---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.

Executive Summary:
A critical authorization bypass vulnerability in SiYuan allows any authenticated user, including those with restricted permissions, to execute arbitrary SQL commands and potentially compromise the entire application database.

Vulnerability Details

CVE-ID: CVE-2026-32767

Affected Software: SiYuan Knowledge Management System

Affected Versions: 3.6.0 and below

Vulnerability: This flaw exists in the /api/search/fullTextSearchBlock endpoint when the method parameter is set to 2. An authenticated attacker with "Reader" role privileges can bypass security middleware to inject raw SQL statements directly into the SQLite database.

Business Impact

A successful exploit grants an attacker full control over the application's data layer. This results in total loss of data confidentiality, integrity, and availability, as an attacker can exfiltrate, modify, or delete all stored knowledge and system tables. The CVSS score of 9.8 reflects the critical nature of this flaw, where a low-privileged user can cause catastrophic system-wide impact.

Remediation Plan

Immediate Action: Administrators must upgrade SiYuan to version 3.6.1 or later immediately to apply the necessary authorization and read-only checks to the affected endpoint.

Proactive Monitoring: Review application logs for unusual activity involving the /api/search/fullTextSearchBlock endpoint, specifically looking for SQL syntax or the use of method=2 by non-admin users.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses and consider implementing a Web Application Firewall (WAF) to filter for common SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation by any authenticated user and the critical impact on data integrity, the potential for internal or external exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it completely bypasses the application's security model. Organizations using SiYuan should prioritize the update to version 3.6.1. Failure to remediate this flaw leaves the entire knowledge base vulnerable to unauthorized manipulation or permanent deletion by any user with basic access.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: 1.8.208 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeScout versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) via unsanitized email notification templates, allowing unauthenticated attackers to execute arbitrary scripts.

Executive Summary:
A critical Stored XSS vulnerability in FreeScout allows unauthenticated attackers to conduct session hijacking and account takeover by injecting malicious payloads into email notifications.

Vulnerability Details

CVE-ID: CVE-2026-32754

Affected Software: FreeScout

Affected Versions: 1.8.208 and below

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability originating from the improper sanitization of incoming email bodies within the Laravel framework. An unauthenticated attacker can inject malicious HTML or JavaScript that executes when viewed by an agent or administrator, leading to credential theft or account takeover.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows attackers to compromise administrative accounts and gain unauthorized access to sensitive help desk communications. Given the CVSS score of 9.3, this flaw represents a critical threat to data confidentiality and integrity, potentially leading to widespread account compromise and reputational damage.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.209 or later immediately to apply the necessary output sanitization.

Proactive Monitoring: Monitor help desk email traffic for unusual patterns and review system logs for suspicious activity originating from external email addresses.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a WAF to filter common XSS payloads in incoming emails.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of exploitation, the potential for malicious activity is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the FreeScout application to version 1.8.209 to mitigate the risk of remote code execution and unauthorized account access.

---METADATA---
VENDOR: GNU
PRODUCT: inetutils (telnetd)
AFFECTED_VERSIONS: Through 2.7
---END_METADATA---

Description Summary:
GNU inetutils telnetd through version 2.7 contains an out-of-bounds write vulnerability in the LINEMODE SLC suboption handler due to missing buffer checks.

Executive Summary:
A critical out-of-bounds write in the GNU telnet daemon allows remote attackers to potentially execute arbitrary code or cause a denial of service on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-32746

Affected Software: GNU inetutils (telnetd)

Affected Versions: Through 2.7

Vulnerability: The add_slc function in the telnet daemon does not verify if the internal buffer is full before writing data during the Set Local Characters (SLC) negotiation. This allows a remote, unauthenticated attacker to overflow the buffer and overwrite adjacent memory locations.

Business Impact

Because telnetd often runs with elevated privileges, an out-of-bounds write can lead to full system compromise. The CVSS score of 9.8 indicates a high degree of exploitability and impact. Successful exploitation could result in unauthorized access to legacy systems, data theft, or persistent presence within the network environment.

Remediation Plan

Immediate Action: Disable the telnet service immediately and migrate to secure alternatives like SSH. If telnet must be used, apply the latest security patches from the GNU project.

Proactive Monitoring: Audit system logs for crashes in the telnetd process and monitor network traffic for unusual telnet negotiation sequences.

Compensating Controls: Use network isolation or VPNs to restrict telnet access to trusted administrative hosts only, and employ an Intrusion Detection System (IDS) to flag malformed telnet packets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in core networking utilities like inetutils are frequently targeted once disclosed.

Analyst Recommendation

The use of telnet is generally discouraged due to its lack of encryption. This vulnerability provides a critical reason to finally decommission any remaining telnet infrastructure. If decommissioning is not possible, the GNU inetutils package must be updated to a patched version immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in libheif due to improper memory handling, potentially allowing arbitrary code execution via a specially crafted HEIF or AVIF file.

Executive Summary:
A heap-based buffer overflow in the libheif library exposes systems to potential remote code execution through malicious image file processing.

Vulnerability Details

CVE-ID: CVE-2026-32741

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the decoding of HEIF/AVIF image formats. The flaw can be triggered by an unauthenticated user providing a maliciously crafted image file to an application utilizing the affected library.

Business Impact

The exploitation of this vulnerability could lead to arbitrary code execution, resulting in full system compromise, loss of data confidentiality, and potential service disruption. With a CVSS score of 7.1, this represents a significant risk to any environment that relies on libheif for image processing, as attackers may leverage this to gain unauthorized access to underlying host systems.

Remediation Plan

Immediate Action: Update the libheif library to version 1.22.0 or later immediately to incorporate the necessary memory safety patches.

Proactive Monitoring: Monitor system logs for unexpected crashes or errors in applications that handle HEIF or AVIF image files, which may indicate exploitation attempts.

Compensating Controls: Implement file-type validation and sandboxing for image processing services to isolate potential memory corruption events from the broader system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability in the wild. However, given the nature of memory corruption flaws, the potential for exploitation is high, and immediate patching is strongly recommended.

Analyst Recommendation

Given the severity of heap-based buffer overflows, organizations should prioritize updating all instances of libheif. Failure to patch allows a vector for remote code execution, which could be catastrophic if the library is integrated into public-facing web services or media processing pipelines.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in libheif allows attackers to perform memory corruption, potentially leading to system instability or arbitrary code execution via malicious image files.

Executive Summary:
An out-of-bounds write vulnerability in libheif poses a severe risk of memory corruption and potential system compromise when processing malformed HEIF/AVIF files.

Vulnerability Details

CVE-ID: CVE-2026-32740

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability involves an out-of-bounds write (CWE-787) within the libheif decoder. An unauthenticated attacker can exploit this by submitting a specially crafted image file, causing the application to write data outside of intended memory boundaries.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of total system impact. Successful exploitation could allow an attacker to overwrite critical memory, leading to privilege escalation or unauthorized code execution, which may result in severe operational downtime and data breaches.

Remediation Plan

Immediate Action: Upgrade to libheif version 1.22.0 or later to remediate the out-of-bounds write defect.

Proactive Monitoring: Review application performance metrics and error logs for signs of memory exhaustion or segmentation faults that could indicate an attempt to trigger this write-related flaw.

Compensating Controls: Utilize memory-safe execution environments or restrict file processing to low-privilege service accounts to limit the blast radius of a potential exploitation event.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical impact is rated as total, necessitating urgent attention from security teams.

Analyst Recommendation

The high CVSS score reflects the dangerous nature of out-of-bounds write vulnerabilities. Security teams must ensure all software dependencies using libheif are identified and patched to version 1.22.0 immediately to prevent unauthorized memory manipulation and potential system takeover.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: @apostrophecms/import-export
AFFECTED_VERSIONS: Prior to version 3.5.3
---END_METADATA---

Description Summary:
A "Zip Slip" path traversal vulnerability in the ApostropheCMS import-export module allows authenticated users with content modification permissions to write arbitrary files to the host filesystem.

Executive Summary:
A critical Zip Slip vulnerability in ApostropheCMS allows authenticated editors to overwrite system files and achieve remote code execution by uploading malicious archives.

Vulnerability Details

CVE-ID: CVE-2026-32731

Affected Software: ApostropheCMS @apostrophecms/import-export

Affected Versions: Prior to version 3.5.3

Vulnerability: The extract() function in gzip.js uses path.join() without sanitizing ../ segments in tar entry names. This allows an authenticated user with "Global Content Modify" permissions to upload a .tar.gz file that writes content to any path accessible by the Node.js process.

Business Impact

This vulnerability is assigned a CVSS score of 9.9. While it requires authentication, the "Global Content Modify" role is commonly held by many staff members. A successful exploit allows for host-level code execution, permanent data loss via file overwriting, and full server compromise, leading to total operational disruption.

Remediation Plan

Immediate Action: Update the @apostrophecms/import-export package to version 3.5.3 or higher immediately.

Proactive Monitoring: Review CMS upload logs for .tar.gz files and audit the filesystem for any unexpected files created in system directories or application source folders.

Compensating Controls: Ensure the Node.js process runs with the least possible filesystem privileges and implement a WAF to inspect archive contents if possible, though patching is the only reliable fix.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. Zip Slip is a well-documented vulnerability class, making this an easy target for malicious insiders or compromised editor accounts.

Analyst Recommendation

Given the CVSS score of 9.9, this is the most critical vulnerability in this batch. Organizations must update their ApostropheCMS dependencies immediately to prevent a catastrophic compromise of the host environment.

---METADATA---
VENDOR: SciTokens
PRODUCT: SciTokens (Python library)
AFFECTED_VERSIONS: Prior to version 1.9.6
---END_METADATA---

Description Summary:
SciTokens is vulnerable to SQL Injection in its KeyCache class due to the unsafe use of Python's str.format() for query construction, allowing attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in the SciTokens library allows unauthenticated attackers to execute arbitrary database commands, potentially leading to a full compromise of the local SQLite database.

Vulnerability Details

CVE-ID: CVE-2026-32714

Affected Software: SciTokens SciTokens (Python library)

Affected Versions: Prior to version 1.9.6

Vulnerability: The KeyCache class within the SciTokens library fails to properly sanitize user-supplied data, specifically the issuer and key_id fields. By using Python's str.format() to build SQL queries, the application enables an attacker to inject malicious SQL syntax into the local SQLite database environment.

Business Impact

A successful exploit of this vulnerability could result in unauthorized data exfiltration, modification, or deletion within the local database. Given the library's role in security token management, this flaw could compromise the integrity of the entire authentication and authorization framework. The CVSS score of 9.8 reflects the high potential for total loss of confidentiality and integrity without requiring high privileges.

Remediation Plan

Immediate Action: Update the SciTokens Python library to version 1.9.6 or later immediately to replace the vulnerable query construction logic with parameterized queries.

Proactive Monitoring: Review application logs for unusual characters or SQL syntax within token-related requests and monitor for unexpected changes to the local SQLite database files.

Compensating Controls: Implement input validation at the application layer to restrict issuer and key_id strings to expected alphanumeric patterns before they reach the library.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical role of SciTokens in identity management, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to any application utilizing the SciTokens library for security assertions. Organizations should prioritize the update to version 1.9.6 immediately to mitigate the risk of SQL injection. Failure to patch may allow attackers to bypass security controls by manipulating the underlying token cache.

---METADATA---
VENDOR: OpenProject
PRODUCT: OpenProject
AFFECTED_VERSIONS: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1
---END_METADATA---

Description Summary:
The OpenProject Repositories module is vulnerable to a persisted Cross-Site Scripting (XSS) attack due to improper sanitation of filenames within repository commits.

Executive Summary:
A critical persisted XSS vulnerability in OpenProject allows attackers with repository push access to execute malicious scripts in the browsers of project members.

Vulnerability Details

CVE-ID: CVE-2026-32703

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: The Repositories module fails to properly escape filenames when displaying changesets. An attacker with push access can create a commit containing a filename with malicious HTML/JavaScript, which executes when other project members view the repository's changeset page.

Business Impact

A successful persisted XSS attack can lead to session hijacking, unauthorized actions performed on behalf of project members, and the theft of sensitive project data. Given the CVSS score of 9.0, the risk is severe as it can target high-privilege users, potentially leading to a broader compromise of the OpenProject instance and the data it contains.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 to ensure that filenames are correctly sanitized before being rendered in the web interface.

Proactive Monitoring: Audit repository commit histories for filenames containing suspicious characters, such as <script> tags or unusual HTML entities.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external scripts, providing a secondary layer of defense against XSS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for push access limits the attacker pool to those who already have some level of trust within a project.

Analyst Recommendation

While this vulnerability requires push access, the potential for session hijacking of administrators makes it a critical priority. Organizations should apply the recommended security updates immediately to protect their users from targeted browser-based attacks.

---METADATA---
VENDOR: Builder.io
PRODUCT: Qwik
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Qwik JavaScript framework poses a high risk to web applications, potentially allowing for unauthorized client-side or server-side interactions.

Executive Summary:
A high-severity vulnerability in the Qwik framework could allow attackers to compromise web application performance and user data integrity.

Vulnerability Details

CVE-ID: CVE-2026-32701

Affected Software: Builder.io Qwik

Affected Versions: See vendor advisory for affected versions

Vulnerability: Qwik is affected by a security flaw within its performance-focused rendering or state management logic. The CVSS score of 7.5 indicates that an attacker could potentially exploit this flaw to execute unauthorized actions, though the specific authentication requirements depend on the framework's implementation in a given application.

Business Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS), session hijacking, or the manipulation of application state, resulting in significant reputational damage and loss of user trust. With a CVSS score of 7.5, the risk to web-facing assets is substantial, particularly for organizations relying on Qwik for high-traffic production sites.

Remediation Plan

Immediate Action: Update the Qwik framework to the latest patched version through your package manager (e.g., npm, yarn) immediately.

Proactive Monitoring: Monitor web application firewall (WAF) logs for suspicious patterns targeting framework-specific endpoints or unusual client-side state transitions.

Compensating Controls: Implement a robust Content Security Policy (CSP) to mitigate the impact of potential injection attacks enabled by this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in modern JavaScript frameworks are often targeted quickly once a patch is released.

Analyst Recommendation

We recommend an immediate audit of all projects utilizing the Qwik framework and the application of the latest security patches. Developers should prioritize this update to maintain the security posture of their web applications and protect end-user data.

---METADATA---
VENDOR: OpenProject
PRODUCT: OpenProject
AFFECTED_VERSIONS: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1
---END_METADATA---

Description Summary:
OpenProject is vulnerable to an SQL injection via custom field names, which can be leveraged to manipulate git checkout paths and achieve arbitrary Ruby code execution upon application restart.

Executive Summary:
A critical SQL injection and path traversal chain in OpenProject allows authenticated administrators to escalate privileges and execute arbitrary Ruby code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-32698

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: This vulnerability involves an SQL injection within the Cost Report generation feature via unsanitized custom field names. While the initial vector requires administrator privileges, it can be chained with a repository module flaw to write a git repository to an arbitrary path, leading to remote code execution (RCE).

Business Impact

A successful exploit allows for the complete compromise of the OpenProject application and the underlying server infrastructure. Given the CVSS score of 9.1, the risk is critical as it enables attackers to execute arbitrary code, potentially leading to the theft of sensitive project data, intellectual property, and total system downtime. The ability to inject Ruby code signifies a total loss of integrity and confidentiality for the affected environment.

Remediation Plan

Immediate Action: Administrators must immediately upgrade OpenProject installations to versions 16.6.9, 17.0.6, 17.1.3, 17.2.1, or later to patch the underlying injection vulnerabilities.

Proactive Monitoring: Monitor application logs for unusual SQL syntax in Cost Report queries and inspect the filesystem for unauthorized git repository checkouts in non-standard directories.

Compensating Controls: Restrict administrative access to trusted personnel only and implement strict network-level egress filtering to prevent the server from connecting to malicious external git repositories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the potential for full system compromise through RCE, the potential for exploitation is high once the technical details are reverse-engineered.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path from application-level access to host-level code execution. Organizations using OpenProject should prioritize the application of the vendor-provided patches immediately to mitigate the risk of a full-scale server breach.

---METADATA---
VENDOR: Automated Logic
PRODUCT: WebCTRL
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
WebCTRL systems using the BACnet protocol are vulnerable to unauthorized access due to a lack of network-layer authentication inherent in the protocol.

Executive Summary:
WebCTRL building automation systems are at risk of unauthorized control and manipulation because the BACnet protocol lacks essential network-layer authentication.

Vulnerability Details

CVE-ID: CVE-2026-32666

Affected Software: Automated Logic WebCTRL

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: WebCTRL systems inherit a significant security weakness from the BACnet protocol, which does not require authentication at the network layer. An unauthenticated attacker with network access to the BACnet broadcast domain can send spoofed or unauthorized commands to building controllers.

Business Impact

Exploitation of this vulnerability could allow an attacker to take control of critical building systems, including HVAC, lighting, and physical access controls. This poses a direct threat to physical security, operational continuity, and occupant safety. The CVSS score of 7.5 reflects the high impact on availability and integrity within industrial and building control environments.

Remediation Plan

Immediate Action: Isolate BACnet traffic to a dedicated, secure VLAN and apply all available vendor security patches for WebCTRL and associated hardware.

Proactive Monitoring: Use Industrial Control System (ICS) monitoring tools to detect unauthorized BACnet read/write requests or anomalous traffic patterns on the building automation network.

Compensating Controls: Implement BACnet/SC (Secure Connect) where supported or utilize hardware-based VPNs and firewalls to encapsulate and authenticate BACnet traffic between segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of authentication in legacy BACnet is a well-known issue frequently targeted in ICS-specific research and attacks.

Analyst Recommendation

The risk to building operations is severe; therefore, organizations must move beyond relying on the inherent insecurity of the BACnet protocol. Immediate network segmentation is required to prevent unauthenticated access. We strongly recommend transitioning to BACnet/SC or implementing robust compensating network security measures to ensure that only authorized administrative workstations can communicate with WebCTRL controllers.

---METADATA---
VENDOR: SOLAS (formerly Transware)
PRODUCT: GUARDIANWALL MailSuite/Mail Security Cloud
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in GUARDIANWALL MailSuite and Mail Security Cloud, potentially allowing arbitrary code execution.

Executive Summary:
A critical stack-based buffer overflow in GUARDIANWALL email security products allows remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-32661

Affected Software: GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a stack-based buffer overflow in the web service. It can be triggered by a remote, unauthenticated attacker sending a crafted request, leading to code execution under the context of the grdnwww user.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe risk to organizational email security. Successful exploitation could lead to full compromise of the email appliance, enabling the interception of sensitive communications, internal network reconnaissance, and persistent malware deployment.

Remediation Plan

Immediate Action: Check the official vendor advisory for the latest security patch and apply it immediately to all vulnerable GUARDIANWALL instances.

Proactive Monitoring: Monitor network traffic for malformed or unusually large requests directed at the GUARDIANWALL web interface.

Compensating Controls: Restrict access to the GUARDIANWALL administrative and web interfaces to trusted IP addresses only, and deploy a WAF to inspect incoming traffic for buffer overflow patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this vulnerability in an email security gateway, immediate patching is required. Organizations should treat this as a high-priority remediation to prevent potential interception of confidential business communications.

---METADATA---
VENDOR: the affected software
PRODUCT: the affected software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An administrative endpoint is exposed without authentication, allowing remote attackers to access sensitive device management functions.

Executive Summary:
A high-severity authentication bypass vulnerability allows unauthenticated remote attackers to gain full administrative access to device management functions.

Vulnerability Details

CVE-ID: CVE-2026-32646

Affected Software: the affected software

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is characterized by a complete lack of authentication on a specific administrative endpoint. An unauthenticated attacker can directly access management interfaces, allowing them to modify configurations or control the device remotely.

Business Impact

Unauthorized administrative access is one of the most severe security failures possible. With a CVSS score of 7.5, the impact includes total loss of device control, potential data exfiltration, and the ability for an attacker to use the device as a foothold within the internal network.

Remediation Plan

Immediate Action: Apply the vendor security patch immediately to enforce authentication on all administrative endpoints.

Proactive Monitoring: Scan for exposed management interfaces on the network and review access logs for any unauthorized hits to administrative URLs.

Compensating Controls: Place the administrative interface behind a management VLAN or a firewall that restricts access to a limited set of trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, unauthenticated administrative access is a "low-hanging fruit" for attackers and is likely to be targeted rapidly.

Analyst Recommendation

This vulnerability represents a critical failure in security architecture. Due to the unauthenticated nature of the flaw and the CVSS score of 7.5, you must apply the patch immediately or disable the affected management interface until remediation is complete.

---METADATA---
VENDOR: Milesight
PRODUCT: AIOT Cameras
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Milesight AIOT cameras use SSL certificates with default private keys, enabling potential man-in-the-middle attacks.

Executive Summary:
Milesight AIOT cameras are vulnerable to traffic interception due to the use of hardcoded, default SSL private keys in specific firmware versions.

Vulnerability Details

CVE-ID: CVE-2026-32644

Affected Software: Milesight AIOT Cameras

Affected Versions: See vendor advisory

Vulnerability: The firmware utilizes default private keys for SSL/TLS communication, allowing an unauthenticated attacker to decrypt encrypted traffic or perform sophisticated man-in-the-middle (MitM) attacks.

Business Impact

The CVSS score of 9.8 reflects the high risk of traffic interception and unauthorized access to sensitive video feeds and administrative credentials. This flaw undermines the entire security architecture of the camera deployment, potentially leading to unauthorized surveillance or credential theft.

Remediation Plan

Immediate Action: Update camera firmware to the latest available version provided by Milesight that addresses the default key issue.

Proactive Monitoring: Review network traffic logs for anomalous SSL/TLS handshake patterns or unauthorized connection attempts to the camera management interfaces.

Compensating Controls: Isolate camera networks using VLANs and restrict access to management interfaces via a VPN or firewalled proxy.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must prioritize firmware updates for all deployed Milesight cameras. If immediate patching is not possible, segmenting these devices from the primary network is essential to mitigate the risk of interception.