---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical click-through XSS attack that can lead to unauthorized JavaScript execution via malicious SVG files.

Vulnerability Details

CVE-ID: CVE-2026-32940

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup without escaping. The sanitization process misses certain XML MIME types, allowing an unauthenticated attacker to craft a URL that, when clicked by a victim, executes JavaScript within the context of the application.

Business Impact

A successful Cross-Site Scripting (XSS) attack can allow an attacker to steal session cookies, perform actions on behalf of the user, or deface the application. Although it requires a "click-through," the high CVSS score of 9.3 highlights the significant risk to user data and the potential for session hijacking in a knowledge-heavy environment.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later to implement the corrected SVG sanitization logic and input escaping.

Proactive Monitoring: Inspect application logs for unusual parameters being passed to the dynamic icon API and monitor for reports of suspicious links within the SiYuan community.

Compensating Controls: Implement a strong Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of objects from untrusted origins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability is technically detailed, suggesting that proof-of-concept exploits could be developed quickly.

Analyst Recommendation

The risk of XSS in a productivity tool like SiYuan is substantial. Users should update to version 3.6.1 immediately. Until the patch is applied, users should be warned against clicking on unknown links that point to their SiYuan instance's dynamic icon API.

---METADATA---
VENDOR: TP-Link
PRODUCT: Range Extenders
AFFECTED_VERSIONS: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more
---END_METADATA---

Description Summary:
An authentication logic vulnerability in TP-Link range extenders allows unauthenticated attackers on an adjacent network to reset administrator passwords.

Executive Summary:
A critical authentication logic vulnerability in various TP-Link range extenders allows unauthenticated attackers to hijack administrative control over affected devices.

Vulnerability Details

CVE-ID: CVE-2026-3294

Affected Software: TP-Link Range Extenders

Affected Versions: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more

Vulnerability: This is an authentication logic vulnerability (CWE-20) where insufficient validation allows an unauthenticated attacker on an adjacent network to manipulate login parameters. Successful exploitation results in an unauthorized administrator password reset, granting the attacker full control over the device.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant security risk. Successful exploitation allows an attacker to gain full administrative access to range extenders, potentially enabling them to intercept network traffic, modify DNS settings, or pivot into the internal network, leading to severe data compromise and loss of network integrity.

Remediation Plan

Immediate Action: Update the affected TP-Link range extenders to the latest firmware version provided by the vendor.

Proactive Monitoring: Review device access logs for unusual login attempts or unauthorized password reset events.

Compensating Controls: Restrict access to the management interface of the range extenders to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for an unauthenticated attacker to gain full control, immediate attention is required. Administrators should verify their specific device models against the vendor's advisory and apply the latest firmware updates as soon as they become available to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.

Executive Summary:
SiYuan knowledge management systems are vulnerable to sensitive file exfiltration, allowing attackers to copy and read local files via crafted HTML content.

Vulnerability Details

CVE-ID: CVE-2026-32938

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/lute/html2BlockDOM endpoint fails to validate file:// links in pasted HTML against a sensitive-path list. An attacker can trick the system into copying local files into the assets directory, which can then be accessed by an authenticated visitor via the GET /assets/*path endpoint.

Business Impact

The impact of this vulnerability is critical, as it allows for the unauthorized exfiltration of sensitive system files, including configuration files and personal data. With a CVSS score of 9.9, the risk to data confidentiality is extreme. Organizations or individuals using SiYuan for sensitive knowledge management could face significant data breaches and loss of privacy.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Review the workspace assets directory for any unexpected files that may have been copied from sensitive local system paths.

Compensating Controls: Restrict access to the SiYuan web interface and disable the ability to paste HTML from untrusted sources until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the technical details provided in the disclosure make it relatively straightforward for an attacker to craft an exploit.

Analyst Recommendation

The high CVSS score of 9.9 necessitates an immediate update to version 3.6.1. Users should be cautioned against pasting content from untrusted sources into the application until the update is confirmed. Prioritize the protection of the host machine's filesystem by applying the fix now.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.12
---END_METADATA---

Description Summary:
An authorization bypass in OpenClaw's Feishu integration misclassifies group chat reaction events as private conversations, allowing attackers to circumvent group security protections.

Executive Summary:
OpenClaw versions prior to 2026.3.12 contain a critical authorization bypass vulnerability that allows attackers to circumvent group-specific security controls by misclassifying chat types.

Vulnerability Details

CVE-ID: CVE-2026-32924

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.12

Vulnerability: The vulnerability occurs when Feishu reaction events omit the chat_type field, leading OpenClaw to misclassify them as peer-to-peer (p2p) conversations. Attackers can exploit this logic error to bypass groupAllowFrom and requireMention protections that are only enforced for group chats.

Business Impact

By bypassing group-specific authorization, an attacker can interact with the agent in ways that should be restricted, potentially leading to unauthorized information disclosure or command execution within a group context. The CVSS score of 9.8 reflects the high severity of bypassing these fundamental security boundaries.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.12 or later to ensure that reaction events are correctly classified and security policies are strictly enforced.

Proactive Monitoring: Review Feishu integration logs for reaction events missing chat_type and audit agent interactions that may have bypassed group restrictions.

Compensating Controls: Implement secondary validation layers for sensitive agent commands that require explicit user confirmation regardless of the chat type.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation. The logic flaw is specific to the Feishu reaction event handling but represents a significant bypass of the intended authorization model.

Analyst Recommendation

Authorization bypasses involving message classification can lead to subtle but dangerous security failures. Organizations using OpenClaw with Feishu must apply the 2026.3.12 update immediately to ensure all security protections are active across all chat types.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.11
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in OpenClaw's token rotation mechanism allows users with limited pairing scopes to mint high-privilege administrative tokens and achieve remote code execution.

Executive Summary:
OpenClaw versions prior to 2026.3.11 contain a critical privilege escalation flaw that allows authenticated attackers to gain administrative control and execute remote code on connected nodes.

Vulnerability Details

CVE-ID: CVE-2026-32922

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.11

Vulnerability: The device.token.rotate function fails to properly constrain newly minted scopes to the caller's existing permissions. This allows an authenticated attacker with operator.pairing scope to escalate their privileges to operator.admin, subsequently enabling remote code execution via the system.run function.

Business Impact

This vulnerability poses a severe risk to organizational security, as it allows a low-privileged user to seize full control of the OpenClaw gateway and connected nodes. The CVSS score of 9.9 reflects the high impact on system integrity and the potential for complete unauthorized access to sensitive operational environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.11 or later to ensure that token rotation strictly adheres to scope constraints.

Proactive Monitoring: Audit all recently minted tokens and review audit logs for any instances of operator.pairing users successfully invoking administrative functions or the system.run command.

Compensating Controls: Implement strict identity and access management (IAM) policies and utilize a least-privilege model to limit the number of users with pairing capabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation of this vulnerability. The technical complexity is low for an authenticated user, making the likelihood of exploitation significant once the vulnerability is known.

Analyst Recommendation

This privilege escalation vulnerability is a critical threat to the OpenClaw ecosystem. Administrators must apply the latest security patches immediately to prevent attackers from bypassing authorization controls and gaining full remote code execution capabilities across the network.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.13
---END_METADATA---

Description Summary:
OpenClaw contains a remote command injection vulnerability in the iMessage attachment staging flow. Unsanitized SCP paths allow attackers to execute commands on remote hosts.

Executive Summary:
Attackers can execute arbitrary commands on remote servers configured with OpenClaw by sending a malicious iMessage attachment, leading to full remote system compromise.

Vulnerability Details

CVE-ID: CVE-2026-32917

Affected Software: OpenClaw

Affected Versions: Before 2026.3.13

Vulnerability: A remote command injection vulnerability exists in the iMessage attachment staging flow. Unsanitized attachment paths containing shell metacharacters are passed directly to an SCP command. An unauthenticated attacker can craft a path that executes arbitrary commands on the remote host when attachment staging is enabled.

Business Impact

This vulnerability allows for the complete takeover of servers used for iMessage staging. Attackers can gain persistent access, exfiltrate private messages, and move laterally to other systems in the network. The CVSS score of 9.8 reflects the high severity of unauthenticated remote command execution on critical communication infrastructure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.13 or later immediately. If patching is not possible, disable the remote attachment staging feature.

Proactive Monitoring: Monitor remote hosts for suspicious scp or ssh processes and inspect system logs for unusual file paths containing shell characters like ;, &, or |.

Compensating Controls: Implement strict SSH key management and limit the commands that the OpenClaw user can execute on remote hosts using rssh or similar restricted shell environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. The vulnerability is highly critical because it can be triggered remotely through the standard iMessage flow.

Analyst Recommendation

Command injection via SCP operands is a well-understood but devastating flaw. Organizations relying on OpenClaw for message staging must prioritize the update to version 2026.3.13. Until the patch is applied, the remote staging feature should be considered unsafe and disabled.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.7 before 2026.3.11
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.3.11 contain an unauthenticated authorization bypass allowing remote attackers to execute privileged gateway actions via synthetic operator clients.

Executive Summary:
A critical authorization bypass in OpenClaw allows unauthenticated remote attackers to perform administrative actions, including session deletion and agent execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32916

Affected Software: OpenClaw

Affected Versions: 2026.3.7 before 2026.3.11

Vulnerability: This flaw involves an authorization bypass within plugin subagent routes that utilize a synthetic operator client with excessive administrative scopes. Remote unauthenticated attackers can target these routes to invoke runtime methods and perform privileged actions without valid credentials.

Business Impact

A successful exploit allows an external actor to gain administrative control over gateway functions, leading to unauthorized session termination or malicious agent execution. Given the CVSS score of 9.4, this vulnerability represents a critical threat that could result in total system compromise, data loss, and significant operational downtime. The ability for unauthenticated users to bypass security controls necessitates immediate remediation.

Remediation Plan

Immediate Action: Administrators must upgrade OpenClaw to version 2026.3.11 or later immediately to patch the vulnerable subagent routing logic.

Proactive Monitoring: Security teams should review gateway access logs for unusual requests to plugin-owned routes and monitor for unauthorized agent execution or unexpected session terminations.

Compensating Controls: Implementing strict IP whitelisting for gateway access and deploying a Web Application Firewall (WAF) to filter suspicious runtime method calls can provide temporary protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the unauthenticated access vector, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this authorization bypass cannot be overstated, as it grants administrative-level access to unauthenticated remote users. Organizations using affected versions of OpenClaw must prioritize the application of the official vendor patch immediately. Failure to update leaves the infrastructure vulnerable to complete takeover and persistent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.7
---END_METADATA---

Description Summary:
OpenClaw fails to properly validate headers during cross-origin redirects, leading to the leakage of sensitive authorization headers like API keys to untrusted destinations.

Executive Summary:
A critical header validation vulnerability in OpenClaw allows attackers to intercept sensitive API keys and authorization tokens by triggering cross-origin redirects.

Vulnerability Details

CVE-ID: CVE-2026-32913

Affected Software: OpenClaw

Affected Versions: Before 2026.3.7

Vulnerability: The fetchWithSsrFGuard function contains an improper header validation flaw. When a request is redirected to a different origin, the system fails to strip sensitive custom headers (e.g., X-Api-Key, Private-Token), forwarding them to the new, potentially malicious destination.

Business Impact

The leakage of administrative API keys and private tokens can lead to full account takeover and unauthorized access to the OpenClaw environment. Attackers can intercept these credentials by inducing a redirect to a server they control. With a CVSS score of 9.3, this vulnerability represents a critical risk to the confidentiality of system credentials and integrated third-party services.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.7 or later to ensure that sensitive headers are properly stripped during cross-origin redirects.

Proactive Monitoring: Review logs for unusual outbound requests or redirects to unknown domains, especially those initiated by automated processes or internal fetch functions.

Compensating Controls: Rotate all API keys and private tokens that may have been exposed through cross-origin requests prior to the patch application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. This type of vulnerability is often exploited in complex attack chains involving user-generated content or open redirects.

Analyst Recommendation

The exposure of authentication secrets is a critical security failure. It is imperative to update OpenClaw to the patched version immediately. Furthermore, security teams should treat any existing API keys as potentially compromised and perform a full credential rotation after the update is complete.

---METADATA---
VENDOR: Chamilo
PRODUCT: Chamilo LMS
AFFECTED_VERSIONS: Prior to 1.11.38 and 2.0.0-RC.3
---END_METADATA---

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in its file move function, allowing authenticated users to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code with web server privileges, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32892

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is an OS Command Injection vulnerability within the move() function in fileManage.lib.php. The application fails to properly sanitize user-supplied input before passing it to shell commands, enabling any authenticated user with teacher-level access to achieve remote code execution.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands as the www-data user, leading to potential full system compromise, data exfiltration, and unauthorized modification of learning materials. With a CVSS score of 9.1, this vulnerability represents a critical threat to the confidentiality and availability of the LMS platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later to incorporate the necessary input sanitization.

Proactive Monitoring: Review web server access logs for anomalous mv or shell-related command patterns and monitor for unexpected process creation by the www-data service account.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block requests containing shell metacharacters in file path parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which allows direct OS command execution—the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their Chamilo LMS instances and restrict course creation permissions to trusted users until the update is applied to mitigate the risk of unauthorized system-level access.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector, allowing for full administrative session takeover and service-wide credential theft.

Executive Summary:
A critical stored XSS vulnerability in Anchorr’s Jellyseerr integration allows attackers to forge administrative session tokens and gain full control over the bot and all linked media services.

Vulnerability Details

CVE-ID: CVE-2026-32891

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: Malicious JavaScript can be injected via the Jellyseerr user selector. When an administrator views the dashboard, the script executes, calls the authenticated /api/config endpoint, and exfiltrates session tokens and API keys. This allows an attacker with a Jellyseerr account to escalate to full administrator status.

Business Impact

This vulnerability results in a total compromise of the Anchorr ecosystem. By hijacking an admin session, attackers gain access to the dashboard and all integrated services, including Jellyfin, Jellyseerr, and Discord. The exposure of API keys allows for simultaneous account takeovers across multiple platforms, leading to extensive data exposure and unauthorized infrastructure control. The CVSS score of 9.0 underscores the high severity.

Remediation Plan

Immediate Action: Update Anchorr to version 1.4.2 immediately to remediate the XSS flaw and secure the administrative configuration data.

Proactive Monitoring: Audit Jellyseerr user accounts for suspicious names or profiles and monitor Anchorr admin logs for session activity originating from unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block XSS payloads and restrict access to the Anchorr dashboard to a management VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the potential for chained attacks leading to a full service-wide takeover makes this a high-risk vulnerability.

Analyst Recommendation

Applying the 1.4.2 update is the only effective way to mitigate this risk. Given that this vulnerability allows for administrative session forgery, administrators should also invalidate all current sessions and rotate all API keys for integrated services (Discord, Jellyfin, Jellyseerr) immediately after patching.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below suffer from a stored XSS vulnerability in the User Mapping dropdown, enabling unauthenticated attackers to exfiltrate critical secrets and API keys.

Executive Summary:
A critical stored Cross-Site Scripting (XSS) vulnerability in Anchorr allows attackers to exfiltrate sensitive credentials, including Discord tokens and API keys, by targeting an administrator's browser.

Vulnerability Details

CVE-ID: CVE-2026-32890

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: The web dashboard's User Mapping dropdown fails to sanitize input, allowing any Discord user in a configured guild to inject malicious JavaScript. This script executes in the admin's session to exfiltrate plaintext secrets from the /api/config endpoint without requiring direct authentication to the bot.

Business Impact

The impact is severe, as the vulnerability facilitates the theft of critical secrets like DISCORD_TOKEN, JELLYFIN_API_KEY, and JWT_SECRET. This leads to a total compromise of the bot and all integrated media services, potentially exposing user data and allowing unauthorized access to the underlying media server infrastructure. The CVSS score of 9.6 highlights the extreme risk of credential exfiltration.

Remediation Plan

Immediate Action: Update the Anchorr bot to version 1.4.2 immediately to patch the XSS vulnerability and secure the configuration endpoint.

Proactive Monitoring: Monitor Discord guild activity for suspicious user mapping requests and review web server logs for unauthorized access to the /api/config endpoint.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict where scripts can be executed and where data can be exfiltrated, reducing the effectiveness of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit can be triggered by any member of a Discord guild and results in full credential theft, it is a high-priority target for attackers.

Analyst Recommendation

Organizations utilizing Anchorr must treat this as a critical priority due to the plaintext exposure of API keys and tokens. Immediate application of version 1.4.2 is required. Following the update, it is strongly recommended to rotate all potentially exposed secrets, including Discord tokens and media server API keys.

---METADATA---
VENDOR: libheif
PRODUCT: libheif
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the libheif library, which is used for decoding and encoding HEIF and AVIF image formats.

Executive Summary:
A high-severity vulnerability in the libheif media processing library poses a risk of remote code execution or system instability when processing malicious image files.

Vulnerability Details

CVE-ID: CVE-2026-32882

Affected Software: libheif libheif

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are missing, vulnerabilities in media processing libraries like libheif typically involve buffer overflows or memory safety issues when parsing malformed HEIF or AVIF files. This usually allows an unauthenticated attacker to trigger a crash or execute code by providing a malicious image file.

Business Impact

With a CVSS score of 7.1, this vulnerability represents a significant risk to any application or system that processes user-uploaded image files. Successful exploitation could lead to application-level denial of service or unauthorized code execution within the context of the service processing the image.

Remediation Plan

Immediate Action: Update the libheif library to the latest version provided by the maintainers or via the OS package manager.

Proactive Monitoring: Monitor application logs for segmentation faults or abnormal memory usage patterns during image processing.

Compensating Controls: Use sandboxing or containerization for all image processing tasks to isolate the library from the underlying host system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations handling user-submitted media must prioritize this update. Given that library vulnerabilities are often exploited via malformed file uploads, ensuring that all dependencies are patched is critical to maintaining a secure perimeter.

---METADATA---
VENDOR: OPEXUS
PRODUCT: eComplaint and eCASE
AFFECTED_VERSIONS: Versions before 10.1.0.0
---END_METADATA---

Description Summary:
OPEXUS eComplaint and eCASE expose secret verification codes in HTTP responses during password resets. Attackers can use this to hijack accounts and reset security questions without authorization.

Executive Summary:
A critical information disclosure vulnerability in OPEXUS eComplaint and eCASE allows unauthenticated attackers to hijack user accounts by intercepting password reset verification codes.

Vulnerability Details

CVE-ID: CVE-2026-32865

Affected Software: OPEXUS eComplaint and eCASE

Affected Versions: Versions before 10.1.0.0

Vulnerability: The application incorrectly includes the secret password reset verification code within the HTTP response when the ForcePasswordReset.aspx page is requested. An unauthenticated attacker who knows a target's email address can trigger a reset and retrieve the code from the response to gain full account access.

Business Impact

The CVSS score of 9.8 indicates a critical risk to organizational data and user privacy. Successful exploitation allows for complete account takeover, enabling attackers to access sensitive complaint data or case files. Furthermore, because the attacker can reset security questions, the original user may be permanently locked out of their account, leading to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Upgrade OPEXUS eComplaint and eCASE to version 10.1.0.0 or later to ensure verification codes are no longer exposed in responses.

Proactive Monitoring: Audit application logs for an unusual volume of password reset requests originating from a single IP address or targeting multiple users.

Compensating Controls: Implement rate limiting on the password reset endpoint and ensure that all web traffic is inspected for sensitive tokens being leaked in outbound HTTP bodies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. The logic flaw is straightforward to exploit, making it a highly attractive target for malicious actors once the vulnerability details are known.

Analyst Recommendation

Organizations using OPEXUS eComplaint or eCASE must apply the version 10.1.0.0 update immediately. Because this flaw allows for unauthenticated account takeover, it poses a direct threat to the confidentiality of sensitive case management data.

---METADATA---
VENDOR: Cudy
PRODUCT: LT300
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the Cudy LT300 router, potentially allowing unauthorized system access.

Executive Summary:
The Cudy LT300 router contains a high-severity security flaw that poses a significant risk of unauthorized system compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-32833

Affected Software: Cudy LT300

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Cudy LT300 router, potentially allowing an attacker to bypass security controls. Given the nature of router-based flaws, this typically impacts the device's management interface, likely requiring network-level access to exploit.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the network gateway, enabling attackers to intercept traffic, modify network configurations, or pivot into internal segments. With a CVSS score of 8.8, this represents a high risk to organizational data integrity and network confidentiality.

Remediation Plan

Immediate Action: Check the official Cudy support portal immediately for firmware updates and apply the latest security patches to all deployed units.

Proactive Monitoring: Monitor network traffic for unusual administrative login attempts or unauthorized modifications to router configuration settings.

Compensating Controls: Restrict access to the router’s administrative management interface to trusted internal IP addresses or a dedicated management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the LT300 as a network gateway, immediate remediation is required. Administrators should verify the current firmware version against the vendor's security advisory and prioritize patching to prevent unauthorized access to the network infrastructure.

---METADATA---
VENDOR: Admidio
PRODUCT: Admidio User Management
AFFECTED_VERSIONS: 5.0.0 through 5.0.6
---END_METADATA---

Description Summary:
Admidio versions 5.0.0 through 5.0.6 fail to validate delete permissions and CSRF tokens in the documents module, allowing unauthenticated or low-privileged users to delete files.

Executive Summary:
A critical vulnerability in Admidio's document management module allows unauthenticated or unauthorized users to permanently delete the entire document library through manipulated HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-32817

Affected Software: Admidio User Management

Affected Versions: 5.0.0 through 5.0.6

Vulnerability: The application fails to perform proper authorization checks for file and folder deletion, only verifying view-level access. Furthermore, the lack of CSRF protection allows an unauthenticated attacker to trigger deletions via simple GET requests if the module is in public mode.

Business Impact

This vulnerability poses a significant risk to data availability and business continuity. An attacker can achieve a total denial of service for the document library by wiping all files. For organizations relying on Admidio for user management and document storage, this could lead to the permanent loss of sensitive records and significant reputational damage. The CVSS score of 9.1 reflects this high impact on availability.

Remediation Plan

Immediate Action: Upgrade Admidio to version 5.0.7 immediately to introduce proper permission validation and CSRF protection for the documents module.

Proactive Monitoring: Review web server logs for suspicious GET requests targeting modules/documents-files.php with folder_delete or file_delete actions.

Compensating Controls: If immediate updates are not possible, disable the "Documents and Files" module or set documents_files_module_enabled to 0 in the application configuration.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the exploit—requiring only a basic HTTP GET request—makes it highly likely to be targeted.

Analyst Recommendation

The ability for unauthenticated users to destroy a document library is a critical security failure. Administrators must apply the version 5.0.7 patch immediately. Ensure that backups of the document library are verified and stored securely to mitigate the impact of potential data loss incidents.