---METADATA---
VENDOR: Nezha
PRODUCT: Monitoring
AFFECTED_VERSIONS: From version 1.4.0 to before version 2.0.8
---END_METADATA---

Description Summary:
Nezha Monitoring contains a vulnerability where a low-privileged user can trigger arbitrary commands across all monitored servers, resulting in cross-tenant remote code execution.

Executive Summary:
A critical RCE vulnerability in Nezha Monitoring allows authenticated users to execute arbitrary commands on all managed servers, regardless of tenant boundaries.

Vulnerability Details

CVE-ID: CVE-2026-46716

Affected Software: Nezha Monitoring

Affected Versions: From version 1.4.0 to before version 2.0.8

Vulnerability: A RoleMember user can create a malicious cron task that pushes arbitrary commands to the global server pool. These commands are executed by agents on all monitored servers, bypassing tenant isolation.

Business Impact

This is a critical cross-tenant Remote Code Execution (RCE) vulnerability. An attacker with minimal access can gain control over every server managed by the Nezha instance, leading to a complete compromise of the entire server fleet. Given the CVSS score of 9.9, this vulnerability poses an extreme threat to organizational operations.

Remediation Plan

Immediate Action: Update Nezha Monitoring to version 2.0.8 immediately.

Proactive Monitoring: Audit existing cron tasks within the Nezha dashboard for any unauthorized or suspicious commands. Review agent execution logs for command execution patterns.

Compensating Controls: Restrict access to the Nezha dashboard interface to a limited set of trusted administrators until the patch is applied.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 12, 2026, a public exploit exists for this vulnerability. The risk of exploitation is extremely high and immediate remediation is required.

Analyst Recommendation

The ability to execute arbitrary code across an entire fleet of managed servers is a catastrophic risk. Administrators must update to version 2.0.8 immediately to prevent potential mass compromise of their server infrastructure.

---METADATA---
VENDOR: misskey-dev
PRODUCT: misskey
AFFECTED_VERSIONS: >= 12.37.0, < 2026.5.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Misskey fails to properly validate JSON-LD signatures, enabling attackers to spoof activities on the federated social media platform.

Executive Summary:
A critical cryptographic signature validation flaw in Misskey allows remote, unauthenticated attackers to spoof activities, potentially compromising the integrity of the federated platform.

Vulnerability Details

CVE-ID: CVE-2026-46713

Affected Software: misskey-dev misskey

Affected Versions: >= 12.37.0, < 2026.5.4

Vulnerability: The vulnerability exists in the JSON-LD signature validation and compaction process. An unauthenticated attacker can leverage this flaw to submit spoofed activities that the platform incorrectly identifies as valid.

Business Impact

Exploitation of this vulnerability undermines the trust model of the federated platform. By spoofing activities, attackers can potentially spread misinformation, impersonate users, or manipulate platform interactions. The CVSS score of 9.2 highlights the severe impact on integrity, as an attacker can influence system operations without authentication.

Remediation Plan

Immediate Action: Update Misskey to version 2026.5.4 or later immediately. This version contains the necessary fixes for the JSON-LD signature validation process.

Proactive Monitoring: Monitor logs for suspicious activity patterns, particularly those involving unusual JSON-LD payloads or unexpected actor signatures. Investigate any reports of spoofed user posts or platform interactions.

Compensating Controls: While no direct virtual patch exists, implement strict rate limiting on activity processing to mitigate the impact of bulk-spoofing attempts. Review federated connection settings to ensure only trusted instances are allowed to interact with the platform.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw is specific to the handling of federated data structures and signature verification.

Analyst Recommendation

Administrators of Misskey instances must upgrade to version 2026.5.4 to resolve the signature validation flaw. Given the critical threat to platform integrity and user trust, this update should be applied as part of an urgent maintenance cycle.

---METADATA---
VENDOR: Notepad++
PRODUCT: Notepad++
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Notepad++ source code editor that may allow for unauthorized system impact.

Executive Summary:
A high-severity security vulnerability in Notepad++ presents a potential risk to system integrity and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-46710

Affected Software: Notepad++

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific nature of this vulnerability in Notepad++ remains under investigation; however, it is classified as a high-severity flaw that may impact application stability or security. Authentication requirements are currently unspecified, necessitating a cautious approach until full disclosure is provided by the vendor.

Business Impact

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to organizational assets. Successful exploitation could lead to unauthorized local access, potential data manipulation, or system instability, directly impacting business continuity and the security of sensitive development environments.

Remediation Plan

Immediate Action: Verify the version of Notepad++ in use and apply the latest security patches released by the vendor as soon as they become available.

Proactive Monitoring: Review system and application logs for anomalous behavior or unauthorized process execution associated with the Notepad++ application.

Compensating Controls: Restrict application execution privileges and implement endpoint detection and response (EDR) solutions to identify and block suspicious activity originating from text editor processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this CVE, administrators must prioritize monitoring official vendor channels for patch releases. Once a patch is available, it should be deployed across all affected workstations immediately to mitigate the risk of exploitation.

---METADATA---
VENDOR: Progress Software
PRODUCT: MOVEit Automation
AFFECTED_VERSIONS: 2025.0.0-2025.0.8, 2024.0.0-2024.1.7, prior to 2024.0.0
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in Progress Software MOVEit Automation allows unauthorized access to the application.

Executive Summary:
A critical authentication bypass vulnerability in Progress Software MOVEit Automation allows attackers to circumvent login requirements and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-4670

Affected Software: Progress Software MOVEit Automation

Affected Versions: 2025.0.0 before 2025.0.9, 2024.0.0 before 2024.1.8, and versions prior to 2024.0.0.

Vulnerability: The application contains a flaw that permits an authentication bypass, effectively allowing an attacker to access the system without valid credentials.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Unauthorized access to MOVEit Automation, which is frequently used for sensitive file transfers, poses an extreme risk of data exfiltration and loss of confidentiality for all data processed by the platform.

Remediation Plan

Immediate Action: Update MOVEit Automation to the latest patched version (2025.0.9, 2024.1.8, or the latest available) immediately.

Proactive Monitoring: Review authentication and access logs for anomalous login activity or unauthorized access attempts from unexpected IP addresses.

Compensating Controls: Implement strict network access controls to limit access to the MOVEit interface to known, trusted management segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation. However, the criticality of authentication bypasses requires immediate attention.

Analyst Recommendation

Organizations should prioritize this update. Given the nature of MOVEit as a high-value target for data theft, ensure that the patch is applied across all instances immediately.

---METADATA---
VENDOR: Boxlite
PRODUCT: Boxlite
AFFECTED_VERSIONS: < 0.9.0
---END_METADATA---

Description Summary:
Boxlite prior to 0.9.0 fails to restrict kernel capabilities, allowing malicious code to remount directories as read-write and perform arbitrary write operations.

Executive Summary:
A critical sandbox-escape vulnerability in Boxlite allows attackers to gain unauthorized write access to host directories, necessitating an immediate update to version 0.9.0.

Vulnerability Details

CVE-ID: CVE-2026-46695

Affected Software: Boxlite

Affected Versions: < 0.9.0

Vulnerability: This is a sandbox-escape vulnerability where untrusted code can remount host directories from read-only to read-write. The issue stems from a failure to restrict kernel capabilities and drop CAP_SYS_ADMIN from the guest, which is accessible to unauthenticated attackers running code within the container.

Business Impact

Successful exploitation allows an attacker to bypass critical security boundaries, gaining unauthorized write access to host directories that should be read-only. Given the CVSS score of 10.0, this represents a total compromise of the sandbox integrity, potentially leading to system-wide data corruption or further privilege escalation on the host server.

Remediation Plan

Immediate Action: Upgrade Boxlite to version 0.9.0 or later, which enforces read-only status at the hypervisor level and drops CAP_SYS_ADMIN from the guest.

Proactive Monitoring: Monitor system logs for unexpected file system remount commands or unauthorized write activity within container environments.

Compensating Controls: Implement strict resource constraints and restrict the usage of privileged containers until the patch can be applied.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 10, 2026, a public exploit is available for this vulnerability. Given the ease of bypassing the read-only contract, organizations should prioritize patching immediately to prevent sandbox escapes.

Analyst Recommendation

The severity of this vulnerability is extreme, as it effectively nullifies the isolation provided by the Boxlite sandbox. Administrators must immediately upgrade to version 0.9.0 to enforce the necessary hypervisor-level security controls and prevent arbitrary code execution on the underlying host.

---METADATA---
VENDOR: emlog
PRODUCT: emlog
AFFECTED_VERSIONS: <= 2.6.13
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Emlog versions 2.6.13 and earlier are vulnerable to path traversal and remote file inclusion due to improper control of file paths and include statements.

Executive Summary:
Emlog website building system contains critical path traversal and remote file inclusion flaws that could allow an authenticated attacker to compromise the server.

Vulnerability Details

CVE-ID: CVE-2026-46687

Affected Software: emlog emlog

Affected Versions: <= 2.6.13

Vulnerability: This vulnerability involves path traversal (CWE-24) and improper control of filenames for include statements (CWE-98). An authenticated attacker with low privileges can leverage these flaws to access unauthorized files or execute arbitrary code on the server.

Business Impact

The ability to perform remote file inclusion or path traversal poses a severe threat to the entire hosting environment. A successful exploit could lead to full system compromise, unauthorized data access, and the execution of malicious scripts. The CVSS score of 7.7 reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Monitor the vendor security advisory page for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Inspect web server logs for suspicious file paths or attempts to access restricted directories, and monitor for unusual outbound network connections from the web server.

Compensating Controls: Restrict file system permissions for the web server user to the minimum required level and utilize a Web Application Firewall to block requests containing directory traversal sequences.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Due to the availability of a proof-of-concept and the high technical impact, this vulnerability must be treated as a priority. Administrators should restrict access to the affected system until a security patch is provided by the vendor.

---METADATA---
VENDOR: emlog
PRODUCT: emlog
AFFECTED_VERSIONS: <= 2.6.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Emlog is susceptible to a Cross-site Scripting vulnerability that can be triggered by unauthenticated attackers.

Executive Summary:
Emlog is vulnerable to a Cross-site Scripting attack that could allow unauthenticated actors to compromise web content and user sessions.

Vulnerability Details

CVE-ID: CVE-2026-46686

Affected Software: emlog emlog

Affected Versions: <= 2.6.13

Vulnerability: This is an Improper Neutralization of Input during Web Page Generation (CWE-79) vulnerability. It allows an unauthenticated attacker to inject malicious scripts into the application, which are then executed in the context of the user's browser.

Business Impact

This vulnerability carries a CVSS score of 8.5, indicating a high risk of unauthorized access or data compromise. By exploiting this flaw, an attacker could potentially hijack administrative sessions, perform actions on behalf of users, or deface the website, leading to significant reputational damage.

Remediation Plan

Immediate Action: Review the official Emlog security advisories for the latest available patch and apply it to all affected instances immediately.

Proactive Monitoring: Monitor web server access logs for anomalous request strings, specifically those containing script tags or encoded characters indicative of XSS probes.

Compensating Controls: Utilize a Web Application Firewall to block common XSS payloads and sanitize input before it reaches the vulnerable application components.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of authentication requirements makes this vulnerability particularly attractive to automated attack tools.

Analyst Recommendation

Due to the existence of a proof-of-concept and the high severity of this vulnerability, immediate remediation is required. Administrators must ensure their Emlog instances are updated to the latest secure version to prevent potential exploitation.

---METADATA---
VENDOR: YesWiki
PRODUCT: YesWiki
AFFECTED_VERSIONS: < 4.6.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the YesWiki Bazar form-import path allows remote attackers to execute arbitrary SQL commands and extract sensitive database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in YesWiki allows remote attackers to extract sensitive data, including user password hashes, from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-46670

Affected Software: YesWiki YesWiki

Affected Versions: < 4.6.4

Vulnerability: The vulnerability exists in the Bazar form-import path within the FormManager::create() function. It permits an unauthenticated visitor to inject malicious SQL into an INSERT statement, resulting in unauthorized database access.

Business Impact

The ability to perform unauthenticated SQL injection constitutes a critical threat to data confidentiality and integrity. With a CVSS score of 9.8, this vulnerability allows attackers to dump the entire database, including authentication credentials, which could lead to widespread system compromise and severe reputational damage.

Remediation Plan

Immediate Action: Update YesWiki to version 4.6.4 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor database query logs for anomalous activity or unexpected syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the form-import path.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation in the wild. While a Nuclei detection template exists, there is no confirmed public proof-of-concept or weaponized exploit available at this time.

Analyst Recommendation

Given the ease of exploitation and the severity of potential data loss, immediate patching is required. All administrators of YesWiki installations must upgrade to version 4.6.4 to eliminate this critical SQL injection vector.

---METADATA---
VENDOR: Bludit
PRODUCT: Bludit CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Bludit content management system that may allow for unauthorized system impact.

Executive Summary:
A high-severity vulnerability in the Bludit content management system poses a significant risk to the integrity and availability of hosted web content.

Vulnerability Details

CVE-ID: CVE-2026-46656

Affected Software: Bludit CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Bludit core framework; while specific exploitation vectors remain under investigation, such flaws often involve improper input validation or insufficient authentication controls within the CMS architecture.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high potential for unauthorized access or administrative compromise. Successful exploitation could lead to the defacement of websites, unauthorized data exfiltration, or the deployment of malicious scripts, resulting in severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: Administrators must monitor the official Bludit security advisory portal and apply the latest security patches as soon as they are released.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unauthorized attempts to access sensitive administrative directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter out common web-based attack vectors and provide virtual patching for the environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be treated as a priority item. Organizations running Bludit should perform an inventory of their instances and prepare for an emergency patching cycle once the vendor releases specific remediation guidance.

---METADATA---
VENDOR: TwigPHP
PRODUCT: Twig
AFFECTED_VERSIONS: >= 3.15.0, < 3.26.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Twig is vulnerable to code injection, allowing an authenticated attacker to manipulate template generation and execute arbitrary code.

Executive Summary:
Twig contains an authenticated code injection vulnerability that could allow an attacker to achieve unauthorized code execution within the application environment.

Vulnerability Details

CVE-ID: CVE-2026-46640

Affected Software: TwigPHP Twig

Affected Versions: >= 3.15.0, < 3.26.0

Vulnerability: This vulnerability involves improper control of code generation, enabling an authenticated user to perform code injection attacks that bypass standard security restrictions.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code, which can result in complete loss of application control, unauthorized data access, and potential escalation of privileges. The CVSS score of 8.7 highlights the significant risk to business operations and the critical necessity for patching.

Remediation Plan

Immediate Action: Upgrade the Twig template engine to version 3.26.0 or higher to mitigate the code injection risk.

Proactive Monitoring: Review application performance logs and audit logs for anomalous behavior related to template processing or unexpected system calls.

Compensating Controls: Use a Web Application Firewall to monitor for and block known injection patterns, while restricting user access to template management features.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly impactful for systems that allow users to influence template generation processes.

Analyst Recommendation

Given the high severity of this code injection vulnerability, immediate patching is required to secure the environment. Ensure all instances of Twig are updated to version 3.26.0 to eliminate the risk of arbitrary code execution by authenticated actors.

---METADATA---
VENDOR: TwigPHP
PRODUCT: Twig
AFFECTED_VERSIONS: < 3.26.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Twig is vulnerable to code injection, allowing an authenticated user to perform unauthorized actions by manipulating template generation.

Executive Summary:
The Twig template engine contains a code injection vulnerability that allows an authenticated user with sufficient permissions to execute arbitrary code within the application context.

Vulnerability Details

CVE-ID: CVE-2026-46633

Affected Software: TwigPHP Twig

Affected Versions: < 3.26.0

Vulnerability: This vulnerability is a code injection flaw arising from improper control over the generation of code, which can be triggered by an authenticated attacker to execute arbitrary commands.

Business Impact

A successful exploit grants the attacker the ability to execute code with the privileges of the web application, leading to full system compromise, data theft, or lateral movement within the network. With a CVSS score of 8.7, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment.

Remediation Plan

Immediate Action: Update the Twig library to version 3.26.0 or later to resolve the code injection vulnerability.

Proactive Monitoring: Monitor application logs for suspicious template rendering activity or unauthorized attempts to access system-level functions.

Compensating Controls: Implement strict input validation and ensure that user-supplied content is never passed directly into template rendering functions without rigorous sanitization.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, the potential for remote code execution makes this a high priority for remediation.

Analyst Recommendation

Administrators should treat this vulnerability as critical due to the potential for remote code execution. Ensure that all dependencies are audited and updated to version 3.26.0 to mitigate the risk of unauthorized code execution.

---METADATA---
VENDOR: Twenty
PRODUCT: Twenty CRM
AFFECTED_VERSIONS: 1.7.7 through 1.16.7
---END_METADATA---

Description Summary:
Twenty CRM is vulnerable to RCE via chained SQL injection and PostgreSQL COPY TO PROGRAM attacks in the REST API.

Executive Summary:
An authenticated Remote Code Execution (RCE) vulnerability in Twenty CRM allows attackers to execute arbitrary OS commands on the database server.

Vulnerability Details

CVE-ID: CVE-2026-46624

Affected Software: Twenty, Twenty CRM

Affected Versions: 1.7.7 through 1.16.7

Vulnerability: This is a critical RCE vulnerability involving a chained SQL injection and PostgreSQL COPY TO PROGRAM attack. An authenticated user can inject malicious SQL through the unsanitized timeZone parameter in the REST API, resulting in arbitrary command execution if the database service runs with superuser privileges.

Business Impact

The vulnerability poses a severe risk to organizational data integrity and system availability. With a CVSS score of 9.9, this flaw allows for complete system compromise, enabling attackers to extract sensitive CRM data or pivot into the internal network. Successful exploitation could lead to catastrophic reputational damage and prolonged operational downtime.

Remediation Plan

Immediate Action: Upgrade Twenty CRM to a patched version that sanitizes the timeZone input parameter.

Proactive Monitoring: Review database query logs for anomalous COPY TO PROGRAM syntax or unusual SQL injection patterns within the REST API.

Compensating Controls: Implement strict input validation at the Web Application Firewall (WAF) level to block suspicious SQL queries containing command execution patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE vulnerability and the potential for full system takeover, immediate patching is mandatory. Administrators must prioritize updating Twenty CRM and auditing current database user permissions to adhere to the principle of least privilege, ensuring the application does not run as a database superuser.

---METADATA---
VENDOR: SolidInvoice
PRODUCT: SolidInvoice
AFFECTED_VERSIONS: Prior to version 2.3.17
---END_METADATA---

Description Summary:
SolidInvoice stores API tokens in plaintext within the database, risking full credential compromise if the database is exposed or accessed by an unauthorized party.

Executive Summary:
A critical plaintext credential storage vulnerability in SolidInvoice exposes all REST API tokens to potential theft, facilitating full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-46622

Affected Software: SolidInvoice

Affected Versions: Prior to version 2.3.17

Vulnerability: This vulnerability involves the insecure storage of API tokens as plaintext strings in the api_tokens database table. An attacker with access to the database—whether via SQL injection, leaked backups, or insider access—can retrieve these tokens to impersonate users and gain full unauthorized access to the application.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a significant risk to the confidentiality and integrity of the invoicing platform. Successful exploitation allows for complete unauthorized access to API-connected services, potentially leading to the theft of financial data, customer records, and unauthorized manipulation of invoicing workflows.

Remediation Plan

Immediate Action: Upgrade to version 2.3.17 or later immediately to address the insecure storage mechanism.

Proactive Monitoring: Audit database access logs for unusual queries targeting the api_tokens table and monitor API logs for anomalous usage patterns.

Compensating Controls: Ensure strict access controls on database backups and implement database encryption at rest to mitigate the impact of physical or logical data exposure.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 13, 2026, there is a public exploit available for this vulnerability. Given the ease with which plaintext tokens can be harvested, organizations should prioritize patching as an urgent security requirement.

Analyst Recommendation

The exposure of API tokens in plaintext is a severe security oversight that provides an immediate path to full account takeover. Administrators must update to version 2.3.17 immediately and rotate all existing API tokens to invalidate any credentials that may have already been compromised.

---METADATA---
VENDOR: Fission
PRODUCT: Fission Router
AFFECTED_VERSIONS: Prior to version 1.23.0
---END_METADATA---

Description Summary:
A route authorization bypass in the Fission router allows unauthorized callers to invoke functions by guessing their metadata, bypassing defined HTTPTrigger restrictions.

Executive Summary:
A critical routing vulnerability in Fission prior to version 1.23.0 allows unauthenticated attackers to invoke serverless functions, bypassing security controls.

Vulnerability Details

CVE-ID: CVE-2026-46614

Affected Software: Fission Fission Router

Affected Versions: Prior to version 1.23.0

Vulnerability: The Fission router incorrectly registers internal-style routes for all Function objects, regardless of whether an HTTPTrigger is defined. This allows an unauthenticated attacker who can reach the router to invoke any function by guessing its name and namespace, circumventing host, path, and method restrictions.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the serverless environment. Successful exploitation could lead to unauthorized execution of internal functions, potentially exposing sensitive data or allowing an attacker to manipulate serverless workloads. This aligns with MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).

Remediation Plan

Immediate Action: Upgrade Fission to version 1.23.0 or later to ensure proper route authorization is enforced.

Proactive Monitoring: Monitor router access logs for high volumes of 404 errors or unexpected requests targeting the /fission-function/ path, which may indicate enumeration attempts.

Compensating Controls: Implement network-level access control lists (ACLs) to restrict access to the Fission router (port 8888) to known, authorized internal services only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security failure in the Fission routing architecture. Administrators must prioritize updating to version 1.23.0 immediately to prevent unauthorized function invocation and potential privilege escalation within the Kubernetes cluster.

---METADATA---
VENDOR: Fission
PRODUCT: Fission
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Fission, a Kubernetes-native serverless framework, contains a vulnerability that requires immediate attention from users of the platform.

Executive Summary:
A high-severity vulnerability has been identified in the Fission serverless framework, requiring urgent review and remediation to maintain cluster security.

Vulnerability Details

CVE-ID: CVE-2026-46612

Affected Software: Fission

Affected Versions: See vendor advisory

Vulnerability: Fission is an open-source, Kubernetes-native serverless framework. While specific technical details are currently limited, the vulnerability is classified as high severity, indicating a potential risk to the integrity or availability of the Kubernetes-native environment.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk. As Fission manages the deployment of serverless functions within Kubernetes, an exploit could potentially allow for unauthorized code execution, privilege escalation within the cluster, or disruption of serverless workloads.

Remediation Plan

Immediate Action: Monitor official Fission security communications and apply vendor-recommended updates or patches as soon as they become available.

Proactive Monitoring: Review Kubernetes audit logs for unauthorized access to Fission-related resources and monitor serverless function execution for anomalous behavior.

Compensating Controls: Apply strict Kubernetes RBAC policies to limit the permissions associated with Fission components to the minimum necessary for operation.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. Organizations should remain vigilant and apply updates as soon as the vendor releases specific guidance.

Analyst Recommendation

Given the high CVSS score, organizations utilizing Fission must stay updated on security disclosures. Immediate application of patches upon release is recommended to mitigate the risk of cluster-level compromise or service disruption.

---METADATA---
VENDOR: Blendmedia
PRODUCT: WP CTA – Call Now Button, Sticky Button & Call to Action Builder
AFFECTED_VERSIONS: 0 through 2.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP CTA plugin for WordPress is susceptible to time-based blind SQL Injection via the 'fildname' parameter.

Executive Summary:
A time-based blind SQL injection vulnerability in the WP CTA WordPress plugin allows unauthenticated attackers to extract sensitive information from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-4661

Affected Software: Blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder

Affected Versions: 0 through 2.2.2

Vulnerability: The plugin contains a vulnerability in the 'fildname' parameter, which fails to properly sanitize user input, allowing for time-based blind SQL injection (CWE-89). This can be executed by an unauthenticated attacker.

Business Impact

SQL injection vulnerabilities allow attackers to query the database, potentially exposing sensitive customer data, configuration details, or authentication credentials. Given the CVSS score of 7.5, this is a high-severity issue that could lead to significant data exfiltration.

Remediation Plan

Immediate Action: Update the WP CTA plugin to the latest version immediately to patch the vulnerable parameter handling.

Proactive Monitoring: Use a database activity monitor to identify slow or unusual queries that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common SQL injection patterns and filter malicious input in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability is exploitable by unauthenticated users, it presents a significant risk to any site utilizing this plugin. Administrators should apply the vendor-provided security update without delay to prevent potential database compromise.

---METADATA---
VENDOR: Nicolargo
PRODUCT: Glances
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An additional security vulnerability has been identified in the Glances monitoring tool that may permit unauthorized system-level interactions.

Executive Summary:
The Nicolargo Glances monitoring tool is susceptible to a high-severity vulnerability that could facilitate unauthorized system access if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-46607

Affected Software: Nicolargo Glances

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Glances monitoring tool's ability to securely manage system interactions and input processing. The flaw allows for potential exploitation by an attacker to execute unauthorized operations, undermining the security posture of the monitored environment.

Business Impact

Exploitation of this vulnerability threatens the integrity of the monitoring environment and, by extension, the underlying systems being monitored. With a CVSS score of 7.8, the risk of unauthorized access or service disruption is significant, potentially leading to loss of control over critical server management processes.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to remediate the vulnerability in the Glances application.

Proactive Monitoring: Increase the frequency of log audits for the Glances service, specifically looking for unexpected process spawning or anomalous configuration changes.

Compensating Controls: Restrict network access to the Glances monitoring interface using VPNs or firewalls to ensure only authenticated users can interact with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must address CVE-2026-46607 as a matter of urgency to prevent the exploitation of monitoring infrastructure. Applying the latest updates is the most effective way to eliminate this risk and ensure that the monitoring tool remains a secure component of the environment.

---METADATA---
VENDOR: Nicolargo
PRODUCT: Glances
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Glances cross-platform monitoring tool could potentially be leveraged by remote attackers to compromise system monitoring integrity.

Executive Summary:
A high-severity vulnerability in the Nicolargo Glances monitoring tool exposes systems to potential unauthorized exploitation and administrative risk.

Vulnerability Details

CVE-ID: CVE-2026-46606

Affected Software: Nicolargo Glances

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the Glances cross-platform monitoring framework, affecting how the tool processes requests or manages internal operations. The flaw may allow an attacker to bypass standard security controls to execute unauthorized actions on the host system.

Business Impact

A successful exploit of this vulnerability could grant an attacker unauthorized control over the monitoring tool, potentially leading to system-wide compromise or the exfiltration of sensitive performance and configuration data. The CVSS score of 7.8 confirms the high severity, as monitoring tools often require elevated privileges to function, thereby amplifying the blast radius of a successful attack.

Remediation Plan

Immediate Action: Update the Glances installation to the latest version provided by the vendor to ensure all security patches are applied.

Proactive Monitoring: Review system logs for unusual execution patterns or unauthorized attempts to access the Glances web-based or API interface.

Compensating Controls: Utilize a Web Application Firewall (WAF) or network-level access control lists (ACLs) to limit access to the Glances interface to authorized administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on Glances for system oversight makes it a high-value target for attackers looking to maintain persistence or gain intelligence on infrastructure. Security teams should treat this vulnerability with high priority and ensure that all instances are updated or isolated from public-facing networks.

---METADATA---
VENDOR: Golang
PRODUCT: golang.org/x/image/vp8l
AFFECTED_VERSIONS: 0 up to 0.45.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The golang.org/x/image/vp8l library is vulnerable to a memory allocation error when processing VP8L encoded images, which can lead to a denial of service via memory exhaustion.

Executive Summary:
A memory allocation vulnerability in the golang.org/x/image/vp8l decoder allows unauthenticated attackers to trigger a denial of service through specially crafted image files.

Vulnerability Details

CVE-ID: CVE-2026-46603

Affected Software: Golang golang.org/x/image/vp8l

Affected Versions: 0 up to 0.45.0

Vulnerability: This vulnerability is caused by memory allocation with an excessive size value (CWE-789) when decoding VP8L images. An unauthenticated attacker can submit a malicious image file to an application using this library, forcing the system to allocate excessive memory and causing a crash.

Business Impact

The CVSS score of 7.5 reflects the high impact on service availability. Applications that process user-supplied images are particularly at risk, as this vulnerability provides a trivial path for attackers to crash backend services, leading to potential operational disruption.

Remediation Plan

Immediate Action: Update the golang.org/x/image dependency to version 0.45.0 or later to resolve the memory allocation defect.

Proactive Monitoring: Monitor application crash logs and memory usage patterns for services that handle image uploads or processing.

Compensating Controls: Use image processing pipelines that perform strict validation and sanitization of image headers before they reach the decoding library to mitigate the risk of malicious payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, the vulnerability is considered automatable, which increases the risk of wide-scale exploitation if a public exploit is released.

Analyst Recommendation

Developers should immediately update their Go dependencies to the patched version. Given the ease with which this vulnerability can be automated by attackers, prompt remediation is necessary to prevent potential denial of service attacks against image-processing infrastructure.

---METADATA---
VENDOR: HashiCorp
PRODUCT: go-getter
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
HashiCorp’s go-getter library contains a vulnerability, potentially related to improper handling of remote resources, that could lead to security risks in dependent applications.

Executive Summary:
A high-severity vulnerability in HashiCorp's go-getter library requires immediate attention as it impacts multiple downstream products relying on this library for resource retrieval.

Vulnerability Details

CVE-ID: CVE-2026-4660

Affected Software: HashiCorp go-getter

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the go-getter library, which is commonly used to download remote files or directories. While specific details are limited, such flaws typically involve insecure handling of URLs or data during the retrieval process.

Business Impact

Because go-getter is a foundational library used by various infrastructure-as-code and orchestration tools, this vulnerability could lead to remote code execution or unauthorized file access in dependent applications. The CVSS score of 7.5 highlights the potential for severe security degradation across affected enterprise environments.

Remediation Plan

Immediate Action: Identify all internal applications and services that utilize the HashiCorp go-getter library and update them to the version specified in the vendor advisory.

Proactive Monitoring: Monitor for unexpected outbound network connections or file system modifications initiated by applications utilizing go-getter.

Compensating Controls: Implement egress filtering to prevent applications from fetching resources from untrusted or unknown external origins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, the widespread use of this library in infrastructure tools makes the potential for exploitation high.

Analyst Recommendation

Given the central role of go-getter in HashiCorp and third-party tools, organizations should perform an immediate inventory of their software stack to identify affected dependencies. Prioritize patching to prevent potential remote exploitation of infrastructure management workflows.

---METADATA---
VENDOR: PHP Jabbers
PRODUCT: PHP Poll Script
AFFECTED_VERSIONS: 0 up to 4.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The PHP Jabbers PHP Poll Script is susceptible to a SQL injection vulnerability, allowing authenticated users to perform unauthorized database operations.

Executive Summary:
A SQL injection vulnerability in the PHP Jabbers PHP Poll Script allows authenticated attackers to execute arbitrary SQL commands against the backend database.

Vulnerability Details

CVE-ID: CVE-2026-46593

Affected Software: PHP Jabbers PHP Poll Script

Affected Versions: All versions prior to 4.1

Vulnerability: This is an SQL injection vulnerability (CWE-89) that permits an authenticated user to bypass intended query constraints. The vulnerability involves improper neutralization of user-supplied data before it is included in a database command.

Business Impact

Exploitation of this flaw could allow an attacker with administrative access to extract sensitive information from the poll database or manipulate poll results. With a CVSS score of 8.6, the risk to data integrity is significant, potentially leading to reputational damage if poll data is tampered with or if underlying user data is accessed.

Remediation Plan

Immediate Action: Upgrade to PHP Poll Script version 4.1 or later to resolve the underlying security flaw.

Proactive Monitoring: Monitor database query performance and look for signs of unauthorized access or unexpected data modification patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter out suspicious SQL syntax in requests directed toward the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Although the exploit requires authentication, the severity of the potential impact necessitates prompt remediation.

Analyst Recommendation

Security teams should ensure that all instances of the PHP Jabbers PHP Poll Script are updated to version 4.1 immediately. Given the high severity of SQL injection vulnerabilities, maintaining up to date software is the most effective way to prevent unauthorized database manipulation.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.0.0 up to (excluding) 4.14.8, 4.15.0 up to (excluding) 4.18.3, 4.19.0 up to (excluding) 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel CXF SOAP component is vulnerable to an Improper Input Validation and 'Confused Deputy' issue, allowing unauthenticated attackers to bypass security controls.

Executive Summary:
An improper input validation vulnerability in Apache Camel's CXF SOAP component enables unauthenticated attackers to act as a confused deputy, leading to unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-46592

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.0.0 up to (excluding) 4.14.8, 4.15.0 up to (excluding) 4.18.3, 4.19.0 up to (excluding) 4.21.0

Vulnerability: This vulnerability stems from improper input validation (CWE-20) and a 'Confused Deputy' (CWE-441) flaw in the CXF SOAP component. It allows an unauthenticated attacker to manipulate the component into acting as an intermediary to access restricted resources.

Business Impact

The ability for an unauthenticated attacker to exploit this vulnerability creates a significant risk of unauthorized information disclosure. By inducing the system to act as a proxy for malicious requests, an attacker can bypass internal security perimeters. With a CVSS score of 7.5, the risk is substantial for any organization using Apache Camel to handle SOAP-based web services.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates by upgrading to the latest patched version of Apache Camel (4.14.8, 4.18.3, or 4.21.0).

Proactive Monitoring: Monitor SOAP traffic for malformed requests or unexpected intermediary behavior that deviates from standard service patterns.

Compensating Controls: Implement strict input validation at the gateway level and ensure that the SOAP service is not permitted to make outbound requests to sensitive internal networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly concerning as it is exploitable by unauthenticated attackers. Security teams should expedite the deployment of the necessary patches across all affected Apache Camel instances to prevent potential unauthorized access.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.10.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper neutralization of special elements in data query logic exists in the Apache Camel Neo4J component, enabling potential query injection.

Executive Summary:
A high-severity query injection vulnerability in the Apache Camel Neo4J component allows unauthenticated attackers to manipulate data queries.

Vulnerability Details

CVE-ID: CVE-2026-46591

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.10.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0

Vulnerability: The Neo4J component fails to properly neutralize special elements within data query logic. This allows an unauthenticated attacker to inject malicious query parameters, potentially leading to unauthorized data modification or disclosure.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant threat to data integrity. Attackers can bypass application-level controls to perform unauthorized operations on the backend database, potentially leading to the compromise of sensitive information or corruption of critical business data.

Remediation Plan

Immediate Action: Update Apache Camel to the versions identified by the vendor to ensure proper neutralization of query inputs.

Proactive Monitoring: Monitor database query logs for syntax anomalies or unauthorized query patterns that deviate from standard application behavior.

Compensating Controls: Implement strict input validation at the application layer and utilize parameterized queries wherever possible to neutralize potential injection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease with which this vulnerability can be exploited and its impact on data integrity, organizations should treat this as a high-priority update. Ensure all affected Camel integrations are patched to prevent unauthorized database manipulation.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.18.0 up to (excluding) 4.18.3, 4.19.0 up to (excluding) 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel PQC component is susceptible to a Deserialization of Untrusted Data vulnerability, potentially allowing remote code execution if exploited.

Executive Summary:
A critical deserialization vulnerability in the Apache Camel PQC component could allow an authenticated attacker to execute arbitrary code on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-46590

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.18.0 up to (excluding) 4.18.3, 4.19.0 up to (excluding) 4.21.0

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data (CWE-502) within the PQC component. An authenticated attacker can leverage this flaw to trigger unauthorized code execution.

Business Impact

Successful exploitation of this vulnerability can result in a full system compromise, including the loss of confidentiality, integrity, and availability of the host environment. Given the high CVSS score of 8.8, this vulnerability represents an urgent threat to any infrastructure relying on Apache Camel for data processing.

Remediation Plan

Immediate Action: Upgrade Apache Camel to version 4.18.3 or 4.21.0, or the latest stable release provided by the vendor.

Proactive Monitoring: Review application access logs for unusual serialization patterns or unexpected inbound data streams that may indicate exploitation attempts.

Compensating Controls: Restrict network access to the affected service to trusted internal sources only, and utilize runtime security tools to monitor for spawned child processes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must prioritize upgrading the Apache Camel framework to the specified non-vulnerable versions. Given the potential for remote code execution, this update should be treated as a high-priority maintenance task.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 0 through 4.14.7, 4.15.0 through 4.18.2, 4.19.0 through 4.20.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical improper input validation vulnerability in Apache Camel allows unauthenticated attackers to potentially perform unauthorized operations on the affected system.

Executive Summary:
Apache Camel contains an improper input validation flaw that exposes the platform to unauthenticated remote exploitation, necessitating urgent remediation.

Vulnerability Details

CVE-ID: CVE-2026-46588

Affected Software: Apache Camel

Affected Versions: 0 through 4.14.7, 4.15.0 through 4.18.2, 4.19.0 through 4.20.0

Vulnerability: The vulnerability stems from insufficient validation of input data processed by the Apache Camel framework. This allows an unauthenticated remote attacker to influence application behavior through crafted input, which may lead to adverse security consequences.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a substantial threat to the stability and security of internal data pipelines. Successful exploitation could result in unauthorized access to sensitive data transmitted through Camel or the degradation of system services. Addressing this vulnerability is essential for maintaining the confidentiality and integrity of business-critical data flows.

Remediation Plan

Immediate Action: Update Apache Camel instances to the latest vendor-provided version that addresses this specific CVE.

Proactive Monitoring: Review system and application access logs for anomalous traffic patterns or unexpected input strings targeting integrated services.

Compensating Controls: Utilize network-level traffic inspection and WAF rules to sanitize or block potentially malicious payloads before they reach the Camel framework.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority, as it permits unauthenticated access to the underlying framework. It is recommended to verify all affected versions in production and development environments and apply the vendor-recommended patches at the earliest opportunity.

---METADATA---
VENDOR: Apache
PRODUCT: Camel
AFFECTED_VERSIONS: 0 through 4.14.7, 4.15.0 through 4.18.2, 4.19.0 through 4.20.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache Camel is susceptible to an Improper Input Validation vulnerability, potentially allowing unauthenticated remote attackers to impact system integrity and availability.

Executive Summary:
An unauthenticated remote code execution or injection risk exists in Apache Camel due to improper input validation, requiring immediate patching to prevent unauthorized system interaction.

Vulnerability Details

CVE-ID: CVE-2026-46587

Affected Software: Apache Camel

Affected Versions: 0 through 4.14.7, 4.15.0 through 4.18.2, 4.19.0 through 4.20.0

Vulnerability: This vulnerability involves improper input validation (CWE-20) within the Apache Camel framework. The flaw is remotely exploitable by an unauthenticated attacker, meaning no prior user credentials or session tokens are required to trigger the vulnerable code path.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high-severity risk to business operations. Exploitation could lead to unauthorized data manipulation or service disruption, directly impacting the availability and reliability of enterprise integration services. Organizations relying on Camel for critical data routing should prioritize this fix to prevent potential service downtime or unauthorized system access.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Apache Camel as specified in the official vendor security advisory.

Proactive Monitoring: Monitor application logs for unusual input patterns or unexpected error codes that may indicate probing for input validation flaws.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent traffic filtering solution to inspect and block malformed requests directed at Camel endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of network-based exploitation, the potential for exploitation is considered high.

Analyst Recommendation

Given the high CVSS score and the widespread use of Apache Camel in integration middleware, this vulnerability poses a significant risk to organizational infrastructure. Administrators should audit their environments to identify all instances of the affected software and apply the necessary security updates immediately to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: 0 up to (excluding) 24.09.06
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Apache OFBiz versions prior to 24.09.06 are susceptible to Code Injection and Eval Injection vulnerabilities, allowing authenticated users to execute arbitrary code on the server.

Executive Summary:
A critical code injection vulnerability in Apache OFBiz allows authenticated attackers to achieve remote code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-46586

Affected Software: Apache OFBiz

Affected Versions: 0 up to (excluding) 24.09.06

Vulnerability: This vulnerability consists of Improper Control of Generation of Code (CWE-94) and Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95), which allows an authenticated attacker to inject and execute arbitrary code through the application.

Business Impact

The CVSS score of 7.3 highlights the potential for full system compromise. Successful exploitation grants an attacker the ability to execute commands with the privileges of the OFBiz service, leading to total data exfiltration, service disruption, or the installation of persistent backdoors.

Remediation Plan

Immediate Action: Upgrade Apache OFBiz to version 24.09.06 or apply the upstream fix commit 25b27902c88c72633d57af66aa28b21ebf95cfc8.

Proactive Monitoring: Audit server logs for unauthorized code execution patterns or unexpected child processes spawned by the Java application process.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the service account's ability to execute shell commands or write to sensitive directories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, the impact is severe, making it a high priority for internal security teams.

Analyst Recommendation

Given the critical nature of code injection flaws, organizations should treat this update with high priority. Apply the vendor-provided patch to version 24.09.06 immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel Lucene
AFFECTED_VERSIONS: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Apache Camel Lucene component contains an improper input validation vulnerability that allows for authorization bypass via user-controlled keys.

Executive Summary:
A high-severity authorization bypass vulnerability in Apache Camel Lucene allows unauthenticated attackers to potentially gain unauthorized access to sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-46585

Affected Software: Apache Software Foundation Apache Camel Lucene

Affected Versions: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0

Vulnerability: This vulnerability stems from improper input validation (CWE-20) and improper authorization handling (CWE-639). An unauthenticated remote attacker can supply a crafted user-controlled key to bypass security checks within the component.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to data confidentiality. With a CVSS score of 7.5, the vulnerability is classified as High; it allows unauthorized actors to access information that should be restricted, potentially leading to the leakage of proprietary or sensitive business data.

Remediation Plan

Immediate Action: Upgrade to version 4.14.8, 4.18.3, 4.21.0 or later as specified in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual patterns or suspicious requests containing unexpected input keys targeting the Lucene component.

Compensating Controls: Implement strict input validation at the Web Application Firewall (WAF) layer to filter out malicious or malformed keys before they reach the backend service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitability (low attack complexity and no authentication required), organizations should prioritize patching this vulnerability during the next maintenance cycle. Applying the vendor-supplied updates is the only definitive way to eliminate the underlying security flaw.

---METADATA---
VENDOR: Yamcs
PRODUCT: Yamcs
AFFECTED_VERSIONS: < 5.12.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in the Yamcs mission control framework allows unauthenticated attackers to execute arbitrary OS commands via the Nashorn ScriptEngine.

Executive Summary:
A critical code injection vulnerability in Yamcs allows unauthenticated remote attackers to execute arbitrary system commands, posing a total compromise risk to the host environment.

Vulnerability Details

CVE-ID: CVE-2026-46562

Affected Software: Yamcs Yamcs

Affected Versions: < 5.12.7

Vulnerability: The vulnerability exists because the Nashorn ScriptEngine fails to implement a ClassFilter when processing user-supplied JavaScript algorithms. This allows an unauthenticated attacker to inject malicious code that invokes arbitrary Java classes, resulting in OS command execution as the Yamcs process.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the Yamcs process and the underlying host system. Given the CVSS score of 9.8, this represents an extreme risk, enabling data theft, lateral movement, or complete system destruction.

Remediation Plan

Immediate Action: Upgrade the Yamcs installation to version 5.12.7 or 5.13.0 immediately. These versions disable algorithm editing by default and implement the necessary security filters.

Proactive Monitoring: Review application logs for unauthorized calls to the MdbOverrideApi endpoint or suspicious JavaScript activity within algorithm definitions.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Yamcs management interface using a Web Application Firewall or network segmentation to prevent external access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the combination of unauthenticated access and the ability to bridge JavaScript execution into native Java system calls.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized system access. Administrators should prioritize the deployment of the vendor-provided patch to remediate the unsafe evaluation of dynamic code.

---METADATA---
VENDOR: Plane
PRODUCT: Plane
AFFECTED_VERSIONS: Prior to version 1.3.1
---END_METADATA---

Description Summary:
A cross-workspace asset authorization bypass exists in Plane, allowing authenticated users to read, copy, delete, and overwrite assets in other workspaces.

Executive Summary:
An authorization bypass vulnerability in the Plane project management tool allows authenticated users to illicitly access and modify assets across unauthorized workspaces.

Vulnerability Details

CVE-ID: CVE-2026-46558

Affected Software: Plane

Affected Versions: Prior to version 1.3.1

Vulnerability: This is an authorization bypass vulnerability occurring within the asset management functionality. It allows any authenticated user to interact with assets in workspaces they do not own or have permission to access, essentially negating workspace isolation.

Business Impact

With a CVSS score of 8.3, this high-severity vulnerability poses a significant risk to organizational data integrity and confidentiality. Successful exploitation could lead to unauthorized data exfiltration, the deletion of critical project documentation, or the overwriting of sensitive assets, potentially resulting in severe operational disruption and loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade your Plane installation to version 1.3.1 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of asset interaction, particularly requests targeting workspace IDs associated with other teams or projects.

Compensating Controls: Ensure strict role-based access control (RBAC) policies are enforced at the network level and consider placing the instance behind a WAF to detect anomalous API requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for an authenticated user to bypass workspace boundaries constitutes a critical failure in logical access control. Organizations utilizing Plane must prioritize upgrading to version 1.3.1 to ensure workspace integrity and prevent unauthorized cross-workspace data manipulation.

---METADATA---
VENDOR: Kubernetes
PRODUCT: mcp-server-kubernetes
AFFECTED_VERSIONS: Prior to version 3.6.0
---END_METADATA---

Description Summary:
An access control bypass in mcp-server-kubernetes allows clients to invoke Kubernetes operations directly, bypassing tool discovery restrictions.

Executive Summary:
A failure in access control enforcement within the mcp-server-kubernetes tool allows unauthorized execution of sensitive cluster management commands.

Vulnerability Details

CVE-ID: CVE-2026-46519

Affected Software: Kubernetes mcp-server-kubernetes

Affected Versions: Prior to version 3.6.0

Vulnerability: The project enforces environment variables intended to restrict Kubernetes operations only at the tool discovery layer (tools/list). It fails to enforce these same restrictions at the execution layer (tools/call), allowing any client that knows the name of a restricted tool to invoke it directly.

Business Impact

With a CVSS score of 8.8, this is a critical security failure. If an attacker gains access to the MCP server, they can execute unauthorized Kubernetes cluster management operations. This could lead to the deletion of resources, unauthorized access to secrets, or full cluster compromise, significantly impacting the stability and security of the entire infrastructure.

Remediation Plan

Immediate Action: Upgrade to mcp-server-kubernetes version 3.6.0 or later to ensure that security restrictions are properly enforced during the tool execution phase.

Proactive Monitoring: Audit Kubernetes API server logs for unexpected or unauthorized tool execution calls originating from the MCP server.

Compensating Controls: Implement strict network policies and RBAC for the MCP server itself, ensuring that only authenticated and authorized entities can communicate with the server endpoint.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Access control failures at the execution level are extremely dangerous in infrastructure management tools. Administrators must ensure that security logic is applied consistently across all request pathways and should prioritize the update to version 3.6.0 immediately.

---METADATA---
VENDOR: mwtcmi
PRODUCT: frogman
AFFECTED_VERSIONS: < 1.6.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in mwtcmi frogman allows authenticated users with low-level permissions to access sensitive system secrets and execute unauthorized administrative commands.

Executive Summary:
An authenticated missing authorization vulnerability in mwtcmi frogman enables low-privileged users to exfiltrate critical system credentials and execute administrative functions.

Vulnerability Details

CVE-ID: CVE-2026-46515

Affected Software: mwtcmi frogman

Affected Versions: < 1.6.3

Vulnerability: The application fails to perform adequate authorization checks for multiple API functions, allowing users with PERM_READ access to invoke sensitive endpoints. This flaw exposes sensitive data, including Asterisk dialplan contexts, SSH commands, and raw SIP credentials.

Business Impact

The exploitation of this vulnerability allows unauthorized access to sensitive configuration and authentication data. With a CVSS score of 9.3, the impact is critical: it facilitates full system compromise, potential lateral movement within the telephony infrastructure, and the exposure of proprietary communication data.

Remediation Plan

Immediate Action: Upgrade mwtcmi frogman to version 1.6.3 or later to apply the necessary authorization checks.

Proactive Monitoring: Review access logs for unusual patterns of API calls, specifically monitoring for repeated invocations of administrative functions by low-privileged user accounts.

Compensating Controls: Implement strict network segmentation to limit access to the frogman API to known, trusted management workstations only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a fundamental failure to enforce access controls on sensitive API endpoints, making it highly susceptible to exploitation by any authenticated user.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating to version 1.6.3 to close the authorization gap and prevent the exfiltration of sensitive credentials and configuration data.

---METADATA---
VENDOR: mwtcmi
PRODUCT: Frogman
AFFECTED_VERSIONS: < 1.6.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An input validation flaw in the Frogman PBX control software allows authenticated users with writing privileges to inject arbitrary Asterisk directives.

Executive Summary:
A critical code injection vulnerability in Frogman allows authenticated attackers to execute arbitrary Asterisk commands, potentially leading to full control over PBX operations.

Vulnerability Details

CVE-ID: CVE-2026-46512

Affected Software: mwtcmi Frogman

Affected Versions: < 1.6.2

Vulnerability: The application fails to properly sanitize template parameters used in dialplan configuration. An authenticated user possessing PERM_WRITE capabilities can exploit this to inject malicious directives such as System or SHELL into the Asterisk configuration files.

Business Impact

Exploitation allows an attacker to manipulate PBX functionality, potentially intercepting communications, rerouting calls, or executing OS-level commands through Asterisk. With a CVSS score of 9.9, this vulnerability poses a severe threat to the integrity and confidentiality of voice infrastructure.

Remediation Plan

Immediate Action: Upgrade to Frogman version 1.6.2 to resolve the sanitization failures in the dialplan application logic.

Proactive Monitoring: Monitor Asterisk configuration files for unexpected changes or the inclusion of unauthorized directives. Audit user permissions to ensure only authorized personnel have write access to dialplan templates.

Compensating Controls: Implement strict role-based access controls to limit the number of users with PERM_WRITE privileges until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the ability to escape into the Asterisk shell environment makes this a high-impact vector.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest version of Frogman. Security teams should verify that all write-capable user accounts are strictly managed to minimize the risk of internal or credential-based abuse.

---METADATA---
VENDOR: SimpleSAMLphp
PRODUCT: casserver
AFFECTED_VERSIONS: Prior to version 7.0.3
---END_METADATA---

Description Summary:
A path traversal vulnerability in the SimpleSAMLphp-casserver allows attackers to read and potentially execute arbitrary code via malicious file-based ticket manipulation.

Executive Summary:
The SimpleSAMLphp-casserver module is vulnerable to path traversal and remote code execution, requiring an immediate update to version 7.0.3.

Vulnerability Details

CVE-ID: CVE-2026-46491

Affected Software: SimpleSAMLphp-casserver

Affected Versions: Prior to version 7.0.3

Vulnerability: The vulnerability stems from improper input validation and path construction in the file-based ticket storage. Attackers can use path traversal sequences like ../target.serialized to read and unserialize files outside the intended directory, facilitating remote code execution.

Business Impact

The CVSS score of 8.6 reflects the severe risk of remote code execution, which could allow an attacker to gain full control over the underlying server. This could lead to a complete compromise of authentication services, data exfiltration, and significant reputational damage to organizations relying on this CAS implementation.

Remediation Plan

Immediate Action: Update the SimpleSAMLphp-casserver module to version 7.0.3 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious file access patterns, particularly those involving directory traversal sequences or attempts to access serialized files outside the designated ticket storage directory.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block path traversal attempts and suspicious serialized data patterns.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 11, 2026, public exploitation information is available for this vulnerability. Organizations should treat this as a high-priority incident and apply patches immediately.

Analyst Recommendation

The presence of a public exploit significantly increases the risk of active targeting. Security teams should prioritize patching this vulnerability immediately to prevent unauthorized access and potential system takeover.

---METADATA---
VENDOR: Samlify
PRODUCT: Samlify
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Samlify Node.js library, which is commonly used for SAML authentication.

Executive Summary:
A critical security flaw in the Samlify Node.js library threatens the integrity of SAML-based authentication mechanisms in integrated applications.

Vulnerability Details

CVE-ID: CVE-2026-46490

Affected Software: Samlify (Node.js library)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts the Samlify library, a tool for handling SAML assertions in Node.js applications. The flaw potentially compromises the authentication flow, which could allow for identity spoofing or authentication bypass depending on the implementation.

Business Impact

As Samlify is used to manage authentication, a vulnerability here puts the security of all connected applications at risk. A CVSS score of 8.8 highlights the possibility of unauthorized access to protected resources, which could lead to widespread data exposure across the enterprise.

Remediation Plan

Immediate Action: Update the Samlify library dependency in all Node.js projects to the version specified by the vendor as containing the fix.

Proactive Monitoring: Monitor authentication logs for suspicious login patterns or irregular SAML assertion failures.

Compensating Controls: Implement additional validation checks for SAML assertions at the application level as a secondary layer of defense.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of authentication libraries, developers and security teams must treat this update as a high priority. Ensure that all applications utilizing the Samlify library are patched and tested to maintain the integrity of user identity management.

---METADATA---
VENDOR: SolidInvoice
PRODUCT: SolidInvoice
AFFECTED_VERSIONS: SolidInvoice up to 2.3.16
---END_METADATA---

Description Summary:
An authenticated administrator in SolidInvoice can upload an SVG file containing embedded JavaScript, resulting in stored cross-site scripting (XSS).

Executive Summary:
A stored XSS vulnerability in SolidInvoice allows an authenticated administrator to execute malicious scripts in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2026-46489

Affected Software: SolidInvoice

Affected Versions: SolidInvoice up to 2.3.16

Vulnerability: The application fails to properly sanitize SVG file uploads. An authenticated administrator can upload an SVG file containing malicious JavaScript, which is then stored and executed in the browser of any user who views the file.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a significant risk to the integrity of user sessions. An attacker can use this XSS to steal session cookies, capture administrative credentials, or perform unauthorized actions on behalf of other users, leading to potential data breach and administrative account compromise.

Remediation Plan

Immediate Action: Upgrade SolidInvoice to version 2.3.17 or later to implement strict file upload sanitization.

Proactive Monitoring: Review audit logs for suspicious file uploads and monitor for anomalous browser behavior among administrative users.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts script execution and prevents the loading of unauthorized scripts from uploaded files.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This stored XSS vulnerability grants significant leverage to an attacker who has already gained administrative access. Updating to version 2.3.17 is essential to prevent the execution of malicious scripts and protect the organization's user base from cross-site scripting attacks.

---METADATA---
VENDOR: Lissy93
PRODUCT: Dashy
AFFECTED_VERSIONS: < 4.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dashy contains a vulnerability allowing for improper access control and authentication, which may lead to unauthorized system configuration changes.

Executive Summary:
An improper access control vulnerability in Lissy93 Dashy versions prior to 4.0.8 poses a high risk of unauthorized configuration manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46485

Affected Software: Lissy93 Dashy

Affected Versions: < 4.0.8

Vulnerability: This vulnerability involves improper authentication and access control mechanisms, allowing unauthenticated attackers to potentially modify system settings or configurations.

Business Impact

The ability for an unauthenticated attacker to alter dashboard configurations can lead to severe operational disruption or the exposure of sensitive internal service references. With a CVSS score of 8.2, this high-severity flaw represents a significant risk to the integrity and availability of the self-hosted dashboard environment.

Remediation Plan

Immediate Action: Update Dashy to version 4.0.8 or later immediately to resolve the authentication and access control flaws.

Proactive Monitoring: Review system configuration files for unexpected changes and monitor access logs for unauthorized attempts to reach administrative endpoints.

Compensating Controls: Restrict network access to the Dashy instance using a VPN or IP allowlisting at the firewall level to prevent external, unauthenticated exposure.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which allows for remote control over configuration settings.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize patching this system. Please apply the 4.0.8 update as soon as possible to prevent potential unauthorized access and configuration tampering.

---METADATA---
VENDOR: Headplane
PRODUCT: Headplane Web UI
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Headplane Web UI for Headscale, which may permit unauthorized access or impact the management of the network overlay.

Executive Summary:
A high-severity vulnerability in the Headplane management interface could allow unauthorized actors to manipulate network configurations.

Vulnerability Details

CVE-ID: CVE-2026-46484

Affected Software: Headplane Web UI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the Web UI layer, likely involving an authentication or access control bypass that permits an attacker to perform administrative actions without valid credentials.

Business Impact

The CVSS score of 8.1 highlights the risk of unauthorized management of network infrastructure. Since Headplane interfaces with Headscale (a Tailscale-compatible controller), an exploit could allow an attacker to disrupt network connectivity, add unauthorized nodes, or access sensitive network metadata, causing widespread operational disruption.

Remediation Plan

Immediate Action: Apply the latest security updates released by the Headplane maintainers immediately.

Proactive Monitoring: Monitor logs for unauthorized login attempts or unexpected modifications to the network state, such as newly registered nodes that were not authorized by the administrator.

Compensating Controls: Implement strict network segmentation to ensure the Headplane UI is not exposed to the public internet, requiring a VPN or proxy with authentication for access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of network management tools, it is imperative to mitigate this vulnerability promptly. Administrators should verify their current version and apply patches immediately to prevent potential unauthorized access to the network control plane.

---METADATA---
VENDOR: OpenMetadata
PRODUCT: OpenMetadata Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been disclosed in the OpenMetadata unified metadata platform, potentially impacting system security and data integrity.

Executive Summary:
A critical security flaw within the OpenMetadata platform exposes the environment to unauthorized access, necessitating immediate administrative review.

Vulnerability Details

CVE-ID: CVE-2026-46481

Affected Software: OpenMetadata Platform

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core functionality of the metadata platform, likely involving improper authorization checks that could permit unauthorized actors to interact with sensitive metadata or administrative functions.

Business Impact

With a CVSS score of 8.3, this vulnerability represents a significant risk to data governance environments. Unauthorized access to metadata platforms can lead to the exposure of sensitive data structures, business intelligence configurations, and internal system architectures, potentially facilitating further lateral movement within the network.

Remediation Plan

Immediate Action: Update the OpenMetadata deployment to the latest version provided by the vendor to address the underlying security defect.

Proactive Monitoring: Conduct a thorough audit of user authentication logs and monitor for unusual API activity or unauthorized configuration changes within the platform.

Compensating Controls: Restrict network access to the OpenMetadata interface to trusted IP ranges and ensure all administrative interfaces are protected by multi-factor authentication (MFA).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue demands immediate attention. System administrators should prioritize testing and deploying the latest vendor updates in non-production environments before rolling them out to production to maintain the integrity of their data metadata infrastructure.

---METADATA---
VENDOR: FlowiseAI
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Flowise drag-and-drop user interface used for building Large Language Model (LLM) flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow interface poses a significant risk to organizations utilizing this platform for AI automation.

Vulnerability Details

CVE-ID: CVE-2026-46480

Affected Software: FlowiseAI Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Flowise interface, which is used for creating customized LLM flows. While specific technical details are limited, the severity score of 8.8 indicates a significant security deficiency potentially allowing for unauthorized access or code execution.

Business Impact

Compromise of the Flowise interface could allow attackers to manipulate LLM workflows, potentially leading to unauthorized data exfiltration, injection of malicious prompts, or disruption of AI-driven business processes. A CVSS score of 8.8 necessitates immediate attention to prevent the abuse of sensitive LLM integrations.

Remediation Plan

Immediate Action: Check the vendor's official documentation for the latest release and update the Flowise instance to the recommended secure version.

Proactive Monitoring: Review access logs for the Flowise dashboard and monitor for unusual workflow configurations or unauthorized project modifications.

Compensating Controls: Place the Flowise interface behind a reverse proxy or VPN with strict authentication requirements to minimize exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations integrating Flowise into their production pipelines should treat this vulnerability as urgent. Apply available patches immediately and audit existing LLM flows for any signs of tampering or unauthorized configuration changes.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46479

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Flowise interface. Users should assume that any flaw in this component requires prompt remediation to prevent unauthorized access or system-level exploitation.

Business Impact

A CVSS score of 8.8 warrants immediate remediation efforts to prevent potential compromise of the Flowise environment. Failure to address this could lead to unauthorized access to sensitive data processed by the LLM, resulting in severe operational or reputational damage.

Remediation Plan

Immediate Action: Ensure the installation is updated to the latest vendor-provided release.

Proactive Monitoring: Maintain detailed logs of all administrative actions within the Flowise interface to identify any unauthorized configuration changes.

Compensating Controls: Restrict access to the Flowise management interface to authorized personnel only via VPN or secure gateway solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity, it is imperative to maintain a proactive posture by applying updates as soon as they become available. Regularly auditing the security configuration of the Flowise environment is recommended to minimize the attack surface.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46478

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. As with related entries, the flaw requires immediate attention to prevent unauthorized interaction with LLM orchestration components.

Business Impact

With a CVSS score of 8.8, this vulnerability indicates a high potential for impact, potentially allowing attackers to compromise LLM flow integrity. This could lead to unauthorized data processing or the injection of malicious instructions into the language model pipelines.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor immediately upon release to address the underlying vulnerability.

Proactive Monitoring: Monitor application logs for anomalous activity, particularly actions related to workflow creation or modification by non-authorized users.

Compensating Controls: Utilize Web Application Firewalls (WAF) to monitor and block potentially malicious payload structures targeting the Flowise interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Ensure that the Flowise instance is not exposed to untrusted networks and apply all vendor-supplied patches promptly to secure the LLM infrastructure.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists within the Flowise drag-and-drop interface used for building customized large language model flows.

Executive Summary:
A high-severity vulnerability in the Flowise LLM workflow platform poses a significant risk to the integrity and confidentiality of integrated data environments.

Vulnerability Details

CVE-ID: CVE-2026-46477

Affected Software: Flowise Flowise

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an issue within the Flowise workflow interface. While specific authentication requirements are currently pending further disclosure, similar flaws in low-code platforms often permit unauthorized execution or data access.

Business Impact

Successful exploitation of this flaw could result in unauthorized access to sensitive LLM data pipelines or the manipulation of workflow logic. Given the CVSS score of 8.8, this vulnerability represents a high risk that could lead to significant data exfiltration or service disruption if attackers gain control over LLM orchestration.

Remediation Plan

Immediate Action: Update the Flowise deployment to the latest version provided by the vendor as soon as an official security patch is released.

Proactive Monitoring: Review system and application access logs for unusual traffic patterns or unauthorized API requests directed at the Flowise interface.

Compensating Controls: Implement strict network access controls and utilize a Web Application Firewall (WAF) to filter suspicious requests targeting the workflow builder.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Flowise must prioritize the monitoring of vendor security channels for patch availability. Due to the high CVSS score, it is recommended to isolate the service from public-facing networks until a verified update is applied to mitigate the risk of unauthorized workflow manipulation.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Flowise versions prior to 3.1.2
---END_METADATA---

Description Summary:
A mass assignment vulnerability in Flowise allows an authenticated user to take over custom templates belonging to other workspaces.

Executive Summary:
A high-severity mass assignment vulnerability in Flowise allows authenticated users to hijack other users' custom templates, potentially compromising proprietary LLM workflows.

Vulnerability Details

CVE-ID: CVE-2026-46476

Affected Software: Flowise

Affected Versions: Prior to 3.1.2

Vulnerability: This is a mass assignment flaw where any authenticated user with edit permissions can reassign a custom template to any workspace by guessing or enumerating the workspace UUID. This allows for unauthorized modification or theft of custom LLM flow configurations.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity of AI-driven business processes. Unauthorized access to custom LLM templates can lead to the exposure of sensitive logic, intellectual property theft, or the injection of malicious prompts into corporate workflows.

Remediation Plan

Immediate Action: Upgrade Flowise to version 3.1.2 or later to address the mass assignment vulnerability.

Proactive Monitoring: Review access logs for unusual workspace modification requests or unauthorized enumeration of UUIDs.

Compensating Controls: Implement strict access control policies and ensure that workspace identifiers are not exposed in client-side responses or predictable formats.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 16, 2026, a public exploit is available. The relative ease of enumerating UUIDs makes this a high-priority risk for all Flowise deployments.

Analyst Recommendation

The combination of a mass assignment flaw and a public exploit makes this a critical security concern. Organizations should update their Flowise installations immediately and audit existing workspace configurations to ensure no templates have been subject to unauthorized reassignment.

---METADATA---
VENDOR: Flowise
PRODUCT: Flowise
AFFECTED_VERSIONS: Prior to version 3.1.2
---END_METADATA---

Description Summary:
A mass-assignment vulnerability in Flowise allows authenticated users to move assistants between workspaces, resulting in cross-workspace takeover.

Executive Summary:
A mass-assignment flaw in the Flowise platform allows authenticated users to hijack assistants from other workspaces, leading to unauthorized data access and flow manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46475

Affected Software: Flowise

Affected Versions: Prior to version 3.1.2

Vulnerability: This is a mass-assignment vulnerability occurring during the creation or update of assistants. By manipulating the workspaceId in a PUT request, an authenticated user can reassign an assistant to a workspace they control.

Business Impact

With a CVSS score of 8.8, this vulnerability allows for significant unauthorized access within multi-tenant or collaborative environments. The potential for cross-workspace takeover could result in the compromise of sensitive LLM flows and proprietary data, severely impacting organizational security posture.

Remediation Plan

Immediate Action: Update the Flowise platform to version 3.1.2 or later to correct the mass-assignment vulnerability.

Proactive Monitoring: Review access and API logs for unusual PUT requests or unauthorized attempts to modify workspace associations.

Compensating Controls: Implement strict role-based access control (RBAC) and validate that users only have permissions within their intended workspace to limit the impact of such flaws.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate workspace associations represents a critical authorization bypass. Administrators must update to the latest version immediately to ensure that workspace isolation is properly enforced and to prevent unauthorized access to sensitive LLM flows.

---METADATA---
VENDOR: TCHATZI
PRODUCT: Authen::TOTP
AFFECTED_VERSIONS: 0 up to (excluding) 0.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Authen::TOTP Perl module contains a vulnerability related to insufficient entropy, which may weaken the security of generated Time-based One-Time Passwords.

Executive Summary:
A vulnerability in the Authen::TOTP library involving insufficient entropy potentially allows for the prediction of authentication tokens, undermining multi-factor security controls.

Vulnerability Details

CVE-ID: CVE-2026-46473

Affected Software: TCHATZI Authen::TOTP

Affected Versions: 0 up to (excluding) 0.1.1

Vulnerability: This vulnerability (CWE-331) stems from insufficient entropy during token generation. It is an unauthenticated vulnerability, as it affects the underlying cryptographic strength of the TOTP implementation itself.

Business Impact

If the TOTP tokens generated by this library are predictable, an attacker could potentially bypass multi-factor authentication (MFA) mechanisms that rely on this module. This could lead to unauthorized account access, identity theft, and the compromise of any systems protected by the affected MFA implementation. The CVSS score of 7.5 highlights the significant threat to authentication integrity.

Remediation Plan

Immediate Action: Upgrade the Authen::TOTP module to version 0.1.1 or later to ensure cryptographically secure token generation.

Proactive Monitoring: Review authentication logs for patterns suggesting brute-force or prediction-based attempts against MFA-protected accounts.

Compensating Controls: Where possible, verify if the implementation allows for alternative, cryptographically stronger TOTP libraries until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically concerning due to the critical role of TOTP in modern security architectures.

Analyst Recommendation

The reliance on predictable tokens negates the primary purpose of multi-factor authentication. IT teams using the Authen::TOTP module must treat this as a high-priority update to restore the integrity of their authentication systems and prevent potential account takeovers.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper input validation vulnerability exists in the Apache Camel NATS component, which may allow for unauthorized data processing.

Executive Summary:
An unauthenticated input validation vulnerability in the Apache Camel NATS component creates a significant risk of unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-46457

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.0.0 up to 4.14.8, 4.15.0 up to 4.18.3, 4.19.0 up to 4.21.0

Vulnerability: The NATS component fails to perform adequate input validation. This enables an unauthenticated attacker to send crafted inputs that the component may process improperly, leading to potential integrity compromise.

Business Impact

The CVSS score of 7.5 reflects the high risk posed by this vulnerability. Successful exploitation could allow an attacker to inject unauthorized messages or data into the NATS infrastructure, potentially disrupting business processes or altering the state of downstream systems that rely on Camel-processed data.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the Apache Camel NATS component immediately.

Proactive Monitoring: Review NATS message traffic and application logs for unusual input patterns or unexpected message payloads that do not conform to expected schema formats.

Compensating Controls: Utilize message authentication and validation proxies to filter incoming traffic to the NATS component until the underlying software can be patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Input validation flaws are common vectors for system disruption. Organizations should prioritize the application of the vendor's security update to ensure that the NATS component correctly handles input, thereby maintaining the integrity of the data stream.