patterns originating from terminal/SSH clients.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability requires urgent attention, especially for users who frequently interact with external links or handle remote systems. Patching is the only effective way to mitigate the risk of command injection.