---METADATA---
VENDOR: Glances
PRODUCT: Glances
AFFECTED_VERSIONS: Prior to version 4.5.2
---END_METADATA---

Description Summary:
The Glances monitoring tool exposes sensitive HTTP Basic credentials for downstream servers via an unauthenticated API endpoint when the central browser is run without a password.

Executive Summary:
An unauthenticated information disclosure vulnerability in Glances allows remote attackers to harvest reusable authentication secrets for protected downstream monitoring servers.

Vulnerability Details

CVE-ID: CVE-2026-32633

Affected Software: Glances Glances

Affected Versions: Prior to version 4.5.2

Vulnerability: The /api/4/serverslist endpoint returns raw server objects that include embedded HTTP Basic credentials in the uri field. In common internal deployments where the Glances Browser is started without the --password flag, this endpoint is completely unauthenticated.

Business Impact

The exposure of reusable credentials allows an attacker to gain unauthorized access to all downstream Glances servers within the infrastructure. With a CVSS score of 9.1, this vulnerability poses a critical risk to organizational security, as it facilitates lateral movement and provides attackers with deep visibility into system performance and configurations across the entire network.

Remediation Plan

Immediate Action: Update Glances to version 4.5.2 or higher immediately and ensure that all Glances Browser instances are configured with the --password requirement.

Proactive Monitoring: Review API access logs for unauthorized requests to the /api/4/serverslist endpoint and monitor for anomalous login activity on downstream monitoring nodes.

Compensating Controls: Implement network segmentation to ensure the Glances API is only accessible from trusted administrative subnets and use a Web Application Firewall (WAF) to block unauthenticated access to the /api/ path.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the unauthenticated nature of the disclosure makes this a highly attractive target for internal or external attackers seeking to escalate privileges.

Analyst Recommendation

This vulnerability represents a significant failure in credential handling. It is imperative that organizations update to version 4.5.2 and enforce password authentication on all monitoring interfaces to prevent the mass exposure of infrastructure credentials.

---METADATA---
VENDOR: Mintplex Labs
PRODUCT: AnythingLLM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
AnythingLLM contains a high-severity vulnerability related to how it processes content into context for Large Language Models, potentially leading to unauthorized access.

Executive Summary:
A critical vulnerability in AnythingLLM allows for the potential compromise of LLM context and system integrity, posing a severe risk to AI-integrated data workflows.

Vulnerability Details

CVE-ID: CVE-2026-32628

Affected Software: Mintplex Labs AnythingLLM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the application's core logic for transforming content into LLM context. While specific technical details are limited, it likely involves improper sanitization of inputs, which could allow an unauthenticated or low-privileged attacker to influence the LLM's behavior or access sensitive data.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as High-to-Critical. A successful exploit could lead to the exposure of private documents used as context, the injection of malicious instructions into the LLM, or broader system compromise, severely impacting the reliability and security of AI-driven business operations.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Mintplex Labs for the AnythingLLM application immediately.

Proactive Monitoring: Monitor application logs for anomalous content ingestion requests or unusual patterns in LLM interaction history.

Compensating Controls: Isolate the AnythingLLM instance within a restricted network segment and implement strict API authentication to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score reflects the significant access an attacker could gain to sensitive organizational data used in AI training and chatting.

Analyst Recommendation

The urgency for this remediation is high due to the 8.8 CVSS score. Security teams should prioritize the update of AnythingLLM instances to prevent attackers from compromising the integrity of the organization's LLM context and associated data repositories.

---METADATA---
VENDOR: AnythingLLM
PRODUCT: AnythingLLM Desktop
AFFECTED_VERSIONS: 1.11.1 and earlier
---END_METADATA---

Description Summary:
A Streaming Phase XSS in AnythingLLM Desktop's chat pipeline escalates to Remote Code Execution (RCE) on the host OS due to insecure Electron configurations and lack of sanitization.

Executive Summary:
AnythingLLM Desktop is subject to a critical vulnerability where a simple chat interaction can trigger remote code execution on the user's computer without any interaction.

Vulnerability Details

CVE-ID: CVE-2026-32626

Affected Software: AnythingLLM Desktop

Affected Versions: 1.11.1 and earlier

Vulnerability: The vulnerability stems from a failure to escape HTML entities in the custom markdown-it image renderer and the use of dangerouslySetInnerHTML without DOMPurify sanitization. This unauthenticated XSS flaw escalates to RCE because the underlying Electron framework is insecurely configured.

Business Impact

This vulnerability poses a catastrophic risk to individual workstations and corporate data. An attacker can execute arbitrary commands on the host operating system simply by sending a malicious payload through the chat interface. The CVSS score of 9.6 reflects the ease of exploitation and the total compromise of the host machine.

Remediation Plan

Immediate Action: Update AnythingLLM Desktop to the latest version (post-1.11.1) immediately to apply the necessary sanitization and Electron security hardening.

Proactive Monitoring: Review endpoint security logs for suspicious process spawning from the AnythingLLM application and inspect chat history for unusual markdown or HTML tags.

Compensating Controls: Use application control software to restrict the execution of unauthorized scripts and ensure the application is run with the least privilege necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation. However, the combination of XSS and RCE in a popular desktop application makes this a highly attractive target for attackers.

Analyst Recommendation

Immediate remediation is mandatory for all users of AnythingLLM Desktop. The transition from XSS to RCE is a critical failure point; therefore, updating to a version that implements proper DOMPurify sanitization and hardened Electron settings is the only effective way to mitigate this risk.

---METADATA---
VENDOR: Apollo
PRODUCT: Federation
AFFECTED_VERSIONS: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in Apollo Federation's query plan execution allows attackers to pollute Object.prototype, potentially leading to remote code execution or denial of service.

Executive Summary:
Apollo Federation is vulnerable to a critical prototype pollution flaw that allows malicious clients or compromised subgraphs to compromise the integrity of the entire gateway.

Vulnerability Details

CVE-ID: CVE-2026-32621

Affected Software: Apollo Federation

Affected Versions: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2

Vulnerability: A vulnerability in the gateway's query plan execution allows for the pollution of Object.prototype. This can be triggered by a malicious client using field aliases/variables or by a compromised subgraph sending malicious JSON response payloads.

Business Impact

Prototype pollution in a central gateway like Apollo Federation is a Critical risk (CVSS 9.9). It can lead to Remote Code Execution (RCE), bypass of security logic, or persistent Denial of Service (DoS) across the entire application graph. This affects the core architecture of the organization's API ecosystem.

Remediation Plan

Immediate Action: Update Apollo Federation to version 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2, or later to address the pollution flaw.

Proactive Monitoring: Audit GraphQL queries for unusual field aliasing patterns and monitor subgraph responses for unexpected JSON structures targeting prototype-inheritable properties.

Compensating Controls: Implement strict schema validation and use security libraries that freeze the Object.prototype to prevent modification at runtime.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 16, 2026, there is no public information indicating active exploitation. However, prototype pollution is a highly effective attack vector against Node.js-based environments.

Analyst Recommendation

Given the CVSS score of 9.9 and the central role Apollo Federation plays in modern API architectures, this update must be applied immediately. Security teams should coordinate with development teams to ensure all gateways and subgraphs are running the patched versions to maintain the integrity of the unified graph.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SPeL injection vulnerability in the Spinnaker Echo service allows remote attackers to execute arbitrary Java code and access system files with full JVM privileges.

Executive Summary:
Spinnaker is subject to a critical remote code execution vulnerability that allows attackers to gain full system access via insecure SPeL expression processing.

Vulnerability Details

CVE-ID: CVE-2026-32613

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The Echo service fails to restrict SPeL (Spring Expression Language) to a trusted context, allowing an authenticated or unauthenticated attacker (depending on deployment) to invoke arbitrary Java classes and execute commands on the underlying host.

Business Impact

The severity of this vulnerability is underscored by its CVSS score of 9.9, reflecting the potential for full system compromise. Successful exploitation grants attackers the ability to execute arbitrary commands, access sensitive credentials, and pivot within the infrastructure, leading to catastrophic data breaches and loss of control over the CI/CD pipeline.

Remediation Plan

Immediate Action: Upgrade Spinnaker to version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. If patching cannot be performed immediately, disable the Echo service as a temporary workaround.

Proactive Monitoring: Review system logs for unusual process execution or unauthorized file access originating from the Echo service component.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Runtime Application Self-Protection (RASP) tool to detect and block malicious expression language payloads directed at the Spinnaker services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total compromise vector. Security teams must treat this as a high-priority incident, ensuring that all Spinnaker instances are updated to the secure versions or that the vulnerable service is disabled to prevent exploitation.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in Spinnaker's clouddriver pods allows attackers to execute arbitrary commands, potentially compromising credentials and resources.

Executive Summary:
Spinnaker clouddriver pods are vulnerable to arbitrary command execution, posing a critical risk of complete environment compromise.

Vulnerability Details

CVE-ID: CVE-2026-32604

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The application fails to properly sanitize inputs, allowing an attacker to execute arbitrary commands directly on the clouddriver pods. This vulnerability facilitates the exfiltration of credentials and the modification of cloud resources managed by the platform.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely severe. Successful exploitation allows an attacker to achieve full control over the clouddriver component, leading to the compromise of cloud credentials, unauthorized manipulation of infrastructure resources, and potential lateral movement into the target cloud environment.

Remediation Plan

Immediate Action: Upgrade to Spinnaker version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. As a temporary mitigation, disable the gitrepo artifact types.

Proactive Monitoring: Monitor for unexpected command execution within container environments and watch for unusual spikes in resource usage or unexpected network connections originating from clouddriver pods.

Compensating Controls: Apply strict network policies to restrict outbound traffic from clouddriver pods and ensure that the service account permissions associated with the pods follow the principle of least privilege.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease with which arbitrary commands can be executed, this vulnerability requires immediate attention. Organizations should prioritize updating their Spinnaker environment to the patched versions to prevent unauthorized access and potential takeover of their cloud infrastructure.

---METADATA---
VENDOR: PyJWT
PRODUCT: PyJWT
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
PyJWT, a Python implementation of JSON Web Token, contains a vulnerability that could compromise token integrity or verification processes.

Executive Summary:
A high-severity vulnerability in the PyJWT library threatens the integrity of JSON Web Token (JWT) authentication, potentially allowing attackers to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-32597

Affected Software: PyJWT

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the PyJWT library's handling of token processing or verification. While specific function names are not provided, the flaw likely impacts the core authentication logic used by applications relying on this Python implementation.

Business Impact

A successful exploit could lead to unauthorized access to sensitive application features or administrative interfaces. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data breaches and identity spoofing, as JWTs are frequently used for session management and identity propagation in modern web architectures.

Remediation Plan

Immediate Action: Update the PyJWT library to the latest patched version via pip or your preferred package manager immediately.

Proactive Monitoring: Review application logs for unusual authentication patterns or failed token validation attempts that might indicate exploitation testing.

Compensating Controls: Implement strict input validation for all JWT headers and ensure that the library is configured to explicitly require secure signing algorithms (e.g., RS256).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role PyJWT plays in authentication, the potential for exploitation is high once technical details become public.

Analyst Recommendation

The high CVSS score of 7.5 underscores the urgency of this advisory. Organizations using PyJWT must prioritize updating their dependencies across all environments to mitigate the risk of authentication bypass. Failure to patch could leave applications vulnerable to sophisticated session hijacking attacks.

---METADATA---
VENDOR: Nelio Software
PRODUCT: Nelio AB Testing
AFFECTED_VERSIONS: versions up to and including 8.2.7
---END_METADATA---

Description Summary:
Nelio AB Testing plugin for WordPress contains a code injection vulnerability. This allows remote attackers to execute arbitrary code by exploiting improper control of code generation.

Executive Summary:
Nelio AB Testing versions up to 8.2.7 are susceptible to a critical code injection vulnerability that could lead to full site takeover and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-32573

Affected Software: Nelio Software Nelio AB Testing

Affected Versions: n/a through 8.2.7

Vulnerability: This flaw involves the Improper Control of Generation of Code ('Code Injection') within the Nelio AB Testing plugin. The vulnerability allows an attacker to inject and execute malicious code, potentially gaining unauthorized control over the WordPress environment.

Business Impact

A successful exploit could result in the complete compromise of the affected web server, leading to unauthorized data access, website defacement, or the installation of persistent backdoors. The CVSS score of 9.1 reflects a Critical severity level, indicating that the vulnerability poses an extreme risk to organizational data integrity and service availability.

Remediation Plan

Immediate Action: Update the Nelio AB Testing plugin to the latest available version (greater than 8.2.7) immediately to patch the injection point.

Proactive Monitoring: Review web server access logs for unusual PHP execution patterns or suspicious requests targeting plugin directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rulesets specifically designed to block common remote code execution (RCE) and code injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical CVSS score of 9.1, the potential for rapid exploit development is high.

Analyst Recommendation

The critical nature of this code injection vulnerability necessitates immediate remediation. IT administrators should prioritize updating the Nelio AB Testing plugin across all WordPress instances to prevent unauthorized system access and ensure the security of the underlying hosting infrastructure.

---METADATA---
VENDOR: UnQLite
PRODUCT: UnQLite for Perl
AFFECTED_VERSIONS: 0.06 and earlier
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
UnQLite for Perl versions 0.06 and earlier contain a heap-based buffer overflow vulnerability due to the use of an outdated embedded library.

Executive Summary:
UnQLite for Perl versions 0.06 and earlier are vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-3257

Affected Software: UnQLite UnQLite for Perl

Affected Versions: 0.06 and earlier

Vulnerability: The Perl module embeds a 2014 version of the UnQLite library that is susceptible to a heap-based buffer overflow. This vulnerability likely requires an attacker to provide malicious input that triggers the overflow during memory processing.

Business Impact

With a CVSS score of 9.8, this is a Critical vulnerability. Successful exploitation could allow for remote code execution (RCE), leading to full system compromise, loss of data confidentiality, and severe operational impact.

Remediation Plan

Immediate Action: Update the UnQLite Perl module to the latest version that utilizes a patched version of the underlying library.

Proactive Monitoring: Monitor for application crashes or abnormal memory usage patterns in the Perl environment, which may indicate attempted exploitation.

Compensating Controls: Ensure that the application is running with the principle of least privilege to minimize the potential damage if an RCE attempt is successful.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the criticality of a heap-based overflow makes this a high-priority target for threat actors.

Analyst Recommendation

This vulnerability is critical due to the potential for remote code execution. Organizations using UnQLite for Perl must treat this as an emergency update and migrate to the latest version immediately to eliminate the vulnerable library dependency.

---METADATA---
VENDOR: PublishPress
PRODUCT: PublishPress Revisions
AFFECTED_VERSIONS: From n/a through 3.7.23
---END_METADATA---

Description Summary:
PublishPress Revisions is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands. This affects versions up to 3.7.23.

Executive Summary:
PublishPress Revisions for WordPress is vulnerable to a critical Blind SQL Injection attack, which could allow attackers to extract sensitive data from the site's database.

Vulnerability Details

CVE-ID: CVE-2026-32539

Affected Software: PublishPress Revisions (WordPress Plugin)

Affected Versions: From n/a through 3.7.23

Vulnerability: The vulnerability is a Blind SQL Injection resulting from improper neutralization of user-supplied input used in SQL queries. An attacker can use specially crafted payloads to query the database indirectly, potentially identifying as an unauthenticated or low-privileged user depending on the revisionary access configuration.

Business Impact

Successful exploitation can lead to the unauthorized disclosure of sensitive information, including user credentials, site configurations, and proprietary content. SQL injection is a high-impact flaw that can lead to complete database compromise. The CVSS score of 9.3 highlights the severe risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Update the PublishPress Revisions plugin to the latest available version (greater than 3.7.23) to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing SQL keywords such as UNION, SELECT, SLEEP(), or AND/OR logic patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with generic SQL injection protection rules to block malicious payloads before they reach the WordPress application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Blind SQLi is more difficult to exploit than standard SQLi but remains a highly effective method for data exfiltration by patient attackers.

Analyst Recommendation

SQL injection remains one of the most dangerous web vulnerabilities. We recommend an immediate update to the latest version of PublishPress Revisions. Additionally, ensure that the database user for WordPress follows the principle of least privilege to limit the scope of any potential injection.

---METADATA---
VENDOR: Halfdata
PRODUCT: Green Downloads
AFFECTED_VERSIONS: From n/a through 2.08
---END_METADATA---

Description Summary:
Green Downloads allows unrestricted upload of files with dangerous types, enabling the use of malicious files. This affects versions up to 2.08.

Executive Summary:
The Green Downloads WordPress plugin is vulnerable to an unrestricted file upload flaw, allowing unauthenticated attackers to upload and execute malicious scripts on the server.

Vulnerability Details

CVE-ID: CVE-2026-32536

Affected Software: Green Downloads (WordPress Plugin)

Affected Versions: From n/a through 2.08

Vulnerability: This is an Unrestricted Upload of File with Dangerous Type vulnerability in the halfdata-paypal-green-downloads component. The plugin does not properly validate file extensions or content types, allowing an unauthenticated user to upload executable files (e.g., .php files) to the server.

Business Impact

This vulnerability directly leads to Remote Code Execution (RCE). An attacker can upload a web shell and gain full control over the website and the underlying server environment. The CVSS score of 9.9 reflects the critical nature of unauthenticated file upload vulnerabilities.

Remediation Plan

Immediate Action: Update Green Downloads to the latest version immediately. If no update is available, disable the file upload functionality or the plugin entirely.

Proactive Monitoring: Scan the plugin's download and upload directories for unexpected PHP or executable files that do not match the expected document types.

Compensating Controls: Configure the web server to disable the execution of scripts in the directory where the plugin stores uploaded files (e.g., using .htaccess or Nginx configuration).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Unrestricted file upload is a highly reliable exploitation method once a vulnerable endpoint is identified.

Analyst Recommendation

The ability to upload and execute files provides an attacker with a permanent foothold on the system. This vulnerability must be remediated immediately. Ensure that all file upload components in your environment enforce strict allow-lists for file extensions and perform server-side content validation.

---METADATA---
VENDOR: JetMonsters
PRODUCT: JetFormBuilder
AFFECTED_VERSIONS: From n/a through 3.5.6.1
---END_METADATA---

Description Summary:
JetFormBuilder is vulnerable to Code Injection due to improper control of code generation. This affects versions up to and including 3.5.6.1.

Executive Summary:
A critical code injection vulnerability in the JetFormBuilder WordPress plugin allows unauthenticated attackers to execute arbitrary code on the server, leading to a complete site takeover.

Vulnerability Details

CVE-ID: CVE-2026-32525

Affected Software: JetFormBuilder (WordPress Plugin)

Affected Versions: From n/a through 3.5.6.1

Vulnerability: The vulnerability is a Code Injection flaw within the jetformbuilder component. The plugin fails to properly sanitize inputs that are later used in the generation of executable code, allowing an unauthenticated attacker to inject and run malicious PHP scripts.

Business Impact

Successful exploitation allows for Remote Code Execution (RCE), giving the attacker the same permissions as the web server. This can lead to the theft of sensitive customer data, deployment of malware, and total loss of site availability. The CVSS score of 9.9 indicates an extreme risk level.

Remediation Plan

Immediate Action: Update JetFormBuilder to version 3.5.7 or higher immediately to patch the code injection entry points.

Proactive Monitoring: Review web logs for unusual POST requests to form-processing endpoints that contain PHP code fragments or obfuscated strings.

Compensating Controls: Implement strict file integrity monitoring (FIM) to detect any unauthorized changes to the WordPress core or plugin files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 25, 2026, there is no public information indicating active exploitation. Code injection in form builders is a common target for automated exploit kits.

Analyst Recommendation

Given the CVSS score of 9.9, this vulnerability is critical. We recommend an immediate update of the JetFormBuilder plugin. Administrators should also review their WordPress security posture to ensure that unauthenticated code execution is mitigated by layered defenses.

---METADATA---
VENDOR: flycart
PRODUCT: UpsellWP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The UpsellWP (checkout-upsell-and-order-bumps) software contains a Blind SQL Injection vulnerability caused by improper neutralization of special elements within SQL commands.

Executive Summary:
The flycart UpsellWP software is vulnerable to a High-severity Blind SQL Injection attack that could result in the unauthorized disclosure of sensitive e-commerce database content.

Vulnerability Details

CVE-ID: CVE-2026-32459

Affected Software: flycart UpsellWP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A Blind SQL Injection vulnerability exists in the checkout-upsell-and-order-bumps component of UpsellWP. The software does not correctly handle special elements in SQL commands, allowing an attacker to probe the database and extract information through inference.

Business Impact

A successful exploit could allow an attacker to access sensitive sales data, customer information, and configuration settings. Given the CVSS score of 8.5, this vulnerability presents a high risk to the confidentiality and integrity of the e-commerce environment, potentially leading to data breaches and loss of revenue.

Remediation Plan

Immediate Action: Update the UpsellWP plugin to the latest secure version immediately to patch the SQL injection vulnerability.

Proactive Monitoring: Monitor database performance for latency that might indicate time-based blind SQL injection attempts and review access logs for suspicious query strings.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious SQL input and ensure that database accounts use the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This High-severity vulnerability in UpsellWP requires immediate remediation to protect the underlying database from unauthorized access. Administrators should apply the available vendor patch as the primary defense mechanism to ensure the continued security of the e-commerce platform and its data.

---METADATA---
VENDOR: codepeople
PRODUCT: CP Contact Form with Paypal
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The CP Contact Form with Paypal (cp-contact-form-with-paypal) software is susceptible to Blind SQL Injection due to improper neutralization of special elements in SQL commands.

Executive Summary:
A High-severity Blind SQL Injection vulnerability in the codepeople CP Contact Form with Paypal plugin allows attackers to potentially access and exfiltrate sensitive database records.

Vulnerability Details

CVE-ID: CVE-2026-32433

Affected Software: codepeople CP Contact Form with Paypal

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Blind SQL Injection located in the cp-contact-form-with-paypal component. It arises from the failure to properly sanitize user inputs used in database operations, enabling attackers to execute unauthorized queries and extract data.

Business Impact

The impact of this vulnerability includes the potential exposure of contact form submissions, transaction details, and user account information. With a CVSS score of 8.5, the risk to the organization's data confidentiality is high, potentially leading to identity theft or the compromise of financial transaction records.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for CP Contact Form with Paypal immediately to eliminate the injection vulnerability.

Proactive Monitoring: Review application and database logs for any signs of automated scanning or unusual SQL syntax originating from public-facing forms.

Compensating Controls: Restrict database user permissions to the minimum necessary and utilize a Web Application Firewall (WAF) to detect and block SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a significant threat to any site utilizing the CP Contact Form with Paypal plugin. It is imperative that administrators prioritize the application of the official patch to mitigate the risk of unauthorized database interactions and ensure the security of user-submitted data.

---METADATA---
VENDOR: levelfourdevelopment
PRODUCT: WP EasyCart
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The levelfourdevelopment WP EasyCart (wp-easycart) software is vulnerable to Blind SQL Injection through improper neutralization of special elements used in SQL commands.

Executive Summary:
WP EasyCart is affected by a High-severity Blind SQL Injection vulnerability that could permit attackers to gain unauthorized access to sensitive e-commerce and customer database information.

Vulnerability Details

CVE-ID: CVE-2026-32422

Affected Software: levelfourdevelopment WP EasyCart

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A Blind SQL Injection vulnerability exists within the wp-easycart component. This flaw allows an attacker to manipulate database queries by submitting crafted input, bypassing standard security checks to infer the contents of the database through application behavior.

Business Impact

For e-commerce platforms, this vulnerability is particularly critical as it may expose customer payment history, personal identifiable information (PII), and order details. The CVSS score of 8.5 reflects the high potential for data compromise, which could lead to financial loss, legal liabilities, and a total loss of consumer confidence.

Remediation Plan

Immediate Action: Upgrade WP EasyCart to the patched version immediately to close the SQL injection vector and secure the database.

Proactive Monitoring: Regularly audit database access logs and monitor for anomalous response times that could indicate time-based blind SQL injection attempts.

Compensating Controls: Implement strict input validation and use prepared statements where possible, while leveraging a WAF to provide an additional layer of defense against injection attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the sensitive nature of e-commerce data handled by WP EasyCart, this High-severity vulnerability must be addressed with the highest urgency. Security teams should ensure that the latest vendor patches are applied across all production environments immediately to safeguard customer and business data.

---METADATA---
VENDOR: David Lingren Media
PRODUCT: Media Library Assistant
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Blind SQL Injection vulnerability exists in David Lingren Media Library Assistant (media-library-assistant) due to improper neutralization of special elements in SQL commands.

Executive Summary:
The David Lingren Media Library Assistant software contains a High-severity Blind SQL Injection vulnerability that enables unauthorized actors to query the database and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-32399

Affected Software: David Lingren Media Library Assistant

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The media-library-assistant component is susceptible to Blind SQL Injection. The software fails to adequately sanitize input used in SQL statements, allowing an attacker to execute arbitrary database commands and observe the application's response to reconstruct database contents.

Business Impact

This vulnerability poses a severe threat to the confidentiality of the organization's data assets. Given the CVSS score of 8.5, an attacker could compromise the entire database, leading to the theft of sensitive media metadata, user information, or administrative credentials, which may result in significant reputational damage.

Remediation Plan

Immediate Action: Administrators should immediately update to the most recent version of the Media Library Assistant plugin to address this critical security flaw.

Proactive Monitoring: Enable comprehensive query logging on the database server and monitor for repeated, structured queries that suggest automated exploitation attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to intercept and neutralize SQL injection payloads before they reach the vulnerable application component.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a high-risk entry point for attackers seeking to compromise database integrity. Organizations should prioritize the deployment of the official security update immediately to mitigate the risk of data loss and unauthorized system access.

---METADATA---
VENDOR: delphiknight
PRODUCT: Geo to Lat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Geo to Lat (geo-to-lat) software contains a Blind SQL Injection vulnerability due to improper neutralization of special elements within SQL commands.

Executive Summary:
The delphiknight Geo to Lat software is vulnerable to a High-severity Blind SQL Injection flaw that could allow an attacker to extract sensitive information from the backend database.

Vulnerability Details

CVE-ID: CVE-2026-32368

Affected Software: delphiknight Geo to Lat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Blind SQL Injection residing in the geo-to-lat component. It occurs when the application fails to properly sanitize user-supplied input before using it in a database query, allowing an attacker to infer data through boolean or time-based responses.

Business Impact

A successful exploit of this vulnerability could lead to the unauthorized extraction of sensitive data, including user credentials and proprietary site information. With a CVSS score of 8.5, this High-severity flaw represents a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance and loss of customer trust.

Remediation Plan

Immediate Action: Apply the latest security patches provided by delphiknight immediately to remediate the underlying SQL injection flaw.

Proactive Monitoring: Implement database activity monitoring to detect unusual query patterns and review application logs for suspicious parameters or high volumes of Boolean-based requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection rules to filter and block malicious traffic targeting this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The High-severity rating of this SQL injection vulnerability necessitates immediate attention from security administrators. It is strongly recommended that the primary remediation—applying the vendor-supplied patch—be completed without delay to prevent unauthorized database access and potential data exfiltration.

---METADATA---
VENDOR: Rob Felty
PRODUCT: Collapsing Categories (WordPress Plugin)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Collapsing Categories plugin for WordPress is vulnerable to Blind SQL Injection, which could lead to unauthorized database access and information disclosure.

Executive Summary:
A high-severity Blind SQL Injection vulnerability in the Collapsing Categories WordPress plugin allows attackers to compromise database security and extract sensitive site information.

Vulnerability Details

CVE-ID: CVE-2026-32366

Affected Software: robfelty Collapsing Categories (collapsing-categories)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Blind SQL Injection due to inadequate input sanitization in its database query logic. This allows an attacker to send crafted requests that manipulate SQL execution, facilitating the extraction of sensitive data through inference.

Business Impact

The CVSS score of 8.5 highlights the critical nature of this flaw. Successful exploitation could result in the theft of administrative credentials and sensitive site data, potentially leading to unauthorized content modification or complete site defacement.

Remediation Plan

Immediate Action: Update the Collapsing Categories plugin to the latest available version immediately to mitigate the SQL Injection risk.

Proactive Monitoring: Review web server logs for repetitive requests to the plugin's endpoints that appear to be testing logical conditions or inducing time delays.

Compensating Controls: Implement a robust Web Application Firewall (WAF) to filter out common SQL Injection attack patterns and restrict database user privileges to the minimum necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. However, automated vulnerability scanners often target plugins with these types of flaws.

Analyst Recommendation

Immediate remediation via patching is the only effective way to address this high-severity vulnerability. Administrators should prioritize this update to ensure the continued security of their WordPress installation and its underlying data.

---METADATA---
VENDOR: Mullvad
PRODUCT: VPN
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
An unspecified vulnerability exists within the Mullvad VPN client, potentially impacting the security of the application on desktop and mobile platforms.

Executive Summary:
The Mullvad VPN client is subject to a security vulnerability that may compromise the integrity or confidentiality of the VPN connection.

Vulnerability Details

CVE-ID: CVE-2026-32323

Affected Software: Mullvad VPN

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is currently undefined in scope and nature. The authentication requirements remain unknown, and further technical disclosure is required to assess the specific attack vector.

Business Impact

A CVSS score of 7.3 indicates a High severity risk. Successful exploitation could potentially allow an attacker to intercept traffic or bypass VPN security controls, leading to a loss of privacy or unauthorized network access for users relying on the client.

Remediation Plan

Immediate Action: Check the official Mullvad website for the latest software version and apply updates across all desktop and mobile installations immediately.

Proactive Monitoring: Review VPN connectivity logs for signs of unexpected session terminations or unauthorized connection attempts.

Compensating Controls: If an update is not immediately available, consider temporarily utilizing alternative secure tunnels or disabling the client if the risk of exposure outweighs the requirement for the VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users and administrators should monitor official vendor channels for security patches regarding this client. Due to the critical nature of VPN software as a security control, maintaining the latest version is imperative to ensure the confidentiality of network traffic.

---METADATA---
VENDOR: Ella
PRODUCT: Ella Core (5G Core)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Ella Core, a 5G core for private networks, contains a security vulnerability that could impact the availability or integrity of private cellular communications.

Executive Summary:
A high-severity vulnerability in the Ella Core 5G platform poses a critical risk to the security and operational stability of private 5G networks.

Vulnerability Details

CVE-ID: CVE-2026-32319

Affected Software: Ella Core

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Ella Core 5G network stack. While specific technical details are limited, the high CVSS score suggests an attacker could potentially disrupt network services or intercept communication metadata within the private 5G environment.

Business Impact

With a CVSS score of 7.5, this flaw could lead to the disruption of mission-critical communications in industrial or enterprise settings. Exploitation could result in network downtime, unauthorized access to network management functions, and potential espionage within the private cellular infrastructure.

Remediation Plan

Immediate Action: Coordinate with the vendor to apply the latest security patches to the Ella Core 5G infrastructure as soon as possible.

Proactive Monitoring: Monitor network signaling traffic for anomalies and review administrative access logs for the 5G core management interface.

Compensating Controls: Isolate the 5G core management network from the public internet and use strong network segmentation to limit the impact of a potential breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. Because this affects critical infrastructure components, the impact of a successful attack is exceptionally high.

Analyst Recommendation

Security teams managing private 5G networks must treat this as a critical priority. Immediate patching and the implementation of robust network isolation are essential to protect the integrity of the cellular core.