---METADATA---
VENDOR: Himmelblau
PRODUCT: Himmelblau
AFFECTED_VERSIONS: 3.0.0 to before 3.1.0
---END_METADATA---

Description Summary:
Himmelblau allows unauthenticated remote attackers to bypass tenant-scoped authentication when no tenant domain is configured, enabling unauthorized access via dynamic provider registration.

Executive Summary:
A critical authentication vulnerability in Himmelblau allows unauthenticated attackers to bypass domain restrictions and gain access to Microsoft Azure Entra ID and Intune environments.

Vulnerability Details

CVE-ID: CVE-2026-31957

Affected Software: Himmelblau Interoperability Suite

Affected Versions: 3.0.0 to before 3.1.0

Vulnerability: When deployed without a configured tenant domain in himmelblau.conf, the suite fails to enforce tenant-scoped authentication. This allows an unauthenticated attacker to use arbitrary Entra ID domains by dynamically registering providers at runtime, bypassing intended security boundaries in remote environments.

Business Impact

This flaw permits unauthorized access to sensitive enterprise identity and device management platforms. Given the CVSS score of 10, the risk includes total compromise of Azure Entra ID and Intune configurations, leading to unauthorized data access and potential lateral movement across the corporate cloud infrastructure.

Remediation Plan

Immediate Action: Update the Himmelblau suite to version 3.1.0 immediately and ensure a specific tenant domain is configured in the himmelblau.conf file.

Proactive Monitoring: Review authentication logs for login attempts from unexpected or unknown Entra ID domains and monitor for dynamic provider registration events.

Compensating Controls: Use IP allowlisting to restrict access to the Himmelblau service and implement multi-factor authentication (MFA) across all identity providers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. The "bootstrap" nature of this behavior increases the likelihood of misconfiguration in production environments.

Analyst Recommendation

Organizations relying on Himmelblau for Azure interoperability must treat this as a top-priority remediation. The ability to bypass tenant scoping effectively nullifies identity boundaries, necessitating an immediate update to version 3.1.0 to restore secure authentication.

---METADATA---
VENDOR: OpenOlat
PRODUCT: OpenOlat (e-learning platform)
AFFECTED_VERSIONS: 10.5.4 to before 20.2.5
---END_METADATA---

Description Summary:
OpenOlat fails to verify JWT signatures in its OpenID Connect implicit flow implementation, allowing attackers to bypass authentication by providing forged, unverified tokens.

Executive Summary:
OpenOlat’s failure to cryptographically verify JWT signatures allows unauthenticated attackers to forge identity tokens and gain unauthorized access to the e-learning platform.

Vulnerability Details

CVE-ID: CVE-2026-31946

Affected Software: OpenOlat OpenOlat (e-learning platform)

Affected Versions: 10.5.4 to before 20.2.5

Vulnerability: The OpenID Connect implementation in OpenOlat incorrectly parses JWTs by discarding the signature segment without verification. Because the getAccessToken() method only validates non-cryptographic claims like audience and issuer, an unauthenticated attacker can craft a malicious JWT that the system accepts as valid.

Business Impact

This flaw effectively nullifies the security of the OpenID Connect authentication mechanism, leading to potential widespread account takeovers and unauthorized access to sensitive educational data. The CVSS score of 9.8 underscores the critical nature of this authentication bypass, which threatens the privacy of students and staff and the overall integrity of the platform.

Remediation Plan

Immediate Action: Upgrade OpenOlat installations to version 20.2.5 or higher, which introduces mandatory cryptographic signature verification against the Identity Provider's JWKS endpoint.

Proactive Monitoring: Audit authentication logs for unusual login patterns or JWTs lacking standard headers, and monitor for unauthorized access to administrative or privileged user accounts.

Compensating Controls: If an immediate update is not possible, consider temporarily disabling OIDC implicit flow or enforcing secondary authentication factors where applicable.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical details provided in the disclosure make the creation of a functional exploit trivial for a motivated attacker.

Analyst Recommendation

The absence of signature verification is a fundamental security failure in any OIDC implementation. Administrators must treat this as a top-priority security event and apply the 20.2.5 patch immediately to ensure that only authenticated, verified users can access the system.

---METADATA---
VENDOR: LibreChat
PRODUCT: LibreChat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
LibreChat, an open-source ChatGPT clone, contains a high-severity vulnerability that could impact the security of the AI interface and user data.

Executive Summary:
LibreChat is affected by a high-severity security vulnerability that could allow attackers to compromise the application environment or gain unauthorized access to user sessions.

Vulnerability Details

CVE-ID: CVE-2026-31945

Affected Software: LibreChat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the LibreChat application, a platform for interfacing with various AI models. With a CVSS score of 7.7, the flaw likely involves improper input validation or a session management issue that could be exploited by an attacker to intercept data or perform actions on behalf of users.

Business Impact

Exploitation of this vulnerability could lead to the exposure of sensitive AI prompts, API keys, and private conversations. In a corporate environment, this represents a significant data leak risk. The High severity rating (7.7) reflects the potential for attackers to disrupt the service or compromise the privacy of all users on the platform.

Remediation Plan

Immediate Action: Administrators of LibreChat instances should pull the latest Docker images or update the source code to the most recent patched version immediately.

Proactive Monitoring: Review application logs for suspicious API calls or unauthorized attempts to access the administrative dashboard.

Compensating Controls: Implement a reverse proxy with strong authentication (e.g., OAuth or SAML) to protect the LibreChat interface from direct public exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation. However, open-source AI tools are currently high-interest targets for researchers and malicious actors alike.

Analyst Recommendation

Given the increasing use of AI clones in business workflows, this vulnerability should be treated with high priority. Administrators must ensure their LibreChat deployments are updated to the latest version to protect user data and maintain the integrity of the AI environment.

---METADATA---
VENDOR: LibreChat
PRODUCT: LibreChat
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
LibreChat, an open-source ChatGPT clone, contains a vulnerability that could allow for unauthorized access to application features or user data.

Executive Summary:
LibreChat is affected by a high-severity vulnerability that could lead to the compromise of user conversations and sensitive application configurations.

Vulnerability Details

CVE-ID: CVE-2026-31944

Affected Software: LibreChat

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the LibreChat application framework, which provides additional features over standard AI interfaces. The flaw likely involves improper access control or input validation, potentially allowing an attacker to interact with the system in an unauthorized manner.

Business Impact

The impact of this vulnerability includes potential data breaches involving private AI conversations and the exposure of API keys or other secrets stored within the LibreChat environment. With a CVSS score of 7.6, the risk is high, as it directly threatens the privacy of users and the security of integrated AI services.

Remediation Plan

Immediate Action: Update the LibreChat deployment to the latest version available on the official repository to patch the security flaw.

Proactive Monitoring: Audit user activity logs for unusual login patterns or unauthorized access to administrative features.

Compensating Controls: Deploy the application behind a reverse proxy with strong authentication and utilize a WAF to inspect incoming traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, open-source AI tools are frequent targets for attackers seeking to harvest credentials or sensitive data.

Analyst Recommendation

Administrators of LibreChat instances should prioritize the application of security updates to protect user privacy and organizational assets. Immediate remediation is necessary to ensure that the AI chat environment remains secure against unauthorized access and data exfiltration.

---METADATA---
VENDOR: LibreChat
PRODUCT: LibreChat
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in LibreChat, a ChatGPT clone, which may lead to unauthorized access or system compromise.

Executive Summary:
LibreChat is affected by a high-severity security flaw that could compromise the confidentiality and integrity of the AI chat platform.

Vulnerability Details

CVE-ID: CVE-2026-31943

Affected Software: LibreChat

Affected Versions: See vendor advisory for affected versions

Vulnerability: While the specific technical vector is not detailed in the summary, the high CVSS score of 8.5 suggests a significant flaw, likely involving improper access control or input validation within the LibreChat application.

Business Impact

A successful exploit could allow attackers to access private chat histories, manipulate AI responses, or gain unauthorized access to the application's underlying infrastructure. Given the CVSS score of 8.5, this vulnerability poses a substantial risk to user privacy and organizational data security, potentially leading to regulatory non-compliance.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the LibreChat maintainers immediately to close the identified security gap.

Proactive Monitoring: Review application logs for unusual API calls or unauthorized attempts to access user sessions and administrative settings.

Compensating Controls: Implement strong authentication mechanisms, such as Multi-Factor Authentication (MFA), and use a Web Application Firewall to monitor incoming traffic for malicious patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 28, 2026, there is no public information indicating active exploitation of this vulnerability. Users should remain vigilant as ChatGPT clones are increasingly targeted by threat actors seeking to harvest credentials or session tokens.

Analyst Recommendation

The high severity of this vulnerability requires immediate attention. Organizations deploying LibreChat should verify their current version and update to the latest patched release to ensure the continued security of their AI communications and data.

---METADATA---
VENDOR: jsPDF Project
PRODUCT: jsPDF Library
AFFECTED_VERSIONS: Prior to version 4.2.1
---END_METADATA---

Description Summary:
jsPDF versions prior to 4.2.1 are vulnerable to HTML and script injection via the output function's options argument, leading to Cross-Site Scripting (XSS).

Executive Summary:
The jsPDF JavaScript library contains a critical vulnerability that allows attackers to inject malicious scripts into the browser context of victims who open generated PDFs.

Vulnerability Details

CVE-ID: CVE-2026-31938

Affected Software: jsPDF Library

Affected Versions: Prior to version 4.2.1

Vulnerability: The output function fails to sanitize the options argument, allowing an unauthenticated attacker to provide malicious HTML or scripts. When a victim opens a PDF generated with these options, the script executes within their browser context.

Business Impact

This vulnerability facilitates Cross-Site Scripting (XSS), which can lead to the theft of session cookies, sensitive data, or the modification of the user's browser environment. Given the CVSS score of 9.6, the risk is critical as it allows for remote code execution in the client's browser, potentially compromising internal web applications that utilize the library.

Remediation Plan

Immediate Action: Upgrade the jsPDF library to version 4.2.1 or higher to resolve the sanitization failure in the output function.

Proactive Monitoring: Review application code to identify where user-controlled input is passed to the jsPDF library and ensure all inputs are strictly validated.

Compensating Controls: As a temporary workaround, implement robust server-side and client-side sanitization of any user input before it is passed to the output method of the jsPDF library.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical ease of injecting scripts into JavaScript libraries makes this a high-priority target for attackers.

Analyst Recommendation

Organizations using jsPDF for dynamic document generation must update to version 4.2.1 immediately. Failure to do so leaves end-users vulnerable to script injection attacks that can bypass browser security boundaries and compromise sensitive session data.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability identified in the Suricata network engine could be exploited to disrupt security monitoring or bypass detection mechanisms.

Executive Summary:
Suricata IDS/IPS sensors are affected by a high-severity vulnerability that poses a direct threat to network security and threat detection capabilities.

Vulnerability Details

CVE-ID: CVE-2026-31937

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the Suricata engine, impacting its network IDS and IPS functions. An unauthenticated attacker could potentially exploit this flaw through specially crafted network traffic, leading to a denial of service or detection evasion.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to organizational security. A failure in the Suricata engine can leave the network vulnerable to various attacks, leading to potential data breaches, system compromise, and significant reputational damage if an intrusion goes undetected.

Remediation Plan

Immediate Action: Update all affected Suricata instances to the latest secure version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Monitor for unexpected service restarts or unusual traffic patterns that might indicate an attempt to exploit the IDS engine.

Compensating Controls: Maintain up-to-date endpoint security and centralized logging to provide alternative methods of detection for malicious activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity underscores the need for prompt patching.

Analyst Recommendation

Immediate action is required to patch the Suricata engine. Security administrators should prioritize this update to ensure that the network's primary intrusion detection and prevention system remains effective and resilient.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity flaw in the Suricata engine could compromise the reliability of network intrusion detection and prevention.

Executive Summary:
The Suricata network IDS/IPS engine is vulnerable to an exploit that could lead to engine failure or the evasion of security controls.

Vulnerability Details

CVE-ID: CVE-2026-31935

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Suricata engine's ability to process network traffic correctly. An unauthenticated remote attacker could exploit this flaw to cause a denial of service or to bypass the security signatures intended to protect the network.

Business Impact

The compromise of a network security engine like Suricata can result in a complete loss of visibility into malicious network activity. Given the CVSS score of 7.5, the risk of a successful attack is high, potentially leading to long-term undetected access by adversaries and significant remediation costs.

Remediation Plan

Immediate Action: Apply the recommended security patches for Suricata as soon as they are made available by the vendor or distribution.

Proactive Monitoring: Regularly audit the Suricata configuration and performance metrics to ensure the engine is operating at full capacity and without errors.

Compensating Controls: Deploy additional network-level security measures, such as access control lists (ACLs) on routers, to provide a baseline level of protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. The complexity of modern network traffic makes engine-level vulnerabilities a constant threat.

Analyst Recommendation

Apply the primary remediation patch immediately. Ensuring the continued operation and integrity of the IDS/IPS infrastructure is paramount to maintaining an effective security posture against modern threats.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in Suricata's network engine could allow an attacker to bypass intrusion detection signatures or crash the inspection service.

Executive Summary:
Suricata, a critical network security engine, contains a high-severity vulnerability that could be exploited to disable or evade network monitoring.

Vulnerability Details

CVE-ID: CVE-2026-31934

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This flaw exists in the Suricata network IDS/IPS engine. It allows an unauthenticated attacker to potentially bypass security rules or cause a denial-of-service condition by sending malformed or specifically sequenced network traffic to the affected sensor.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant threat to network security operations. An effective exploit could disable the organization's "first line of defense," leading to increased risk of undetected breaches, intellectual property theft, and non-compliance with security standards.

Remediation Plan

Immediate Action: Upgrade the Suricata engine to the most recent version provided by the vendor to close the identified security gap.

Proactive Monitoring: Enable detailed logging for the Suricata engine to capture evidence of potential exploitation attempts or malformed packet processing errors.

Compensating Controls: Utilize a multi-vendor security strategy where possible to ensure that a single point of failure in one IDS engine does not leave the network entirely unprotected.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high severity and potential for IDS evasion make this a critical issue for security teams.

Analyst Recommendation

Immediate remediation via patching is strongly advised. Organizations should treat this as a high-priority update to ensure that their network monitoring capabilities are not compromised by external actors.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Suricata engine is vulnerable to a flaw that could result in a denial of service or the bypass of network security policies.

Executive Summary:
Suricata network security sensors are affected by a high-severity vulnerability that could compromise the integrity of network traffic inspection.

Vulnerability Details

CVE-ID: CVE-2026-31933

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides within the Suricata engine, which functions as a network IDS and IPS. An unauthenticated attacker may be able to trigger this flaw by sending specific network packets, potentially leading to a crash of the Suricata process or a failure to inspect certain traffic.

Business Impact

A CVSS score of 7.5 indicates a high severity level, as this flaw directly undermines the primary defensive mechanism for the network. A successful exploit could lead to unauthorized network access going unnoticed, resulting in data exfiltration, malware propagation, or significant operational disruptions.

Remediation Plan

Immediate Action: Update all Suricata installations to the latest patched version available from the vendor.

Proactive Monitoring: Implement external monitoring for the Suricata service status to detect and respond to any engine crashes in real-time.

Compensating Controls: Ensure that secondary security controls, such as NetFlow analysis, are active to provide visibility if the primary IDS fails.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Security researchers frequently target IDS engines, increasing the likelihood of an exploit being developed.

Analyst Recommendation

Apply the necessary patches without delay. Maintaining the health of network security infrastructure is a critical component of a robust defense-in-depth strategy, and this update is essential for risk mitigation.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security flaw in the Suricata IDS/IPS engine could permit attackers to interfere with network traffic analysis and security enforcement.

Executive Summary:
A vulnerability in the Suricata network engine poses a high risk to network visibility and the effectiveness of intrusion prevention measures.

Vulnerability Details

CVE-ID: CVE-2026-31932

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a defect in the Suricata engine's packet handling or protocol analysis modules. An unauthenticated remote attacker could leverage this flaw to disrupt the monitoring capabilities of the IDS or cause the service to fail.

Business Impact

The failure of an IDS/IPS engine can lead to a "blind spot" in the corporate network, allowing malicious actors to operate without detection. With a CVSS score of 7.5, the potential for system downtime and the resulting loss of security oversight represents a significant risk to organizational assets and data security.

Remediation Plan

Immediate Action: Deploy the official security updates for Suricata immediately to address this engine-level vulnerability.

Proactive Monitoring: Review Suricata alert logs for anomalies and ensure that the engine is not dropping packets or entering an error state.

Compensating Controls: Use network segmentation to limit the blast radius of any potential intrusion that might bypass the affected IDS sensors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. The critical nature of IDS software makes this a high-value target for attackers seeking to evade detection.

Analyst Recommendation

It is imperative to apply the recommended updates immediately. Security teams must treat any vulnerability in their monitoring infrastructure with the highest urgency to ensure that defensive capabilities remain intact.

---METADATA---
VENDOR: Suricata
PRODUCT: Suricata Engine
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Suricata network IDS/IPS engine that may impact traffic inspection.

Executive Summary:
The Suricata network security engine is affected by a vulnerability that could allow attackers to bypass security monitoring or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-31931

Affected Software: Suricata Engine

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the core processing engine of Suricata, a network intrusion detection and prevention system. An unauthenticated attacker could potentially send specially crafted network traffic to exploit this flaw, leading to engine instability or detection evasion.

Business Impact

As a critical component of network defense, a vulnerability in Suricata directly impacts the organization's ability to detect and block threats. The CVSS score of 7.5 reflects a high risk where the security appliance itself becomes a point of failure, potentially leading to undetected lateral movement by attackers or network downtime.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Suricata development team or your specific distribution maintainer.

Proactive Monitoring: Monitor the health and performance of Suricata sensors for unexpected crashes or high CPU utilization that may indicate exploitation.

Compensating Controls: Implement redundant security layers, such as host-based firewalls and endpoint detection, to mitigate the impact if the network IDS is bypassed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Given Suricata's role in security, any flaw in its engine is a high-priority concern for network administrators.

Analyst Recommendation

Immediate patching of all Suricata instances is required to maintain the security posture of the network. Administrators should verify that the engine is correctly processing traffic after the update to ensure continued protection against network-based threats.

---METADATA---
VENDOR: Daktronics
PRODUCT: VFC-DMP-5000
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Daktronics VFC-DMP-5000 devices utilize default administrative credentials with weak authentication controls, posing a significant risk of unauthorized access.

Executive Summary:
Daktronics VFC-DMP-5000 units are susceptible to unauthorized administrative access due to the use of insecure, non-mandatory default credentials.

Vulnerability Details

CVE-ID: CVE-2026-31928

Affected Software: Daktronics VFC-DMP-5000

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a credential management vulnerability where the device ships with a default administrative account. The lack of enforced password changes during initial setup allows for potential unauthenticated access by remote attackers.

Business Impact

The risk of unauthorized administrative access is critical, as it provides an attacker with full control over the device. With a CVSS score of 8.1, this vulnerability could lead to total system compromise, unauthorized data modification, or the use of the device as a pivot point for further lateral movement within the network.

Remediation Plan

Immediate Action: Manually change the default administrative credentials immediately and ensure strong, unique passwords are enforced for all management interfaces.

Proactive Monitoring: Monitor network traffic for unauthorized login attempts or unusual management console access patterns.

Compensating Controls: Place the device management interface behind a secure VPN or restrict access to specific, trusted management IP addresses via firewall rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Default credential vulnerabilities are a common target for automated exploitation tools. It is imperative that all organizations deploying these devices perform an immediate credential audit and enforce password rotation policies to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Ays Pro
PRODUCT: Fox LMS (WordPress Plugin)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Ays Pro Fox LMS plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to exfiltrate data from the database through inference.

Executive Summary:
The Ays Pro Fox LMS plugin contains a high-severity Blind SQL Injection vulnerability that enables attackers to silently extract sensitive information from the WordPress database.

Vulnerability Details

CVE-ID: CVE-2026-31922

Affected Software: Ays Pro Fox LMS (fox-lms)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Blind SQL Injection flaw caused by improper neutralization of user-supplied input in SQL commands. An attacker can use time-based or boolean-based techniques to infer the contents of the database, even without direct error messages.

Business Impact

With a CVSS score of 8.5, this vulnerability poses a significant threat to the confidentiality of student and course data. Attackers could steal user hashes, personal details, and administrative credentials, leading to a full site takeover and long-term data exfiltration.

Remediation Plan

Immediate Action: Apply the latest security update for the Ays Pro Fox LMS plugin immediately to close the SQL Injection vector.

Proactive Monitoring: Monitor for unusually slow database response times, which can be a symptom of time-based Blind SQL Injection attempts.

Compensating Controls: Utilize database-level security controls and a WAF to detect and drop suspicious requests containing SQL keywords or logical operators.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. Blind SQL Injection is harder to detect than standard SQLi but is equally dangerous for data integrity.

Analyst Recommendation

Given the high severity, immediate patching is mandatory. Organizations using Fox LMS must update the plugin to the latest version to prevent unauthorized data access and protect the privacy of their learning management system.

---METADATA---
VENDOR: weDevs
PRODUCT: WP ERP (WordPress Plugin)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The weDevs WP ERP plugin for WordPress is vulnerable to SQL Injection, which could allow attackers to extract or modify database information.

Executive Summary:
A high-severity SQL Injection vulnerability in the weDevs WP ERP plugin allows attackers to compromise the underlying WordPress database, leading to full data exposure.

Vulnerability Details

CVE-ID: CVE-2026-31917

Affected Software: weDevs WP ERP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin fails to properly neutralize special elements in SQL commands, resulting in a classic SQL Injection flaw. This allows an attacker to inject malicious SQL queries through vulnerable parameters, potentially bypassing authentication or extracting sensitive data.

Business Impact

The CVSS score of 8.5 indicates a severe risk. A successful exploit could lead to the complete compromise of the WordPress database, including user credentials, financial records, and proprietary business data managed within the ERP system, resulting in catastrophic data loss and reputational damage.

Remediation Plan

Immediate Action: Update the weDevs WP ERP plugin to the latest patched version immediately to remediate the SQL Injection vulnerability.

Proactive Monitoring: Enable database query logging and review for suspicious SQL patterns, such as "UNION SELECT" or unexpected administrative account creations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL Injection protection rules to block malicious payloads targeting the ERP plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. However, SQL Injection remains one of the most frequently exploited vulnerability classes in WordPress environments.

Analyst Recommendation

The high CVSS score and the nature of the vulnerability demand immediate action. Administrators must patch the WP ERP plugin without delay to prevent a total database compromise and ensure the security of their business operations.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Apache OFBiz, potentially allowing unauthorized internal network requests.

Executive Summary:
An SSRF vulnerability in Apache OFBiz allows unauthorized parties to manipulate internal network requests, posing a risk of information disclosure or further internal network exploitation.

Vulnerability Details

CVE-ID: CVE-2026-31910

Affected Software: Apache OFBiz

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is a Server-Side Request Forgery (SSRF) flaw in Apache OFBiz. It allows an attacker to force the application to make requests to unintended locations, which can be used to scan internal networks or interact with internal-only services.

Business Impact

The risk associated with SSRF includes the potential for attackers to bypass firewalls and interact with sensitive internal services that are otherwise inaccessible from the internet. With a CVSS score of 7.5, this vulnerability represents a high risk to organizational data security, potentially facilitating lateral movement within the network.

Remediation Plan

Immediate Action: Consult the official Apache OFBiz security advisory page to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Inspect network traffic logs for unusual outbound requests originating from the OFBiz server to internal resources or unexpected external endpoints.

Compensating Controls: Implement strict egress filtering on the server hosting OFBiz to restrict unauthorized network communication to sensitive internal segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information regarding active exploitation of this specific CVE. However, SSRF flaws in enterprise software are frequently targeted for reconnaissance and internal pivot attacks.

Analyst Recommendation

Organizations utilizing Apache OFBiz should treat this SSRF vulnerability as a high priority. Until a patch is applied, ensure that the server's network access is restricted to the minimum necessary functions to mitigate the impact of potential unauthorized internal requests.

---METADATA---
VENDOR: Apache
PRODUCT: OFBiz
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Apache OFBiz contains a vulnerability that allows unauthorized actors to access sensitive information due to improper exposure controls.

Executive Summary:
A critical information exposure vulnerability in Apache OFBiz poses a significant risk of unauthorized data access to sensitive organizational information.

Vulnerability Details

CVE-ID: CVE-2026-31909

Affected Software: Apache OFBiz

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The authentication requirement is currently unspecified, but the nature of the flaw suggests potential bypass of access controls.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive business data, potentially resulting in regulatory non-compliance, loss of intellectual property, and reputational damage. With a CVSS score of 7.5, this vulnerability represents a high-risk entry point that could be leveraged to gain unauthorized visibility into internal system states.

Remediation Plan

Immediate Action: Monitor official Apache security bulletins and apply the latest security patches or configuration updates as soon as they are released.

Proactive Monitoring: Review system and application access logs for unusual patterns, particularly unauthorized requests to sensitive endpoints or data directories.

Compensating Controls: Implement strict network segmentation and ensure the application is protected by a Web Application Firewall (WAF) configured to block suspicious or unauthorized access attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized data access, organizations should treat this vulnerability with high priority. Administrators must track vendor communications closely and apply updates immediately upon availability to mitigate the risk of information leakage.

---METADATA---
VENDOR: WebSocket API Provider
PRODUCT: WebSocket Application Programming Interface
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WebSocket Application Programming Interface lacks necessary restrictions on the frequency of authentication requests, facilitating automated credential attacks.

Executive Summary:
The WebSocket API is vulnerable to brute-force authentication attacks due to a lack of request rate limiting, posing a high risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-31904

Affected Software: WebSocket API Provider WebSocket Application Programming Interface

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application's WebSocket interface does not enforce a maximum threshold for authentication attempts. This allows an unauthenticated attacker to programmatically attempt thousands of password combinations without being blocked or delayed by the system.

Business Impact

Failure to restrict authentication attempts can result in widespread account compromise and the exposure of proprietary data handled via the WebSocket API. This leads to loss of data integrity and potential regulatory non-compliance regarding access controls. The CVSS score of 7.5 justifies the High severity rating, as the flaw directly impacts the confidentiality and integrity of the system.

Remediation Plan

Immediate Action: Update the affected software to the most recent version that includes fixes for authentication rate limiting.

Proactive Monitoring: Implement real-time alerting for high-frequency authentication failures and monitor for source IPs that deviate from normal traffic patterns.

Compensating Controls: Utilize an external identity provider or an API security layer to enforce multi-factor authentication (MFA) and request-per-second limits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of a public exploit, the technical barrier to entry for exploiting this flaw is extremely low.

Analyst Recommendation

This vulnerability represents a critical weakness in the authentication architecture of the WebSocket API. It is imperative that administrators apply the recommended security updates immediately. Relying on password complexity alone is insufficient when an attacker can perform unlimited attempts; therefore, patching is the only effective long-term mitigation.

---METADATA---
VENDOR: WebSocket API Provider
PRODUCT: WebSocket Application Programming Interface
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The WebSocket Application Programming Interface fails to implement rate limiting or restrictions on authentication requests, enabling potential brute-force attacks.

Executive Summary:
A high-severity vulnerability in the WebSocket API allows attackers to perform unlimited authentication attempts, significantly increasing the risk of unauthorized account access.

Vulnerability Details

CVE-ID: CVE-2026-31903

Affected Software: WebSocket API Provider WebSocket Application Programming Interface

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from a lack of improper throttling or account lockout mechanisms within the WebSocket API's authentication handler. An unauthenticated remote attacker can exploit this flaw by submitting an exhaustive number of authentication requests to crack user credentials.

Business Impact

The lack of authentication rate limiting poses a significant risk of account takeover and unauthorized data access. Successful exploitation could lead to the compromise of sensitive user information, administrative control over the API, and potential downstream impact on integrated systems. The CVSS score of 7.5 reflects a High severity, primarily due to the ease of automating brute-force attacks against exposed interfaces.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to implement authentication request throttling and account lockout policies.

Proactive Monitoring: Review authentication logs for an unusually high volume of failed login attempts originating from single IP addresses or targeting specific accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API Gateway with rate-limiting rules configured to block excessive requests to authentication endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, because brute-force techniques are standard in the attacker's toolkit, the potential for exploitation is high once the vulnerability is publicly disclosed.

Analyst Recommendation

The absence of authentication restrictions is a fundamental security oversight that must be addressed immediately. Organizations should prioritize the deployment of vendor-supplied patches to protect against automated credential-stuffing attacks. In the interim, strictly monitor API traffic for anomalous authentication patterns to detect and mitigate ongoing exploitation attempts.

---METADATA---
VENDOR: CairoSVG
PRODUCT: CairoSVG
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
CairoSVG, a Python-based SVG to PDF/PNG converter, is vulnerable to a flaw that may lead to unauthorized file access or resource exhaustion during graphics processing.

Executive Summary:
The CairoSVG library contains a high-severity vulnerability that could allow an attacker to compromise systems during the conversion of maliciously crafted SVG files.

Vulnerability Details

CVE-ID: CVE-2026-31899

Affected Software: CairoSVG

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the processing of SVG files by the CairoSVG library. Attackers may be able to provide specially crafted SVG files that exploit the underlying Cairo graphics library, potentially leading to Server-Side Request Forgery (SSRF) or local file inclusion.

Business Impact

With a CVSS score of 7.5, this vulnerability poses a high risk to applications that allow users to upload or process SVG images. An exploit could lead to the exposure of internal system files or provide a foothold for further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Upgrade the CairoSVG Python package to the latest version immediately to patch the processing flaw.

Proactive Monitoring: Monitor system resource usage and outbound network connections from servers performing SVG conversions for signs of SSRF or exploitation attempts.

Compensating Controls: Implement strict sandboxing for graphics processing tasks and use a Content Security Policy (CSP) to limit the capabilities of processed SVG content.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation. SVG processing libraries are frequent targets for researchers, and public exploits often follow shortly after disclosure.

Analyst Recommendation

Immediate remediation is required for any application utilizing CairoSVG for image conversion. Updating the library is the most effective way to mitigate the risk of remote exploitation and protect internal data from unauthorized access.

---METADATA---
VENDOR: jsPDF
PRODUCT: jsPDF
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
jsPDF contains a high-severity vulnerability within its JavaScript-based PDF generation logic that could allow for malicious exploitation during document creation.

Executive Summary:
A high-severity vulnerability in the jsPDF library poses a significant risk to applications generating client-side documents, potentially allowing for unauthorized code execution or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-31898

Affected Software: jsPDF jsPDF

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the core processing logic of the jsPDF library. While the specific mechanism is not detailed in the summary, vulnerabilities in this library often involve unauthenticated attackers manipulating document inputs to trigger improper memory handling or script execution.

Business Impact

A successful exploit could lead to the generation of malicious PDF files, which may be used to deliver further payloads to end-users or compromise the environment where the PDF is generated. With a CVSS score of 8.1, this represents a High-tier risk that could result in significant reputational damage and the loss of data integrity within automated reporting systems.

Remediation Plan

Immediate Action: Update the jsPDF library to the latest patched version available on npm or via the project's official repository to mitigate the underlying flaw.

Proactive Monitoring: Implement strict input validation for any user-supplied data that is incorporated into generated PDFs to detect and block injection attempts.

Compensating Controls: Deploy Content Security Policies (CSP) to restrict the execution of unauthorized scripts that might be triggered during the PDF generation process.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the widespread use of jsPDF in web applications, the potential for exploitation is high.

Analyst Recommendation

The High severity of this vulnerability (CVSS 8.1) necessitates immediate attention from development teams. Organizations should prioritize updating their dependencies and auditing their PDF generation workflows to ensure that malicious inputs cannot bypass existing security controls.

---METADATA---
VENDOR: WeGIA
PRODUCT: WeGIA
AFFECTED_VERSIONS: Prior to 3.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WeGIA contains a critical SQL injection vulnerability in the remover_produto_ocultar.php script due to improper handling of user-supplied request data.

Executive Summary:
A critical SQL injection vulnerability in WeGIA allows attackers to execute arbitrary database commands, leading to total data exfiltration or system disruption.

Vulnerability Details

CVE-ID: CVE-2026-31896

Affected Software: WeGIA

Affected Versions: Prior to 3.6.6

Vulnerability: The vulnerability stems from the use of extract($_REQUEST) followed by direct concatenation of variables into a SQL query. This allows an attacker to manipulate SQL queries, enabling unauthorized data access or denial-of-service via time-based attacks.

Business Impact

The severity of this flaw is underscored by the 9.8 CVSS score, indicating critical risk. An attacker can bypass security controls to extract the entire contents of the database, potentially including sensitive donor or institutional information, or render the application unusable.

Remediation Plan

Immediate Action: Update the WeGIA application to version 3.6.6 immediately to implement secure parameter binding and remove unsafe request handling.

Proactive Monitoring: Review database audit logs for anomalous query patterns, specifically looking for time-based delay commands or unexpected syntax.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious requests targeting the vulnerable script.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a high-impact vulnerability that requires immediate attention. Administrators must prioritize the update to version 3.6.6 to eliminate the insecure query execution path and protect institutional data.

---METADATA---
VENDOR: Dagu
PRODUCT: Dagu
AFFECTED_VERSIONS: Versions prior to 2.2.4
---END_METADATA---

Description Summary:
A path traversal vulnerability in Dagu's workflow engine allows attackers to manipulate the dagRunId field to delete arbitrary directories, including the system temporary directory.

Executive Summary:
A critical path traversal vulnerability in Dagu allows for arbitrary directory deletion, potentially leading to a system-wide denial of service on root or Docker deployments.

Vulnerability Details

CVE-ID: CVE-2026-31886

Affected Software: Dagu Workflow Engine

Affected Versions: Versions prior to 2.2.4

Vulnerability: This flaw exists in the inline DAG execution endpoints where the dagRunId field is passed to filepath.Join without validation. An unauthenticated or unauthorized caller can use ".." segments to traverse the file system, causing a deferred os.RemoveAll call to delete unintended directories, such as /tmp.

Business Impact

A successful exploit can result in a total Denial of Service (DoS). In non-root deployments, the attacker can disrupt all concurrent Dagu processes by deleting their temporary files. In root or Docker environments, the deletion of the entire /tmp directory can crash the underlying operating system and all hosted services. The CVSS score of 9.1 reflects the critical nature of this availability impact and the lack of complex requirements for exploitation.

Remediation Plan

Immediate Action: Update Dagu to version 2.2.4 or later immediately to resolve the path validation flaw and prevent unauthorized directory deletion.

Proactive Monitoring: Review system logs for HTTP requests containing directory traversal sequences (e.g., "../") targeted at DAG execution endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path traversal characters in the dagRunId parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of constructing a traversal payload, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, particularly for organizations running Dagu in containerized or root-privileged environments. The ability for an attacker to trigger a system-wide denial of service necessitates an immediate upgrade to version 2.2.4. Organizations should prioritize this patch in their next maintenance window to mitigate the risk of significant operational downtime.

---METADATA---
VENDOR: Taskosaur
PRODUCT: Taskosaur
AFFECTED_VERSIONS: 1.0.0
---END_METADATA---

Description Summary:
Taskosaur 1.0.0 allows unauthenticated attackers to register accounts with SUPER_ADMIN privileges by manually modifying the role parameter during the registration process.

Executive Summary:
A critical privilege escalation vulnerability in Taskosaur allows any unauthenticated user to register as a SUPER_ADMIN, granting them full control over the project management platform.

Vulnerability Details

CVE-ID: CVE-2026-31874

Affected Software: Taskosaur

Affected Versions: 1.0.0

Vulnerability: The application fails to validate the role parameter during user registration. An unauthenticated attacker can manipulate the registration request payload to include a SUPER_ADMIN role, which the backend accepts without restriction, resulting in a fully privileged administrative account.

Business Impact

This flaw allows for the complete compromise of the Taskosaur instance, including access to all project data, AI task execution logs, and user information. With a CVSS score of 9.8, the vulnerability enables an attacker to effectively hijack the entire platform and its integrated conversational AI tools.

Remediation Plan

Immediate Action: Update Taskosaur to a version higher than 1.0.0 that enforces server-side role assignment restrictions.

Proactive Monitoring: Audit the user database for any accounts created with the SUPER_ADMIN role that were not explicitly authorized by existing administrators.

Compensating Controls: Temporarily disable public user registration until the patch is applied or implement a manual approval process for all new accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. The simplicity of this "Insecure Direct Object Reference" (IDOR) style flaw makes it highly likely to be exploited if the platform is public-facing.

Analyst Recommendation

The ability for any user to self-promote to the highest level of administrative access is a fundamental security failure. Immediate remediation via software update is required to protect organizational data and maintain the integrity of the project management environment.

---METADATA---
VENDOR: Cloud
PRODUCT: Cloud CLI (Claude Code UI)
AFFECTED_VERSIONS: Prior to 1.24.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Cloud CLI utility is vulnerable to OS command injection via improper sanitization of Git-related API parameters, allowing authenticated attackers to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in Cloud CLI versions prior to 1.24.0 poses a critical risk by allowing authenticated attackers to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2026-31862

Affected Software: Cloud, Cloud CLI

Affected Versions: Prior to 1.24.0

Vulnerability: The application utilizes execAsync() with improper string interpolation of user-controlled parameters within Git-related API endpoints. This flaw allows an authenticated attacker to inject and execute arbitrary OS commands.

Business Impact

Successful exploitation grants an attacker the ability to execute commands with the privileges of the application process. Given the CVSS score of 9.1, this vulnerability poses a severe risk of full system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Cloud CLI to version 1.24.0 or later immediately to sanitize input parameters correctly.

Proactive Monitoring: Review system and application logs for suspicious process execution patterns or unexpected shell commands originating from the CLI tool.

Compensating Controls: Restrict access to the CLI utility to authorized users only and ensure the application runs with the principle of least privilege to minimize potential impact.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a critical security risk that can lead to complete system takeover. Organizations using the Cloud CLI must prioritize the update to version 1.24.0 to mitigate the risk of remote command execution.

---METADATA---
VENDOR: Jellyfin
PRODUCT: jellyfin-ios
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The jellyfin-ios GitHub Actions workflow is vulnerable to arbitrary code execution via pull requests, potentially leading to full repository takeover and App Store supply chain attacks.

Executive Summary:
A critical CI/CD workflow vulnerability in the Jellyfin iOS repository allows unauthenticated attackers to execute arbitrary code, threatening the integrity of the Apple App Store supply chain.

Vulnerability Details

CVE-ID: CVE-2026-31852

Affected Software: Jellyfin (jellyfin-ios)

Affected Versions: See vendor advisory for specific workflow revisions.

Vulnerability: The code-quality.yml GitHub Actions workflow improperly handles pull requests from forked repositories. Due to excessive write permissions, an unauthenticated attacker can execute arbitrary code during the CI process, leading to the exfiltration of secrets and the potential poisoning of App Store releases and container registries.

Business Impact

This vulnerability represents a high-impact supply chain risk. A successful exploit could allow an attacker to compromise the entire Jellyfin organization, inject malicious code into official iOS app releases, and exfiltrate highly privileged credentials. The CVSS score of 10 reflects the absolute severity of a potential repository and organization takeover.

Remediation Plan

Immediate Action: No action is required from end users; the Jellyfin maintainers must secure the GitHub Actions workflows by following the principle of least privilege and restricting fork-based triggers.

Proactive Monitoring: Maintainers should audit GitHub Actions logs for suspicious pull request activity and rotate any secrets that may have been exposed during the vulnerable period.

Compensating Controls: Organizations should implement mandatory code review for all CI/CD configuration changes and utilize GitHub's "Require approval for all outside collaborators" setting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. This is a workflow-level vulnerability, meaning the software itself is not "buggy," but the build environment was insecurely configured.

Analyst Recommendation

While end users are not required to take action, this incident highlights the critical importance of CI/CD security. Development teams must ensure that GitHub Actions workflows triggered by external contributors do not have access to sensitive secrets or write permissions.

---METADATA---
VENDOR: Rukovoditel
PRODUCT: CRM
AFFECTED_VERSIONS: 3.6.4 and earlier
---END_METADATA---

Description Summary:
A reflected XSS vulnerability in the Rukovoditel CRM Zadarma telephony API allows unauthenticated attackers to execute malicious scripts.

Executive Summary:
An unauthenticated reflected cross-site scripting (XSS) vulnerability in Rukovoditel CRM poses a high risk of session hijacking and credential theft.

Vulnerability Details

CVE-ID: CVE-2026-31845

Affected Software: Rukovoditel CRM

Affected Versions: 3.6.4 and earlier

Vulnerability: The Zadarma telephony API endpoint (/api/tel/zadarma.php) fails to sanitize the zd_echo GET parameter, allowing an unauthenticated attacker to inject arbitrary JavaScript that executes in the victim's browser.

Business Impact

With a CVSS score of 9.3, this vulnerability is critical. Attackers can exploit this to perform session hijacking, phishing attacks, or account takeovers, potentially leading to unauthorized access to sensitive CRM data and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Rukovoditel CRM to version 3.7 or later.

Proactive Monitoring: Review web server logs for suspicious requests to the Zadarma API endpoint containing script-like patterns.

Compensating Controls: Deploy a WAF with rules configured to detect and block reflected XSS attempts in URL parameters.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Apr 11, 2026, there is no public information indicating active exploitation. However, the ease of exploitation and potential impact necessitate immediate patching.

Analyst Recommendation

Given the high CVSS score and the nature of XSS, organizations should prioritize upgrading to version 3.7 immediately to eliminate the injection vector.

---METADATA---
VENDOR: goodoneuz
PRODUCT: pay-uz Laravel package
AFFECTED_VERSIONS: <= 2.2.24
---END_METADATA---

Description Summary:
The pay-uz Laravel package contains an unauthenticated remote code execution vulnerability via the /payment/api/editable/update endpoint.

Executive Summary:
An unauthenticated remote code execution vulnerability in the pay-uz Laravel package allows attackers to overwrite critical payment files and execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-31843

Affected Software: goodoneuz pay-uz Laravel package

Affected Versions: <= 2.2.24

Vulnerability: The application fails to implement authentication middleware on the /payment/api/editable/update endpoint, allowing unauthenticated attackers to write arbitrary content into executable PHP files. These files are subsequently executed by the server, resulting in remote code execution (RCE).

Business Impact

With a CVSS score of 9.8, this is a critical vulnerability that grants an attacker full control over the application server. The potential impact includes the theft of sensitive financial data, unauthorized transactions, and complete server compromise, which could lead to significant reputational and financial damage.

Remediation Plan

Immediate Action: Update the pay-uz package to the latest secure version immediately and audit the /payment/api/ directory for unauthorized file modifications.

Proactive Monitoring: Monitor access logs for unauthorized POST requests to the /payment/api/editable/update endpoint and inspect file integrity on the server.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block traffic to the vulnerable endpoint and restrict access to the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, given the ease of exploitation (no authentication required), the risk is extreme.

Analyst Recommendation

This vulnerability is highly severe due to the lack of required authentication and the direct impact on code execution. Organizations utilizing this package must treat this as a top-priority remediation item and verify the integrity of their payment processing workflows immediately.